Video Screencast Help

Archiving and eDiscovery Community Blog

Showing posts in English
Rob.Wilcox | 08 Mar 2011 | 0 comments

 

I spotted the following Outlook registry key lurking on the internet the other day :

To force Unicode or ANSI PSTs, navigate to

HKEY_CURRENT_USER\Software\Microsoft\Office\N.0\Outlook.

Add the NewPSTFormat value with one of the following values:

  • Prefer Unicode PST: 0 (default)
  • Prefer ANSI PST: 1
  • Enforce Unicode PST: 2
  • Enforce ANSI PST: 3
    N = your version of Outlook, 11 = Outlook 2003, 12 = Outlook 2007, 14 = Outlook 2010

It’s a messy one!  If you have the key set to 3, you get NO Vault Cache whatsoever.  No content, no metadata, nothing.  I’ve not tried all the other options, but it’s for sure something to check, if you’re not getting any Vault Cache created.  I also didn’t see any error messages anywhere!

If anyone finds, or knows of any other "killer" Outlook registry keys, I'd be happy to hear about.

Rob.Wilcox | 07 Mar 2011 | 2 comments

One of the questions I get asked about most often comes up because the Enterprise Vault Outlook Add-in has been affected by RPC/HTTP restrictions defined in the Desktop Policy.  If you take a look at the Desktop Policy you will see the following :

 

The “issue” is the setting “RPC over HTTP restrictions” and the fact that the default behaviour, when this is in use, is to disable the whole of the Outlook Add-in entirely.  Not good for an end-user!

The question is ..  How does the Addin “know” that RPC/HTTP is enabled?

The answer is that it doesn’t.  There isn’t an Outlook Object Model or Outlook API (that we know of!) that can tell us HOW Outlook is currently connected.  We can find out whether the connection is online, cached, disconnected, working offline, in drizzle mode and so on, but not...

Rob.Wilcox | 07 Mar 2011 | 1 comment

 

On the properties of an Enterprise Vault server, you can see the location of the “cache” folder.  The cache location is used for a handful of things include :-

* A location for temporarily storing vault cache content files

* Pass-Through recalls

My question though is where do people put this location when Enterprise Vault is installed on a cluster?  My take on it is that it should be installed on a shared volume/drive, but there is nothing (currently) that stops you putting it on a local drive (only the online help warns you that it might be a good thing).

So shared disk on a cluster, or local?

Rob.Wilcox | 04 Mar 2011 | 3 comments

 

One of the things that Enterprise Vault Outlook Addin does on startup is work out version of Outlook you have installed.  This is done by looking in the following registry key:

HKEY_CLASSES_ROOT\Outlook.Application\CurVer

If there are problems accessing that registry key, permissions etc, or the key is just plain wrong, then the Outlook Addin will likely give you an error, and not work.

Rob.Wilcox | 04 Mar 2011 | 1 comment

 

I am currently looking at an issue where the Enterprise Vault converters take a high percentage of CPU.  On my run of the mill reproduction box, which is a single processor VMWare image, EVConverterSandbox runs at 100% CPU, when I observe it in :

* Task Manager

* Performance Monitor

Now here is the interesting thing.  On a dual processor machine, it is different :

In Task Manager I see 50% CPU for EVConverterSandbox

In Perfmon I see 100% CPU for EVConverterSandbox.

Pushing this out further, on a 4x4 server (4 quad core processors), the maximum for any process is just 6.25% CPU.  Something to watch out for, especially when you’re browsing for “high” CPU usage processes…

I’m not sure this is common across all machines, or just my virtual machines – but it’s definitely something to watch out for !

KarlW | 25 Feb 2011 | 1 comment

So I just took a look at mailbox auditing in Exchange Server 2010, that reminded me of another question I was asked internally based on litigation hold and couldn't find it documented anywhere.  For those who aren't sure what this is a quick trip to TechNet (http://technet.microsoft.com/en-us/library/ee861123.aspx) should clear things up.

 

So you've read that and understand the difference between Deletions, Purges and Versions.  So you pop a user on litigation hold using the following command:

 

Set-Mailbox -Identity "Karl Woodrow" -LitigationHoldEnabled $true

 

Litigation hold command

 

The problem is that now EV is running and archiving from the mailbox the Discovery search is littered with Deletes and Versions caused...

KarlW | 25 Feb 2011 | 0 comments

A while back I saw a question asking if Enterprise Vault (EV) could archive audit information for an Exchange 2010 mailbox.  It was a feature I wasn't too familiar with but knowing the Audit folder was located under the Recoverable Items folder I could safely answer no.  However I wanted to know more about the feature and what impact EV would have - and I've finally had time to take a look into it.

 

Mailbox Audit Logging is a feature that can record User actions on a user mailbox.  When enabling auditing you can validate specific actions that should be logged and what logon type.  Actions can be audited for Administrators, Delegates and the owner of the mailbox (by default when auditing is enabled no Owner actions are captured).  Obviously 'Administrators' stood out for me and I wondered what this meant for EV.

 

Let's take a walk through auditing a mailbox enabled for Archiving in EV.

...

Rob.Wilcox | 22 Feb 2011 | 0 comments

 

I have encountered this in passing on our internal forums a few times… the issue being that “randomly” when users log in to Outlook they are missing all buttons, as though they aren’t enabled, and never have been.

One possible cause of this is that during the archiving process we synchronise the mailboxes, one of the things that that entails is that the current hidden message in the mailbox, containing desktop/archiving settings is deleted, and a new one created.  The issue is that if the user has peeked over their Exchange mailbox send/receive limit, we can do the delete, but we can’t add the new settings..  Effectively disabling them.

The client trace usually looks something like this :

22/02/2011 20:20:24.700[1520]: Log file created (level 1).

22/02/2011 20:20:24.700[1520]: RPC over HTTP is not enabled (flags = 0)

22/02/2011 20:20:24.717[1520]: LoadSettingsFromHiddenMessage com_error:...

Rob.Wilcox | 22 Feb 2011 | 0 comments

 

Enterprise Vault’s Outlook Addin has the ability to bring up a dialog box called “Vault Information” which can provide valuable troubleshooting information.  To bring up the dialog you do the following :

Outlook 2003 / Outlook 2007

Press control and shift, and click on an EV button on the toolbar.  That brings up this screen:

Clicking on Vault Information then shows you the information:

 

 

Outlook 2010

For Outlook 2010 it’s a little different.

Click on File –> Enterprise Vault

Click on Additional support information

Rob.Wilcox | 21 Feb 2011 | 4 comments

A few weeks ago I was wondering about something to do with Enterprise Vault.  Specifically what happens when a user does this :-

 

I mean, they tick the box, suspending themselves from archiving.

I’ve checked around, and I don’t think there is a way of telling this from the server, because ticking that box adds a filter message to Outlook.

So in theory, lots of users could tick this box, and they’d not get any archiving performed by the Enterprise Vault server.   I guess they’d know, if they were configured with an Exchange mailbox quota..  but if there is no quota in place, then in theory they could go a long time with no archiving happening.

I wonder whether anyone has come across this being ticked when they were troubleshooting why a mailbox wasn’t getting archived?