Removing orphaned in-place hold

Question

An eDiscovery Case was apparently removed but the in-place holds were never removed. So a user now shows a hold GUID on their mailbox and is prevented from emptying their deleted items once they hit the 100gb max. Since the Case identifier has been removed from the system, the Get-CaseHoldPolicy command using the GUID (minus the prefix) returns an error.

Was on phone with MS support and they are currently at a loss.

There is an attribute in on-prem Active Directory named "msExchUserHoldPolicies" that holds the GUID of the in-place hold. We are in hybrid setup so when I clear this value and run AD Connect sync, the value comes right back. Research shows that there is an attribute named "cloudMsExchUserHoldPolicies" that is the online attribute that apparently AD Connect cannot clear. I have not found a way to clear the value of this cloud attribute...assuming this will even allow the user to be able to reduce the mailbox size and use it.

Was hoping that someone in the interworld had run into this situation before and might have some tips.

I found the script Remove-UserInPlaceHold (discussed https://learn.microsoft.com/en-us/archive/blogs/dsheehan/exchange-lingering-orphaned-in-place-holds-on-mailboxes-blocking-cleanup-moves) and have run it but it hasn't helped.

Thought it worth a try to ask.

Thanks.

Answer 1

This worked for me:

Set-Mailbox -identity <exchangeguid> -RemoveOrphanedHolds <inplaceholdidentity>

Once you've run this command, you can go into AD and wipe out the contents of the msExchUserHoldPolicies attribute, and it will remain empty! This can be accomplished rapidly using the following command:

get-aduser -Filter "msExchUserHoldPolicies -eq '<inplaceholdidentity>'" -properties * | Set-ADUser -Remove @{msExchUserHoldPolicies="<inplaceholdidentity>"}

Of course, make sure to replace <inplaceholdidentity> with the actual GUID that's showing up on the user mailboxes under "InPlaceHolds" (get-mailbox | fl name,inplaceholds)

Note that this process will only work for ACTIVE mailboxes where the actual search no longer exists.

Answer 2

Hi @bob h ,

I found this thread similar to your issue: Exchange Online - Remove Phantom In-Place Hold , please try the solution provided in it to see whether it is helpful to your scenario:

Empties hidden Deleted Items folders, such as 'Purges'. Won't empty 'Purges' folder if 'In-Place Hold' or 'Litigation Hold' is applied to mailbox

Search-mailbox -identity "identity" -SearchDumpsterOnly -DeleteContent  

Disabled Litigation Hold on Mailbox

Set-Mailbox –Identity "identity" -LitigationHoldEnabled $false  

Gets various relevant metrics and settings

Get-Mailbox -Identity "identity" | Format-List DisplayName,Name,IsInactiveMailbox,LitigationHoldEnabled,LitigationHoldDuration,InPlaceHolds,RetentionHoldEnabled,RetentionPolicy  

Gets the name of Retention Policy, based off GUID provided in a Get-Mailbox command for In-Place Holds

Get-RetentionCompliancePolicy <GUID> | FL Name  

Script found to provide folder sizes of hidden Deleted Items folders (Purges, etc.)

"======================================================"   
$RecipientName = "PrimaryEmail"  
$RecipientDisplayName = (get-recipient $RecipientName).displayname  
  
Optional (for reporting purposed):  
  
$RecipientNetBIOSName = (get-recipient $RecipientName).name  
$RecipientPrimAlias = (get-recipient $RecipientName).PrimarySmtpAddress  
  
Write-host "======================================================" -ForegroundColor Cyan                      
	write-host "Dumpster and Deletions Report for '$RecipientDisplayName' ($RecipientName) (Does not apply to Mailusers or Contacts):" "$(get-date)" -ForegroundColor Yellow  
Write-host "======================================================"  
Write-host "Dumpster and Deletions Report provides Size Values for the mailbox 'Deleted items', 'Recover Deleted Items' (Dumpster), and 'Purges' values."  -ForegroundColor Cyan  
     Write-Host "Does not apply to Mailusers" -ForegroundColor cyan  
     Write-Host "*** If Lit Hold is present, Recover and Purges will be larger and must be ignored.) ***"  -ForegroundColor Red  
     Write-Host "***"  
     Write-Host "The ‘Recoverable Items’ folder contains the following subfolders:" -ForegroundColor Yellow  
     Write-Host "   Recoverable Items: This is the total amount combined in Deletions, Calendar Logging, Purges, and Versions."  
     Write-Host "   Calendar Logging:  For Calendar diagnostic purposes"  
     Write-Host "   Deletions:         Recover Deleted Items or the ‘Dumpster'"  
     Write-Host "                      This subfolder contains all items deleted from the Deleted Items folder. "  
     Write-Host "   Versions:          If In-Place Hold or Litigation Hold is enabled:"  
     Write-Host "                      This subfolder contains the original and modified copies of the deleted items."  
     Write-Host "   Purges:            If either Litigation Hold or single item recovery is enabled:"  
     Write-Host "                      This subfolder contains all items that are hard deleted."  
     Write-Host "======================================================" -ForegroundColor Cyan  
Get-MailboxFolderStatistics $RecipientName -FolderScope RecoverableItems | ft Name,FolderAndSubfolderSize, @{name="LitigationHoldEnabled";expression={(Get-mailbox $RecipientName).LitigationHoldEnabled}} –a  
##########################################################  

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Appreciate the information. The search-mailbox command returned 0 items. Litigationholdenabled was already set to $false (the problem is an inplace hold). The get-retentioncompliancepolicy can't find the GUID shown in the InPlaceHolds attribute. Nor can get-caseholdpolicy. The actual inplace hold case is not present in the compliance console anymore although the GUID still shows in mailboxes.

Answer 4

Hello @bob h and @Joyce Shen - MSFT ,

I am having the exact issue that bobh-8117 described in a hybrid configuration and went through the same steps noted here and unfortunately having the same results. If you found how to clear the cloudMsExchUserHoldPolicies online attribute, please let me know. My Recoverable items folder has reached the 100GB limit.

Thanks in advance!

Answer 5

I also had this same issue and could not find any reference to the inplace hold that was on my mailbox. We are in a hybrid mode and using the notes above I was able to finally remove the inplace hold. I cleared the value "msExchUserHoldPolicies" with ADSIEdit and even replaced the value with "Test" just to see if it would update the mailbox online... which it did but had the value restored quickly. I kept clearing and syncing the value and it finally cleared it and I was able to run the MFA to clear all of the recoverable items and DiscoveryHolds folders both which were at 100GB.

Hope this helps.