Problems with compliance search for mailboxes in large tenant

%3CLINGO-SUB%20id%3D%22lingo-sub-444819%22%20slang%3D%22en-US%22%3EProblems%20with%20compliance%20search%20for%20mailboxes%20in%20large%20tenant%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-444819%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Everyone.%20I%20manage%20a%20large%20O365%20tenant%2C%20~192%2C000%20mailboxes.%20We%20have%20been%20having%20issues%20with%20compliance%20searches%20across%20our%20mailboxes%20for%20which%20I%20opened%20a%20MS%20Premier%20Support%20case.%20Basically%20about%2080%25%20of%20our%20searches%20will%20end%20in%20a%20failures%20on%20the%20O365%20side.%26nbsp%3B%20CS021-001%20is%20one%20of%20the%20errors%20we%20get.%20MS%20has%20acknowledged%20that%20this%20error%20is%20on%20their%20end%20indicating%20an%20issue%20with%20their%20systems.%20They%20have%20told%20me%20that%20the%20only%20work%20around%20is%20to%20create%20a%20bunch%20of%20di%3CSPAN%20class%3D%22text_exposed_show%22%3Estribution%20groups%20containing%20a%20subset%20of%20the%20mailboxes%20and%20do%20the%20searches%20one%20at%20a%20time%20across%20those%20groups.%20This%20is%20not%20efficient%20as%20our%20moves%2C%20adds%20and%20changes%20are%20frequent.%20I%20need%20to%20frequently%20do%20these%20searches%20in%20order%20find%20phishing%20messages%20which%20need%20to%20be%20deleted%20which%20slip%20pass%20our%20scanners.%20I%20opened%20this%20ticket%20in%20December%202018%20and%20still%20have%20not%20come%20to%20a%20viable%20solution.%20I%20was%20just%20wondering%20if%20anyone%20with%20large%20tenants%20is%20also%20experiencing%20similar%20issues.%3C%2FSPAN%3E%3C%2FP%3E%3CDIV%20class%3D%22text_exposed_show%22%3E%3CP%3ESearch%20parameters%20are%20simple%3B%20Date%2C%20Sender%20and%20Subject.%3C%2FP%3E%3CP%3EFailures%20will%20show%20up%20eventually%20on%20New-ComplianceSearch%2C%20as%20well%20as%20New-ComplianceSearchActions.%20Due%20to%20the%20large%20number%20of%20mailboxes%20it%20is%20normal%20for%20the%20search%20to%20run%20for%20at%20least%20an%20hour%20before%20returning%20a%20success%20or%20failure.%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3CP%3EPS%20I%20have%20used%20Get-MessageTrace%20to%20limit%20the%20subset%20of%20mailboxes%20to%20search%20against%20and%20to%20also%20generate%20a%20CSV%20to%20upload%20Into%20Proofpoint%20TRAP.%20The%20problem%20I%20have%20found%20is%20several%20instances%20of%20message%20not%20showing%20in%20the%20tracking%20logs.%20Also%2C%20a%20few%20days%20ago%20Message%20Tracking%20was%20completely%20broken%20in%20Office%20365.%3C%2FP%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-446670%22%20slang%3D%22en-US%22%3ERe%3A%20Problems%20with%20compliance%20search%20for%20mailboxes%20in%20large%20tenant%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-446670%22%20slang%3D%22en-US%22%3E%3CP%3EI%20guess%20you%20can%20also%20try%20good%20old%20Search-Mailbox%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2188984%22%20slang%3D%22en-US%22%3ERe%3A%20Problems%20with%20compliance%20search%20for%20mailboxes%20in%20large%20tenant%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2188984%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F8781%22%20target%3D%22_blank%22%3E%40Prayer%20Solanky%3C%2FA%3E%26nbsp%3B%20I'm%20seeing%20the%20same%20error%20(CS021-001)%20with%20less%20than%2010K%20mailboxes%20total.%20Search%20times%20have%20increased%20to%20over%203%20hours.%20I'm%20also%20using%20Date%2C%20Sender%2C%20and%20Subject%20to%20find%20%26amp%3B%20remove%20spam.%20I%20have%20an%20open%20ticket%2C%20but%20no%20answers%20yet.%3C%2FP%3E%3CP%3ESteve%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi Everyone. I manage a large O365 tenant, ~192,000 mailboxes. We have been having issues with compliance searches across our mailboxes for which I opened a MS Premier Support case. Basically about 80% of our searches will end in a failures on the O365 side.  CS021-001 is one of the errors we get. MS has acknowledged that this error is on their end indicating an issue with their systems. They have told me that the only work around is to create a bunch of distribution groups containing a subset of the mailboxes and do the searches one at a time across those groups. This is not efficient as our moves, adds and changes are frequent. I need to frequently do these searches in order find phishing messages which need to be deleted which slip pass our scanners. I opened this ticket in December 2018 and still have not come to a viable solution. I was just wondering if anyone with large tenants is also experiencing similar issues.

Search parameters are simple; Date, Sender and Subject.

Failures will show up eventually on New-ComplianceSearch, as well as New-ComplianceSearchActions. Due to the large number of mailboxes it is normal for the search to run for at least an hour before returning a success or failure.

Thanks!

PS I have used Get-MessageTrace to limit the subset of mailboxes to search against and to also generate a CSV to upload Into Proofpoint TRAP. The problem I have found is several instances of message not showing in the tracking logs. Also, a few days ago Message Tracking was completely broken in Office 365.

3 Replies

I guess you can also try good old Search-Mailbox?

@Prayer Solanky  I'm seeing the same error (CS021-001) with less than 10K mailboxes total. Search times have increased to over 3 hours. I'm also using Date, Sender, and Subject to find & remove spam. I have an open ticket, but no answers yet.

Steve

I Have the same problem in my Tenant...