Exchange Online 中就地电子数据展示的搜索限制Search limits for In-Place eDiscovery in Exchange Online

各种类型的限制均适用于 Exchange Online 和 Office 365 中的就地电子数据展示搜索。这些限制有助于维护提供给 Office 365 组织的服务的运行状况和质量。在大多数情况下,您无法修改这些限制,但您应该了解他们,以便可以在规划、运行电子数据展示搜索以及排除故障时将这些限制考虑在内。Various types of limits are applied to In-Place eDiscovery searches in Exchange Online and Office 365. These limits help to maintain the health and quality of services provided to Office 365 organizations. In most cases, you can't modify these limits, but you should be aware of them so that you can take these limits into consideration when planning, running, and troubleshooting eDiscovery searches.

源邮箱限制Source mailbox limits

就地电子数据展示对可在单个搜索中搜索到的源邮箱数量有限制。下表描述了这些限制,并建议了解决这些问题的替代方法。这些限制适用于使用 Exchange 管理中心 (EAC) 或远程 Windows PowerShell 创建的电子数据展示搜索。In-Place eDiscovery has limits on the number of source mailboxes that can be searched in a single search. The following table describes these limits and suggests alternative ways to work around them. These limits apply to eDiscovery searches created by using the Exchange admin center (EAC) or Remote Windows PowerShell.

限制说明Description of limit 限制Limit 详细信息和建议的解决方法More information and suggested workarounds
可以在单个就地电子数据展示搜索中搜索的最大邮箱数。The maximum number of mailboxes that can be searched in a single In-Place eDiscovery search.
10,00010,000
如果您的组织中有多个 10,000 个邮箱,您将无法使用 EAC 中的邮箱页上的搜索所有邮箱选项。若要搜索大量的邮箱 (最多 10,000 个邮箱总数),可以将用户组织到通讯组或动态通讯组,然后在 EAC 中的邮箱页上指定一组。1If you have more than 10,000 mailboxes in your organization, you won't be able to use the Search all mailboxes option on the Mailboxes page in the EAC. To search large numbers of mailboxes (up to 10,000 mailboxes total), you can organize users into distribution groups or dynamic distribution groups and then specify a group on the Mailboxes page in the EAC. 1
针对此限制的一种解决办法是使用 Office 365 合规中心中的合规性搜索功能,对单个搜索中可以搜索的邮箱数没有限制。在合规中心中运行搜索来搜索组织中的所有邮箱,以确定那些包含搜索结果的邮箱。然后可以使用该邮箱列表作为 EAC 中的就地电子数据展示搜索的源邮箱。有关详细信息,请参阅在电子数据展示工作流中使用合规性搜索One workaround for this limit is to use the Compliance Search feature in the Office 365 Compliance Center, which doesn't have a limit for the number of mailboxes that can be searched in a single search. You run a search in the Compliance Center to search all mailboxes in your organization to identify those that contain search results. Then you can use that list of mailboxes as the source mailboxes for an In-Place eDiscovery search in the EAC. For details, see Use Compliance Search in your eDiscovery workflow.
可以在仍然允许您查看关键字统计信息的单个就地电子数据展示搜索中搜索到的最大邮箱数。The maximum number of mailboxes that can be searched in a single In-Place eDiscovery search that still allows you to view keyword statistics.
100100
运行电子数据展示搜索估计后,您可以查看关键字统计信息。这些统计信息显示有关搜索查询中使用的每个关键字返回的项目数的详细信息。如果搜索中包括 100 个以上的源邮箱,则在试图查看关键字统计信息时会返回一个错误。After you run an eDiscovery search estimate, you can view keyword statistics. These statistics show details about the number of items returned for each keyword used in the search query. If more than 100 source mailboxes are included in the search, an error will be returned if you try to view keyword statistics.
若要查看关键字统计信息,可以将源邮箱的数量减少到 100 或更少,然后重新运行搜索估计。在获得满意的搜索查询后,可以将其他源邮箱添加到搜索,然后复制或导出搜索结果。To view keyword statistics, reduce the number of source mailboxes to 100 or fewer, and then rerun the search estimate. When you're satisfied with the search query, you can add additional source mailboxes to the search and then copy or export the search results.
可以在单个就地电子数据展示搜索中置于就地保留的最大邮箱数。The maximum number of mailboxes that can be placed on In-Place Hold in a single In-Place eDiscovery search.
10,00010,000
通过使用单个电子数据展示搜索,可以将置于就地保留的最多 10,000 个邮箱。但是,如果您选择页上的搜索所有邮箱选项,您将无法启用都搜索 In-place Hold。放置大量上的邮箱的保留使用单个就地保留,使用通讯组或动态通讯组组合在一起,邮箱,然后在 EAC 中的邮箱页上指定其中一个组。1You can place up to 10,000 mailboxes on In-Place Hold by using a single eDiscovery search. However, if you select the Search all mailboxes option on the Sources page, you won't be able to enable an In-Place Hold for that search. To place a large number of mailboxes on hold using a single In-Place Hold, use distribution groups or dynamic distribution groups to group mailboxes together, and then specify one of those groups on the Mailboxes page in the EAC. 1
将大量邮箱置于保留状态的一个更好的选择是使用诉讼保留。不建议使用大量单个就地电子数据展示搜索将邮箱置于保留状态。有关详细信息,请参阅Place all mailboxes on holdA better option for placing a hold on a large number of mailboxes is to use a Litigation Hold. Using lots of single In-Place eDiscovery searches to place mailboxes on hold isn't recommended. For more information, see Place all mailboxes on hold.

