Expiry Deleting Messages in Archives Locked for Legal Hold

[PerfumeKing]

We are running Enterprise Vault version: 11.0.0.1470 on Microsoft Windows Server 2008 R2 Standard Service Pack 1.

We recently turned on the Expiry process in our environment after it had been inactive for a long time.  Prior to activating Expiry I used the Administration Console to find all Exchange Mailboxes for individuals involved in legal issues, and cleared the checkbox for the Deletion Protection options “Allow deletion of archived items and of this archive” and “Delete expired items from this archive automatically”.  I also ran a SQL query to confirm all messages in these archives were set to the retention category “Business”, which shows the checkbox set for “Retain items forever” in the policies section of the Administration Console.

I was surprised to discover one of these mailboxes went from 85k messages down to 64k messages after the Expiry process was run.  I’m looking to understand why this could have happened with the safeguards I described in place.

[RahulG]

I would suggest you first check the storage expiry report which you may found in the event Log. If the Items are placed on Hold by Discovery acclerator the expiry should not delete the items from the archive thought the retension period expire.

[JesusWept3 · Accepted solution]

Would suggest opening a case with support , it sounds like you did everything right The allow deletion is just for regular user deletes, it won't protect you from expiry, but it would stop them deleting items manually So either there was a miscount of items, or someone changed the config after you set it before the expiry or it's a bug In the expiry event after it ran, how many items in the business retention were deleted?

[GertjanA]

Or, perhaps, those items have a different retention period?