automating ediscovery exports with powershell

Question

I and trying to have powershell run a script that goes to ediscovery, creates a search for a user, waitings for it to complete, exports it to blob, then downloads it from blob to a local server this top part is not code. these are all the imports modules that I have importing

# Import required modules
Import-Module AzureAD
Import-Module Az
Import-Module Microsoft.Online.SharePoint.PowerShell
Import-Module ExchangeOnlineManagement
Import-Module Microsoft.Exchange.Management.ExoPowershellModule

# Variables
$tenantAdmin = "<tenant admin email>"                                            # Replace with your       tenant admin email
$tenantAdminPassword = ConvertTo-SecureString "<password>" -AsPlainText -Force    # Replace with your tenant admin password
$eDiscoveryCaseName = "name of case"                                    # Replace with your eDiscovery case name
$blobStorageAccount = "<blob storage account name>"                                          # Replace with your blob storage account name
$blobStorageAccessKey = "<blob storage access key>" # Replace with your blob storage access key
$blobContainerName = "name of blob container"                                            # Replace with your desired blob container name (without the URL)
$localDownloadPath = "name of local server"                         # Replace with your desired local storage path

# Create credentials object
$credentials = New-Object System.Management.Automation.PSCredential ($tenantAdmin, $tenantAdminPassword)

# Connect to AzureAD
Connect-AzureAD -Credential $credentials

# Connect to SharePoint Online
Connect-SPOService -Url "https://<tenant>-admin.sharepoint.com/" -Credential $credentials

# Connect to Exchange Online
Connect-ExchangeOnline -Credential $credentials

# Connect to Security & Compliance Center PowerShell using Modern Authentication
Connect-IPPSSession -Credential $credentials

# Create the eDiscovery case if it doesn't exist
if (-not (Get-ComplianceCase -Identity $eDiscoveryCaseName -ErrorAction SilentlyContinue)) {
    New-ComplianceCase -Name $eDiscoveryCaseName -CaseType Core
}

# Get the eDiscovery case
$eDiscoveryCase = Get-ComplianceCase -Identity $eDiscoveryCaseName
if ($eDiscoveryCase -eq $null) {
    Write-Host "eDiscovery case not found"
    exit
}

# Start the eDiscovery search
$searchName = $eDiscoveryCaseName + "Name of user"
New-ComplianceSearch -Name $searchName -ExchangeLocation All -ContentMatchQuery "kind:email OR     kind:document" -ComplianceCase $eDiscoveryCase
Start-ComplianceSearch -Identity $searchName

# Export the eDiscovery search to Azure Blob Storage
$exportSettings = @{
    ExportId = (New-Guid).Guid
    StorageAccountName = $blobStorageAccount
    StorageAccountKey = $blobStorageAccessKey
    ContainerName = $blobContainerName
    SearchName = $searchName
}
New-ComplianceSearchAction -SearchName $searchName -Export -AzureBlobStorageAccountUrl "https://<blob     storage account name>.blob.core.windows.net" -AzureBlobStorageAccountKey $blobStorageAccessKey -        AzureBlobStorageContainer $blobContainerName

Wait for the export to finish

$exportStatus = Get-ComplianceSearchAction -Identity $searchName -ActionType     Export
while ($exportStatus.Status -eq "InProgress") {
Start-Sleep -Seconds 60
$exportStatus = Get-ComplianceSearchAction -Identity $searchName -        ActionType Export
}

# Download exported files from Azure Blob Storage to the specified local storage path
if ($exportStatus.Status -eq "Completed") {
$blobContext = New-AzureStorageContext -StorageAccountName $blobStorageAccount -StorageAccountKey $blobStorageAccessKey
$blobs = Get-AzureStorageBlob -Container $blobContainerName -Context     $blobContext

foreach ($blob in $blobs) {
    $localFilePath = Join-Path -Path $localDownloadPath -ChildPath $blob.Name
    Get-AzureStorageBlobContent -Blob $blob.Name -Container     $blobContainerName -Context $blobContext -Destination $localFilePath

