Mailbox not vaulting
I have one user that I am attempting to vault. When I first received the request, I added the user to the Windows sercurity provisioning group that added user to be provisioned for EV. I then synced the mailbox and started the forced archive. When the request came in, the user's mailbox was close to 100 GB! The mailbox is now down to 30 GB and 59 GB is in the vault. But the policy the user is assigned to moves all IPM.Note items older than 60 days to the Vault. I impersonated his mailbox in OWA and he still has many items older than 60 days in his mailbox. I've forced vaulted him many times. Nothing more is moving to the Vault. Earlier today, I disabled him for Vault, zapped both the archive and his mailbox and re-enabled him. Still nothing moving to vault.
I've followed this link.
https://vox.veritas.com/t5/Articles/Troubleshootin...
The user is still part of our 60 day provisioning group. (I uploaded an image showing he is...)
His mailbox is not hidden in the GAL or disabled in AD.
He is not disabled for archiving. I check that by attempting to disable someone. If they're not provisioned at all, I can't find them to enable or disable. But if I can disable someone, I know they're enabled. (I then just cancel out of the disable user wizard.)
The user is still on the same mailbox server as then the ticket came in.
About this entry...
Wrong mix of policy settings?
Sometimes in a purely quota based archiving situation it might seem like items are not being archived, but really that might be perfectly normal.
We don't have quotas, so this is not it. We don't have Symantec support anymore. But Symantec used to always focus in on the quota for a user and I'd have to overly disprove them that there are no quotas. They'd pull out the dtrace and say, the user does have a quota because dtrace shows it. I'd show them over and over, no they don't. After an hour or so, they'd drop it and we'd find the problem elsewhere. But here's the proof...
[PS] C:\Windows\system32>get-mailbox user | fl *database*,*quota*
Database : DAG02DB10
UseDatabaseRetentionDefaults : False
UseDatabaseQuotaDefaults : True
ArchiveDatabase :
DisabledArchiveDatabase :
ProhibitSendQuota : unlimited
ProhibitSendReceiveQuota : unlimited
RecoverableItemsQuota : unlimited
RecoverableItemsWarningQuota : unlimited
UseDatabaseQuotaDefaults : True
IssueWarningQuota : unlimited
RulesQuota : 64 KB (65,536 bytes)
ArchiveQuota : unlimited
ArchiveWarningQuota : unlimited
[PS] C:\Windows\system32>get-mailboxdatabase dag02db10 | fl *quota*
ProhibitSendReceiveQuota : unlimited
ProhibitSendQuota : unlimited
RecoverableItemsQuota : 30 GB (32,212,254,720 bytes)
RecoverableItemsWarningQuota : 20 GB (21,474,836,480 bytes)
QuotaNotificationSchedule : {Sun.1:00 AM-Sun.1:15 AM, Mon.1:00 AM-Mon.1:15 AM, Tue.1:00 AM-Tue.1:15 AM, Wed.1:00 AM-
Wed.1:15 AM, Thu.1:00 AM-Thu.1:15 AM, Fri.1:00 AM-Fri.1:15 AM, Sat.1:00 AM-Sat.1:15 AM}
IssueWarningQuota : unlimited
Below is a snippet of a dtrace on archivetask. (I doctored it up removing our company name and other identifiable information of the innocent...)
24254 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M FindExchServerDn - Exchange Server Found. DN: CN=TN001WEXMBX004,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=xxx Exchange,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=xxx,DC=net
24255 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M {GetExchangeServerValues:#4291} Exchange DN: [CN=TN001WEXMBX004,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=xxx Exchange,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=xxx,DC=net]|Exchange AD search path: [GC://TN001WGC11.US.xxx.net]|Exchange FQDN: [US.xxx.NET]
24256 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {CExchangePolicyCache::GetDefaultPolicy:#270} Default policy is [13C154C35E01BC147B294FA9B593FFEAF1012700EVSARCHIVE01 (Default Exchange Mailbox Policy)]
24257 09:36:50.631 [8272] (ArchiveTask) <9252> EV:H {CArchivingAgent::ProcessUserEx:#18105} Beginning processing of mbx [], mode [RN_ARCHIVING, RN_SCPROCESSING (0x3)], report mode [False]...
