What to do When eDiscovery Search Fails in Exchange 2013?

Read time 4 minutes

The eDiscovery or electronic discovery feature (In-place eDiscovery) in Exchange Server and Office 365 allows you search information in the user mailboxes, Microsoft Teams, Office 365 Groups, SharePoint, Skype, and OneDrive for Business for legal and forensic requirements.

In-place eDiscovery can be accessed from the Security and Compliance Center in Exchange admin center (EAC), where you can create a search and later export the search results for further analysis. But sometimes, in Exchange 2013, the eDiscovery feature fails to perform a search, and then it gives an error message:

Failed Search or Export, Mailbox:/o=techtarget/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=user::Item:::DocumentId:::ItemId: with error: [FailedToSearchMailboxes] Class ExtendedAttribute is only valid for Exchange version 1941996250 or later.

Or the error may be:

The search server can't find an object to execute the search. Please contact your administrator for assistance. The message from the search server is "the active directory user wasn't found, <.'

Another error of this type is:

The Active Directory user wasn't found, /o=GM/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=9ca72100e77c493e96893e9bebf361b2-WZ46K6.

Some similar error messages are received in Exhcang4e 2016 and 2019 too. However, we will focus on the error faced by Exchange 2013 users.

The reasons behind the search error

There are various reasons behind these error messages, and some of them are the following:

1. The user has not installed the latest Cumulative Updates for Exchange 2013. Because of this:
   • eDiscovery function is not handling any information which the autodiscover is sending.

   or

   • The search cmdlets access an AD session limited to local DC.
2. User has not installed .Net 4.7 or the latest version but is using Internet Explorer 9.0 or latest.
3. The settings of the local Intranet Zone are not appropriately configured for the Internet Explorer.
4. The user is using a third-party browser rather than the Internet Explorer.

Based on the possible reasons, you can follow multiple methods like the following:

Install the latest Cumulative Updates for Exchange 2013. You can get the details about the updates, and also download them from https://docs.microsoft.com/en-us/exchange/updates-for-exchange-2013-exchange-2013-help

Install the latest version of .Net on the local computer and then perform the eDiscovery search. For this, please visit: https://dotnet.microsoft.com/download/dotnet-framework

If the settings of the local Intranet Zone are not done correctly, then use the upcoming steps:

1. Start Internet Explorer.
2. Go to Internet Options and click the Tools menu.
3. Check the sites at the Advanced option.
4. Add the https://*.outlook.com at the site list.
5. Restart the Internet Explorer.

Use Internet Explorer as it is supported by all Microsoft platforms.

After you have rectified the error, you can further make a, eDiscovery search query and get the desired content. Here are the following cases which you can create using the eDiscovery feature;

Here are the actions you can do using the eDiscovery feature;

1. Create and manage new search cases.
2. Assign eDiscovery permissions to the users to access search cases, preview search results, export search results, and create hold associated with an eDiscovery search.
3. User Windows PowerShell script to get a detailed report which consists of information of holds which are associated with eDiscovery searches.
4. Get a detailed report which consists of information of holds which are associated with eDiscovery searches.

• Ensure that your system meets the essential requirements like Windows 7 or later versions, Microsoft .NET Framework 4.7, latest version of the browser (Internet Explorer, Mozilla Firefox, or Google Chrome), etc.
• Make sure that the account you export has an active mailbox
• Confirm that the account used to export has the required permissions

In-place eDiscovery features used to search and export mailbox data to a safe location. However, when there is a need for comprehensive backup of Exchange/Office 365 data, this feature may not be of that much help. That’s why you should use a professional tool like Kernel Exchange Backup & Restore to backup Exchange and Office 365 mailbox to a PST file.

Back up Exchange Mailboxes to PST

Kernel Exchange Backup & Restore is a straightforward migration tool to take Exchange Server Backup and allows you to save the Exchange data in PST format at the desired folder. It provides you also a concise migration report in a CSV format showing the status of each message. The benefit is using this tool is that you can run multiple backups at the same time, and each migration runs efficiently.