One of the customers I work with apply extensive retention policies for mailboxes in the organization. A restrictive policy applied to a mailbox receiving a lot of messages with attachments will likely cause incidents where the recoverable items quota is exceeded.
In this case the root cause is retention policies but this could also be caused by litigaton hold, eDiscovery case holds etc. This article assumes it is OK to remove these policies and hard deleting the messages. If these messages need to be retained.
Before proceeding, verify that the quota is exceeded by running the below command. Mailboxes on hold have a default recoverable item quota of 100 GB.
Get-MailboxStatistics <PrimarySMTPAddress> | ft DisplayName, TotalDeletedItemSize, DeletedItemCount
Preparations
Before proceeding we need to make sure that messages can be deleted from the mailbox. This involves changing some settings for the mailbox. The following command will disable deleted item retention and single item recovery for the mailbox.
Set-Mailbox <PrimarySMTPAddress> -RetainDeletedItemsFor 0
Set-Mailbox <PrimarySMTPAddress> -SingleItemRecoveryEnabled $false
You also need to ensure the mailbox is no longer affected by any holds. Microsoft explains this in detail in this article. Note that a applied retention policy starting with a minus sign means the mailbox is excluded from the policy.
As changes related to retention / holds usually take a long time to apply in large organizations I recommend waiting 24 hours before proceeding.
Deleting the items
To delete the items I grant my account access to the mailbox in question and setup a new Outlook profile for the task. I configure the profile not to use cached Exchange mode and close the Outlook client as soon as the target mailbox becomes avaialble.
Using MFCMAPI I proceed with deletion of the contents of the DiscoveryHolds folder:
- Start the application and select “Session” -> “Logon…”
- Select the newly created Outlook profile and click “OK”.
- Double-click the target mailbox in the list of available mailboxes.
- Expand the mailbox and the “Recoverable Items” folder.
- Right-click “DiscoveryHolds” and select “Advanced” -> “Empty items and subfolders from folder…”
- Check the “Hard Deletion” box and click “OK”.
The deletion process should start immediately you should see the ItemsInFolder and FolderAndSubfolderSize changing when running the command below.
Get-MailboxFolderStatistics -Identity <PrimarySMTPAddress> -FolderScope RecoverableItems | ft Identity, ItemsInFolder, FolderAndSubfolderSize
When you’re happy with the results verify that you’re under the recoverable item quota by running this again.
Get-MailboxStatistics <PrimarySMTPAddress> | ft DisplayName, TotalDeletedItemSize, DeletedItemCount
It everything looks OK make sure to re-apply the single item recovery and deleted item retention settings. Below are commands to restore defaults.
Set-Mailbox <PrimarySMTPAddress> -RetainDeletedItemsFor 14
Set-Mailbox <PrimarySMTPAddress> -SingleItemRecoveryEnabled $true
Possible issues
If deleting the items only results in the items being moved from “DiscoveryHolds” to “Purges” it most likely means the item retention and single items recovery settings are not fully applied. Wait some time and run the below command.
Start-ManagedFolderAssistant -Identity <PrimarySMTPAddress>
Update: 2021-09-07: Another reason message may be getting stuck in Purges is the mailbox property ElcProcessingDisabled being set to True. Microsofts own documentation suggest that’s the way it should be done but my experience is that setting it to false may resolve this issue (thanks for verifying Michael).
Set-Mailbox -Identity <PrimarySMTPAddress> -ElcProcessingDisabled $false
Start-ManagedFolderAssistant -Identity <PrimarySMTPAddress>
Hi, thank you for effort on doing this post. I tried to follow these steps, but I ended up with following error in MFCMAPI:
Warning:
Code: MAPI_W_PARTIAL_COMPLETION == 0x00040680
Function lpMAPIFolderToEmpty->EmptyFolder( lpProgress ? reinterpret_cast(m_hWnd) : NULL, lpProgress, ulFlags)
File D:\a\1\s\UI\Dialogs\HierarchyTable\MsgStoreDlg.cpp
Line 719
Hi,
I’m afraid I haven’t encountered that error. Did you find a way to get it to work?
