Removing orphaned in-place hold

Question

An eDiscovery Case was apparently removed but the in-place holds were never removed. So a user now shows a hold GUID on their mailbox and is prevented from emptying their deleted items once they hit the 100gb max. Since the Case identifier has been removed from the system, the Get-CaseHoldPolicy command using the GUID (minus the prefix) returns an error.

Was on phone with MS support and they are currently at a loss.

There is an attribute in on-prem Active Directory named "msExchUserHoldPolicies" that holds the GUID of the in-place hold. We are in hybrid setup so when I clear this value and run AD Connect sync, the value comes right back. Research shows that there is an attribute named "cloudMsExchUserHoldPolicies" that is the online attribute that apparently AD Connect cannot clear. I have not found a way to clear the value of this cloud attribute...assuming this will even allow the user to be able to reduce the mailbox size and use it.

Was hoping that someone in the interworld had run into this situation before and might have some tips.

I found the script Remove-UserInPlaceHold (discussed https://learn.microsoft.com/en-us/archive/blogs/dsheehan/exchange-lingering-orphaned-in-place-holds-on-mailboxes-blocking-cleanup-moves) and have run it but it hasn't helped.

Thought it worth a try to ask.

Thanks.

Answer 1

Many apologies to ask the question and vanish.

The gist of it was that I had to open a case with the mother ship and go through at least three techs...basically re-stating and showing them the problem...until finally, magically, someone "up there" cleared the reference to the in-place holds so that the user was able to finally empty their Deleted Items. Probably ran adsiedit against Azure AD, I would assume.

I had tried clearing the value in the on-prem AD and synching and the value would always return.

Of course, MS never bothered to share with me what or how they did it, which is a real shame. Even if I don't have sufficient rights in their cloud to do it, the old-time Exchange Admin in me was really curious. But, alas...

So, go ahead and open a ticket and prepare for a few days of relaying until the right person gets the case.

Answer 2

This worked for me. I was able to remove an orphane in-placehold

Invoke-HoldRemovalAction -Action RemoveHold -ExchangeLocation "user email address" -HoldId "hold ID"

replace hold ID with the orphaned ID.

Answer 3

Adding something for anyone who finds this in their search who has the problem on Exchange Online

There is a new powershell command to remove the orphaned hold on an exchangeonline user.

You must make sure the source of the hold has been deleted.

So first search the mailbox to see the hold status `

get-mailbox [mailbox@domain.example] | fl hold ` Make sure all holds are false and note the guid of the inplacehold

Now see if there is any remaining mailbox search entries with an inplaceholdsenabled

Get-MailboxSearch -resultsize "unlimited" | fl

Note the inplaceholdidentity of any searches you find. If it matches the hold you are trying to remove you need to remove the hold from the search and likely you want to remove the search entry too.

$inplacehold = Get-MailboxSearch -InPlaceHoldIdentity [GUIDofInplaceholdidentity]

Set-MailboxSearch $inplacehold.Name -InPlaceHoldEnabled $false

Now if you can WAIT. Give it 4 hours to clean up the holds.

check if your user has the holds again `

get-mailbox [mailbox@domain.example] | fl hold ` If it has not cleared you likely have a phantom / orphaned hold

You can remove the old search by

Remove-MailboxSearch -Identity "[Name of Search]"

To clear the orphanhold from the mailbox use

Set-Mailbox -Identity [mailbox@domain.example] -RemoveOrphanedHolds [GUIDofInplaceholdidentity]