eDiscovery Search Fails in Exchange 2013, What Next?

eDiscovery is the search feature for in-place search in Exchange Server and Office 365 where it can look for searched items in various mailboxes, SharePoint, OneDrive, Groups, Skype, etc. The bigger organizations that are using the service of Exchange Server (both on-premises and online) create eDiscovery searches to look for important data in their mailboxes. eDiscovery works for active data as well as the deleted items and the original versions of the updated items placed in other features ‘in-Place Hold and Litigation Hold.’
In Exchange 2013, you can create an eDiscovery search using the following steps-

1. Navigate to Compliance management > In-place eDiscovery & hold.
2. Select the New Add Icon.
3. Enter a search name in In-Place eDiscovery & Hold’s Name and description page, add an optional description, and then click Next.
4. Choose the mailboxes to search for on the Mailboxes page. You have the option of searching all mailboxes or just a specified subset of them.
5. The next page is the Search query page, where you must input the following details
   • Include all user mailbox content – To put everything in the selected mailboxes on hold, choose this option.
     You cannot add more search critxeria if this option is used.
   • Filter based on criteria – To specify search parameters, such as keywords, start and finish dates, sender and recipient addresses, message kinds, and more, choose this option.
6. The ‘In-place hold settings’ page brings more features to create eDiscovery search -‘Hold indefinitely’ – To put the returned products on an ongoing hold, choose this option. Until you remove the mailbox from the search or remove the search, the items that are on hold will remain in place.

‘Specify the number of days to hold items relative to their received date’ –  Use this option to keep products on hold for a set time.
For instance, if your company mandates that all messages be kept on file for at least seven years, you can utilize this option.
To ensure that objects are removed after seven years, employ a time-based In-Place Hold in conjunction with a retention policy.

7. Click Finish and Save to create a complete eDiscovery search. When you run it, then its results are displayed on the details pane.

While running an eDiscovery search in Exchange 2013, on some rare occasions, you may face some errors that denote that the search was a failure. The error message is following-
“Export failed with error type: ‘FailedToSearchMailboxes’. Details: The underlying connection was closed: An unexpected error”

A user has asked a similar kind of question when they were using a hybrid connection between Exchange on-premises and Exchange Online. When they created an eDiscovery search and run it in the Security & Compliance Center, then they got the above-mentioned error.

Microsoft has given a workaround to reduce the number of searched mailboxes and then recreate the search request.

Workaround #1.

You must lower the number of mailboxes in which the eDiscovery will search for items.

Create a new eDiscovery search and input less than 10 mailboxes in the ‘specify mailboxes to search option. It will lower the burden for eDiscovery and it will run smoothly.

Workaround #2.

In Exchange Server, a maximum of two In-Place eDiscovery searches may be active at once. The third eDiscovery search won’t be queued and will instead fail if it is launched while the first two searches are still active. Before you can successfully launch a new search, one of the currently ongoing searches must be finished.

Workaround #3.

You must assign the proper permissions and add the user as a member of the eDiscovery Manager Role group in the compliance portal. Only the members of this group can create the eDiscovery searches. Use the following steps to add the user to the respective role group-

1. Use the login information for an admin account in your Office 365 or Microsoft 365 organization to access the compliance portal.
2. Select the eDiscovery Manager role group on the Permissions page.
3. Click Edit next to the eDiscovery Manager section on the eDiscovery Manager screen.
4. Click Choose Discovery Manager on the Choose eDiscovery Manager page of the update role group wizard.
5. After clicking Add, check the boxes next to each user you want to include in the role group.
6. After selecting the users, you wish to add, click Add, followed by Done.
7. After adding the users to the role group by clicking Save, click Close to finish the process.

Conclusion

The in-hold eDiscovery search is a reliable solution to search for items from large mailboxes where you cannot find them easily. If some items are deleted, then they will not show in the search results. To keep mailbox items safe, you should have Office 365 Backup software to save items in some offline files. A professional Office 365 Backup software saves the online mailbox’s data in various file formats to access them in offline files.