Forum Discussion

Phil_McDougal's avatar
Phil_McDougal
Level 5
18 years ago

BCC'd email question

Hello all.

We're trying to figure out how we can see who the recipients of a BCC'd email are by using the Vault.

For instance, if you search for 'ACME_Corp' as the sender, several emails come up but none of them show the email address it was sent to.  The Vault has this information in it somewhere doens't it?  I'm concerned about how we can see where an email went if someone sent data out and BCC'd the recipients.

Thank you!
PM.

Message Edited by Phil McDougal on 07-17-200711:22 AM

Enterprise Vault
Information Governance

6 Replies

Sort By
  • Phil_McDougal's avatar
    Phil_McDougal
    Level 5
    18 years ago
    Hey all, this is a response from Symantec.  Can someone please verify that this is true or not? I need to know if someone internally sends out data to a list of BCC email addys, will I be able to search and find out who the recipients were (without going through the user's mailbox).  OR I need to be able to see the email addresses of internal users who are getting BCC'd from an outside address.

    Phil,

    >Is there a way that you can search on an archived message but get a list of all recipients, including undisclosed ?

    No, not through any application at the moment.

     

    According to MS, On Exchange 2003, BCC recipients become Undisclosed Recipients and are not displayed as BCC recipients in the header of the attached message. This is by design due to legal requirements. It wasn't like that with Exchange 2000, Microsoft has modified the design of BCC recipient in Exchange 2003. So we can't keep in the archives information not kept into Exchange.

     

    This has changed with Support of Exchange 2007, BCC recipients are able to be searched on using the BCC field. Also we do not discard the envelope, we now store this as part of the dvs, although at this stage we do not leverage this in any way.


    Thank you!
    PM.

  • Phil_McDougal's avatar
    Phil_McDougal
    Level 5
    18 years ago
    Well, I just confirmed that our exchange systems are using "Envelope Journaling" so I think I'm all good on the exchnage side but I still don't see any of the Envelope Journal reports associated with the messages.  Weird thing is I see the expanded Distribition List in the Failed to Store directory.  Any thoughts?

    Thank you!
    PM.

  • TonySterling's avatar
    TonySterling
    Moderator
    18 years ago
    Phil,
    If the folder Failed to Expand DL?   If yes check the permissions on the DL to make sure the Vault Service account has permissions to expand it.
  • Phil_McDougal's avatar
    Phil_McDougal
    Level 5
    18 years ago
    Hi Tony,

    There is a folder called Failed to Expand DL but there are only 2 messages in it and the vault service account has access to the distribuition list in both.  I get about 25,000 messages a day and I currently have about 50,000 in Failed to Store folder.

    Symantec is working on it but I'm afraid I'm losing the ability to search on these messages and giving compliancy a grabber ...

    Thank you for your help.
    Phil.

  • Phil_McDougal's avatar
    Phil_McDougal
    Level 5
    18 years ago
    Does anyone know how you view the Envelope Journal Report?  OR can tell me is it's possible to use EV or CA to search the vault for messages with a BCC'd DL?

    Support is telling me that I need to have BCC Journaling on and NOT envelope journaling if I want to search by BCC addresses or DLs.  Can anyone verify that for me?
  • Phil_McDougal's avatar
    Phil_McDougal
    Level 5
    18 years ago
    Hey all, I have an update from Symantec.  I'm actually pretty surprised that there aren't more discussions about this since it seems pretty darn important for compliancy purposes.  I'd like to know what form of Journaling others are running.

    Here's the clip from Support...

    Hello, I am contacting you regarding this open case.  Here is information from our backline regarding BCC journaling vs envelope journaling.

     
    In all of my lab tests, the BCC recipient list is available to search as TO: when using JournalBCC registry key and envelope journaling is off.  My tests are conducted with Compliance and Discovery searches.  CA and DA treat TO; CC: and BCC: as 'TO:' when searching.
     
    Envelope on the other hand, will capture the BCC as Undisclosed recipients and are not searchable as normal TO recipients in Search.asp.  They are not searchable in CA DA under any circumstance that I am currently aware of. 

     

    You had also asked for further questions be answered:

     
    Using BCC Journaling: If the CEO gets an email from person (internal (using the GAL)) sending out client info to a Distribution List that is sent on the BCC line, when compliance searches the mail of the CEO, they will see the recipients in the body of the message?

    1) Yes
     

    Using BCC Journaling: If the CEO gets an email from person (external) sending out client info to a Distribution List that is sent on the BCC line, when compliance searches the mail of the CEO, they will see the DL but will NOT see the recipients in the body of the message because it was an externally created DL.  Correct?


    2) When they send to an external distribution list, the local exchange server does not know it is a distribution list and will treat it as a regular email address, thus he will only be able to search on the DL and not the people within the DL regardless if it is TO FROM or BCC.

    Please let me know if you have any further questions regarding this case "How does EV handle BCC'd messages?"


    Thanks,
    PM.