Exchange 2019 - Mail Search

[Bankesy]

Good morning,

 

I have been asked to search for any e-mails sent by anyone to anyone that might contain a particular name in the the subject or body, I've never had to do this before so I tried to muddle my way through an "in-place eDiscovery & hold" but during the estimating phase it just errors out.

 

Does anybody have any suggestions please?

 

Thanks

[6Foot2]

Would splitting the search, so that you get fewer results, help?

 

Search 1: Same search terms, but only search in the subject.

Search 2: Same search terms, but only search in the body.

 

Or same search as the original one, but limit the range of the search to specific date blocks. Repeat the search until the entire date range required has been covered.

[Bankesy]

@6Foot2

 

I'm part way to solving my own problem here, just read an article about using PowerShell to create the compliance search and then using eDiscovery to view the results. I was just literally trying to use the eDiscovery interface.

 

So now I can see there are supposedly 755 items containing the name in the subject line of e-mails sent within the last year but I can't preview the search results, I just get a log in page (to which I'm entering my own credentials) only to be presented with no search results.

[6Foot2]

You seem to be making progress.

 

My comment was only a suggestion off the top of my head because I no longer have access to a network to test my ideas.

 

Hope you solve it soon.

[psydii]

Does your account have permission to review the results? I seem to recall edisco related permissions/roles get quite complicated. I'm pretty sure I recall once being in a position to create edisco cases, but not review them.. but that was back in 2020 and it has moved a long way since then.

 

I think you need the eDiscovery Manager or eDiscovery Administrator role. The Compliance Administrator role is not sufficient. Under the hood, permission from the 2013/16 era for search and discovery are no longer sufficient.

[Bankesy]

@6Foot2

 

I actually did limit the search to the subject because that was the example on the article, I couldn't see how to search the body.

[6Foot2]

...I actually did limit the search to the subject because that was the example on the article, I couldn't see how to search the body.

 

OK. How about the suggestion to limit the range of dates to help the search proceed?

[Bankesy]

@psydii @6Foot2

 

It wasn't a permissions thing, here's what I did in the end (all via PowerShell):

Created a compliance search

Ran compliance search

Created a discovery mailbox

Assigned permissions on discovery mailbox to myself\others

 

Used eDiscovery to copy search results to the discovery mailbox

 

Thanks both for your help