Export Fails from e-Discovery Site with Unknown Error

 

Scenario

A user on in-place hold has been deleted and their mailbox is now “inactive”

A search is required on this users mailbox and the data needs to be exported to PST.  A new case is created in the e-Discovery site, the source mailbox is set and the query is configured.  The search/query finishes and the export is selected.  The initial Export procedure prompts for login to the Office 365 portal and a location to store the downloaded data.

Everything looks good….until

 

 

If you are me you hop over to the Compliance Management section of the Exchange Management console and configure the same (ish) search there.  It won’t be quite as granular as the e-discovery site.  You configure the search and source mailbox and voila the search executes as you had hoped.  Then you select to export and voila the export works as well.

So what is the issue with the e-discovery site?  You say.

 

I compared my test tenant with my client tenant and looked at the  specifics of the e-discovery Case’s.  Specifically I noticed that the clients Case had a different Custodian than the users mailbox name.  IE> Username Bill then Custodian should be Bill unless manually configured

I then found out that the inactive mailbox had been added as an alias to this named Custodian and I could confirm this by running the following powershell:

get-mailbox “name of mailbox”

The results returned the same name of the Custodian responsible for the inactive mailbox in the e-discovery site.

 

The Resolution

In order to successfully export the data from the e-discovery site Case I needed to remove the inactive mailbox alias from the named custodian.  For good measure I also removed the named custodian and configured an admin account (a member of the Discovery Management group)

Doing both these things allowed me to successfully launch the same export and download the data.

You will know you are on the right track because when this process works as it should you will be prompted to login to the Office 365 portal and then you will be prompted to login a second time to authenticate the mailbox.

 

HUGE TIP

There is little to no information on how to configure a Custodian, add one, delete one or do anything with one.  While troubleshooting the above issue I happened across the section to add/remove Custodians for e-discovery Cases and then I could not find it again.  If appeared to vanish from the e-discovery site all together.

Tuck this away should you ever need to add or remove a Custodian from an e-Discovery sub site…

It exists as a in a list of the sub site you are in:  http://mydomain.com/sites/ediscovery/subsitename/Lists/Custodians