Aug 10 2017 10:51 AM
Aug 10 2017 10:51 AM
I am continually expanding on my offboarding process within Orchestrator. I decided to add the export of the email so that all that has to be done is go to the Content search and download it (unless someone knows how to do that as well...). My addition works, however, instead of creating a single PST file, I end up getting the actual folders with individual email in message file format. I have tried what is correct per everything I could find (honestly, not a lot of detail on the subject). The current single line in question is:
New-ComplianceSearchAction -SearchName $SearchName -Export -ArchiveFormat PerUserPST -EnableDedupe $true
I have tried different values for -ArchiveFormat including leaving it completely off since a single pst per user is supposed to be the default.
I will include the entire part of the script responsible for the full function in case it is supposed to be declared somewhere else (but I haven't found anything).
# Create Compliance Search - Export Email $SearchName = "Export - " + $term.Name New-ComplianceSearch -ExchangeLocation $term365.UserPrincipalName -Name $SearchName # Start Compliance Search and wait to complete Start-ComplianceSearch $SearchName do { Start-Sleep -s 5 $complianceSearch = Get-ComplianceSearch $SearchName } while ($complianceSearch.Status -ne 'Completed') # Create Compliance Search in exportable format New-ComplianceSearchAction -SearchName $SearchName -Export -ArchiveFormat PerUserPST -EnableDedupe $true $ExportName = $SearchName + "_Export" #Wait for Export to complete do { Start-Sleep -s 5 $complete = Get-ComplianceSearchAction -Identity $ExportName } while ($complete.Status -ne 'Completed')
Any help would be appreciated!
Aug 10 2017 11:30 AM
SolutionNo way to do it without going to the SCC and initializing the download via the click-one app, sorry. Perhaps you can automate it via AzCopy or some other tool that takes container/token as input - you can get those via the Result property of Get-ComplianceSearchAction.
As for the cmdlet, make sure you also use the -Format parameter!
The Format parameter specifies the format of the search results when you use the Export switch. Valid values are:
FxStream Export to PST files. This is the only option that's available when you export search results from the Security & Compliance Center.
Mime Export to .eml messsage files. This the default value when you use cmdlets to export the search results.
It's most likely what causes the issue in your case.
Jan 02 2018 12:45 PM
Jan 03 2018 11:44 AM
Through E-Discovery yes, not through regular Exchange Online.
There are third-party tools out there that have created tools for this.
Jan 03 2018 11:46 AM
Jan 03 2018 11:53 AM
To clarify, everything up to the physical exporting can be scripted with basic existing cmdlets. To do the actual export, you would have to write some additional code to do this via the GUI, as there is currently no cmdlet to grab the export and save it locally.
Here is the scriplet regarding this function:
# Create Compliance Search - Export Email
$SearchName = "Export - " + $term.Name
New-ComplianceSearch -ExchangeLocation $user365.WindowsLiveID -Name $SearchName
# Start Compliance Search and wait to complete
Start-ComplianceSearch $SearchName
do
{
Start-Sleep -s 5
$complianceSearch = Get-ComplianceSearch $SearchName
}
while ($complianceSearch.Status -ne 'Completed')
# Create Compliance Search in exportable format
New-ComplianceSearchAction -SearchName $SearchName -EnableDedupe $true -Export -Format FxStream -ArchiveFormat PerUserPST
#Wait for Export to complete
do
{
Start-Sleep -s 5
$complete = Get-ComplianceSearchAction -Identity $ExportName
}
while ($complete.Status -ne 'Completed')
Jan 03 2018 11:54 AM
Jan 03 2018 05:39 PM
once exported how can I download the PST, please your urgent help
Jan 04 2018 02:18 AM
In Compliance and Security center go to your export and click download on the right
Jan 04 2018 05:27 AM
Jan 04 2018 05:37 AM
Are there eDiscovery PowerShell commands to do the export? We want to export the content search results from eDiscovery content searches to a shared drive for investigators to access.
Jan 05 2018 10:00 AM
I have searched a lot but I don't think there is a way to download it through PS
Jan 05 2018 10:22 AM
Actually, even the export no longer works. I have currently opened a ticket with Office 365 to find out why. There is:
New-ComplianceSearchAction -SearchName $SearchName -Export
A parameter cannot be found that matches parameter name 'Export'.
The updated help still shows the parameter, and the TechNet page has not been updated. However, search for it in the Command modules help in ISE, the check box for Export has now disappeared in the last week as well as the ArchiveFormat parameter. Can't find anything about it.
Jan 05 2018 10:24 AM
Hi Brad
I was having the exact same issue.
I tried it on thuesday and it failed to find the parameter
Tried it on wednesday and it found the parameter
I think they are activly working on the cmdlet. I wouldn't use it in the meanwhile.
Jan 06 2018 04:11 AM
The compliance search functionality is being rewritten at present. This might have had the side-effect of removing the parameter. I have pinged the development team to ask.
Jan 06 2018 04:22 AM
Jan 06 2018 05:06 AM
I doubt it. The problem is that exported results are in temporary Azure storage that is accessed by a key. Handling that key in a secure manner to make it available and usable to a PowerShell cmdlet is something I do not think the developers have considered yet.
Jan 08 2018 02:10 AM
Check that the account you use to log into PowerShell is a member of the Compliance Center eDiscovery Manager role group... The account needs to have this right to expose the Export function.
Jan 08 2018 03:35 AM
Aug 10 2017 11:30 AM
SolutionNo way to do it without going to the SCC and initializing the download via the click-one app, sorry. Perhaps you can automate it via AzCopy or some other tool that takes container/token as input - you can get those via the Result property of Get-ComplianceSearchAction.
As for the cmdlet, make sure you also use the -Format parameter!
The Format parameter specifies the format of the search results when you use the Export switch. Valid values are:
FxStream Export to PST files. This is the only option that's available when you export search results from the Security & Compliance Center.
Mime Export to .eml messsage files. This the default value when you use cmdlets to export the search results.
It's most likely what causes the issue in your case.