24258 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M CMailboxUsage::SetMailboxInUse - Adding MbxDN to List:[/O=xxx EXCHANGE/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=USERNAME]
24259 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {CArchivingAgent::Initialise} (Entry)
24260 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {MigratedDominoItems::Reset} (Entry)
24261 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {MigratedDominoItems::Reset} (Exit)
24262 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L CPrioritizedItemTable::InitialiseTable(Age) - Setting up the table. Size: [1000]
24263 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L CPrioritizedItemTable::InitialiseTable(Quota) - Setting up the table. Size: [1000]
24264 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {CArchivingAgent::Initialise} (Exit) Status: [Success]
24265 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M CAA::PUEX() - Calling FindUser()|LegacyMbxDn = /o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username|ExchangeFQDN = US.xxx.NET|ExchSearchPath = GC://TN001WGC11.US.xxx.net
24266 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M SanitizeUserName() - Sanitized username '/o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username' to '/o=xxx Exchange/ou=Exchange Administrative Group \28FYDIBOHF23SPDLT\29/cn=Recipients/cn=username'
24267 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M FindUser() - Using searchbase GC://TN001WGC11.US.xxx.net
24268 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M FindUser() - Search filter: (&(objectCategory=user)(legacyExchangeDN=/o=xxx Exchange/ou=Exchange Administrative Group \28FYDIBOHF23SPDLT\29/cn=Recipients/cn=username))
24269 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M FindUser() - [homeMDB] = CN=DAG02DB10,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=xxx Exchange,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=xxx,DC=net
24270 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M FindUser() - [distinguishedName] = CN=username,OU=Users,OU=Corporate,DC=US,DC=xxx,DC=net
24271 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L :CArchivingAgent::ProcessUser() |Getting a MAPI session from the session pool |
24272 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M CMAPISession::GetMapiSessionFromPoolEx(AdditionalFlags = 0)
24273 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M CMAPISession::GetMapiSessionFromPoolEx: Exit status: 0x0
24274 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {CPolicyTargetGroupCache::GetUsersPolicyTargetGroup:#225} Found entry for user [/o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username] in cache.
24275 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {CPolicyTargetGroupCache::GetUsersPolicyTargetGroup:#250} User [/o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username] maps to policy [13D7DA27F340B0E4FBB432CC08A52C4591012p00EVSARCHIVE01] [xxx EVS Users]
24276 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L {CExchangePolicyCache::GetPolicy:#243} Returning policy: [13C154C35E01BC147B294FA9B593FFEAF1012700EVSARCHIVE01 (Default Exchange Mailbox Policy)]
24277 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M CAA::GUP() - /o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username is using Policy : Default Exchange Mailbox Policy
24278 09:36:50.631 [8272] (ArchiveTask) <9252> EV:L :CArchivingAgent::ProcessUser() |Creating the Entry ID of user mailbox to be processed |
24279 09:36:50.631 [8272] (ArchiveTask) <9252> EV:M :CArchivingAgent::ProcessUser() |Open users message store |
24280 09:36:50.756 [8272] (ArchiveTask) <9252> EV:L :CArchivingAgent::ProcessUser() |Getting the entry ID of the mailbox wastebasket or deleted items folder |
24281 09:36:50.756 [8272] (ArchiveTask) <9252> EV:L {CFolderHelper::GetSpecialFolders:#2060} Getting special folder Ids (Wastebasket, Outbox, Sent Items &c.), attempt [1] of [4]
24282 09:36:50.771 [8272] (ArchiveTask) <9252> EV:L {CArchivingAgent::ProcessOWARestoredItems()} (Entry)
24283 09:36:50.771 [8272] (ArchiveTask) <9252> EV:M ProcessOWARestoredItems: OWARestoredItemTimeout: 120 minutes
24284 09:36:50.771 [8272] (ArchiveTask) <9252> EV:M ProcessOWARestoredItems: Deleting item(s) restored on or before: 13:36:50 10/02/2017
I just opened the user's mailbox via Outlook and checked the types of emails that are old and verified they are mostly IPM.Note. None are pending or any types of messages that are filtered out by the archiving policy.