How to filter for the archives who are deleted from AD

[tauseef_mohamad]

Hello,

Environment:

EV 9.0.4

I need to get a report for the archives who are deleted from Active Directory

Do we compare the usage report with existing AD report and then filter that does not match the usage, however the question is that what do we compare cause there will be duplicate names. Should can compare the billing account.

I also tried to check the exchange mailbox entry table however i do not have the reference for the values for each column.

[Rob_Wilcox1 · Accepted solution]

This might help:

https://www-secure.symantec.com/connect/downloads/script-show-archives-no-user-accounts

[tauseef_mohamad]

Thank you for the prompt response. I tried both the queries :

strQuery = "SELECT A.ArchiveName, T.SID FROM Archive A, Trustee T, Root R WHERE A.RootIdentity = R.RootIdentity AND R.OwningTrusteeIdentity = T.TrusteeIdentity"

Use :

SELECT a.archivename, a.sid FROM archiveview a left outer join trustee t on T.TrusteeIdentity = a.OwningTrusteeIdentity

However it also gives users who are active. I want to delete the archives of the users deleted from AD hence we need the report and we do not want to delete any archive that is for an active user.

[GabeV]

When you list all the archives in the VAC, you can tell if the account was deleted or not sorting by billing account. If you see the SID in the list, then that means EV couldn't find the AD account. Of course, this is based in the fact that the billing account matches the same mailbox and AD account. When the mailbox is automatic enabled for archiving, EV assigns the user account as a billing account. Using that information, you can go ahead and delete the archives directly from the VAC. Also, you can export this view to a text file.

I hope this helps.

[Rob_Wilcox1]

The SQL Statement in my link will give ALL archives.  But the script interprets the results, resolves the SIDs and shows 'unknown' for unresolvable SIDs.  Unresolvable SIDs are the ones where the AD account has been deleted.