New-ComplianceSearchAction - shows as completed but does not work.

Pawel Jarosz 46 Reputation points
2021-03-26T12:39:08.98+00:00

Hi,
I am having issue similar to:

https://social.technet.microsoft.com/Forums/en-US/42d7ac9c-904f-45aa-8845-25a4275ba748/compliancesearchaction-purge-does-not-delete-anything?forum=Exch2016Comp

It happens in Exchange Online, I would like to use the following query - same query as Online Protection DSR uses:
participants:"TestUser2@keyman .co.uk" OR author:"TestUser2" OR createdby:"TestUser2"(c:c)(ItemClass=IPM.Document)(ItemClass=IPM.Note)(ItemClass=IPM.Note.Microsoft.Conversation)(ItemClass=IPM.Note.Microsoft.Missed)(ItemClass=IPM.Note.Microsoft.Conversation.Voice)(ItemClass=IPM.Note.Microsoft.Missed.Voice)(ItemClass=IPM.SkypeTeams.Message)

Action "-Purge" worked yesterday almost all good (messges from the TesUser2 Teams were not removed), then tried today just to double check why / maybe it was one time issue - and no success.

Not a single message has been removed this time - which is weird as yesterday it worked and IM messages got removed (as I said apart from 1 from the TestUser2 Teams), I run the "-Purge" action several times - no success.

How come something works yestarday and today not? Tried with creating new searches, ran the old ones sevral times (I am fully aware it removes 10 items at one go) - nothing. I am doing tests, there was reallysmall amount of messges, there are not hundreds of them but around 10.

Is there something I am forgetting about?
Pawel Jarosz

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,168 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,359 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pawel Jarosz 46 Reputation points
    2021-03-26T12:58:20.347+00:00

    Additionally: Search-Mailbox says it is retired, New-MailboxSearch says it is retired and to use New-ComplianceSearch. I know I can use them, but would like to leverage this certain query from DSR.

    Additionally2: New-MailboxSearch says it uses KQL in quesry language - same as New-ComplianceSearch,, however when I use the same Searchquesry in mailbox search - it says:

    "CalculatedQuery: The query of mailbox search 'pjarosz_test1' is invalid. Details: The property keyword isn't supported."

    0 comments
  2. Vasil Michev 95,081 Reputation points MVP
    2021-03-26T14:16:26.577+00:00

    Purge will not work immediately, unless you have disabled SIR, and made sure no other holds are in effect. Basically. check all the steps here: https://learn.microsoft.com/en-us/microsoft-365/compliance/delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-worldwide
    Search-Mailbox is still available and working btw, but it will have similar issues unless everything in the list above is disabled.

    0 comments
  3. Pawel Jarosz 46 Reputation points
    2021-03-30T21:13:11.783+00:00

    Hi Michev,

    Thanks for your engagement in this thread. The thing is I see these items normally in the chat window, not in any hidden folders, visible only for admins. Will go through the steps you have send but on the first glance from what I can see it is about messages being retained after deletion in some sort of "Purges" or "SubstrateHold" folder.

    I do know that Search-Mailbox still works ^^, even use it in some GDPR processes, the thing is when running -DeleteContent against a mailbox all emails are getting removed immediately - except teams messages on Teams - they are untouched, and not just 10 minutes after running the command but like for 2 days, so it should work till then.

    I said I ran this, but doubt that this command has power to remove actual messages on MS Teams, and from what I've tested - compliance search does remove these kind of items. I know there are retention policies for MS Teams (not sure whether I need M365 E3 or O365 E3 tho, for this to work), the thing is I need to remove only certain messages between this one person and certain people, on certain times - not all of them.

    Cheers,
    J