SOLVED

Confirm if items(Emails) purged after running New-ComplianceSearchAction in Compliance PowerShell

%3CLINGO-SUB%20id%3D%22lingo-sub-2368598%22%20slang%3D%22en-US%22%3EConfirm%20if%20items(Emails)%20purged%20after%20running%20New-ComplianceSearchAction%20in%20Compliance%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2368598%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Tech%20Community%20Folks%2C%3CBR%20%2F%3E%3CBR%20%2F%3EWe%20have%20received%20a%20request%20to%20delete%20some%20items(Email%20Messages%5D%20from%20EXCHANGE.%3CBR%20%2F%3E%3CBR%20%2F%3EAccording%20to%20this%20guide%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fsearch-for-and-delete-messages-in-your-organization%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fsearch-for-and-delete-messages-in-your-organization%3Fview%3Do365-worldwide%3C%2FA%3E%26nbsp%3BI%20created%20my%20content%20search%20and%20ran%20it%20%5B%3CFONT%20color%3D%22%23FF9900%22%3E%20STEP1%3C%2FFONT%3E%5D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20has%20found%26nbsp%3B%3CSTRONG%3E%3CEM%3E%3CU%3E44%20items!%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FU%3E%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3EThen%20as%20%3CFONT%20color%3D%22%23FF9900%22%3ESTEP2%3C%2FFONT%3E%3A%20I%26nbsp%3B%20connected%20to%20Compliance%20%26amp%3B%20Security%20Center%20in%20PowerShell%20as%20Admin%2C%20and%20ran%26nbsp%3B%3CSPAN%3ENew-ComplianceSearchAction%20-SearchName%20%22%3C%2FSPAN%3EABC_004_22_2%3CSPAN%3E%22%20-Purge%20-PurgeType%20SoftDelete%3CBR%20%2F%3E%5B%20I%20ran%20this%20command%20atleast%2010%20times%20%5D%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSPAN%3EOnce%20I%20get%20the%20status%20via%3A%3C%2FP%3E%3CP%3E%3CSTRONG%3EGet-ComplianceSearchAction%26nbsp%3B%20-Identity%20'%3C%2FSTRONG%3EABC_004_22_2%3CSTRONG%3E_Purge'%20%7C%20Format-list%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20shows%20the%20task%20has%20been%3CSTRONG%3E%20completed...%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSTRONG%3E%3C%2FP%3E%3CDIV%3EName%20SearchName%20Action%20RunBy%20JobEndTime%20Status%3CBR%20%2F%3E----%20----------%20------%20-----%20----------%20------%3CBR%20%2F%3E%3CSTRONG%3EABC_004_22_2_Purge%20ABC_004_22_2%20Purge%20Fadavinia%2C%20Ali%202021%2F05%2F18%209%3A26%3A29%20PM%20Completed%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSTRONG%3ENow%20my%20question%20is%20here%3A%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EWhen%20I%20go%20to%20%3CEM%3E%3CU%3E%3CSTRONG%3ESecurity%20%26amp%3B%20Compliance%20--%26gt%3B%20Content%20Search%26nbsp%3B%3C%2FSTRONG%3E%3C%2FU%3E%3C%2FEM%3Eand%20query%20my%20case%20again%20the%20results%20are%20still%26nbsp%3B%3CSTRONG%3E44%20items.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSTRONG%3EWhat%20am%20I%20missing%3F%20how%20do%20I%20know%20if%20they%20are%20really%20deleted%3F%3CBR%20%2F%3E%3CSTRONG%3E%3CBR%20%2F%3E%3C%2FSTRONG%3EThanks%20for%20your%20thoughts%20and%20input%3CBR%20%2F%3EAli%3CBR%20%2F%3E%3CSTRONG%3E%3CBR%20%2F%3E%3C%2FSTRONG%3E%3C%2FDIV%3E%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2368598%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%20Center%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EContent%20search%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EContent%20Search%20queries%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Edelete%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPurge%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%20And%20Compliance%20Center%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2368774%22%20slang%3D%22en-US%22%3ERe%3A%20Confirm%20if%20items(Emails)%20purged%20after%20running%20New-ComplianceSearchAction%20in%20Compliance%20PowerShel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2368774%22%20slang%3D%22en-US%22%3ECorrect%2C%20I%20am%20aware%20of%20that%2C%3CBR%20%2F%3E%3CBR%20%2F%3EIn%20this%20case%2C%20neither%20of%20those%20items%20are%20in%20hold%20or%20custody.%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20it%20is%20a%20soft-delete%2C%20it%20will%20land%20and%20showing%20up%20in%20the%20'recoverable%20items'%20folder.%3CBR%20%2F%3E%3CBR%20%2F%3EHow%20can%20I%20check%20if%20they%20have%20moved%20into%20Recoverable%20Items%20Folder%20or%20still%20sitting%20in%20inboxes%3F%3C%2FLINGO-BODY%3E
Contributor

Hi Tech Community Folks,

We have received a request to delete some items(Email Messages] from EXCHANGE.

According to this guide, 

 https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-org... I created my content search and ran it [ STEP1]

 

It has found 44 items!

Then as STEP2: I  connected to Compliance & Security Center in PowerShell as Admin, and ran New-ComplianceSearchAction -SearchName "ABC_004_22_2" -Purge -PurgeType SoftDelete
[ I ran this command atleast 10 times ]

Once I get the status via:

Get-ComplianceSearchAction  -Identity 'ABC_004_22_2_Purge' | Format-list

 

It shows the task has been completed...

Name SearchName Action RunBy JobEndTime Status
---- ---------- ------ ----- ---------- ------
ABC_004_22_2_Purge ABC_004_22_2 Purge Fadavinia, Ali 2021/05/18 9:26:29 PM Completed


Now my question is here:
 
When I go to Security & Compliance --> Content Search and query my case again the results are still 44 items.

What am I missing? how do I know if they are really deleted?

Thanks for your thoughts and input
Ali

 

5 Replies
Even when you do a "purge", items are not immediately deleted, as other features (holds, Single Item Recovery) can prevent this. Read here: https://docs.microsoft.com/en-us/microsoft-365/compliance/delete-items-in-the-recoverable-items-fold...
Correct, I am aware of that,

In this case, neither of those items are in hold or custody.

If it is a soft-delete, it will land and showing up in the 'recoverable items' folder.

How can I check if they have moved into Recoverable Items Folder or still sitting in inboxes?
best response confirmed by Ali Fadavinia (Contributor)
Solution
Run/export the report, you can see the path for each item therein.
Yap, that was the last report I did. It does the job but not efficient though.

I was wondering if there is any PS command that we can use

Update:
I checked the Export results and I can see all the emails are in Recoverable Items Folder except two items(emails) although those two are from similar mailboxes that their emails were deleted successfully.
They are not on in-place/litigation Hold aswell. @Vasil Michev Do you know how I can find out why they can not be deleted? What is preventing the purge? Is there any way?