Precedence of policies controlling deletion from the Vault

[Zap]

I'm trying to understand what settings take precendence when it comes to deleting email from the EV 9 archive.

'Users can delete items from their archive' at the site level is disabled. 'Prevent deletion of archived items in this category' & 'retain items forever' are configured on the email retention category. Today I discovered that users who have virtual vault enabled are able to delete email from their archive. At first I thought it might just be removing the email from the virtual vault but after sync'ing the email also dissapeared from view in archive explorer. After digging around I found the virtual vault policy has 'Users can hard delete items' set to yes. So it would seem that this lower level policy setting takes precedence over the site & retention category settings.

Would anyone care to have a crack at explaining how EV determines if a user can delete an email from the archive? I'm assuming there's an order of precendence? Or at least please point me to a reference?

Thanks

[JesusWept3 · Accepted solution]

First is ge retention category, if the prevent deletion is checked, then EV treats this as a legal hold, even if you attempted to delete the users archive, any items in a retention category where deletion is prevented, the archive will not be deleted, and those items will remain Second is the prevent users from deleting set on the site level, if this is not checked, then delete from vault buttons will be hidden, and any deletions in outlook will become soft deleted where its just the shortcut deleted and not the archived item I'm not sure how this is deleting items for you, but a virtual vault delete should not allow users to delete from the physical archive, especially with the retention category set to prevent, I'd actually say its impossible

[MichelZ]

Hi

This article states that "Users can delete items from their archives" takes precedence to "Users can hard delete":

http://www.symantec.com/business/support/index?page=content&id=HOWTO37759

Are you sure that the mails are physically being deleted from the Archive?

Cheers
Michel

[Zap]

Thanks guys, I will do some more testing to verify that the mail was actually deleted for the user who was testing for me. I have turned off hard deletes in the virtual vault policy now until I get this sorted. Is there any chance what I am seeing is smoke and mirrors in front of the user but the emails actually still exist on the EV server? how would I check it beyond using archive explorer?

On another note I discovered that the virtual vault policy was allowing users to manually archive items which we had never done before. It would seem that shortcuts are not being created for emails dragged into the virtual vault. Am I correct in saying this is by design? Is there anyway to enable shortcut creation for items manually dropped into virtual vault?

Sorry about the questions, I'm playing catchup. Virtual Vault was enabled during my absence from work and hence I'm trying to work through the implications it has caused.

[Zap]

Did some more testing and checked the logs. The deleted emails were actually being moved to the deleleted items folder of the virtual vault. I tried to hard delete the them and was denied. So everything is actually working by design.

Anyone know if shortcuts can be created in a user mailbox for email that is manually dragged into the virtual vault?

[MichelZ]

It is by design that shortcuts do not get created for items dragged into VV.
I don't think you can do that.

What would be the reason to have a shortcut when you have Virtual Vault?
Virtual Vault is all about getting rid of shortcuts in the mailbox ;)

Cheers
Michel

[Zap]

Thanks Michel, I thought that would be the case. The only reason why I would like to create shortcuts is because we have a user base that is well educated in shortcuts. Due to reasons outside of my control virtual vault got turned on for all users and now can not be removed. Less than ideal. We're in the early stages of a large PST migration project and we have a lot of grumpy users who I think might be more accepting if we used virtual vault. Problem I have is from a support point of view we don't want to handle a mixed environment (some users with shortcuts others without). I thought a simple solution to keep things consistent would be to have shortcuts created for items archived through VV. I understand we're asking it to do something it wasn't designed for, I'm just trying to make the best of an unfortunate situation.

[MichelZ]

You could just disallow users to drag things into Virtual Vault...  Maybe that would be an option?

Cheers