How to do In-place eDiscovery in new O365?


In the below post I have described how we can do eDiscovery in new Office 365

       
  • In Exchange admin center select Permissions > admin roles
                       Double click Discovery Management
                       Under Roles Click on Add and Select Mailbox Import Export
                       Under Member, Add yourself as a Member and Click Save.

        

    
  • Now click on compliance management and select in-place eDiscovery & hold
        
  • Hit + sign to create a new search query
  • Give a Name and Description and hit Next
          
  • Select the mailboxes that you want to query and click Next.
        
  • In the next screen if options are greyed out as below it means you do not have proper permissions. Revisit the step for adding permissions. If proper permissions have been added sign out and sign in back
      
  • In the filed provide the text you want to search. You can use Boolean expression like OR and AND to make robust query
      
  • Once you have specified the search attributes hit on Next
  • You can do a in place hold of the search items.(Note, this option will be greyed out if you have selected all mailboxes during the mailbox selection process) and hit on finish
         
               
How to see the search results?
As we have added yourself to the Mailbox import export and other permissions we have the below options available
 
In new O365 we have more robust options to see the results compared to W14


Estimate search results
This gives us a list a small report of the search. It also tells us what was number of hits for each of the items we entered in search Query  as keywords

Part of the estimate result is copied below
----------------------------------------------------------------------------------
Test
This search is for searching all mails in the organization that has word test in the subject line
Hold None
Search Status:   Estimate Succeeded
Run by: Prakum
Run on: 18-07-2013 13:56
Size: 410.23 KB
Items: 5
Errors: None
Statistics:
KEYWORD HITS
Test 25
<-Previous- Keywords: 1 to 1 of 1 -Next->
 -------------------------------------------------------------------------------------

Preview search results
This opens up eDiscovery preview of results in the browser and we could see the results directly in the browser itself


Copy search results
This option opens up a dialog box where you can select fine tune search results and copy the items to Discovery search mailbox
Once you hit Copy, in the search results field towards the left you will have an option to open Discovery Search mailbox..

 
 If you click on open it opens the Discovery Search Mailbox in a new browser




The mailbox will have a folder by the name of the search (TEST in our case) and put the mail items there as below





Export to PST
This is a new option that we have in new O365 where we can export the search results to PST to the local computer. It downloads the results based on mailboxes, ie if the search finds there are 10 mbx that has the keyword we are searching for if creates 10 PST one each for each mailbox.


 

Commenti

Posta un commento

Post popolari in questo blog

Come e quando smantellare i server Exchange in una distribuzione ibrida

Immagine
Articolo tratto da technet di microsoft . Una delle opzioni più interessanti per ottenere una società a Exchange Online è quello di utilizzare l'approccio distribuzione ibrida descritto nel  Piano di una distribuzione ibrida di Exchange Online in Office 365  . Questa è l'unica opzione che permette di facilmente a bordo e caselle di posta off-board (tutte le altre opzioni native sono sul bordo). Oltre alla capacità di off-board, una configurazione ibrida ha le seguenti opzioni principali: Questo argomento vi aiuterà a capire le opzioni per lo smantellamento di cambio ibrido, e quando ognuno di queste opzioni dovrebbe essere attuato. Ci sono molte variazioni a quando e come disattivare i server ibridi di Exchange. Prendendo il tempo di comprendere le implicazioni e pianificare correttamente la disattivazione totale o parziale dei server locali è importante. Disponibilità tra sedi  . Questo ti permette di vedere / informazioni sulla di...
Continua a leggere

Manage Room Mailbox by using PowerShell

In the current article, we will review how to use PowerShell commands for managing Room mailbox in Exchange Online environment. Resource Mailbox is a special type or a Mailbox that uses for the management of meeting Rooms and Equipment. The Resource Mailbox doesn’t require a license. Management of Resource Mailbox could be implemented by using one of the following options: Self-management – the Resource Mailbox will be configured for automation of accepting meeting requests (or decline meeting request if a former meeting request was already set). Resource Mailbox delegate – The delegate is the person that will accept the meeting requests and approve or decline the meeting requests. The term “resource Mailbox” includes two types of Mailboxes – Room Mailbox and Equipment Mailbox. There is a small difference between the two types of the resource mailbox but the use, and the purpose are quite similar (most of the examples will relate to room Mailbox). A Little confession: ...
Continua a leggere

How to reset an Office 365 install to the initial activation/install state

Immagine
1.   Remove Office 365 license for Subscription based installs (not Shared Computer Licensing scenarios): To remove the Office 365 license, you must run two cscript command lines. The command lines are:         A. Run  C:\program files <x86>\Microsoft office\office15>cscript ospp.vbs /dstatus The above command line will generate a report of the currently installed/activated license.  (See Below) NOTE: You might see multiple licenses in the /dstatus report.         B. Make note of value for “ Last 5 characters of installed product key”         C.  Run  C:\program files <x86>\Microsoft office\office15>cscript ospp.vbs /unpkey:“Last 5 of installed product key”   For example:   C:\program files <x86>\Microsoft office\office15>cscript ospp.vbs /unpkey:WB222  (See Below) Repeat the st...
Continua a leggere