365 Compliance Searches and Exports

Compliance Searches and Exports of Office 365

If your trying to track down who sent out those company secrets or correspondence regarding some legal issue you can use the Office 365 Security and Compliance features. You can also use these features to export that data as a spreadsheet and/or as PST data.

First we need to create a content search:

Open Office365 using Microsoft Edge logon as an Administrator and Open “Security and Compliance” console:

clip_image002 or clip_image004

Drill down to “Search and Investigations” and “Content search” as shown below:

clip_image006

Click on the + to add a new search, Name the search and specify locations to search and click “Next” as shown below:

clip_image008

Now put in your search keywords and or any conditions. CAUTION! If you put in something too short or vague and don’t qualify it with a condition, you may get more results than you intended.

clip_image010

Note: you can change the conditions as needed if you don’t get the results intended.

Once you click “Search” it will begin immediately searching your “indexed” database:

Note: Indexed means email and data it can scan and index. It may skip attachments or larger email threads. Soft deleted items are also indexed.

To the right you will see the search results. As you can see below my search grabbed the one email regarding “internal company takeover plans”. To view what specific emails it found you can “preview search results”:

clip_image012

Opening the Preview Search Results:

clip_image014

If you click on “Download Original Item” you can download the email as .eml

If you would like to export the results to a CSV file under “Export report to a computer” Click on “Generate report” as shown below:

clip_image016

Select the options you need for your export.

clip_image018

It will then change the prompt to “Download report” as shown below:

clip_image020

Skip to step “Transferring the data onsite report or PST”

If you need to export all the emails to PST under “Export results to a Computer” click “Start Export” as shown below:

clip_image022

Select the options you need for your export. Keeping in mind the sizes of the PST files that may be created. The bigger the files the more likely for corruption and download issues.

clip_image024

It will then change the prompt to “Download exported results” as shown below:

clip_image026

Transferring the data onsite report or PST:

Whether the PST download or Report download. When you click on that you will receive an “Export Key” as shown below. Copy it and then click on “download results”:

clip_image028

You will then download and install the eDiscovery Export Tool:

clip_image030

You will then be prompted for the export key and path on your local system for the data:

clip_image032

It will then begin downloading the data:

clip_image034

When finished the Report, PST file or files will be in a subdirectory under the path you specified.

Note: Soft Deleted emails will be listed and exportable by the query till they are hard deleted from the mailboxes.

Comments

Post a Comment

Popular posts from this blog

Office 365 Deployment Tool Office Download fails “Could not Install”

Image
Problem: you run the setup.exe /download download.xml and fails immediately with “Couldn’t install” You make sure all the settings are correct (see other blogs) and find nothing wrong Solution: Change drives and run it as an administrator again. For example above i am in the F:\OfficeDeploy directory which is the same directory I have the download.xml directing the download to. If i Change to the c: and run the same command again it works The Office Data folder was created and updated as shown below:
Read more

FRS to DFSR Post Cleanup “File Replication NtFrs Stopped”

Image
After successfully migrating from FRS to DFSR you get the File Replication NtFrs service is Stopped error on the local servers AD DS Services list. In the Event logs you may see Event id 13575 13577. You can confirm your migration completed by opening a cmd prompt as administrator and typing in: dfsrmig /getmigrationstate After your migration to DFSR is completed and you have given your servers ample time to propagate this service is no longer required. Since it is set to “Automatic”, as shown below” it shows in logs as a false positive error. Edit the File Replication Service and change it to “Disabled”, as shown below: Once it is listed as “Disabled” it will no longer show in the Console as an “error” Note : it may take some time to clear from the active view
Read more

Domain Migration SubinACL /Migratetodomain How To:

Caution : DO NOT run this on Domain Controller C:\ and only run on roaming profiles folders, or my docs shares day of migration to avoid ownership change issues. Confirm Domain trust is in place and users and groups have been migrated Test ping of olddomain.org from new domain Test ping of newdomain.org from olddomain Add newdomain.org domain controller host records to olddomain.org including reverse DNS records Confirm the user running the app is a domain admin in BOTH domains Download SubinACL here: http://www.microsoft.com/en-us/download/details.aspx?id=23510 /Migratetodomain- command will add the permissions of the new user to the old files and folders for example if jimbob@olddomain.org was migrated to the new domain jimbob@newdomain.org and you run the command below any file or folder in that path that has jimbob@olddomain.org will add Jimbob@newdomain.org with the exact same permissions. This is a safer way to migrate by keeping the old and new permissions intact while a
Read more