You know by now that I write extensively about Symantec Enterprise Vault, and if you want to stay up to date with the latest posts on that topic email subscription is the best way to do so.
Subscribe for updates:
Exchange server journaling, and having those items journal archived by Enterprise Vault is something that many organisations have implemented, both in Europe, the US and the rest of the world. A question which is sometimes asked though is whether items marked as private (or sensitive) are journaled.
The Enterprise Vault System Status might sometimes show entries like this relating to backups (or lack of them):
How does Enterprise Vault get this information?
Sometimes when data has been archived and then restored, and it is to be re-archived you might encounter an issue where the items won’t re-archive. Let’s see why that might be:
When Enterprise Vault restore an item, it marks some additional MAPI attributes on each item:
When archiving happens again, these items won’t be eligible because they are marked with these attributes. The attributes can be ignored, and there are actually three choices:
HKLM\Software\KVS\Enterprise Vault\Agents
[DWORD] IgnoreEVDates
0 = Off
1 = Ignore Archived date
2 = Ignore Restored date
3 = Ignore both Archived and Restored date
More information in this Connect Forum post: https://www-secure.symantec.com/connect/forums/restored-mail-not-archive-after-re-enable-mailbox#comment-1437041
Perhaps a lesser known feature of Enterprise Vault is an option that can be added to the WEBAPP.INI file to allow users to do ‘basket restores’ to a PST file. If you’ve never tried it then it is something that can be given a quick run through in a lab.
There is, however, a little gotcha that I came across the other day.
One of the questions which is frequently asked on the forums after a new Exchange Server update is whether or not Enterprise Vault will work with it, and whether it will be supported. For the most part in the past, roll-ups or cumulative updates weren’t specifically tested and called out individually. Customers could contact Support, and if an issue was found, it would be worked on and (hopefully) fixed.