eDiscovery: Resolve Search Errors In eDiscovery (Standard)

By Ashwin Venugopal -

 






Introduction 

If you face a problem or error concerning searches in Microsoft Purview eDiscovery (Standard), attempt operation again to eliminate temporary issues. If the suggested solutions do not resolve your search problem, reach out to Microsoft Support. Based on your specific issue, collect output using the Get-ComplianceSearch or Get-ComplianceSearchAction PowerShell cmdlet prior to submitting a support request. 

Search Issue: Difference Between Estimated and Downloaded Search Results

Symptoms

The estimated and downloaded search result statistics are different when you see the search result statistics in the Expert Summary <timestamp>.csv file in the downloaded eDiscovery search results folder. Both the eDiscovery export tool and the search details pane in the Microsoft Purview compliance portal display the estimated search result statistics. 

Cause

A search result estimate is just an estimate and does not represent the precise number of items that satisfy the search query conditions. 

Search Error: "Location Is Ambiguous"

Symptoms

The eDiscovery search fails and returns the message given below-

The compliance search contains the following invalid location(s): <mailbox identifier>. The location <mailbox identifier> is ambiguous.

Cause

The error message's listed locations are not valid. Duplicate or conflicting items in Exchange Online Protection (EOP) use the mailbox identification for each invalid location. 

Resolution

For each invalid location, follow these steps:

  1. Connect to Security & Compliance PowerShell.
  2. Find the duplicate or conflicting objects that use a mailbox identifier via Get-Recipient command- Get-Recipient -Identify "<mailbox identifier from error message>"
  3. Remove the duplicate or conflicting object.

Search Error: Export Appears To Be Stalled

Symptoms

You try to export eDiscovery search results, but the export doesn't finish, and it appears to be stalled. 

Cause

Transient issues can stall the export process.

Resolution

Restart the export. 

Export Download Error: "Cannot Access The File 'ExportData.db'"

Symptoms

When you attempt to download the eDiscovery search results using the eDiscovery export tool, the download either fails or results in zero-byte files. The following error message will appear in the trace.log file of the download export folder-

Hit tolerable error, will retry: The process cannot access the file 'ExportData.db' because it is being used by another process.

Cause

The issue can occur if: 

  • Antivirus software on the destination computer blocks the download.
  • You select a download drive that isn't a local drive.
  • You select a destination folder that's either:
    • The download folder of another eDiscovery export.
    • The parent folder of the download folder of another eDiscovery export. Because the export tool saves metadata files in the parent folder, metadata files for different downloads can conflict.

Resolution

Try the following methods in given order until the error is resolved:

  1. Pause the antivirus scanner on the destination computer, and then retry the download.
  2. Download to a local drive. If necessary, download to a different client computer.
  3. Select a destination folder that doesn't conflict with any concurrent eDiscovery export.
  4. Disable export to a compressed folder, and disable deduplication of Exchange content. If this step resolves the issue, then the cause is probably antivirus software blocking the download or that you tried to download to a remote drive.

Conclusion

Some of the search errors in eDiscovery are discussed above and resolved. 

































Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can...
Read more