We have Enterprise vault 10.0.3 with Exchange Server 2013 CU3.There are muliple emails showing with envelope in Journal mailbox and when we try to process(Store in Vault) them manually, they comes up back to normal envelope icon.When I checked on Journal server Event Log, found Event Id 3427
A user's archive request has failed.
Mailbox: /o=ABCEXH/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=33bb15722e114c7e9b2a452002111346-Journal1
Error: Failed to determine the provisioning group for the mailbox .This mailbox cannot be processed until the Exchange provisioning task has processed the corresponding user's details. Ensure that a provisioning group includes this user and then run the provisioning task. Error: (0x80040d21)
You shouldn't be doing a store-in-vault on items in the journal mailbox.
What do the items actually look like in the journal mailbox? For around 5 minutes they should be pending archive.. a journal part. And then they should be removed, automatically by EV
you can run a dtrace while restarting the task and letting it run for about 5 minutes to see if one of the emails has an issue or in general what the issue is. another way to troubleshoot is to move the emails out of the inbox, restart the task, and move a few back in at a time and see if they get picked up