eDiscovery: Resolve eDiscovery hold errors

By Ashwin Venugopal -

 






Recommended Practices

In order to reduce the number of errors related to eDiscovery holds, the following practices are recommended: 
  • If a hold distribution is still pending, with a status of either On (either) or Off (Pending), wait until the hold distribution is complete before you make any further updates.

  • Check whether a hold policy is pending before you make any further updates to it. 

  • Merge your updates to an eDiscovery hold in a single bulk request rather than updating the hold policy repeatedly for each transaction.

Error: PolicySyncTimeout

If this error appear in the ResultCode: PolicySyncTimeout, then check the LastResultTime to see if it is longer than two hours since the sync reached the time-out. 

Resolution

Run the Set-CaseHoldPolicy -Identity "policyname" -RetryDistribution command to resolve the issue. Also in the case hold page in the Microsoft Purview portal, select Retry to redeploy the policy.

Error: PolicyNotifyError

If you see this error in the ResultCode: PolicyNotifyError, this means that a datacenter issue interrupted the policy sync. 

Resolution

Run the Set-CaseHoldPolicy -Identity "policyname" -RetryDistribution command to resolve the issue. Also in the case hold page in the Microsoft Purview portal, select Retry to redeploy the policy.

Error: InternalError

If this error appears in the ResultCode: InternalError then this issue should be resolved by Microsoft. 

Resolution

Contact Microsoft Support with the following information- 
  1. Policy name
  2. Microsoft 365 service or feature
  3. Result code 
  4. Result message
  5. Diagnostics

Error: FailedToOpenContainer

If there is this error in the ResultCode: FailedToOpenContainer when putting custodians and data sources on hold, then follow the resolution steps. 

Resolution

  1. To check whether the user mailbox exists in your organization, run the Get-Mailbox command in Exchange Online PowerShell. 
  2. To check whether the site exists in your organization, run the Get-SPOSite command in SharePoint Online PowerShell.
  3. Check whether the site URL changed. 
  4. Remove the mailbox or site from the policy if the object doesn't exist. 

Error: SiteInReadOnlyOrNotAccessible

If this error appear in the ResultCode: SiteInReadOnlyOrNotAccessible then, the SharePoint site is in read-only mode. 

Resolution

Unlock the site (or ask an admin to unlock it) to resolve this issue. 

Error: SiteOutOfQuota

If there is this error in the ResultCode:SiteOutOfQuota, that means the SharePoint site has reached its storage quota.

Resolution

Add more storage to the site, or ask an admin to add more storage to the site collection. Also, in the case hold page in the Microsoft Purview portal, select Retry to redeploy the policy. 

Error: RecipientTypeNotAllowed

This error in the ResultCode: RecipientTypeNotAllowed means an Exchange location that is a mailbox is assigned to the policy. 

Resolution

To check whether the address for the endpoint is a valid mailbox, run the Get-Recipient command in Exchange Online PowerShell. However, if the cmdlet determines that the SMTP address isn't valid mailbox, remove it from the policy. 

More Information

Some other things that can help in mitigating this issue:
  • Whenever a hold is revised, it enters a pending state right away. The status of pending indicates that the hold is in the process of being applied to content locations.

  • When you have a script that executes a loop to add locations to a policy individually, the first content location, like a user mailbox, starts the synchronization process, which leads to a pending state. As a result, you will encounter errors for the other users added to the policy in subsequent loops. 

  • If your organization employs a script that executes a loop to modify the content locations for a hold policy, it is necessary to revise the script to ensure it updates locations in one bulk operation.

Conclusion

eDiscovery hold errors are resolved with the help of above methods. 




































Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can...
Read more