Unable to Open archive items from "One" Folder

[AKL]

Hello All

We are running an Enterprise vault 9.0.1.1073 environment with Exchange 2010 SP2 RU1, single domain, single site, single EV site, Servers in same subnet. Clients are utilizing EV 9.0.1.1073 HTTP client with Outlook 2007 SP2 & Outlook 2010.

Today - (I will like to share with complete background) - Assistant of our CEO called mentioning that she is unable to open archived items from "one" folder under CEO's mailbox - She was able to access archived items from other folders fine, however items in that one folder were prompting for credentials when trying to open item, Tthey weren't taking her credentials or CEO's AD account credentials, and when hit cancel, item was failing to open (Error screen-shot attached)

So I did basic troubleshooting highlighted below and couldn't understand why - so opened case with Symantec support as well (417-289-331 - if anyone wants to follow):

1. Gave my account full rights on archive - Opened archive explorer - Found that there is only 1 item in that folder as per EV archive explorer whereas there are thousand of shortcuts in mailbox in same folder.

2. Gave my account full access on mailbox and opeend as shared mailbox - I was able to reciprocate issue with 9.0.3 HTTP client as well.

3. Logged into a windows machine as CEO himself (gave a good feel - No lie ;) - Configured Outlook 2010 with 9.0.3 HTTP client in online mode - Issue remained same.

4. Tried to put in VSA account credentials on prompt and items started to open. Restarted Outlook - Issue came back.

5. I followed below tech-note and determined that those items are associated with no archive in environment, which made me thinking how VSA is able to locate same

http://www.symantec.com/business/support/index?page=content&id=TECH137201&actp=search&viewlocale=en_...

As per Symantec tech recommendations,:

1. Zapped mailbox & permissions and re-enabled - No luck.

2. Ran EVSVR for finding any issue with archive or related index - No luck

Currently - I am rebuilding complete index for CEO archive (since he doesn't uses search features much either way) to see if it fixes the issue. Against the recommendation of Symantec engg for not to do same as it takes long time.

Any other thoughts that could be tried here? (I am thinking running DTrace on restore component of EV Server while trying to access the item)

Client log available if needed.

[TonySterling]

Do you see any errors in the EV App log?  Also, if you could post the client log that would help.

You might also check the IIS log for any errors.

[AKL]

I didn't see any error in EV event logs so far on server, however I will re-check as recommended.

I have attached client log with my best efforts to keep it anonymous - if you find any hole in same, please ignore and do not highlight :)

I am running DTrace on EV Server as well now to see what EV is trying to do when client is attempting restore.

[TonySterling · Accepted solution]

Could you run this query against the EnterpriseVaultDirectory database?

Select * from Root where VaultEntryId  = '194032CE0232793428711B8CFD72A01081110000EVSITE1'

If you replaced the actual site name with  EVSITE1 change it back.

Then run this query with the RootIdentity if ContainerRootIdentity is Null, if it is populated use that number

Select  * from Archive where RootIdentity = 'RootIdentity from the first query '

What is the ArchiveName?  Does it match the CEO?

[AKL]

Thanks a lot for query Tony - the answer was perfect.

I was going through server DTrace and client log at same time comparing saveset IDs in both logs and found that DDuck was triyng to access archived item from MMouse archive.

And then your query confirmed same as well !

I wasn't thinking of it being permission issue because in the folder I mentioned - All Emails were sent by DDuck himself - So didn't occur to me that it was going to different archive altogether.

Thanks again for query - This will be really helpful for perosns reaching this forum and for me in future :D