We help IT Professionals succeed at work.

Trouble running mailbox search Exchange 2016

When trying to run a mailbox search from ECP or command shell we get the same errors, copied below.  Any idea on what direction to troubleshoot this?

[PS] C:\Windows\system32>New-MailboxSearch

cmdlet New-MailboxSearch at command pipeline position 1
Supply values for the following parameters:
Name: Domain User
The request failed. The underlying connection was closed: An unexpected error occurred on a receive.
    + CategoryInfo          : NotSpecified: (:) [], DataSourceOperationException
    + FullyQualifiedErrorId : [Server=SERVERNAME,RequestId=fda72f95-c890-40d6-8840-de18d3d4e826,TimeStamp=12/19/2017
   5:27:53 PM] [FailureCategory=Cmdlet-DataSourceOperationException] 6C09AFD7
    + PSComputerName        : server.domain.com

[PS] C:\Windows\system32>get-mailboxsearch
The request failed. The underlying connection was closed: An unexpected error occurred on a receive.
    + CategoryInfo          : NotSpecified: (:) [Get-MailboxSearch], DataSourceOperationException
    + FullyQualifiedErrorId : [Server=SERVERNAME,,RequestId=fda72f95-c890-40d6-8840-de18d3d4e826,TimeStamp=12/19/2017
   6:01:18 PM] [FailureCategory=Cmdlet-DataSourceOperationException] 25D67BC1,Microsoft.Exchange.Management.Tasks.Get
  MailboxSearch
    + PSComputerName        : server.domain.com

[PS] C:\Windows\system32>$error[0] | fl -force

writeErrorStream      : True
OriginInfo            : server.domain.com
Exception             : System.Management.Automation.RemoteException: The request failed. The underlying connection
                        was closed: An unexpected error occurred on a receive.
TargetObject          :
CategoryInfo          : NotSpecified: (:) [Get-MailboxSearch], DataSourceOperationException
FullyQualifiedErrorId : [Server=SERVERNAME,,RequestId=5d522559-98e6-4836-9e6e-755633fdb089,TimeStamp=12/19/2017
                        6:04:26 PM] [FailureCategory=Cmdlet-DataSourceOperationException]
                        25D67BC1,Microsoft.Exchange.Management.Tasks.GetMailboxSearch
ErrorDetails          :
InvocationInfo        :
ScriptStackTrace      : at <ScriptBlock><Process>, <No file>: line 41
PipelineIterationInfo : {}
PSMessageDetails      :
Comment
Watch Question

Is this error specific to this CMD only ?? are you able to run any other CMD on the shell?

have you tried to connect to any other shell host (CAS sever)??

Author

Commented:
This is only on this specific command.  All other commands work fine.  Its an on premises Exchange 2016 server with 300 mailboxes running CU6.
Todd NelsonSystems Engineer
Top Expert 2016

Commented:
Do you know if the account you are running "New-MailboxSearch" with has been assigned to the "Discovery Management" role group?

References...

Author

Commented:
Yes, the user is a member of the following Exchange Management Groups.  Compliance Management, Discovery Management, Organization Management, Records Management.  The user is also a domain admin account, shema admin, and enterprise admin.
can try if its works when you run it for the specific mailbox, its seems you are just running it without providing any parameter.

New-MailboxSearch -Name "Hold-tailspintoys" -SourceMailboxes DG-Research -SearchQuery "'Patent' AND 'Project tailspintoys'"

https://technet.microsoft.com/en-us/library/dd298064(v=exchg.160).aspx
Same result trying to specify a user.  I get the same issue when trying to use the ECP with a pop up having the same error.  When evoking New-Mailboxsearch, what exactly does it go and talk to.  That seems like what is not working.  Is it using TLS to connect to something possibly.  Just trying to determine what is going on with this command.
try recycling ecp application pool.

did you check if you found anything on the event logs regarding this ??
Found the issue.  TLS 1.0 had been disabled via the registry.  We re-enabled TLS 1.0 and restarted the Exchange server.  Once done, the PowerShell commands will now run.
Seth SimmonsSr. Systems Administrator

Commented:
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Split:
-- JacksonTechnical (https:#a42414683)
-- JacksonTechnical (https:#a42410943)


If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

seth2740
Experts-Exchange Cleanup Volunteer