Common eDiscovery issues and their solutions

First Issue: Ambiguous location

If you try to add user's mailbox location to search and there are duplicate or conflicting objects with the same userID in the Exchange Online Protection (EOP) directory, you receive this error: The compliance search contains the following invalid location(s):[e-mail]. The location "[e-mail]" is ambiguous.

Resolution

- Check for duplicate users or distribution list with the same user ID.

- Connect to Security & Compliance PowerShell.

Article to connect with Security & Compliance PowerShell:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell 

- Run the following command to retrieve all instances of the username:

PowerShell:

Get-Recipient <username>

The output for '[e-mail]' would be similar to the following:

TABLE 1

Name	RecipientType
Alias, User	MailUser
Alias, User	User

     - If multiple users are returned, locate and fix the conflicting object.

Second Issue: Search fails on specific locations

An eDiscovery or content search may yield the following error: This search completed with (#) errors. Would you like to retry the search on the failed locations?

Resolution

If you receive this error, we recommend that you verify the locations that failed in the search then rerun the search only on the failed locations.

- Connect to Security & Compliance PowerShell and then run the following command:

Article to connect with Security & Compliance PowerShell:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell 

PowerShell:

Get-ComplianceSearch <searchname> | FL                                                     

- From the PowerShell output, view the failed locations in the errors field or from the status details in the error from the search output.

- Retry the eDiscovery search on the failed locations only.

- If you continue to receive these errors, see Retry failed locations for more troubleshooting steps.

Article: https://docs.microsoft.com/en-us/Office365/SecurityCompliance/retry-failed-content-search

Third Issue: File not found

When running an eDiscovery search that includes SharePoint Online and One Drive For Business locations, you may receive the error File Not Found although the file is located on the site. This error will be in the export warnings and errors.csv or skipped items.csv. This may occur if the file can't be found on the site or if the index is out of date. Here's the text of an actual error (with emphasis added).

28.06.2019 10:02:19_FailedToExportItem_Failed to download content. Additional diagnostic info : Microsoft.Office.Compliance.EDiscovery.ExportWorker.Exceptions.ContentDownloadTemporaryFailure: Failed to download from content 6ea52149-91cd-4965-b5bb-82ca6a3ec9be of type Document. Correlation Id: 3bd84722-937b-4c23-b61b-08d6fba9ec32. ServerErrorCode: -2147024894 ---> Microsoft.SharePoint.Client.ServerException: File Not Found. at Microsoft.SharePoint.Client.ClientRequest.ProcessResponseStream(Stream responseStream) at Microsoft.SharePoint.Client.ClientRequest.ProcessResponse() --- End of inner exception stack trace ---

Resolution

Check location identified in the search to ensure that the location of the file is correct and added in the search locations.

Use the procedures at Manually request crawling and re-indexing of a site, a library, or a list to reindex the site.

Article: https://docs.microsoft.com/en-us/sharepoint/crawl-site-content 

Fourth Issue: This search result was not downloaded as it is a folder or other artefact that can't be downloaded by itself, any items inside the folder or library will be downloaded.

Resolution:

You may see that error when running an eDiscovery search that includes SharePoint Online and One Drive For Business locations. It means that we were going to try and export the item reported in the index, but it turned out to be a folder so we did not export it. As mentioned in the error, we don't export folder items but we do export their contents.

Fifth Issue: Search fails because recipient is not found

An eDiscovery search fails with error the recipient not found. This error may occur if the user object cannot be found in Exchange Online Protection (EOP) because the object has not synced.

Resolution

- Connect to Exchange Online PowerShell.

Article to connect with Exchange Online: https://docs.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell 

- Run the following command to check if the user is synced to Exchange Online Protection:

PowerShell:

Get-Recipient <userId> | FL

- There should be a mail user object for the user question. If nothing is returned, investigate the user object. Contact Microsoft Support if the object can't be synced.

Sixth Issue: Exporting search results is slow

When exporting search results from eDiscovery or Content Search in the Security and Compliance center, the download takes longer than expected. You can check to see the amount of data to be download and possibly increase the export speed.

Resolution

- Connect to Security & Compliance PowerShell.

Article to connect with Security & Compliance PowerShell:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell 

- Run the following command:

PowerShell:

Get-ComplianceSearch <searchname> | FL

- Find the amount of data to be downloaded in the SearchResults and SearchStatistics parameters.

- Run the following command:

PowerShell:

Get-ComplianceSearchAction | FL

- In the results field, find the data that has been exported and view any errors encountered.

- Check the trace.log file located in the directory that you exported the content to for any errors.

- If you still have issues, consider dividing searches that return a large set of results into smaller searches. For example, you can use date ranges in search queries to return a smaller set of results that can be downloaded faster.

Seventh Issue: Internal server error (500) occurred

When running an eDiscovery search, if the search continually fails with error similar to "Internal server error (500) occurred", you may need rerun the search only on specific mailbox locations.

Resolution

- Break the search into smaller searches and run the search again. Try using a smaller date range or limit the number of locations being searched.

- Connect to Security & Compliance PowerShell.

Article to connect with Security & Compliance PowerShell:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell 

- Run the following command:

PowerShell

Get-ComplianceSearch <searchname> | FL

- Examine the output for results and errors.

- Examine the trace.log file. It's located in the same folder that you exported the search results to.

- Contact CSP Support.

Eight Issue: Holds don't sync

"Resources: It's taking longer than expected to deploy the policy. It might take an additional 2 hours to update the final deployment status, so check back in a couple hours."

Resolution

- Connect to Security & Compliance Center PowerShell and then run the following command for an eDiscovery case hold:

Article to connect with Security & Compliance PowerShell:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell 

- PowerShell

Get-CaseHoldPolicy <policyname> - DistributionDetail | FL

- For a retention policy, run the following command:

PowerShell

Get-RetentionCompliancePolicy <policyname> - DistributionDetail | FL

- Examine the value in the DistributionDetail parameter for errors like the following:

Error: Resources: It's taking longer than expected to deploy the policy. It might take an additional 2 hours to update the final deployment status, so check back in a couple hours.

- Try running the RetryDistribution parameter on the policy in question:

For eDiscovery case holds:

PowerShell

Set-CaseHoldPolicy <policyname> -RetryDistribution

For retention policies:

PowerShell

Set-RetentionCompliancePolicy <policyname> -RetryDistribution

- Contact Connection CSP Support.

Ninth Issue: The condition specified using HTTP conditional header(s) is not met

When downloading search results using the eDiscovery Export Tool, it's possible you might receive the following error: System.Net.WebException: The remote server returned an error: (412) The condition specified using HTTP conditional header(s) is not met. This is transient error, which typically occurs in the Azure Storage location.

Resolution
To resolve this issue, retry downloading the search results, which will restart the eDiscovery Export Tool.

Article: https://docs.microsoft.com/en-us/microsoft-365/compliance/export-search-results?view=o365-worldwide#step-2-download-the-search-results 

Tenth issue: Downloaded export shows no results

After a successful export, the completed download via the export tool shows zero files in the results.

Resolution

This is a client-side issue and in order to remediate it, please attempt the following steps:

1. Try using another client/machine to download.

2. Remove old searches that are no longer needed using Remove-ComplianceSearch cmdlet. Article: https://docs.microsoft.com/en-us/powershell/module/exchange/remove-compliancesearch 

3. Make sure to download to a local drive.

4. Make sure the virus scanner is not running.

5. Make sure that no other export is downloading to the same folder or any parent folder.

6. If the previous steps did not work, disable zipping and de-duplication.

7. If this works then the issue is due to a local virus scanner or a disk issue.