Please try after unchecking the cached mode. somehow purge works on online mode though it takes time.
Found no cached mode please state where that is located?
Here’s a MS article showing how to enable/disabled cached Exchange mode: https://support.microsoft.com/en-us/office/turn-on-cached-exchange-mode-7885af08-9a60-4ec3-850a-e221c1ed0c1c
Are you sure the offending mailbox has been removed from all retention policies? I was running into this and forgot to remove the offending mailbox from a retention policy once I did this it worked.
I ran into the same MFCMAPI error
Ran into the same… The trouble is a a “Chicken and the eggs” I suspect… When deleting stuuf, in goes in the Recovery, but dleleting from the but’s it in the PURGE.
I hard deleted the purge, and things started emptying itself BOTH in purge and Recovery…
Also of note, don’t forget the delay if you had to make yourself a member of the necessary security/compliance groups.
Hey, I was wondering how you deleted the purge. I am having the same issue. Did you do via Mapi? I can’t see Purge in the menu.
After countless Microsoft articles *and* hours on the phone with them, I somehow came across this site and it was the first with decent instructions and the only one THAT WORKED! Boss’s DiscoveryHolds folder was full at 100GB and I been losing sleep over trying to empty or expand it.
Thank you Martin!
That’s awesome, happy to hear that this helps people in the real world! Thanks for sharing 🙂
I got to above error. I found an organization hold on all mailboxes. “Get-OrganizationConfig | FL InPlaceHolds” once that was removed these steps worked.
Much easier than this article but this will tell you how to find and exclude the hold.
https://docs.microsoft.com/en-us/microsoft-365/compliance/delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-worldwide
This didn’t work for me. Emails simply got stuck in Purges
Running Start-ManagedFolderAssistant -Identity did nothing either. Yesterday this command simply moved them back to DiscoveryHolds but today it does nothing and I can’t delete the purges folder and I can’t delete any emails within the Purges folder. I went through the MS guide and tried the Powershell commands with no success either. Our customer is stuck being unable to delete emails.
Try changing the value (true/false) of the setting “ElcProcessingDisabled” for the mailbox using Set-Mailbox. I’ve had issues with messages stuck in purges from time to time and I have something like the above in my notes. Hope it helps and please let me know if it does so that this can be added to the post.
Setting this to False worked. I worked with Microsoft tech on Friday afternoon who pointed this out. In Microsoft’s guide it says to set it to true so that’s where the confusion was.
Thanks for sharing, I’ve updated the article with this now verified piece of info 🙂
Were you able to flush out purges using the mfcmapi? I have a mailbox on which elc is false, i flushed disc holds using mfcmapi but all the 99gb of disc holds are now stuck in Purges and purges is not cleaning up using mfcmapi. Hard deletion not working.
Thank you! That worked flawlessly for me!
I am also getting the MAPI_W_PARTIAL_COMPLETION error. Currently -ElcProcessingDisabled $false
Are you trying to delete something you have already attempted to delete, because it visually didn’t look like it was deleting?
I think that error means its processing your first request.
A refresh of the folder may show it has been deleted.
This article is by far the most clear instruction to cleanup Recoverable Items folder, thanks Martin. The issue I have encountered is the MFCMAPI part, it’s just stuck at “Not Responding” and did nothing while was trying to empty 100GB DiscoveryHolds folder, any idea?
Thank you for those kind words, Sander! Are you sure things aren’t happening in the background when MFCMAPI is “Not responding”? I’ve encountered it quite frequently in these scenarios but by repeatedly running “
Get-MailboxFolderStatistics -Identity -FolderScope RecoverableItems | ft Identity, ItemsInFolder, FolderAndSubfolderSize ” over and over again you can usually see if there is any progress.yes, frequently checked size, nothing happen at all.
The same has been happening for me, MFCMapi hangs after trying clicking OK when selecting hard delete. Event Viewer immediately reports the application has hung. I suspect some update to M365’s MAPI processing may have broken this functionality, possibly specifically for Recoverable Items.
