Re-Archiving restored items

[Schadenfreude]

Greetings,

I'm Running EV2007 SP3 with Exchange 2003SP2.

Yesterday I had to restore all a users item to her mailbox because she found the process of finding items using the vault searches too difficult (whatever).  I used the export feature in the vault console to restore the items back to the original mailbox. Anyway, I now need to re-archive her mailbox but using a different policy that replaces items with shortcuts on stuff that's over 6 months old (which I have in place and is now her default policy).

My question is this.  Because the modified date has changed on these restored items will I have to wait 6 months from now before those restored items get re-archived? Is there a way to get around this other than manually going through her million subfolders and manually archiving all item older than 6 months?

Thanks

[Michael_Bilsbor]

Hi,

EV does't use the modified date it uses the recevied date or sent date which should be unchanged in your case.

[Schadenfreude]

Hmmm, all the items are still there after last night's archiving run. So I guess my question still stands, How can I re-archive items which have been restored with out having to do it manually?

[Dietmar_Deeg]

I'm afraid, you are right. After restoring items back to the mailbox you have to wait the time you configured in your policy.

regards (gruesse)

Dietmar

[Schadenfreude]

Wow that really blows... after the restore this user now has a 13GB mailbox, I need to replace anything older than 6 mos with a shortcut, but from what I understand there no way to configure a policy to do that.  If there is I'd really like to know about it.

Why oh why would the instructions for restoring shortcuts tell you to restore the items from vault and re-achive using shortcuts (when its not possible)?  If I had known I would have recovered her mailbox from an exchange back up and merged her shortcuts back in to her live mailbox.

[scumnvillainy]

I went through something similar. You need to know that with standard messages and Exchange Archiving, by default, EV determines what is elligible for archiving by the sent/recieve date of the email (which in most cases is the same date as last modified). It's the Restored messages that are different. Restored messages are recognized by EV as having been restored and by default EV will then determine a restored items archiving elligibility based on the last modified date. That means that restored items would not get re-archived until X # of days pass (X = whatever your policy is set to) after the restore occurred.

If you want restored items to get re-archived automatically again the next time the archiving task runs then there is a registry tweak that can be enabled on the SEV server so it ignores last modified dates on Restored items and always archives by sent/recieve date.

Check out this KB article too..

http://seer.entsupport.symantec.com/docs/285091.htm

See Option 3, Step3 for that reg key.

Changing that registry key however would be a site wide change, you can't edit that by policy in v7.5.

I don't know if this is going to help you, but if you understand the process a little better maybe you can think of a solution.

[scumnvillainy]

I think I understand your issue a bit better now. I assume the user was originally in a policy that archived items at some time younger then 6 months, like 3 or 4 months? Then she complained and you restored her items back into exchange and bumped her policy out farther to 6 months?? Now you want everything you restored older then 6 months to get re-archived ASAP??

If this is the scenario, you could try this...

- Create a policy just for her where everything is archived older the 6 mos

- Provision her and sync the account, make sure it applies to her only.

- Make sure no other archive tasks are running (if you allow end user archiving this may bite you)

- Make that reg. change on your server so it goes by sent/recieve date on restores in my first post

- run the archive task on just this user

- Verify it works then change the reg. tweak back to default

- renable everyone else, put her back in the proper policy

Obviously you should test this out in a dev lab first...but it might work.

[EV_Guru]

When you restore archived items to your outlook, then the mails are restored as they were original, also with the original date. So after your NEXT archiving run, the mailbox policy apply and those emails are going to be archived again and replaced by shortcuts (when your mailbox policy is so configured).

So no manual archiving is needed, the next archiving run will fix it.

________________

www.longerich.com

[Schadenfreude · Accepted solution]

Thanks for the replies everyone,

Actually 2 archiving runs went by without the restored items being re-archived, some searching around lead me to this

http://seer.entsupport.symantec.com/docs/285091.htm

the part I was missing was this:

3. To allow Enterprise Vault to archive the restored items during the next archiving run, create  the REG_DWORD IgnoreEVDates in HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\Agent.  Set the value of IgnoreEVDates to 3 (decimal), then restart the archiving task.

I did that and after last night's archiving run all the restored items are now replaced with shortcuts

[Paul_Grimshaw]

Just to clear this thraed up. There was the statement earlier in the thread:-

When you restore archived items to your outlook, then the mails are restored as they were original, also with the original date. So after your NEXT archiving run, the mailbox policy apply and those emails are going to be archived again and replaced by shortcuts (when your mailbox policy is so configured). So no manual archiving is needed, the next archiving run will fix it.

Unfortunately this is not strictly true as when an item is restored back to the mailbox the message is stamped with a MAPI property called Restored Date. You can see this if you look at the message post restore with outlook spy. The next archiving date is then by default calculated from the fact that there is a restored Date MAPI attribute on the message.

In full this is how we determine eligibility:-

If a Restored Date or Archived Date is present i.e It has been archived previously and restored then we use PR_LAST_MODIFICATION_TIME

If a message has not previously been archived then we look for values in the following order. So if PR_MESSAGE_DELIVERY_TIME does not have a value for whatever reason then we look for PR_CLIENT_SUBMIT_TIME and so on.

        PR_MESSAGE_DELIVERY_TIME

        PR_CLIENT_SUBMIT_TIME

     PR_CREATION_TIME

So in normal mailbox archiving the date used is PR_MESSAGE_DELIVERY_TIME

As stated as well if you want to ignore the restored date then the registry mentioned is the correct way to do this.