cancel
Showing results for 
Search instead for 
Did you mean: 

User getting access denied on some, but not all emails after ingesting from PST (Event 6287 - Access Denied)

DW7084
Level 2

We have a user on Enterprise Vault that can't access all of her emails.

The emails were originally ingested from a PST file. She could access them fine when they were in a PST, but now some of her emails prompt for a username/password when she trys to open them.

It seems to be very random. Some emails she can open fine, and others she can't. There is no pattern with age, sender, folder etc.

The event log says:

Event 6287

Unable to fetch item from "evemail.----------------------.local". 
Reason: Access denied      (0xc0041801) 
Saveset Id: 201404016361959~201403171245200000~Z~90C562118F74ABF192CC51998E280991 
Archive Name: ----username's name---
Archive Folder Path: Archive Archive Folders Personal 
Reference: [GOAFS] 

I've checked her permissions and she has read, write and delete. I've also granted myself permissions and I can't access the same emails too, although I can access other emails belonging to this user fine.

Something that seems a little weird to me is the squares in the Archive Folder Path shown in the event log (see attached screenshot). Is this normal?

EVEmail-AcessDenied-6287.png

We're running Windows Server 2008 R2, EV 10.0.3.1090 and Exchange 2010 SP3.

I hope someone can help me out, because I'm stumped!

Thanks!

Drew

4 REPLIES 4

Rob_Wilcox1
Level 6
Partner

Isn't this something that will be cured with this technote?

http://www.symantec.com/business/support/index?page=content&id=TECH139601

 

Working for cloudficient.com

DW7084
Level 2

Thanks for the speedy reply!

I hadn't seen that before, but unfortunately after following the steps and re-syncing the permissions with the Mailbox Archiving task, I still can't unarchive these particular emails.

Rob_Wilcox1
Level 6
Partner

Does permissions browser show you anything useful?

Working for cloudficient.com

DW7084
Level 2

No, I don't think so. All the folders say the same thing:

Control: SE_SELF_RELATIVE | SE_DACL_PRESENT
Owner:
  SID: None
Group:
  SID: None
Dacl:
    Header: 
      AceType: ACCESS_ALLOWED_ACE_TYPE
      AceFlags: 
    Mask: 0x7F
      DV_DS_CONTROL_FOLDER
      DV_DS_DELETE_FOLDER
      DV_DS_ADD_FOLDER
      DV_DS_READ_FOLDER
      DV_DS_DELETE_ITEM
      DV_DS_ADD_ITEM
      DV_DS_READ_ITEM
    Sid:
      SID: S-1-5-21-823518204-725345543-682003330-12624
      Name: ---------User Name----------
      DomainName: ----------Domain----------

I'm not 100% sure what it should say though?