Just wanted to say same is happening for me as well, just freezes as soon as I click ‘ok’ after hard delete and checking the mailboxfolderstatistics I’m not seeing any changes in the numbers, have left it for a few hours just in case but seems proper frozen.
What about if I have retention policy for 1 year (only retain mode).
I want to delete only these messages older than one year from Discovery Holds?
Haven’t tried that but based on how retention work my guess would be that it works as expected.
I’ve been using this guide for a while, sometimes I’ve waiting a few days and something just starts kicking it off, today I’ve found something that seems to have kicked the process in.
Check in complainace.microsoft.com to see if you have any settings in Data lifecycle management, I found a retention policy that was set to keep data in exchange for 3 years, by excluding the mailbox in this setting MFCMAPI has started to remove the items.
I hope this helps anyone with the same issue
I believe I have tracked down my issue to (2) InPlaceHolds being the issue as to why MFCMAPI won’t delete files. I can’t find anywhere online that says how long does it take for the user mailbox to be excluded from the Retention Policies? I feel like certain portals say up to 4 hours and others say wait 24 hours!
The weird issue with this user is she can’t edit her Calendar items and I believe it is due to her old Litigation folders in the background exceeding 100GB.
Identity ItemsInFolder FolderAndSubfolderSize
——– ————- ———————-
mcollins\Recoverable Items 0 99.81 GB (107,170,040,668 bytes)
mcollins\Audits 5740 27.86 MB (29,214,345 bytes)
mcollins\Calendar Logging 0 0 B (0 bytes)
mcollins\Deletions 0 0 B (0 bytes)
mcollins\DiscoveryHolds 10 573.8 KB (587,535 bytes)
mcollins\Purges 13873 80.32 GB (86,240,579,414 bytes)
mcollins\SubstrateHolds 2326 252.6 MB (264,862,375 bytes)
mcollins\Versions 8541 19.22 GB (20,634,796,999 bytes)
This is where I’m at hurdle-wise. I have excluded the user mailbox from these to retention policies (I believe anyway!) and I’m still stuck. Help if you can please! I’ve been at this for 2 days now.
LitigationHoldEnabled : False
InPlaceHolds : {-mbx7e36da76278a42f793c1eeb0c614196a, -mbxb0d8e7e47eb94b92ac3951275be341f2}
Did you ever get this sorted out Kirk?
This worked great and even Microsoft support didn’t have this as an option to resolve the issue (they wanted to delete the mailbox as next steps).
Please note that I didn’t see the recoverable items folder but found in this video some settings that fixed this issue.
https://www.youtube.com/watch?v=CVvXGfGxml8 (see notes for option settings)
Hi,
as others seeking help with deleting items in the Recoverable Items folder, I came across this article, and I appreciate all the very useful information.
However, I can’t see the “Recoverable Items” folder when expanding the IPM_SUBTREE.
I see all the usual folders but none of the “hidden” folders.
What am I doing wrong?
It’s possible that you havent created a test outlook profile that is set to not be in cached mode?
Also I found that if the user has their outlook open at the same time as MFCMapi then you will not see all the folders.
Once the items are moved to Purge folder what would be the next step?
Can I empty the purge folder or the items delete by themselves after some time? (All recommended commands here ran, no holds whatsoever)
For anyone who is trying this and regularly running ManagedFolderAssistant I put together this code to run, loop and output when it’s finished:
$mfaruntime=get-date
write-host -NoNewline “Running MFA $mfaruntime ”
Start-ManagedFolderAssistant -Identity
do {
start-sleep -Seconds 2
write-host “.” -NoNewline
$log=Export-MailboxDiagnosticLogs -Identity abradley@urbanest.co.uk -ExtendedProperties
$xml = [xml]($Log.MailboxLog)
$xmllastsuccesstime=[datetime]::ParseExact(($xml.Properties.MailboxTable.Property | ?{ $_.Name -eq “ELCLastSuccessTimestamp” } | % Value),’M/d/yyyy h:mm:ss tt’, $null)
} until ($xmllastsuccesstime -gt $mfaruntime)
write-host “#”
$xml.Properties.MailboxTable.Property | ? {$_.Name -in (“ElcLastRunTotalProcessingTime”,”ELCLastSuccessTimestamp”)}| ft -AutoSize
Get-MailboxFolderStatistics -Identity “$ExchangeGUID” -IncludeAnalysis -FolderScope RecoverableItems | Format-Table Name,ItemsInFolder,FolderSize,*Subject*
Followed the instructions but now all the emails got moved from the “DiscoveryHolds” folder into the “Purges” folder
Do you know how long the wait time before running the below command again?
