Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Archiving and eDiscovery Community Blog
Showing posts in English
Rob.Wilcox | 11 Jul 2011 | 0 comments

Enterprise Vault Policy Manager (EVPM) is a powerful tool that can be used for a variety of purposes.  Many people who have supported Enterprise Vault might have used it, even it was just for “zapping” a mailbox that had a problem with it!  However, EVPM can do much much more than that.

One of the common usage scenarios for EVPM is to use it to setup particular folders in a mailbox and apply specific archiving policy to them.  Normally to top it off, people then make that folder non-deletable, again with EVPM.

Here is a simple script which will create a folder called 5Year in every users mailbox:

DirectoryComputerName = EV1
SiteName = EVSite

Name = FilterA
CreateShortcut = true
DeleteOriginal = true
UnreadMail = true
UseInactivityPeriod = true
InactivityUnits = days
InactivityPeriod = 3


Rob.Wilcox | 10 Jul 2011 | 0 comments

One of the things that is asked for quite frequently, at least it has been in the past, is that end-users want to be able to do Enterprise Vault operations from Search Folders.  I use Search Folders with Outlook 2010 quite frequently for things like “Mails from the Team”, and “Escalations Requested” that sort of thing.  It used to frustrate me that I couldn’t manually archive an item, or restore an archived item.

With the Enterprise Vault Outlook Addin 9.0.1 or higher you *can* do these operations against Outlook 2010.

Unfortunately you can’t with Outlook 2007 or lower.

Rob.Wilcox | 08 Jul 2011 | 0 comments

There aren’t many customers, it seems, that impose limits on the size of users archives.  Some do, for sure, but not that many really.  I guess people use it for billing and capacity reasons.  An issue was unearthed recently in Enterprise Vault 9.0.2 where users who approached/exceeded their quota limit would get “hundreds” of emails informing them of this.  The idea, of course, is to send the user *one* email and keep track of when it was last sent to them, so as not to overload them with reminders. 

This was broken though with Enterprise Vault 9.0.2

It is now fixed, and the binaries are available for download from the following link:

Rob.Wilcox | 08 Jul 2011 | 0 comments

An issue I worked on several months ago resurfaced the other day, when I saw the following technote :

Essentially if you use Outlook 2007 on the Enterprise Vault server then you might see a “build up” of entries in the registry under HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Catalog.

We’ve a couple of issues opened internally, in discussion stages at the moment, to try to clear out this registry key automatically, for deployment scanner to detect it, etc, etc.  In the meantime you might want to add it to your weekly task list .. clear out that key.

Rob.Wilcox | 07 Jul 2011 | 0 comments

Released yesterday by Microsoft, and talked about in detail here, is Exchange 2007 SP 3 Rollup 4.

As normal, our QA / Certification teams won’t be officially certifying against this new release (some testing and general use will take place).  That doesn’t mean that it isn’t supported .. if you install it, always go the lab-route first of all, and if you encounter any problems let us know.

Reference :

Rob.Wilcox | 07 Jul 2011 | 2 comments

For those people that use virtual machines, and copy them, or do full clones of them… this is either something that is interesting, or something you already love to hate.

Yesterday I worked with a colleague (Hello Mr Kitt) to resolve an issue where he couldn’t install Enterprise Vault.  The issue went all the way back to cloning of a Windows 2008 R2 x64 machine.

Using the Sysinternals tool PSGetSID, we eventually saw :




After cloning this virtual machine, we saw :




Yes, they’re the same.

I’ve been...

Rob.Wilcox | 05 Jul 2011 | 29 comments

A question arose the other day, which is worthwhile covering here.  The question is :

When using Outlook 2007 or Outlook 2010 Instant Search, with Virtual Vault enabled, what is meant to be searched?

To answer this you need to consider what you are truly looking at within Outlook when you have Virtual Vault enabled.  Virtual Vault for all intents and purposes is the MDC file, one file.. with “stub” information in it of all the items in your archive.  Even if you have no vault cache content stored locally, or if you have size limitations, or date limitations, the MDC, the metadata, is always the complete set.  It contains things like dates, times, subject, recipients, and most importantly the first 120 characters of the message.

When you search with Outlook Instant you have the following options (From Outlook 2010) :

All mail items

All Outlook Items

All Subfolders

Current Folder


Rob.Wilcox | 05 Jul 2011 | 0 comments

There is almost always something that I forget to do when I set up a new Enterprise Vault server.  You would think I would have a nice checklist to follow, but I don’t.  I never got around to creating one .. yet.  I was struck down by this again the other day.  I setup a new server, all was working well, and after testing archiving and retrieving of a few items I loaded up the mailbox with 10,000 items, and archived them all.

Next I enabled Vault Cache, but I just could NOT get the thing to synchronise any content at all

In the end, after much troubleshooting I discovered the cause.  I had not set a cache location on the server properties :

Useful to know..  difficult to track down !  This is what the client sees :

The Header / MDC synchronisation completes...

Rob.Wilcox | 05 Jul 2011 | 0 comments

Another interesting bit of SQL jiggery pokery that I found the other day was the method to move Vault Store Partition data from one location to another on the same Enterprise Vault server.  This would be useful, if for example, you had started to run out of space on a LUN, and had a “bigger” LUN to put all the partition data on.

The following is the article that I found which describes the procedure :

Rob.Wilcox | 05 Jul 2011 | 0 comments

A question which came up today on the Symantec Connect Forums is whether Vault Cache/Virtual Vault data is secure.  The answer is that by default it’s not.  If a machine containing Vault Cache data were to be used by someone else, then the files which make up Vault Cache/Virtual can be opened by a regular Outlook client.  They’re not particularly “nice” to navigate, but just like Outlook PST files they are not encrypted.  The files we are talking about :-


This is the metadata cache file.  There will be one per archive that the end user is synching.

Example file name :


Even if there is only MDC file there will usually be more than one .DB file.  These form the Content Cache.

Example file name : 2007_01_03_0041.db

By default these file reside in the user profile area,...