We have a rebuild of a EV 12.3 server and I have since had a user state that items she restored were re-archived the following night. She is on a 6 month policy and we don't use shortcuts. I can see under the index info that
I've been looking at this https://www.veritas.com/support/en_US/article.000085223 as a possible reason but was then put of by this https://vox.veritas.com/t5/Enterprise-Vault/Re-Archiving-entire-mailbox/td-p/828220 where Chris states that the IgnoreEVdates setting only applies on a manual archive task and this is happening on others.
We have EV 12.3 servers in other regions and when items are restored they stay restored This makes me think that the default behaviour is for EV to ignore the date sent/received and look at the archive attribute. In other words if it hits 6 months you restore it, you get another 6 months.
I've checked the agents container / subkeys in the registry as per the first link and cannot see any differences on the servers which exhibit the desired behaviour and this new one which does not.
That is strange. Is it possible that someone ran the task manually?
By the way, to confirm whether the items were really re-archived, you can look to see if there are duplicate items in the EV Search.
However, notice that the IgnoreEVDates registry key should only be in place for specific reasons and it should be set to 0 or deleted upon return to normal scheduled archiving.