}
else {
    Write-Host "Export failed"
}

# Get the compliance case
$complianceCase = Get-ComplianceCase -Identity $eDiscoveryCaseName
if ($complianceCase -eq $null) {
    Write-Host "Compliance case not found"
    exit
}

# Add the search to the compliance case
$complianceCaseSearch = Get-ComplianceCaseSearch -CaseId $complianceCase.Id     -SearchName $searchName
Add-ComplianceCaseSearch -CaseId $complianceCase.Id -SearchId 
$complianceCaseSearch.Id

Error is as follows

A parameter cannot be found that matches parameter name 'ComplianceCase'. + CategoryInfo : InvalidArgument: (:) [New-ComplianceSearch], ParameterBindingException + FullyQualifiedErrorId : NamedParameterNotFound,New-ComplianceSearch + PSComputerName : nam11b.ps.compliance.protection.outlook.com

The operation couldn't be performed because 'Terminated accounts (Username removed for privacy)' couldn't be found. + CategoryInfo : WriteError: (:) [Start-ComplianceSearch], ManagementObjectNotFoundException + FullyQualifiedErrorId : [Server=DM6NAM11WS024,RequestId=7b8ae79e-c294-4a48-ad90-8fb08956fb82,TimeStamp=4/17/2023 2:36:01 PM] [FailureCategory=Cmdlet-ManagementObjectNotFoundException] 834D92B1,Microsoft.Office.ComplianceJob.Tasks.StartComplianceSearc h + PSComputerName : nam11b.ps.compliance.protection.outlook.com

A parameter cannot be found that matches parameter name 'AzureBlobStorageAccountUrl'. + CategoryInfo : InvalidArgument: (:) [New-ComplianceSearchAction], ParameterBindingException + FullyQualifiedErrorId : NamedParameterNotFound,New-ComplianceSearchAction + PSComputerName : nam11b.ps.compliance.protection.outlook.com

A parameter cannot be found that matches parameter name 'ActionType'. + CategoryInfo : InvalidArgument: (:) [Get-ComplianceSearchAction], ParameterBindingException + FullyQualifiedErrorId : NamedParameterNotFound,Get-ComplianceSearchAction + PSComputerName : nam11b.ps.compliance.protection.outlook.com

Export failed Get-ComplianceCaseSearch : The term 'Get-ComplianceCaseSearch' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At C:\test.ps1:88 char:25

$complianceCaseSearch = Get-ComplianceCaseSearch -CaseId $complianceC ...
```
                    ~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : ObjectNotFound: (Get-ComplianceCaseSearch:String) [], CommandNotFoundException
- FullyQualifiedErrorId : CommandNotFoundException

Add-ComplianceCaseSearch : The term 'Add-ComplianceCaseSearch' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At C:\test.ps1:89 char:1

Add-ComplianceCaseSearch -CaseId $complianceCase.Id -SearchId $compli ...

  + CategoryInfo          : ObjectNotFound: (Add-ComplianceCaseSearch:String) [], CommandNotFoundException
  + FullyQualifiedErrorId : CommandNotFoundException

Remove-PSSession : Cannot bind argument to parameter 'Session' because it is null. At C:\test.ps1:91 char:27

Remove-PSSession -Session $session
```
                      ~~~~~~~~
```
- CategoryInfo : InvalidData: (:) [Remove-PSSession], ParameterBindingValidationException
- FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.RemovePSSessionCommand

@ryanwebjackson I added the errror to the original file. The permissions issue, I can export them manually. — Robert Harley, Apr 17 '23 at 14:24
@ryanwebjackson running this now, I just got another discovery email, and it says I started a search, my issue currently is finding out if it is working, as there is no history of the search in discovery and in the blob and in the external drive. — Robert Harley, Apr 17 '23 at 14:28

automating ediscovery exports with powershell

Wait for the export to finish

0 Answers0