Export to PST via Powershell

[Deleted]

I am continually expanding on my offboarding process within Orchestrator. I decided to add the export of the email so that all that has to be done is go to the Content search and download it (unless someone knows how to do that as well...). My addition works, however, instead of creating a single PST file, I end up getting the actual folders with individual email in message file format. I have tried what is correct per everything I could find (honestly, not a lot of detail on the subject). The current single line in question is:

New-ComplianceSearchAction -SearchName $SearchName -Export -ArchiveFormat PerUserPST -EnableDedupe $true 

I have tried different values for -ArchiveFormat including leaving it completely off since a single pst per user is supposed to be the default.

I will include the entire part of the script responsible for the full function in case it is supposed to be declared somewhere else (but I haven't found anything).

# Create Compliance Search - Export Email

$SearchName = "Export - " + $term.Name
New-ComplianceSearch -ExchangeLocation $term365.UserPrincipalName -Name $SearchName

# Start Compliance Search and wait to complete

Start-ComplianceSearch $SearchName
do
    {
        Start-Sleep -s 5
        $complianceSearch = Get-ComplianceSearch $SearchName
    }
while ($complianceSearch.Status -ne 'Completed')

# Create Compliance Search in exportable format
New-ComplianceSearchAction -SearchName $SearchName -Export -ArchiveFormat PerUserPST -EnableDedupe $true 
$ExportName = $SearchName + "_Export"

#Wait for Export to complete
do
    {
        Start-Sleep -s 5
        $complete = Get-ComplianceSearchAction -Identity $ExportName
    }
while ($complete.Status -ne 'Completed')

Any help would be appreciated!

[#2 · Accepted solution]

No way to do it without going to the SCC and initializing the download via the click-one app, sorry. Perhaps you can automate it via AzCopy or some other tool that takes container/token as input - you can get those via the Result property of Get-ComplianceSearchAction.

As for the cmdlet, make sure you also use the -Format parameter!

---

The Format parameter specifies the format of the search results when you use the Export switch. Valid values are:

FxStream   Export to PST files. This is the only option that's available when you export search results from the Security & Compliance Center.

Mime   Export to .eml messsage files. This the default value when you use cmdlets to export the search results.

---

It's most likely what causes the issue in your case.

[#3]

Hi Vasil

So you are saying there is no way to export a user's mailbox through PowerShell?

Kind regards
Thijs

[#4]

Through E-Discovery yes, not through regular Exchange Online. 

There are third-party tools out there that have created tools for this. 

[#5]

Is it possible for me to create a PS script that downloads PST's through e discovery?

[#6]

To clarify, everything up to the physical exporting can be scripted with basic existing cmdlets. To do the actual export, you would have to write some additional code to do this via the GUI, as there is currently no cmdlet to grab the export and save it locally.

Here is the scriplet regarding this function:

# Create Compliance Search - Export Email

$SearchName = "Export - " + $term.Name

New-ComplianceSearch -ExchangeLocation $user365.WindowsLiveID -Name $SearchName

# Start Compliance Search and wait to complete

Start-ComplianceSearch $SearchName

do

{

Start-Sleep -s 5

$complianceSearch = Get-ComplianceSearch $SearchName

}

while ($complianceSearch.Status -ne 'Completed')

# Create Compliance Search in exportable format

New-ComplianceSearchAction -SearchName $SearchName -EnableDedupe $true -Export -Format FxStream -ArchiveFormat PerUserPST

#Wait for Export to complete

do

{

Start-Sleep -s 5

$complete = Get-ComplianceSearchAction -Identity $ExportName

}

while ($complete.Status -ne 'Completed')

[#7]

Thank you for the answer.
I was indeed looking for a way to physical exporting for the search. Guess I will have to do that manually.

[#8]

Brad to the rescue

[#9]

once exported how can I download the PST, please your urgent help

[#10]

In Compliance and Security center go to your export and click download on the right

[#11]

This theme is the powershell, Please i need download Result of search

[#12]

Are there eDiscovery PowerShell commands to do the export?  We want to export the content search results from eDiscovery content searches to a shared drive for investigators to access.

[#13]

I have searched a lot but I don't think there is a way to download it through PS

[#14]

Actually, even the export no longer works. I have currently opened a ticket with Office 365 to find out why. There is:

New-ComplianceSearchAction -SearchName $SearchName -Export

A parameter cannot be found that matches parameter name 'Export'.

The updated help still shows the parameter, and the TechNet page has not been updated. However, search for it in the Command modules help in ISE, the check box for Export has now disappeared in the last week as well as the ArchiveFormat parameter. Can't find anything about it.

[#15]

Hi Brad

I was having the exact same issue.

I tried it on thuesday and it failed to find the parameter

Tried it on wednesday and it found the parameter

I think they are activly working on the cmdlet. I wouldn't use it in the meanwhile.

[#16]

The compliance search functionality is being rewritten at present. This might have had the side-effect of removing the parameter. I have pinged the development team to ask.

[#17]

Thank you!
Do you know if it Will je possible to download results through powershell?

[#18]

I doubt it. The problem is that exported results are in temporary Azure storage that is accessed by a key. Handling that key in a secure manner to make it available and usable to a PowerShell cmdlet is something I do not think the developers have considered yet.

[#19]

Check that the account you use to log into PowerShell is a member of the Compliance Center eDiscovery Manager role group... The account needs to have this right to expose the Export function.

[#20]

It is. We have both been using a script to do this for some time. The error returned is that the export flag does not exist. I have exhaustively tested it.