Compliance search partially indexed items
Original version written by Microsoft and published at https://docs.microsoft.com/en-us/microsoft-365/compliance/investigating-partially-indexed-items-in-ediscovery?view=o365-worldwide.
Connect & set up
Run these once per session. All scopes are read-only unless the script makes changes.
# Review required modules and connection steps before running.# Connect to Microsoft Graph or Exchange Online as needed for this script.
Run it
The main script. Copy it, or download the .ps1 and run it from your console.
write-host "**************************************************"write-host " Microsoft 365 Compliance Center " -foregroundColor yellow -backgroundcolor darkgreenwrite-host " eDiscovery Partially Indexed Item Statistics " -foregroundColor yellow -backgroundcolor darkgreenwrite-host "**************************************************"" "# Create a search with Error Tags Refinders enabledRemove-ComplianceSearch "RefinerTest" -Confirm:$false -ErrorAction 'SilentlyContinue'New-ComplianceSearch -Name "RefinerTest" -ContentMatchQuery "size>0" -RefinerNames ErrorTags -ExchangeLocation ALLStart-ComplianceSearch "RefinerTest"# Loop while search is in progressdo{Write-host "Waiting for search to complete..."Start-Sleep -s 5$complianceSearch = Get-ComplianceSearch "RefinerTest"}while ($complianceSearch.Status -ne 'Completed')$refiners = $complianceSearch.Refiners | ConvertFrom-Json$errorTagProperties = $refiners.Entries | Get-Member -MemberType NoteProperty$partiallyIndexedRatio = $complianceSearch.UnindexedItems / $complianceSearch.Items$partiallyIndexedSizeRatio = $complianceSearch.UnindexedSize / $complianceSearch.Size" ""===== Partially indexed items ====="" Total Ratio""Count {0:N0}{1:P2}" -f $complianceSearch.Items.ToString("N0").PadRight(15, " "), $partiallyIndexedRatio"Size(GB) {0:N2}{1:P2}" -f ($complianceSearch.Size / 1GB).ToString("N2").PadRight(15, " "), $partiallyIndexedSizeRatio" "Write-Host ===== Reasons for partially indexed items =====$Report = [System.Collections.Generic.List[Object]]::new() # Create output fileforeach($errorTagProperty in $errorTagProperties){$name = $refiners.Entries.($errorTagProperty.Name).Name$count = $refiners.Entries.($errorTagProperty.Name).TotalCount$frag = $name.Split("{_}")$errorTag = $frag[0]$fileType = $frag[1]$ErrorTagText = $Null; $FileTypeText = $NullSwitch ($ErrorTag) {"attachmentrms" { $ErrorTagText = "Rights Management Encrypted Attachment" }"parserencrypted" { $ErrorTagText = "Parser couldn't decrypt item" }"parsererror" { $ErrorTagText = "Parser encountered an error" }"parserinputsize" { $ErrorTagText = "Parser error on input (maximum) size" }"parsermalformed" { $ErrorTagText = "Parser encountered malformed item" }"parseroutputsize" { $ErrorTagText = "Parser error on output size" }"parserunknowntype" { $ErrorTagText = "Parser encountered unknown format" }"parserunsupportedtype" { $ErrorTagText = "Parser encountered unsupported format" }"retrieverrms" { $ErrorTagText = "Rights Management Encrypted Item" }"default" { $ErrorTagText = "Unknown error" }} #End switchSwitch ($FileType) {"bmp" { $FileTypeText = "Bitmap graphic file" }"doc" { $FileTypeText = "Word (DOC) document" }"docm" { $FileTypeText = "Word (DOCM) template" }"docx" { $FileTypeText = "Word (DOCX) document" }"eml" { $FileTypeText = "Email item" }"encoffmetro" { $FileTypeText = "Password protected PowerPoint PPTX" }"gzip" { $FileTypeText = "GZIP file" }"json" { $FileTypeText = "JSON-formatted data" }"mhtml" { $FileTypeText = "Web archive" }"mp3" { $FileTypeText = "MP3 audio file" }"mp4" { $FileTypeText = "MP4 audio/video file" }"mpp" { $FileTypeText = "Microsoft Project file" }"pdf" { $FileTypeText = "PDF file" }"noformat" { $FileTypeText = "Unknown/no format" }"png" { $FileTypeText = "PNG graphic file" }"ppt" { $FileTypeText = "PowerPoint (PPT) presentation" }"pptx" { $FileTypeText = "PowerPoint (PPTX) presentation" }"ps" { $FileTypeText = "PostScript file" }"tiff" { $FileTypeText = "TIFF graphic file" }"txt" { $FileTypeText = "Text file" }"wav" { $FileTypeText = "Waveform audio file" }"xls" { $FileTypeText = "Excel (XLS) worksheet" }"xlsx" { $FileTypeText = "Excel (XLSX) worksheet" }"xml" { $FileTypeText = "XML format file" }"zip" { $FileTypeText = "ZIP file" }"default" { $FileTypeText = "Unknown file format" }} #End switch$ReportLine = [PSCustomObject] @{ErrorType = $ErrorTagErrorText = $ErrorTagTextFileExt = $FileTypeFileType = $FileTypeTextCount = $Count }$Report.Add($ReportLine)}$Report | Sort Count -desc | Format-Table FileType,Count, ErrorText