Delete and Restores always available in search.asp, searcho2k.asp. Can it be turned off?

[Rob_Vollum]

EV 2007 SP4

At this client, they do not want users to be able to delete from the archive, or restore from the archive. But, they want a few key admins to be able to delete from the archive to clean up any messes.

All of this is easy to manage for most normal stuff related to the Outlook add-in. At the site level I have enabled the ability for users to delete from the archive (why is this a site-level feature?). Then, via policies and provisioning groups I hide the options for delete, restore, cancel, etc from almost all users in the Outlook add-in, and give it to a few in a special provisioning group

The problem? The web apps - Archive Explorer and the browser-based search.asp - don't respect these settings.  We can go to Archive Explorer and do a right-click-delete. Etc.

I added all the things that come from this tech-note into webapp.ini:  http://support.veritas.com/docs/292820

- things like ISDeleteButton, and ArchiveExplorerDelete, etc. and much of the unwanted ability to delete goes away. I do note that those features are not supported past EV 7, which worries me.

Two remaining problems that I can't solve, and my search of this forum makes me think there are no good answers:

1) In search.asp, I can't get rid of the "delete from vault" tab that is available after a search. Also, I can't get rid of the restore options from search.asp. Well, I can by editing the pages, but I don't want to do that!

2) In the integrated search page (searchO2K.asp) there is a link to the browser-based search.asp. If I could turn that off, I could avoid having my users be able to get to the search.asp. But I can't find an option to turn that off, other than editing the web page (which is the suggestion of    http://support.veritas.com/docs/281581)

Any ideas? Are there any option-based ways to get Delete and Restore out of the GUI?

Thanks,

Rob

[GertjanA]

Hi Rob,

I believe it is not possible to disable the delete from Vault on those asp's if you do not disable the 'all users can delete' option.

We also do not allow any deletions.

On the search.asp page, a user is allowed to restore mails, for usability. It so happens people have a need to use (project) mails from years ago. Instead of using Archive Explorer, we allow them to restore the basket.

What messes would there need to be cleaned up? Content in archives? I think that if you allow people to delete in the archive while officially they cannot, you will always have people figuring out how to do it.

My guess is (provided you need to stick to keeping the delete option enabled) you need to adjust the webpages. And, to be safe, enable auditing to monitor delete actions...

Regards,

Gertjan

[Rob_Vollum]

Thanks for your insights. You are confirming all of my own experiments - I appreciate it. I can hide most references to delete, but that's not really secure since underlying it all is still the ability to delete. And it seems that my client is just going to have to live with the fact that users can restore email to Exchange if they make it to the browser-based search.

I think I'm going to just have to set the site setting to not allow deletes, and if the situation arises when we need to delete then I can temporarily change that setting. The "messes" I was referring to are times when classified email spills into unclassified email, and then into EV, and it needs to be removed.

Another option, I guess, is to use EVPM to script "DenyAccess Delete", but that is a management pain and still has windows of vulnerability. So site-setting it is.

Thank you,

Rob