Auditing Retention Folders

[VersEV1]

What are some ways that people audit retention folders?

If you don't keep the ini files, and don't put any special characters or have a naming convention for retention folders, how to you go about finding who has them?

[AndrewB]

just to make sure i understand your question... you want to go through all your mailboxes and identify folders which were created using EVPM?

[VersEV1]

Correct, especailly if they don't have a certain naming convention.

[AndrewB]

just to be clear, if you dont have usernames and dont know which folders you're looking for it means whatever process you come up with would need to scan every single folder in every single mailbox. are you prepared to do that?

[VersEV1]

I have usernames. Say I choose one user, how can I see what retention folders they have?

[dcVAST · Accepted solution]

To check mailboxes in Exchange: Get-MailboxFolderStatistics -identity first.last | ft identity

Or in SQL:
SELECT AFV.FolderName, AFV.FolderPath, A.ArchiveName
FROM ArchiveFolderView AFV
JOIN Root R on AFV.ArchiveVEID = R.VaultEntryId
JOIN Archive A on R.RootIdentity = A.RootIdentity
WHERE FolderName like '%evpm%'

The folders do not have unique names?

[AndrewB]

we're actually having that discussion in a different thread where he said they dont know the folder names

[VersEV1]

Thank you i guess if they do not have a certain naming convention it would be hard to tell them from a regular folder i guess at that point a zap and recreation would be needed to truly audit and limit who has certain folders