Have a look at Roll Base Administration and also specify archive permissions to deny certain persions or groups acces to archives. You can do this via EVPM.

Further to what LCT said, neither Power Admins or the Vault Service Account automatically have permission to search archives other than their own.  They either need permission granted on the archives or have permission inherited from the mailbox.

You might also want to look at switching auditing on, so an admin could not give themselves access, then search, and then remove that access.

http://www.symantec.com/docs/TECH49054

Also, there are ways that searches can be logged via webapp.ini

http://www.symantec.com/docs/TECH66548

see page 142 of the EV8 base admin guide (this still works in 9, but is not documented)

You would obviously have to stop the admin altering the logfiles created, and the webapp.ini file.

Regards,

Jeff

We are setup for journal archiving vs specific mailbox.  So its one general archive that all messages are in.  Although I know you can do roles, I'm asking about a way to guarantee an Admin can't assign them selves access.  The audit process allows for a check mechanism, but ideal is to prevent access vs report on unauthorized.

You would have to secure the Vault Service Account and then set up a custom role in RBA that can't manage archive permissions.

You could then manually deny permission on the journal archives for the Admins.  A manual deny will override an automatically set permission.

As a matter of interest, how are you securing the Exchange side of things?  I mean, a regular Exchange Admin *could* open a users mailbox, and read/edit/delete data.

Yes, this is what my CIO told my manager just recently, I overheard them :-\

so yes how can I do this in EV 8.0 SP4 ?

Wow that does make sense Tony.

Many thanks for the quick reply !