Event 6940 - Storage Online

[Sarah_Seftel1]

"Client request refused due to insufficient privileges, user domain\user attempted to access the Archive: 

Archive name: Corinne Lanoy 

Vault Id: 148B257F583D75347BA84A3F06F35CE301110000SERVER but does not have permission(s) (Read). 

A frequent cause of this Warning is a user attempting an operation on a forwarded, moved, or copied shortcut to a Vault for which they do not have the required permission(s). "

I can understand this event when I am using stubs, and someone forwarded the stub to someone else instead on the email.

BUT - I have loads of those events in a stubs free environment.

So - what can cause this?

Sarah.

[Rob_Wilcox1]

Have you tracked down a user that CAUSED the event?

If so..

See if they have been trying to use browser search?

[Elio_C]

Are you using the Vault Cache? Allowing users to synchronise additional archives?

We had lots of similar issues where colleagues were synchronising additional archives. The mailbox permissions were synchronised from Exchange to the VV folder but lots of our data came from PST imports and some folders had "different" permissions.

In the end we removed the "Vaults" tab from the client add-in (Synchronise Archive Type set to Default Mailbox in the Desktop policy) and forced colleagues to use the Archive Explorer.

No more additional caches which stopped our 6940 errors. Or you could simply update the archive permissions.

I would definitely NOT update the policies to "Include default and anonymous permissions" as some Symantec articles suggest.