EV6 adding new Exchange Target server

[James_Healing]

Hello,

I am trying to add an additional exchange server to allow mailbox archiving. However everytime I add the server i get the following error: Unable to read Enterprise Vault System Mailbox for Exchange Server Check that the Exchange Server is available and you have the correct permissions. Reason: Access is Denied

I have checked the service account rights and it has been applied at the administrative group level and propagates up to the server (with send as and receive as). The account also has local rights to the server.

Any ideas?

[Aaron_Mears]

Have you previously changed the system mailbox that EV is using, or previously setup this "broken" EV server with another install of EV. Check for a mailbox called the standard system mailbox name "EnterpriseVault(servername)".

Aaron

[David_Messeng1]

James,

You probably know that EV needs a specific mailbox on each Exch server as well as the system account. When you run the connection wizard (on v5 anyway) it should present a list of mailboxes on the server or else ask you to nominate your own. If you are nominating your own and picking your Admin mailbox (which I guess resides on the first Exc server) then EV won't work.

The secondary mailboxes do not need privialges. they are only used to connect to the server and read directory. EV will pass thru te credentials of the Service Account to do enablements, etc.

You can't hide the mailboxes.

We givethem all the same display name and put redirects on them to a single mailbox (for Out of Offices and SPAM collection)

I'd reccomend you create a mailbox on the new Exc server first. Let it replicate and then run the new connection wizard and select it from the list.

There is another bug where MAPI needs to determine the system mailboxes uniquely so watch out when creating the aliases. For example evAdmin1 and evAdmin 11 would be a bad choice. There is a work around for this but watch out for it.

Hope this helps


David
http://www.UDStech.com

[James_Healing]

Thanks for the replies.

I've manually created a system mailbox on the target server with the standard name EnterpriseVault-. This is a new server which has not been enabled in a previous version.

I have checked and I can open the mailbox using the enterprise vault service account (I also checked that I can open the mailbox I want to archive). When I try and add it I do not get a wizard, it just comes up with the access is denied message. If I am able to open the mailboxes using outlook it proves that the service account does have rights to the target server.

I have now logged a call with Veritas as this is holding up a large amount of other work now.

What rights in AD do I need (not exchange rights as the account has full admin).

[David_Messeng1]

Hmmm... check your DNS settings. Make sure you are pointing at GCs that know about this Exc server.

Are the Exc servers in different OUs?

[Tremaine]

Can you give us a bit more detail about your environment? (OS version and SP level as well as exchange). Have you tried to create another mailbox with a completely different name. (e.g. evmbxsvrx)?

[Aaron_Mears]

How far does the wizard get? Do you actually see the box that says Enter the Name, with the create archiving tasks below? If you AD is locked down you can have problems is the service account able to query AD?

[James_Healing]

We are running Ev 6.0 on Windows 2003 Std. We are using an EMC Centera for vault storage (CentraStar 2.4). The target server is Exchange 2003 SP1 we already archive from the same exchange organisation

[James_Healing]

The wizard doesn't start. It just errors immediately.

[David_Messeng1]

Could be the same root as Glenn's issue: http://forums.veritas.com/discussions/thread.jspa?threadID=56304&tstart=0

Is the Service Account a member of Local Admins on the new server?

[James_Healing]

The resolution has been provided by support (although it did take them 4 days to call back!!!! - I logged the call as critical).

Description of problem
======================

We now check to see if the system mailbox exists by trying to create a new one – requires permissions to create users in AD!!

In V5, if you told EV to create the system mailbox for an Archiving Service then, on top of having full administrator rights
on the Exchange Server, the VSA needed to have Create User object privs in AD. To avoid this requirement you could choose not
to get EV to create the system mailbox for you.

The same would also be true for V6 but unfortunately we now need this right by default even if you want to create the mailbox
manually!

This is because, for v6, we changed the format of the system mailbox to EnterpriseVault(EXCHANGESERVER) from
ExterpriseVault-EXCHANGESERVER for Exchange 2000 and 2003. For customers who upgrade from v5 to v6, they could already
have a mailbox of EnterpriseVault-EXCHANGESERVER and we need to detect this and use it when creating new tasks.

Due to this, we have added code in EV 6.0 to try and figure out if a system mailbox already exists. Unfortunately, the only
way the Microsoft APIs allows us to do this is to attempt to create the mailbox and then we know if this fails that a
mailbox already exists.

Ultimately this change means we need more permissions to add a task for Exchange 2000/2003 in V6.



Description of solution
=======================

When creating a new task the user now has the choice to pick the enterprise vault system mailbox (the format of the mailbox is
not specified) or a chosen mailbox. If the user selects the Enterprise Vault system mailbox the Enterprise Vault will only then
go off and check if the system mailbox exists - it will not do it any earlier.


Files updated
=============

The below files should all be placed in the Enterprise Vault install directory (by default C:\Program Files\Enterprise Vault)

snapin.dll
directoryservice.exe
directorydb_5_viewsstoredprocs.sql


*******************NOTE************************

I checked back with support as SP1 had been released on the same day. This fix is included in SP1.

I upgraded to SP1 over the weekend and the problem has been resolved.

Finally I am still confused as to why I could not enable the server when the service account was given domain admin rights.