备注

1 仅当创建了搜索或保留时计算组成员身份。如果在创建了搜索之后,将某个用户添加到组,则该用户的邮箱将不会自动添加为源邮箱。您必须编辑搜索并添加邮箱。如果将用户从用于创建搜索或保留的组中删除,这一点也同样适用。您必须编辑搜索并删除邮箱。1 Group membership is calculated only when the search or a hold is created. If a user gets added to the group after the search is created, the user's mailbox won't be added automatically as a source mailbox. You'll have to edit the search and add the mailbox. The same thing applies when a user is removed from a group that is used to create a search or hold. You'll have to edit the search to remove the mailbox.

Exchange 管理中心 限制Exchange admin center limits

当您使用 EAC 创建并运行就地电子数据展示搜索时,也存在一些限制。这些限制主要与您选择源邮箱进行搜索时在 EAC 中显示的源邮箱数量相关。下表描述了这些限制,并建议了解决这些问题的替代方法。There are also limits when you use the EAC to create and run In-Place eDiscovery searches. These limits are primarily related to the number of source mailboxes that are displayed in the EAC when you select source mailboxes to search. The following table describes these limits and suggests alternative ways to work around them.

限制说明Description of limit 限制Limit 详细信息和建议的解决方法More information and suggested workarounds
显示在邮箱选取器中用于在创建新的就地电子数据展示或就地保留搜索时选择源邮箱的最大邮箱数The maximum number of mailboxes that are displayed in the mailbox picker for selecting source mailboxes when creating a new In-Place eDiscovery or In-Place Hold search.
500500
邮箱选取器中仅列出 500 个邮箱、通讯组和动态通讯组,以在创建新搜索时选择源邮箱。系统将显示一条消息,指出收件人数量多于所显示的收件人。下面是针对此限制的一些解决方法:Only 500 mailboxes, distribution groups, and dynamic distribution groups are listed in the mailbox picker to select source mailboxes from when you create a new search. A message is displayed saying that there are more recipients than the ones displayed. Here are some workarounds for this limit:
使用搜索框找到邮箱选取器中未列出的邮箱。Use the search box to find a mailbox that isn't listed in the mailbox picker.
使用通讯组或动态通讯组将大量邮箱组合在一起。然后从邮箱列表中选取组,或使用搜索框进行搜索。创建电子数据展示搜索时,组将扩展到源邮箱。Use distribution groups or dynamic distribution groups to group large numbers of mailboxes together. Then pick the group from the mailbox list or search for it using the search box. Groups are expanded into source mailboxes when you create an eDiscovery search.
选择搜索所有邮箱邮箱页上如果您的组织具有少于 10,000 个邮箱,并且您不打算将邮箱置于保持状态。Select Search all mailboxes on the Mailbox page if your organization has less than 10,000 mailboxes and you're not going to place mailboxes on hold.
如果您要将超过 500 个邮箱置于就地保留,可使用通讯组或动态通讯组对用户进行分组。Use distribution groups or dynamic distribution groups to group users if you want to place more than 500 mailboxes on In-Place Hold.
