Disabling EVS Account with no AD account

[D11nnapp]

We have a number of leavers, whose AD accounts have been disabled, and their associated mailboxes have respectively also been deleted from Exchange.
How can we disable their mailboxes in EVS which are still enabled for archiving?

Thanks

[MichelZ]

They are not showing up on the "Disable Users" button?

[Joseph_Rodgers]

The accounts are gone from the provisioning group.  Once account is deleted in AD EV no longers has a reference.  You may need to remove the account from SQL.

http://seer.entsupport.symantec.com/docs/289950.htm

-Joe

[MichelZ]

Joseph

He stated that the Account was only disabled, not deleted.
Only the Mailbox got deleted.

Cheers

[Joseph_Rodgers]

Please post the applicable lines from a RunNow of the provisioning task (full report mode).

Do you the mailboxes appear in the tools - disable mailbox wizard?

If so, do you get an error when attempting to disable?  Please post error.

If the above is true than the link I originally sent will resolve your problem.

Regards
-Joe

[D11nnapp]

The report lists many leavers accounts which have entries in enterprise vault but which are not in any provisioning group.

I cant actually see them listed as 'enabled users' when I run the disable accounts wizard. So how would I go about cleaning this up?

The AD account still exists but only the mailbox has been deleted from exchange.

We have just done an audit of leavers so there are quite a lot of accounts like this.

Thanks in advance

[Joseph_Rodgers]

Contact your SQL admin and ask for a copy of the ExchangeMailboxEntry in the EnterpriseVaultDirectory (described in the link I posted).  Are the disabled users listed on this table?  If the users are removed from this table they will no longer be archived by Enterprise Vault.

For future I would recommend altering your procedures as follows:

User Leaves company:

1. If desired: Move all mail to enterprise vault via TerminateEmployees mailbox policy (create higher ranked provisioning group that contains only terminated users)
2. Disable archiving of mailbox
3. Disable user in AD
4. Delete Exchange mailbox

TerminatedEmployee policy:

0 Day archiving
No Shortcuts
All message classes (as required)
Advanced - Included all "special" folders (ie: deleted items, tasks, etc.)

-Joe

[MichelZ]

You could also set the "ExcludeDisabledADAccounts" Registry key on the Server, and combine it with a TerminatedEmployee ProvisioningGroup / Policy, like Joe suggests.
But you would then be able to disable the account for security purposes, but still be able to archive mail from this account.

[HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\Agents]
"ExcludeDisabledADAccounts"=dword:00000000

So:

1. Disable AD Account
2. Add to Leavers Provisioning Group
3. When the Mailbox is empty, delete it, along with the User
4. Add Permissions to the Archive for other Employees if appropriate (Manager, replacement Employee.... )


Cheers
Michel

[Joseph_Rodgers]

Michel,

I'm not familiar with that key "ExcludeDisabledADAccounts" (not surprising considering how many "undocumented" keys exist)  do you have any more info\experience about it?  It seems like a very useful key.

only reference I could find: https://www-secure.symantec.com/connect/forums/disabled-users-ad-are-not-archived

Thanks
Joe

[MichelZ]

Joe

Unfortunately, I haven't got more info.
I will probably play around with it in a Test env sometimes :)

Cheers

[D11nnapp]

I have spoken to our DBA's who have confirmed that the process described in your article is not a problem to follow. So we will be going down the route of deleting the entries from the SQL database. I presume this will not affect our ability to still access the archive.

Thanks for your help.

[BigPhil]

Is the procedure mentioned by Joseph in the 3 post also applicable to EV 8?  I dont see it on the list of the products the article applies to.