Permissions on Folders within PSTs being honored in Archive once PST is migrated.

[scumnvillainy]

Hello,

SEV 7.5/SP3. Exchange Archiving. We are in the pilot phase still for this application, only IT has been enabled and a small subset of our user community. We are seeing certain user's migrated PST folders show up in other users Archive Explorer view. Looking at the original PSTs, we see that certain folders were permissioned in Outlook by the end user to allow access to those folders by other users. This most likely was done on those folders while they were in the actual mailbox, and were just retained once they were dragged into a PST.

We are OK with EV honoring permissions set on mailboxes, but we do not want EV to honor custom perm's on PSTs. Is there a way to turn this off for just PST ingested items? We also are a bit confused on the difference between these 2 settings under the Synch tab on each EXCH Mailbox Archive Task:

"Mailbox properties and permissions"

"Folder hierarchy and permissions"

And also under the Mailbox Policy/Adv/Arch. General Tab there is a setting named "Inherited permissions".

We are confused as to what each of these 3 settings actually do. The help and admin guides are a bit vague regarding these settings. Any help would be appreciated.

[Joseph_Rodgers · Accepted solution]

Hi,

1.  This stinks but unfortunately it is a "Feature"  from Microsoft. When a pst is created it will keep the folder permissions of exported folders.

From: http://support.microsoft.com/kb/287070

"Note Folder design properties include permissions, filters, description, forms, and views. If you export items from one .pst file to another, no folder design properties are maintained."

 No good answer on this one.  Are you archiving the items to original location?  If so try using a new root (\Migradted PSTs or something).  This might work.

2.When the auto mailbox sync runs it processes both the mailbox & folders.  SYmantec seperated it  out for the manual sync.

3.Inherited permissions would be those assigned at a higher level in Exchange by an admin.  IE. granting a user account (such as the VSA) full permissions to all mailboxes at the server level.  By default these permissions will NOT sync down the vault.  Only permissions directly assign to a user's mailbox or folder will be synced.

-Joe

[scumnvillainy]

Thanks for the info Joe. That is the most info we have been able to get regarding these configuration settings. We are not migrating PST info back into their original mailbox locations so we will just have to live with how it is for now. But again, you did explain for us a lot of behavior we were uncertain about regarding how SEV honors/process both Outlook set, and AD set mbox perm's. Very helpful!!!