编辑就地电子数据展示或就地保留搜索时显示的最大邮箱数。The maximum number of mailboxes that are displayed when editing an In-Place eDiscovery or In-Place Hold search.
3,0003,000
最多 3000 邮箱将显示在页在 EAC 中编辑就地电子数据展示搜索或保留时。将邮箱添加到源的列表,可以使用搜索框查找 (最多 500 个收件人的邮箱选取器中列出) 邮箱选取器中未列出的邮箱。若要删除的列出邮箱,可以选择它,然后单击删除。若要删除邮箱的未列出,您必须使用 Exchange 命令行管理程序删除它。例如,运行以下命令从名为 ContosoHold 就地保留中移除 Ann Beebe 的用户。Up to 3,000 mailboxes are displayed on the Sources page in the EAC when you edit an In-Place eDiscovery search or hold. To add a mailbox to the list of sources, you can use the search box to find a mailbox that isn't listed in the mailbox picker (a maximum of 500 recipients are listed in the mailbox picker). To remove a mailbox that's listed, you can select it and then click Remove. To remove a mailbox that isn't listed, you have to use the Exchange Management Shell to remove it. For example, the following commands are run to remove the user Ann Beebe from an In-Place Hold named ContosoHold.
$SourceMailboxes = Get-MailboxSearch "ContosoHold"
$SourceMailboxes.Sources.Remove("/o=contoso/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=28e3edb87e29422998ec8f3a946dd1e5-annb")
Set-MailboxSearch "ContosoHold" -SourceMailboxes $SourceMailboxes.Sources
第一个命令创建包含的 ContosoHold 属性的变量。第二个命令删除 Ann Beebe 的用户 (通过指定LegacyExchangeDN属性的值) 的源邮箱列表。第三个命令使用更新的源邮箱列表中编辑 ContosoHold。The first command creates a variable that contains the properties of ContosoHold. The second command removes the user Ann Beebe (by specifying the value of the LegacyExchangeDN property) from the list of source mailboxes. The third command edits ContosoHold with the updated list of source mailboxes.
若要将用户添加到就地保留,请使用上述示例中第二个命令中的以下语法。To add a user to an In-Place Hold, use the following syntax in the second command in the previous example.
$SourceMailboxes.Sources.Add("<LegacyExchangeDN of the user>")
注意: 就地电子数据展示搜索或就地保留的属性由其LegacyExchangeDN属性标识的源邮箱。因为此属性用于唯一标识用户邮箱,使用属性有助于防止添加或删除错误的邮箱。这还有助于避免出现问题,如果两个邮箱具有相同的别名或主 SMTP 地址。Note: The Sources property of an In-Place eDiscovery search or an In-Place Hold identifies the source mailboxes by their LegacyExchangeDN property. Because this property uniquely identifies a user mailbox, using the Sources property helps prevent adding or removing the wrong mailbox. This also helps to avoid issues if two mailboxes have the same alias or primary SMTP address.

其他限制Other limits

下表描述了影响就地电子数据展示搜索的其他限制。The following table describes other limits that affect In-Place eDiscovery searches.

