You know by now that I write extensively about Symantec Enterprise Vault, and if you want to stay up to date with the latest posts on that topic email subscription is the best way to do so.
Subscribe for updates:
A question which was asked on the Symantec Connect Forums a few weeks ago has come back in to my mind in the last few days. I’ve been working a little bit with a product of QUADROtechs’ called FSA Migrator. I needed to do some deeper work on placeholders.
Exchange server journaling, and having those items journal archived by Enterprise Vault is something that many organisations have implemented, both in Europe, the US and the rest of the world. A question which is sometimes asked though is whether items marked as private (or sensitive) are journaled.
The Enterprise Vault System Status might sometimes show entries like this relating to backups (or lack of them):
How does Enterprise Vault get this information?
Sometimes when data has been archived and then restored, and it is to be re-archived you might encounter an issue where the items won’t re-archive. Let’s see why that might be:
When Enterprise Vault restore an item, it marks some additional MAPI attributes on each item:
When archiving happens again, these items won’t be eligible because they are marked with these attributes. The attributes can be ignored, and there are actually three choices:
HKLM\Software\KVS\Enterprise Vault\Agents
[DWORD] IgnoreEVDates
0 = Off
1 = Ignore Archived date
2 = Ignore Restored date
3 = Ignore both Archived and Restored date
More information in this Connect Forum post: https://www-secure.symantec.com/connect/forums/restored-mail-not-archive-after-re-enable-mailbox#comment-1437041
Perhaps a lesser known feature of Enterprise Vault is an option that can be added to the WEBAPP.INI file to allow users to do ‘basket restores’ to a PST file. If you’ve never tried it then it is something that can be given a quick run through in a lab.
There is, however, a little gotcha that I came across the other day.