Failed Distribution List Advice/Guidance

[sleddog]

We have deployed EV Journaling in a very, very large environment. I have already come across some failed DL Expansions. They are in the Failed DLs Folder in the journal mailbox as you would expect.

I know I can change the policy to archive even if one of the DLs fails to expand, but this leaves me open to potentially having valid DL Expansion fail and the item be put in the archive and be unsearchable. This is a problem.

Does anyone have a best practice to deal with this? I don't see manually moving failed items back into the Journal Inbox as a practical solution... simply due to the scope of administering this solution.

Am I missing an obvious solution to this issue?

Thanks!!

[JesusWept3]

there is an option to move failed items back in to the inbox in the Advanced archive settings of the journal policy

[sleddog]

Then there will be an e-mail discoverable by name that was received by the DL Member.

Given this, is it really a big deal if a valid DL Fails to expand occasionally? What do you think?

Thanks for the input!

[JesusWept3]

it can be a big deal because it would be harder to prove that an item was received by someone
So for instance if you search on DL-myDistList 2 years after its been archived, who knows who has been added and removed from that list, you can "assume" someone received something, but you can't prove it unless you have backups of AD to that point when it was sent/received

[sleddog]

There is a copy of that e-mail in the DL Member's inbox that gets journaled/archived correct? So if I search on everything associated with a user, (we never search on a DL) the received e-mail will be in the journal archive, thus discoverable. That would be proof the message was received, No?

Thanks!!

[JesusWept3 · Accepted solution]

actually you're right i'm talking crap, its not that big of a deal if you use envelope journaling, if you don't use envelope journaling (only in 2003, you can't turn off envelope journaling in 2007 or 2010) then you'd have a problem

The real issue would be detection of BCC/undisclosed recipients

[sleddog]

We are doing Journaling at the Hub Transport and we see BCCs in the envelope. Seems like we really don't need DL Expansion once we are on Exchange 2007. Agreed?

Thanks!!

[JesusWept3]

Well the thing is the Envelope Message (P1) will contain all the people that received it, you're right, but it does not denote whether they were To, CC or BCC

So lets say I sent a message to DL-HelpDesk and it has the following members

User A, User B, User C, User D

I send message such as

Subject: Not enough imagination to think of one
To: DL-HelpDesk
BCC: User E

The message hits the inbox and in the P1 message of the envelope it has the following recipients

User A
User B
User C
User D
User E

From the above you can't actually tell whether they were sent to as a DL, individually or in the BCC field, so what Enterprise Vault does is it then opens up the actual message (the P2 message) and it compares the To and CC lines

It will then see that the only recipient is DL-HelpDesk, so then it goes to Exchange and then does a cross check of each user,and it will then see that User E is not in DL-HelpDesk, and he's not in to the To line or the CC line, so therefor he is an undisclosed recipient

It then gets added to the index as an RBCC field and a couple of others denoting that the user is a BCC recipient