if you're asking how to zap a mailbox, here you go:

How to remove (zap) Enterprise Vault (EV) properties from Archive-Enabled Exchange mailboxes

• Article: TECH35614
• Updated: August 5, 2014
• Article URL: http://www.symantec.com/docs/TECH35614

basically, you create an ini file with the parameters in the technote above (which is just a text file with the .ini extension saved in unicode using notepad.) then you run EVPM.exe which is in your EV app directory and follow the prompts.

Thanks for the pointer re ZAPping.

However, I don't know if zapping the archive file really is the complete answer to this problem. It's something I've never done before and I'd appreciate advice on any other means of solving the access to this archive, in the event that zapping doesn't work.

It certainly appears like a permissions problem. Try using premissions browser to see if they are different between the working / non-working cases.

https://support.symantec.com/en_US/article.TECH56331.html

Although that article is for public folders, you can view mailbox permissions too.

I suspect there will be some group on the problem mailbox with a "Deny" on it.

Andrew

Apologies for behiving like I'm unwilling to dive into a cold swimming pool, but...

I tried EVPM command string as follows:

EVPM -? -e Servername -m ServicemailboxAlias -f c:\temp\zapfile.ini

the zapfile contains:

[Directory]
DirectoryComputerName = Servername
Sitename=Siteappellation

[ArchivePermissions]
ArchiveName=Fred Bloggs
Zap=True

Command didn't succeed.

Do I need to 'fully qualify' the servername ? ie Servername.domain.uk, for example ?

you dont need -? in your command. if you want to, just run EVPM.exe and it will prompt you for each variable to input

Hi Andrew.

a big thankyou. Using EVPM as you described was successful! Hooray!

All of the permissions were successfully removed as hoped, by EVPM.

However....

perhaps this was the wrong approach, but I tried it.

I disabled the problem archive in EV, allowed for a few minutes and then re-enabled the archive.I wanted to re-apply just the default permissions.

To my disappointment all of the permissions list that had been there prior to running EVPM re-appeared. As a result, it remains impossible to open an archived item in this mailbox's archive.

I guess I'll have to remove all permissions again with EVPM and manually add, one at a time, only the permissions I believe are required.

Appreciate your advice.

IS there a recommended way to avoid / prevent users or groups with 'automatically set' permissions from being re-added to the permissions list, if an archive is re-enabled ?

it sounds like the permissions are inherited from Exchange/AD. this is an optional setting in the mailbox policy. unless you want to disable it for all your archives, what you might do is create a seperate provisioning group with its own policy and you can add accounts to it as necessary and then deal with the permissions manually.

I'm left wondering if I hadn't disabled and re-enabled the archive for this mailbox, would the unwanted accounts have reappeared ? I'm going to try zapping the archive again and manually adding just the accounts I believe are required.

Looking through the accounts that I'd added back, after successfully running the zap a second time, I found one group with an anomalous name. I've tried renaming the account, which is a group in AD. I've corrected the anomaly in the group, its DL and its UNV entries, but so far no improvement in accessing the archived contents. Most frustrating.