cancel
Showing results for 
Search instead for 
Did you mean: 

Deleting a Restored Mailbox - What will happen to archived emails

Raj_Kumar2
Level 4

I'm using exchange 2010 with EV 9.3.

We normally receive request to restore mailbox from backup tape, and with the exchange 2010 restore and the restore-mailbox commandlet, we will directly extract the mailbox from backup to the existing mailbox in a folder. So the whole mailbox folder structure will be available in a folder and the required emails will be moved to main mailbox.

At this point, i will have double the size of a mailbox (two mailbox). Existing one and the mailbox restore from last weeks backup to restore a single email. and to maintain the mailbox size, we will ask the user to delete the restored mailbox folder.

Our EV is configured to allow user to delete the archived emails. Please help me to understand what will happen to the archived emails.

will it delete the archived emails in backend?

13 REPLIES 13

GabeV
Level 6
Employee Accredited

If you restore the entire mailbox or part of it to a folder called "Restore" and the user deletes this folder after moving any emails to the original mailbox folder structure, nothing would be deleted from the archive, since this folder "Restore" does not exist in the archive. If the user has EV shortcuts in that folder, the archived items will not be deleted from the archive due to the folder path.

I hope this helps.

Ben_Watts
Level 6
Employee Accredited

Hi Raj,

 

No that will not delete the backend emails as you are not touching those archived emails at all.

I am assuming that the restored items are shortcuts in which case the the answer is probably 'yes they will be prompted if they want to delete the archived items'.

 

This is an interesting question though as EV would not have been aware that these shortcuts have in effect 'moved' or copied if the Archive Task has not run between the restore and the deleting and they could, in effect, be orphaned shortcuts which will mean that deleting them will do nothing at all to the archived items,  will double check this in my lab and let you know either way.

 

GabeV got there before me...  :)

 

Pradeep-Papnai
Level 6
Employee Accredited Certified

I would suggest to apply EVPM script in order to stop archiving by from "Restore" folder as a proactive step. http://www.symantec.com/docs/TECH35607

Now coming back to your question. If you user delete shortcut from mailbox & EV desktop policy (option \ options -shortcut deletion = both delete) allows deletion then associated archived items should be deleted from mailbox.

(site settings should allow user deletion & retention category options should not stop deletion).


Deleting simply folders would remove items from EV Archive.

In archive you may see empty folder (restore folder) those will be deleted after 14 days.

Your users can also deleted emails from archive explorer.
 

GabeV
Level 6
Employee Accredited

If I am reading correctly, they ask to the user to delete the restored folder, not any emails or EV shortcuts from the original mailbox folder structure. If that is the case, then nothing will be deleted from the archive since that new folder does not exist in the archive folder structure and any EV shortcut restored in that folder would be considered as orphaned.

If the archiving task runs, that folder should be archived (based on the archiving rules). If the user deletes the restored folder after that folder is archived, EV will delete only the emails under that folder.

If you do not want to archive that folder, then you could consider using the EVPM script to exclude the restored folder from the archiving schedule.

I hope this helps.

Raj_Kumar2
Level 4

Thanks a lot GabeV and Ben Watts fo your update

If the delete the restore folder, I'm prompted with the below warning. Please confirm.

Restore Mailbox Deletion.png

I can proceed with the deletion of restore mailbox?

GabeV
Level 6
Employee Accredited

If you open Archive Explorer, do you see that folder path in the archive: "\Recovery\Recovered Data" ? If so, that means that the archiving task archived that folder. Like I said, if the folder was archived, you will delete ONLY the archived data under that folder. If you do not see that folder in AE, then you do not need to worry about it.

Pradeep-Papnai
Level 6
Employee Accredited Certified

If you select yes, then all the shortcut + assoicated archived will be deleting from vault. Emails those shortcut deleted but items are still in vault, It would be good to delete from archive explorer as well.

