O365合规性搜索HardDelete不工作

Question

用户的已删除邮件中有超过40 GB的电子邮件。她已经确认，她不需要它们是可恢复的。

我已经使用这里概述的方法运行了一个搜索，以提取她的已删除邮件文件夹id。

https://docs.microsoft.com/en-us/microsoft-365/compliance/use-content-search-for-targeted-collections?view=o365-worldwide

然后，我在合规中心为她的用户创建了一个搜索，以文件夹id作为搜索项，在2020年3月30日之前进行搜索。搜索返回20+ GB的结果

我使用Connect-IPPSSession使用2fa连接到法规遵从性服务，并运行以下命令

-Purge -ComplianceSearchAction -SearchName“3/30/2020年3月30日之前删除的项目”-Purge -PurgeType HardDelete

该操作完成后会立即显示

结果:清除类型: HardDelete；项目计数: 0；总大小为0；详细信息：{}

用户邮箱的大小根本没有缩小，所有已删除的邮件仍在那里。再次运行搜索将返回相同的20+ GB结果

我已经尝试了软删除和硬删除选项的操作，结果是相同的，没有任何反应。

我已经与Get-ComplianceSearch确认，该搜索名称的powershell中显示了大约20 Get的数据，那么为什么HardDelete不删除任何内容？

Answer 1

因此，我了解到一个清除操作一次只能删除10个项目。至于为什么你和我没有看到电子邮件被删除，我从来没有完全弄清楚。我怀疑它在每次运行时删除了10个邮箱，但由于我搜索了多个邮箱(根据我的要求)，结果并不清楚。从那以后，我成功地使用了一个脚本(如下所示)，我通过这个blog post找到了一个script，并根据自己的需求进行了调整。

非常感谢托尼·雷德蒙，我修改了他的剧本……

Clear-Host

# Connect to Exchange Online
$credentials = get-credential;
Connect-ExchangeOnline -Credential $credentials
$SccSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Credential $credentials -Authentication "Basic" -AllowRedirection;
Import-PSSession $SccSession

$mailboxes = @("mailbox1@example.net", "mailbox2@example.net")

$monthsToKeep = 3

$sourceDate = (Get-Date).AddMonths(-$monthsToKeep)

$searchName = "PurgeEmails"

$contentQuery = "received<=$($sourcDeate) AND kind:email"

# Clean-up any old searches from failed runs of this script
if (Get-ComplianceSearch -Identity $searchName) {
    Write-Host "Cleaning up any old searches from failed runs of this script"

    try {
        Remove-ComplianceSearch -Identity $searchName -Confirm:$false | Out-Null
    }
    catch {
        Write-Host "Clean-up of old script runs failed!" -ForegroundColor Red
        break
    }
}

Write-Host "Creating new search for emails older than $($sourceate)"

New-ComplianceSearch -Name $searchName -ContentMatchQuery $contentQuery -ExchangeLocation $mailboxes -AllowNotFoundExchangeLocationsEnabled $true | Out-Null
                                                                            
Start-ComplianceSearch -Identity $searchName | Out-Null

Write-Host "Searching..."

while ((Get-ComplianceSearch -Identity $searchName).Status -ne "Completed") {
    Write-Host "." -NoNewline
    Start-Sleep -Seconds 2
}

$items = (Get-ComplianceSearch -Identity $searchName).Items

if ($items -gt 0) {
    $searchStatistics = Get-ComplianceSearch -Identity $searchName | Select-Object -Expand SearchStatistics | Convertfrom-JSON

    $sources = $searchStatistics.ExchangeBinding.Sources | Where-Object { $_.ContentItems -gt 0 }

    Write-Host ""
    Write-Host "Total Items found matching query:" $items 
    Write-Host ""
    Write-Host "Items found in the following mailboxes"
    Write-Host "--------------------------------------"

    foreach ($source in $sources) {
        Write-Host $source.Name "has" $source.ContentItems "items of size" $source.ContentSize
    }

    Write-Host ""

    $iterations = 0;
    
    $itemsProcessed = 0
    
    while ($itemsProcessed -lt $items) {
        $iterations++

        Write-Host "Deleting items iteration $($iterations)"

        New-ComplianceSearchAction -SearchName $searchName -Purge -PurgeType HardDelete -Confirm:$false | Out-Null

        while ((Get-ComplianceSearchAction -Identity "$($searchName)_Purge").Status -ne "Completed") { 
            Start-Sleep -Seconds 2
        }

        $itemsProcessed = $itemsProcessed + 10
        
        # Remove the search action so we can recreate it
        Remove-ComplianceSearchAction -Identity "$($searchName)_Purge" -Confirm:$false  
    }
} else {
    Write-Host "No items found"
}

Write-Host ""
Write-Host "COMPLETED!"