Distribution List members at time of the email Discovered

[philt]

Hi,

Using Discovery Accelerator 9 we are reviewing an eMail that was sent to a Distribution List. We need to know the members of that Distribution List at the time of the email being sent\received. When exporting the email and clicking on the Distribution List it is resolving against our current Active Directory membership and returning Mailboxes that weren't even created at the time of the email discovered, being sent.

Thanks in advance,

Cheers,

Phil

[philt]

Hi,

Does anyone still use this forum? or can I explain what I'm after a different why? Thought others out there would of had a similar issue and a little surprised that there doesn't appear to be any solution or advice.

Thanks in advance if anyone has any info.

Thanks,

Phil

[TonySterling]

Yes, the forum is still used but the issue you are describing seems to be outside of DA, unless I have misunderstood.  

Do you have Expand Distribution List enabled for the journal archive task?  

[philt]

Thanks for your reply Tony,

The "Expand distribution lists" is on for the Journaling Policy.

The issue we have is that we discovered an email using DA. The email is address to a distribution list and that is all it shows in the "To" field.

My question is how do we know who received that email?

Thanks,

Phil

[philt]

Hi,

Still hoping to get more information on this and would like to know if the results we are getting are by design or if we have an issue.

Tony or any others, couple you please let me know what your results look like when you discover an email (using DA), that was sent  to a Distribution List. Do you just see the Distribution List name in the "To:" field or do you see the acutal individual recipients who did receive the email?

Thanks in advance,

Phil

[EV_Ajay]

Hi philit,

I tested the behaviour in my lab and found that i only able to see the Distribution list name in TO field. Unable to see the actual individual recipents who receive email.

[Patti_Rodgers · Accepted solution]

What you are describing is by design. The sender sent the mail to the DL, not to individual people, and while we do query the DL as we are processing the message and store the information needed to index the DL members, we do not change the way the message displays. This is because changing the message display could call the integrity of all EV-archived messages into question ("we know the product can change the recipient info here, here and here, so how can we guarantee the product is not changing the recipient info on all those other messages?").   You would need to rely on other records, such as your AD membership audits, to easily list which users were members of a given DL on a given day. 

[philt]

Thank you Ajay and Patti for taking the time to test and post replies.

Patti, thank you for understanding my question and your informative reply. Yes I do agree that the integrity of the emails have to be absolute so changing these in anyway would call everything else into question. With regards to DL group membership auditing I understand what you are saying but I don’t feel that this would absolutely show that a mailbox actually received an email as they mightn’t of been a member earlier in that day when the email was sent. The only way I can see is to use the Exchange Message Tracking logs, which I have used in the past via software that imports these logs into a Database on a daily basis, which can be queried at a later date…unfortunately my management have decided to stop using this software.

I feel Discovery Accelerator could be enhanced by doing something similar.

At least I know that things are working here as they should be.

Thanks again,

Regards,

Phil

[Kenneth_Adams · Accepted solution]

Hello, Phil;

I just saw your post and the replies you've received to date.  My apology for not seeing it sooner.

When EV archives an e-mail that is sent to a DL, EV asks the Exchange server to expand the DL membership at that time and provide the members in the Journal Report when archiving items through journal archiving.  That Journal Report is known as the P1 wrapper and looks like the message contents with the actual message as an attachment when viewing through the journal mailbox's inbox prior to being archived.  All recipients listed in this P1 wrapper are indexed by EV and are searchable in DA.

When DA displays an e-mail in the preview pane, it displays an HTML rendering of the actual message with the DL name displayed, not the DL members.  An export of the message can be configured to include the Journal Report information in the export report so that you can see all of the DL members at the time the message was archived.  If you should right click on a message with a DL as a recipient and then click on the 'View original' option, that message would open in an Outlook profile.  Expanding the DL at that point would display the current members of the DL, but not necessarily the members at the time the message was archived.

We do not currently have a way to display the members of a DL at the time the message was archived in the preview pane.

If you need to be able to identify all messages to a specific recipient regardless of being sent directly or through a DL, you would need to enable Analytics on the case, then run a quick search of the To field for the specific recipient.  The resultant review set would contain ALL messages sent to that recipient regardless of being sent directly or through a DL membership at the time the message was archived.

I hope this information help.  I'm sorry that we can't display the DL members in the preview of a message sent to a DL.  That would require a feature enhancement.