An account that had it's mailbox archived has been deleted. In the Enterprise Console the account shows up with the Unknown Account & SID. I have tried adding a system account with the permission to get to the vault but each time get a warning window stating Please enter an existing Windows Account Name. This, I assume is because I have left the deleted account SID with permissions, so I try to remove the account permissions and get the error, Account cannot be removed as it has automatically set permissions associated with it.Q. How do I specify a different account with permissions to this users Archive and then remove the old account SID from it?TIA,Paul

Change the Bill to Account for the Archive to something other than what it is, i.e. the Vault service account.Then you will be able to add permissions.

If you set a manual deny permission on the archive for that one user it will override the automatically set grant.

You can remove all auto permissions with an EVPM script but if the mailbox is no longer there then you cannot synchronize any permissions from there so you will have to manually assign permissions to the archive once you have removed them.http://support.veritas.com/docs/280196

HiThanks for the reply. This will certainly do what I require with one caveat, it looks as though this will do it at the vault level, the mbx itself is in a vault with several other user's archived mbx's . Is there any way of stripping out the automatically set permissions at the mailbox level?You have pointed me in the right direction and I have now picked up on the EVPM helpfile on our EV server. In one of the examples below, it shows that you can specify a DN. In short, can I target a single mailbox in a vault containing several and strip only it's permissions?Thanks again,PaulDIRECTORYCOMPUTERNAME = OURSERVERSITENAME = CC_Site1DISTINGUISHEDNAME = /O=ACME/OU=DEVELOPER/CN=RECIPIENTS/CN=SUES;-------------EDIT----------------; 3. Remove existing user permissions on an existing folder;Name = \Existing FolderMailboxDN = /O=ACME/OU=DEVELOPER/CN=RECIPIENTS/CN=SUES;; Remove existing users;ExchangePermissions = -; Tom Sawyer; Mark Twain

Hi Tony, Thanks, this got around what now appears to be a two-part question. I have now successfully added our Service Account with full granted permissions on the target mbx archive.Paul

Have just tested on my system and Tony's suggestion works. Also the technote that I sent will only strip the permissions for one archive even though it specifies vaultname instead of archive name

Deleted Account

17 Replies

TonySterling
Moderator
18 years ago
If you set a manual deny permission on the archive for that one user it will override the automatically set grant.
Paul_Grimshaw
Level 6
18 years ago
You can remove all auto permissions with an EVPM script but if the mailbox is no longer there then you cannot synchronize any permissions from there so you will have to manually assign permissions to the archive once you have removed them.

http://support.veritas.com/docs/280196
TonySterling
Moderator
18 years ago
Change the Bill to Account for the Archive to something other than what it is, i.e. the Vault service account.

Then you will be able to add permissions.
Paul_Costigan
Level 4
18 years ago
Hi

Thanks for the reply. This will certainly do what I require with one caveat, it looks as though this will do it at the vault level, the mbx itself is in a vault with several other user's archived mbx's . Is there any way of stripping out the automatically set permissions at the mailbox level?

You have pointed me in the right direction and I have now picked up on the EVPM helpfile on our EV server. In one of the examples below, it shows that you can specify a DN.

In short, can I target a single mailbox in a vault containing several and strip only it's permissions?

Thanks again,

Paul

DIRECTORYCOMPUTERNAME = OURSERVER

SITENAME = CC_Site1

DISTINGUISHEDNAME = /O=ACME/OU=DEVELOPER/CN=RECIPIENTS/CN=SUES

;
-------------EDIT----------------

; 3. Remove existing user permissions on an existing folder

;

Name = \Existing Folder

MailboxDN = /O=ACME/OU=DEVELOPER/CN=RECIPIENTS/CN=SUES

;

; Remove existing users

;

ExchangePermissions = -; Tom Sawyer; Mark Twain
Paul_Costigan
Level 4
18 years ago
Hi Tony,
Thanks, this got around what now appears to be a two-part question. I have now successfully added our Service Account with full granted permissions on the target mbx archive.

Paul
Paul_Grimshaw
Level 6
18 years ago
Have just tested on my system and Tony's suggestion works. Also the technote that I sent will only strip the permissions for one archive even though it specifies vaultname instead of archive name
Paul_Costigan
Level 4
18 years ago
I'm really pleased with the response on this post, thank you all.

The problem I have is that I actually wish to remove the account unknown (SID) from the permissions on the archive properties of the mailbox.

I suppose it's not really a problem, I'm just trying to be tidy for a change! Although it would be nice to strip out the permissions before the account is deleted.
Stormonts
Level 5
17 years ago
Did you ever find a way to actually remove the unknown SID from the permissions box?
Mojorsn
Level 5
17 years ago
If you zap the archive then all of the permissions including the unknown should be removed. A sample script that we use to perform this task is:

[Directory]
DirectoryComputerName   = ServerXXX
Sitename    = EVSiteXXX

[VaultPermissions]
vaultname= VaultXXX
zap     = True
Stormonts
Level 5
17 years ago
And that will remove only the "Account Unknowns" and will leave any of the legitimate inherited permissions for other mailboxes?