Raj_Kumar2
Level 4

Hi EV-Counselor,

I'm planning to delete the recovery folder, after GabeV's below update. it will delete

If you open Archive Explorer, do you see that folder path in the archive: "\Recovery\Recovered Data" ? If so, that means that the archiving task archived that folder. Like I said, if the folder was archived, you will delete ONLY the archived data under that folder. If you do not see that folder in AE, then you do not need to worry about it.

Deleting the Recovery folder screen shot will delete only the emails in Recovery folder? or it will delete the emails in the main mailbox aswell?

Ben_Watts
Level 6
Employee Accredited

Ok, just tested this in my lab.


I created a new folder and copied some shortcuts from the inbox to the Restored folder, tested the recall from the folder, which worked, deleted the 'Restored' folder, I got the same warning as you, selected 'Yes' which then deleted both folder and Shortcuts.

Went back to the inbox and tried to recall the original shortcuts which then failed with the error message  'This item is no longer in the Vault', meaning that deleting that Restored folder DID remove the items from the Archive. I checked this by looking for the DVS files we were trying to restore and checked the SQL tables, the items had indeed been deleted.

 

The best way you can get around this is to change the Desktop policy for these users temporarily.

If you look at the below screenshot you will have the Shortcut Deletion option within the Exchange DESKTOP policy set to 'Both Deleted' at the moment, if you:-

1) Change that option to  'Shortcut Only'

2) Synchronize the selected users via the Mail Archiving Task to ensure the changes have taken affect

3) Reopen Oulook on the users machine

Then when the users delete the Restore folder they will not be prompted or warned but this time ONLY the shortcuts within that folder will be deleted, the original shortcuts and original archived items will be left as they were.

Capture_0.PNG

 

I have tested and confirmed that this does indeed work and ONLY the shortcuts within that one folder (and subfolders) are deleted, no other mail (shortcuts or archived items) are touched so this should work exactly how you want it to within your environment.

I do suggest however that, as each environment is different, you test the operation on a single mail item before deleting the entire folder, this is simply to confirm that it works for you within your environment and that all settings have been applied and synchronised to the mailbox and hidden message correctly.

 

I hope this is of help to you?

 

 

Just as a side thought, if you are worried about end users losing archived emails by accident you can enable the 'Enable recovery of user deleted items' within the 'Site Properties', this will then give you the option of restoring those items from the 'Archive Properties' within the set time (in the below case 32 days). Keep in mind though that if you do need to restore deleted items in this way ALL items that have been deleted within the last 32days (in the below case) will be restored to the users archive, you are unable to choose on a granular level which ones to restore and which ones to not restore, it is simply a catch-all safety feature.

 

Site Properties

Capture3.PNG

 

Archive Properties

Capture5.PNG

 

 

 

Raj_Kumar2
Level 4

Hi Ben,

Thank you for testing this in your test lab.

Moving the email from one folder recovery folder will have the same link to vault, and deleting the emails from moved folder (recovery) will delete the orignal contents, Your senario will be applicable when restoring the mailbox from backup?

For a test, I delete a single archived email shortcut from the restored mailbox (Recovery folder) and navigate to my main mailbox tried to access the same emails and I was able to un archive without any issue. Not sure how I'm able to un vault. My desktop policy is configured to delete both.

After deleting the single archived shortcut from recovery folder, do i need to run the schronization once to replicate the changes and later I have to un vault the original email to check whether the deletion of email shortcut in the recovery folder is deleting the original contents on the mailbox?

Ben_Watts
Level 6
Employee Accredited

Hi Raj,

When I ran my test I copied the shortcuts to a new folder (essentially the same as restoring the item as you are simply creating a copy of an existing item but in a different location) because of that it makes it essentially the same as restoring from backup media.

If you are restoring Shortcuts within that RESTORED folder then all the information that is held in the original shortcut will be in the restored shortcut too, therefore if you choose to delete the restored shortcut then EV will more than likely make the link to the original item archived from the Inbox hence the warning about deleting the Archived items.

