Audit Search

[Slack]

Hi,

We have been asked to search through multiple users mailboxes for keywords. This is fine in Exchange, but not how I remember it in Vault. We are running V11 and I have not done this since maybe v8 or v9.

First problem. I have no rights to the users archives. Is there a quick way to add the EV admin user to have rights to the all of the Mailbox Archives in EV? I don't want to have to struggle though hundreds of vaults adding in permissions.

Next, is there a good way to search through a load (many, but not all) mailbox vaults for certain key words and export that information to PST for example? I know I did this many years ago in an older version, but not sure how now.

Hopefully this will be something failrly common and will be easy to do.

Many thanks in advance.

[Slack]

Permissions bit.

I have seen this: https://www.veritas.com/support/en_US/article.TECH69114

But it doesn't look like a simple or quick way to do this. The time it would take to script it out like that would be better spent doing it manually. In exchange you can pass get-mailbox or the like to basically catch all mailboxes... there must be something like that for EV. Or maybe there is a role I can add my user to?

[Slack]

Having had a look at the EVMS documentation, I don't even think there is a way to do this using that.

https://download.veritas.com/resources/content/live/DOCUMENTATION/7000/DOC7347/en_US/PowerShell_Guid...

In Exchange you can simply do get-mailbox to list all your mailboxes... but the get-evarchive command only seems to work for a specific user, so you can see all the archives one user has access to. As we have no users who have access to all our archives (and that's really what I am trying to acheive in the post) then it's next to useless here.

Am I missing something? Is there no way to just list ALL the archives in the EVMS? If there was, then I can probably just pipe that in to a set-evarcvive command to add permissions as needed.

Seems like a huge shortcoming if not?!

[ChrisLangevin]

What you are describing is as perfect a use case as it gets for Discovery Accelerator. Search for specific criteria across multiple or all archives in a site. If you find results, export them to PST. Mark them on legal hold so no one can tamper with them. It is built to do exactly what you're asking for.

The EV Search feature built into EV is designed as a user-facing feature for users to search their own archive. Searching across multiple archives at once is not really its intended use.

--Chris

[GertjanA]

To add an account with permissions to all mailbox archives, you can use EVPM (Enterprise Vault Policy Manager). See Utilities Guide for how this works.

When setting permissions, you can use ALL_MAILBOX to set permissions on all Mailbox Archives.

That should do the trick.

However, as indicated above by several people, and in your other post, searching through archives, and exporting items from several archives, you really should be using Discovery Accelerator. That allows more flexibel search and export, and is designed to export specific items from multiple archives.