Shadow copies on leaver mailboxes not clearing

[ashks2014]

Hi All,

As part of our leavers policy, we run a zero-day archiving task against leaver mailboxes. After everything is vaulted the mailbox is disabled from vaulting and then deleted from Exchange.

The problem is even though mail has been archived, we're left with large numbers of shadow copies in the mailbox. Is there anything we can do to remove them? They are still there even after our weekly EV Backup finishes. Shouldn't that clear the shadow copies from the mailbox?

We've looked at turning off shadow copies but in the meantime is there any way of clearing these mailboxes so the item count gets down to 0?

Any advice is much appreciated!

Thanks

[ashks2014]

I've attached a screenshot to illustrate a typical example of a leavers mailbox after archiving.

[GabeV]

Hi ashks2014,

What software are you using for backups? and also, are you using the archive bit or the trigger file? The pending items should be repladed by a shortcut (or removed from the mailbox depending of the mailbox policy settings) once the archived items have been marked as secured and the vault stores are set/clear from backup mode. If everything is in place and configured as it should, a dtrace of StorageFileWatch should give you more details. You can setup a dtrace, set/clear backup mode in the Vault Store and look at the dtrace log file.

In addition, this technote might help:

Messages are awaiting backup after full backup has been completed.
http://www.symantec.com/docs/TECH69486

I hope this helps.

[Rob_Wilcox1]

You may want to consider our free tool, Archive Leavers.

Failing that after archiving, you'll need to do a good, full, EV-aware backup to turn the items in to 'proper' shortcuts, or even better, make sure they're being archived with a policy that doesn't even create shortcuts.

Net result. You'll be left with a mailbox full of shortcuts..  but you'll still not be quite sure what's happened, or happening, since you will have to manually check in the mailbox.

[ashks2014]

We are using Commvault Simpana V10 and EV 10.0.4.1251. We're using the archive attribute with safety copies set to be removed after backup. None of the vault stores are currently in backup mode. One thing i noticed tho is that under last item secured it says 'no backup detected' as below. I will try the dtrace now.

[ashks2014]

Hi Rob..thanks for the reply but not sure we'll be allowed the free tool! Is there no way just to flush these safety copies from the mailboxes? All we want is an empty mailbox so we can remove it from Exchange.

[WiTSend]

I would suspect that you are disabling the mailbox before the final process of removing the shortcuts (shadow copies).   There are a couple steps I would add:

     1) in your "leavers" policy don't have the archive task create shortcuts.  The shortcuts in your graphic appear to be pending shortcuts and it would be best to not create them at all.

other options would be:

    2) Either put a couple day time delay in the step to disable the mailbox,

     3) OR- enable EV to process disabled mailboxes.

If you have actual, not pending, shortcuts then you'll need to use an Exchange process to delete the IPM subtype for shortcuts.

[AndrewB]

i see a couple options for you to try:

1) you can set your vault stores to remove safety copies (what you call shadow copies) immediately

2) you can switch to a trigger file instead of the archive bit

[GabeV]

'No backup detected' means that no backup has occurred. Since you are using the archive bit, open a command prompt, go to the root of the EV partition and run this Windows command to verify the archive attribute:

attrib *.* /s > c:\attrib_out.txt

Then, open the text file c:\attrib_out.txt. If you see the archive attribute, then you need to check the backup software settings or implement the trigger file. Here is an example output:

A            F:\EVStorage\Vault Store\Ptn1\2010\04-01\E\07A\E07A38E8C76CC6E7588C0F6E06B28BE1.DVS
A            F:\EVStorage\Vault Store\Ptn1\2010\04-02\9\07D\907D53B71E6C720864C366DF5EBD89A1.DVS
A            F:\EVStorage\Vault Store\Ptn1\2010\04-14\9\101\9101A578CA85CAEF369F735163D0FCF1.DVS
A            F:\EVStorage\Vault Store\Ptn1\2010\04-14\9\101\9101AAA1FF79077E2A3E3599FD871C71.DVS
A            F:\EVStorage\Vault Store\Ptn1\2010\04-14\9\101\9101AAFE78858852D5DBA3F4938F5961.DVS
A            F:\EVStorage\Vault Store\Ptn1\2010\04-14\9\101\9101AF8B75DC7C07080B9F44EEC7DEA1.DVS
A            F:\EVStorage\Vault Store\Ptn1\2010\04-14\A\070\A070339CAD89D825B803F168E6AD9CF1.DVS

I hope this helps.

[ashks2014]

We do disable the AD account but not the EV archiving. Should that affect shortcut processing? It doesn't happen to all mailboxes, it just seems some of them get stuck! We don't use actual shortcuts or stubs.

[ashks2014]

If we do this, does that then flush the existing safety copies from the leaver mailboxes they are still in?

We just need a way to try to remove the safety copies from our existing leavers so we can go ahead and delete the mailbox from Exchange.

[AndrewB]

yes that's the concept - but it applies to all archives/mailboxes in your vault store. you can't single out just the leavers.

[AndrewB]

make sure you have this in place too

Archiving a mailbox with a disabled Active Directory (AD) account

Article:TECH76587

|

Created: 2009-01-09

|

Updated: 2014-01-02

|

Article URL http://www.symantec.com/docs/TECH76587

[ashks2014]

Thanks mate, this is in place already :)

[ashks2014]

Have run that but i can't see the entries above anywhere.. a search on evstorage just finds this.

[ashks2014]

Thanks to all for all the replies..really helpful. Looks like the backup doesn't clear the shadow copies.

The items with shortcuts are searchable in the users archive so is it safe to delete a mailbox if all it contains is shadow copies? We know the items are vaulted so presumably it;s safe to delete a shadow copy?

[AndrewB]

your best bet (for EV overall, not just your 'eavers) would be one of the two options i outlined.