 

'For a test, I delete a single archived email shortcut from the restored mailbox (Recovery folder) and navigate to my main mailbox tried to access the same emails and I was able to un archive without any issue. Not sure how I'm able to un vault. My desktop policy is configured to delete both.'

It depends on if you also have Vault Cache enabled as you MAY be recalling that item from Vault Cache therefore not appearing to be deleted from Archive.

To ensure your item hasn't been deleted from the Archive you can try to restore it via the Outlook Client (HOW you do that depends on the Outlook client you are using, either ribbon buttons or toolbar buttons) or use Archive Explorer to try and restore the item back to the Inbox, which way you can do this fully depends on what the Policies are setup to allow the clients to do.

 

'After deleting the single archived shortcut from recovery folder, do i need to run the schronization once to replicate the changes and later I have to un vault the original email to check whether the deletion of email shortcut in the recovery folder is deleting the original contents on the mailbox?'

No you dont, once you have deleted an archived item that item is immediately marked for deletion/deleted and you will be unable to recall that item anymore unless you have Vault Cache enabled.

 

Hope that helps?

GabeV
Level 6
Employee Accredited

Raj,

Just to be in the safe side in this scenario:

  1. Identify what desktop policy is being applied to the user and create a new one doing right click over the desktop policy > "Copy Policy" in the VAC.
  2. Change the option "Shortcut Deletion" in the new policy to "Shortcut Only".
  3. Create a new provisioning group.
  4. Add this user to the group and select the new desktop policy.
  5. Update the ranking in the provisioning groups and make sure this new provisioning group is #1 in the ranking.
  6. Run the provisioning task.
  7. Synchronize the mailbox.
  8. Restore the data to the mailbox.
  9. Once you have confirmed that the user has deleted the recovered folder, then go ahead and delete the provisioning group you created in step 3, run the provisioning task and synchronize the mailbox.

Following these steps, you will make sure that the user will not delete any emails from the archive by mistake.

I hope this helps.

Andrew_S_Jones
Level 4
Employee Accredited Certified

Hi Raj,

 

When a user selects the restored folder and attempts to delete the entire folder, or an individual item, the EV Outlook add-in will prompt the user with your yes/no question only if the user’s EV Desktop policy for Shortcut Deletion behavior is set to 'Both'.  If this is set to 'Ask User' then a different prompt will occur that allows the user to determine whether they want to delete archived items and the shortcuts or only the shortcuts.  The EV Add-in does not attempt to validate the folder location of a delete request; with the EV Desktop policy set to delete 'Both' when the user selects 'Yes' the EV Add-in sends a Delete request for each shortcut to the EV Server with the FolderID and the SavesetID contained within the EV Shortcut.  In the case of your scenario the FolderID and SavesetID contained in the EV Shortcut(s) will be the same as those contained within the original location of the shortcuts in the Mailbox.

 

The most likely cause of the shortcut that you copied still working is that likely you have the Site policy to 'Enable recovery of user deleted items', what this means is that the Delete request from the EV Add-in deletes the item from the Index but the item will still exist in the Saveset table for the recovery period.  Once that time frame has expired the original shortcut will no longer work.

 

To ensure that no archived items are deleted I would recommend changing the Shortcut Deletion policy to 'Ask user' across the board, if the 'Both' setting is a requirement for business operations then setting up the temporary policy as described above should work in the short term.

 

I wanted to make you aware of some new features in Enterprise Vault 10.0.4 that would make this a bit easier.  As part of other retention enhancements each Archive within EV now has an option:  ‘Allow deletion of archived items and of this archive’, which would allow you to temporarily prevent users from deleting items from their archive when a Mailbox restore operation is needed as you outlined.  This setting can be controlled via the EV Management Shell, EVPM, and the properties of an Archive within the VAC;  making it very easy to set and clear this option.

 

I hope this information, and the other replies, have answered your questions in this matter.