none
eDiscovery all mailboxes searches Shared mailboxes, Copying results misses them

    Question

  • Peculiar issue.

    Whilst executing a Subject Access Request on all mailboxes, I got a set of results. When I then Copy those results to a discovery mailbox it seems to drop all the Shared mailboxes from the results and doesn't even list them in the Scope details in the Discovery mailbox. If I search specific Shared mailboxes it works fine.

    I tried with a different criteria and I got 6 mailboxes returning results, one of which is a shared mailbox. I then Copy Search Results to my Discovery mailbox and only 5 sub-folder appear. The one missing is the Shared mailbox.

    I cannot export results as a pst file as that seems to hang no matter what I do. I am Organisation Administrator with all search and Export permissions and even permissions to the shared mailboxes in question.

    Any ideas?

    Thursday, August 24, 2017 3:23 PM

Answers

  • The sad news in NO. Opened a case with Microsoft who confirmed this is the case, but the developers had no plans to change the behaviour.

    Their "solution" was to explicitly define the shared mailboxes in the sources Scope. Great if you have a couple, no good if you have hundreds.

    Powershell can do this a lot better, but our ISO, FOI and SAR teams are not powershell people, nor do they have access tot the Email system at that level (they're users, not engineers)

    I'm yet to see if this behaviour is the same in 2016 or 2019, but as of CU22 on Exchange 2013, no change.

    • Marked as answer by NewbieNik73 Wednesday, May 22, 2019 2:19 PM
    Wednesday, May 22, 2019 1:12 PM

All replies

  • Please post specifics.

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    Friday, August 25, 2017 1:49 AM
    Moderator
  • I can't i'm afraid, but I'll try to explain a bit better.

    I create a new search for a specific name or staff number across ALL mailboxes.

    The results are estimated and I look at the preview to see 122 items in 6 mailboxes, mine, a shared mailbox and 4 personal mailboxes. 44 items are in the shared mailbox.

    I then Copy Search Results and pick my Discovery Search Mailbox and only select Enable Full Logging.

    Once complete, I go to the folder in the Discovery Search mailbox to only find 78 items in 5 mailbox folders, mine and the 4 other personal mailboxes. The Shared mailbox and it's 44 items are not listed

    I look at the Results email in the top folder to see that the Shared mailbox is not even listed in the Sources, Sources Searched Successfully nor Sources Not Searched Successfully.  eDiscovery just seems to have forgotten about the Shared mailbox.

    I have tested this on multiple searches and all of them drop any Shared content. My Discovery Scope is not limited (Else I wouldn't get the shared mailboxes in the estimate) 

    I have legal hold, Mailbox Import/export and Mailbox Search permissions and I am an Exchange Recipient, server, organisation, discovery, public folder and Compliance Manager.

    I cannot see any articles about search issues on Shared mailboxes and am getting pressure from our compliance people due to unreliable results..


    • Edited by NewbieNik73 Friday, August 25, 2017 7:35 AM math fail
    Friday, August 25, 2017 7:34 AM
  • Anyone any ideas? We are concerned that a search result is not a proper search result and this makes eDiscovery redundant from a compliance perspective.
    Wednesday, August 30, 2017 9:21 AM
  • Hi,

    I have the same issue with Shared Mailboxes, did you find a solution about this issue ?

    Thx

    Wednesday, May 22, 2019 1:07 PM
  • The sad news in NO. Opened a case with Microsoft who confirmed this is the case, but the developers had no plans to change the behaviour.

    Their "solution" was to explicitly define the shared mailboxes in the sources Scope. Great if you have a couple, no good if you have hundreds.

    Powershell can do this a lot better, but our ISO, FOI and SAR teams are not powershell people, nor do they have access tot the Email system at that level (they're users, not engineers)

    I'm yet to see if this behaviour is the same in 2016 or 2019, but as of CU22 on Exchange 2013, no change.

    • Marked as answer by NewbieNik73 Wednesday, May 22, 2019 2:19 PM
    Wednesday, May 22, 2019 1:12 PM
  • Another bug with In-Place eDiscovery, I have many problems with that and Microsoft is not able to correct them :-(

    Thank you for your reply

    Wednesday, May 22, 2019 3:22 PM