Report to know if an e-mail was archived by manually or by policy

[Gonza]

Hi, I have a policy to archive everything in the last 6 months but a user is telling me that an e-mail with date April 4th 2009 was archived. Someone knows how I could investigate if this e-mails was archived by the user or by a police mistake ???

Thanks
GP

[TonySterling]

You can start with finding the archive date:

To find the archive date...

Highlight the archived item and then hold down Ctrl+Shift and click an EV icon.  Then click Vault Information:

Scroll down to the section called IPM.Note.EnterpriseVault.Shortcut, the archived date will be listed there.

 

If the time is outside of your archive window you can rule out policy mistakes.

Also, do you have Auditing enabled?
 

[Liam_Finn1]

I think the only way to do this is to check the database to see the archive time.

if it was archived during your scheduled archive runs then you can assume that it was done by the archiving task but if outside the normal task times then you can assume it was done by the user

If your live archiving runs during the the same time you have users online then you are SOL

[Gonza]

The windows time is 24 hs with interval with 1 hour. What is SOL ?

Thanks
GP

[Gonza]

Auditing is enable.

Thanks
GP

[TonySterling]

Well if auditing is enabled and you audit archive then look at the date and time it was archived using the method i described and then check the audit logs for that time period.  that might help you show who did the archiving.

[Gonza]

OK Tony, in this moment I have the sql server freeze. I have an open forum for that.