限制说明Description of limit 限制Limit 详细信息More information
可以同时在组织中运行的就地电子数据展示搜索的最大数量。The maximum number of In-Place eDiscovery searches that can run at the same time in your organization.
2 2
如果在仍在运行前两个搜索时启动电子数据展示搜索,第三个搜索不会排队,而将会失败。您必须等到正在运行的搜索中有一个完成,然后才能成功启动一个新搜索。If an eDiscovery search is started while two previous searches are still running, the third search won't be queued and will instead fail. You have to wait until one of the running searches is completed before you can successfully start a new search.
此外,仅执行估计的搜索和副本搜索都被视为就地电子数据展示搜索。因此,如果您同时运行仅执行估计的搜索和副本搜索,将无法开始其他搜索,直到完成其中一个运行中的搜索。但是,您可以在两个搜索同时运行时,预览或导出另一个搜索的搜索结果。Also, estimate-only and copy searches are both considered In-Place eDiscovery searches. So, if you are running an estimate-only search and a copy search at the same time, you can't start another search until one of the running searches is completed. However, you can preview or export the search results from another search while two searches are running.
可以在单个就地电子数据展示搜索查询中指定的最大关键字数。The maximum number of keywords that can be specified in a single In-Place eDiscovery search query.
500500
布尔运算符,如AND不计的关键字的总数。例如,以下关键字查询cat AND dog AND bird AND fish包括四个关键字。Boolean operators, such as AND and OR aren't counted against the total number of keywords. For example, the keyword query cat AND dog AND bird AND fish consists of four keywords.
预览就地电子数据展示搜索结果时,在搜索预览页面上显示的最大项目数。The maximum number of items displayed on the search preview page when previewing In-Place eDiscovery search results.
200200
您在预览搜索结果时,搜索到的邮箱均在电子数据展示搜索预览页上的右窗格中列出。对于每个邮箱,系统还会显示所返回的项目数量以及这些项目的总大小。由搜索返回的项目均在右窗格中列出。预览页面上最多显示 200 个项目。 When you preview search results, the mailboxes that were searched are listed in the right pane on the eDiscovery search preview page. For each mailbox, the number of items returned and the total size of these items are also displayed. Items returned by the search are listed in the right pane. Up to 200 items are displayed on the preview page.
注意: 通过单击左侧窗格中的邮箱,不能在右侧窗格中显示从每个邮箱的项。若要查看特定邮箱中返回的项,可以复制搜索结果,并查看发现邮箱中的项目。Note: Items from each mailbox can't be displayed in the right pane by clicking a mailbox in the left pane. To view the items returned from a specific mailbox, you can copy the search results and view the items in the discovery mailbox.
在单个邮箱上设置的就地保留中可以指定的关键字最大数量。The maximum number of keywords that can be specified in all In-Place Holds placed on a single mailbox.
500500
如果多个就地保留被放置在用户的邮箱,所有搜索查询中的关键字的最大数量为 500。这是因为 Exchange Online 结合使用OR运算符关键字搜索的所有参数从所有就地保留。如果有多于 500 个关键字中的保留查询,然后所有内容的邮箱中将置于保持状态 (和而不仅仅是符合搜索任何的条件基于查询的保留该内容)。所有内容将都保存直到中所有就地保留的关键字总数是为 500 降低或更少。保留所有邮箱内容是在功能上类似于诉讼保留。If multiple In-Place Holds are placed on a user's mailbox, the maximum number of keywords in all search queries is 500. That's because Exchange Online combines all the keyword search parameters from of all In-Place Holds by using the OR operator. If there are more than 500 keywords in the hold queries, then all content in the mailbox is placed on hold (and not just that content that matches the search criteria of any query-based hold). All content is held until the total number of keywords in all In-Place Holds is reduced to 500 or less. Holding all mailbox content is similar in functionality to a Litigation Hold.
变体时使用的前缀通配符搜索精确短语关键字搜索查询中或使用前缀通配符和NEAR运算符时返回的最大数量。Maximum number of variants returned when using a prefix wildcard to search for an exact phrase in a keyword search query or when using a prefix wildcard and the NEAR operator.
10,00010,000
对于非短语查询,我们将使用一个特殊的前缀索引。这只会告诉我们某个单词出现在文档中,而不会告诉我们它在文档中出现的位置。要执行短语查询,我们需要比较短语中的单词在文档中的位置。这意味着我们不能使用短语查询的前缀索引。在这种情况下,我们使用前缀可以扩展到的所有可能的单词在内部扩展查询(即"time*"可以扩展为"time OR timer OR times OR timex OR timeboxed OR …")。10000 是指单词可以扩展到的变体最大数量,而不是与查询匹配的文档数量。非短语搜索词没有上限。For non-phrase queries we use a special prefix index. This only tells us that a word occurs in a document, not where in the document it occurs. To do a phrase query we need to compare the position within the document for the words in the phrase. This means that we cannot use the prefix index for phrase queries. In this case we are internally expanding the query with all possible words that the prefix expands to (i.e. "time*" can expand to "time OR timer OR times OR timex OR timeboxed OR …"). 10,000 is the maximum number of variants the word can expand to, not the number of documents matching the query. For non-phrase terms there are no upper limit.