Start-ManagedFolderAssistant -Identity
24hrs?
same issue here. Have you managed to solve the problem?
Hi there, I followed the step and probably didn’t leave enough time for the item retention and single items recovery settings to fully applied. Therefore I ran the command Start-ManagedFolderAssistant -Identity. However now I can see increase in the DiscoveryHolds. It is now 100GB. Would you know how I can resolve this?
I have a users mailbox that has 104.7GB in the Recoverable items folder that I’ve been trying to delete as they can no longer delete items from their primary mailbox. I’ve followed the steps in the above article and the items in the article linked below but I get an error in the MAPI program every time I try to run it. I am using my outlook in online mode not cached mode currently and I checked that the user was removed form all of the retention policies in our organization.
Has anyone else run across an error like this one?
The error code is: Warning:
Code: MAPI_W_PARTIAL_COMPLETION == 0x00040680
Function lpMAPIFolderToEmpty->EmptyFolder( lpProgress ? reinterpret_cast(m_hWnd) : NULL, lpProgress, ulFlags)
File D:\a\1\s\UI\Dialogs\HierarchyTable\MsgStoreDlg.cpp
Line 717
https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-delete-items-in-the-recoverable-items-folder-of-mailboxes-on-hold?view=o365-worldwide#step-3-remove-all-holds-from-the-mailbox
Same for me
Warning:
Code: MAPI_W_PARTIAL_COMPLETION == 0x00040680
Function lpMAPIFolderToEmpty->EmptyFolder( lpProgress ? reinterpret_cast(m_hWnd) : NULL, lpProgress, ulFlags)
File D:\a\1\s\UI\Dialogs\HierarchyTable\MsgStoreDlg.cpp
Line 717
It goes not responding for a couple of hours, resource monitor shows very little activity then the above
I am having this same issue. All holds are gone, can move data between DiscoveryHolds and Purges but can’t empty Purges. Days of research at this point, tried the single recovery disable, retain for 0 days, running MFA many times, looping, running new-compliancesearchactions, running search-mailbox against the dumpster, monitoring mailbox and folder statistics, MFCMAPI, waiting for various things to take effect… oy!
I recently got a chance to experience this issue again. Happy days. I also struggled with the emptying the purges folder. I think changing the following setting finally did the trick:
Set-Mailbox -Identity -ElcProcessingDisabled $false I’m not sure if I ended up setting it to true or false but it’s probably worth trying both. Hope this helps!
I had the Issue, that deleting the DiscoveryHolds Folder with:
Right-click “DiscoveryHolds” and select “Advanced” -> “Empty items and subfolders from folder…”
Check the “Hard Deletion” box and click “OK”.
Moved the Files to the Purge Folder. After Executing the command:
Set-Mailbox -Identity -ElcProcessingDisabled $false
Start-ManagedFolderAssistant -Identity
It moved the Files back from Purges to DiscoverHolds folder… which had me Stuck for Quite a while…
i came to the Solution to enter the DiscoveryHolds folder via MFCMAPI with a double click. After a while the Program startet to show me the Mails in this Folder. I then startet deleting those Mails manually with Hard Deletion.
This time the Mails got Deleted as inteded and i finally had Space over to clean up the Original Mailbox.
Very senior executive didn’t ever delete anything until the person ran out of storage and then I couldn’t flush out the Purges folder. Thank you so much for this. I spent the entire day yesterday following Microsofts documentation using the New-ComplianceSearchAction. It was driving me bonkers