User name not populate while single user provisioning

[Shashikanth_L]

Hi Team,

One of the user is unable to access his mail which are archive to EV, and when checked the database in EV I could find the user permission are lost.

I had added the permission to the datbase and i was trying to provision the single mail box, i will trying to select the user from the list, but could not find the user name.

EV is attched to Domino.

[Paul_Honey]

Shashikanth,

This may sound like a stuupid question, but does the user actually still exist in the Domino Directory in this environment?

EV automatically synchronizes the username from the ACL of the correspoding user mail file in Domino and validates that the entries we find in the ACL also exist in the Domino Directoy (i.e. that they are current / valid users).

The fact that you suggest this entry has disappeared or been lost from the user's archive permissions, and also that you cannot find the user in the list to re-add it manually (that 'list' will also be querying the DOomino Directory to present available users to add), suggests to me that there is possibly an issue on the Domino side of things, with the user either removed from the entire Domino Domain / Directory, or at least not present in the Domino Directory on the Domino server where EV is performing its queries / lookups.

Regards

Paul

[Shashikanth_L]

Hi Paul,

Yes the user still exists in the Domino Directory, i had double checked in the Domino server it is quering to.

i could see the user still exists in the domino directory. for confirmation I had edited his person document in the EV server also, but still i am unable to find the name in the list.

Let me know how to manually add the user name.

[Paul_Honey]

Shashikanth,

To manually add a Domino user to the permissions of a Domino archive, you can only use the VAC - EVSite - Archives - Domino Mailbox, right click on the archive in question, then on the Permissions tab, select '+ Domino', and in the Add Domino Users, Groups and Wildcards prompt, use the 'Name Contains' / Search to find the user in question, highlight the user, and 'Add'.

If the Add Domino Users, Groups and Wildcards prompt, 'Name Contains' / Search fails to find the user, , but you know the user is listed in the Domino Directory, as you are suggesting in your previous posts, then the next thing I would try would be a rebuild of the indexes of the Domino Directory that EV is looking up against, as those indexes can get stale and out of date and not always return expected results. Have you tried a 'load updall names.nsf' on the Domino server in question to check if it is a Domino Directory index issue?

If that is still not successful, then I would suggest you need to open a case with Support. I am happy to continue helping via the forum and also assist whoever picks up such a case but it is best if we formally track the problem and resolution through support.

The main things that you should reference in the case notes, assuming my understanding of the issue is correct are:

1. User cannot access their data in their mailbox archive - so it is pretty urgent to resolve!

2. The user is listed in their mail file ACL, but this permission is not replicated on the mailbox archive permissions. This suggests that something is going wrong with the provisioning of this user's mail file as the two should always be kept in sync by provisioning, avoiding the need to ever manually add user permissions to a Domino archive

3. The user cannot even be manually added to the archive permissions, as they do not show up in the 'Add User' prompt as described above

For point 3, if you can include DTrace of the MMC and ADMINSERVICE tasks when trying to manually add the user and post it back here / include with the case notes, along with the user's name, then I may be able to see something obvious in that debug output as to why the issue is occurring.

For point 2, DTrace of the EVLotusPolicySyncTask and the failing user's name would be equally helpful for me to look at if you can post here / include with the case notes

Long term, it is essential to resolve point 2 above, as that makes point 3 unnecessary and redundant, but I understand you may want to first fix step 3 as that could give your user immediate relief / resolution.

I look forward to seeing some Dtrace and, if you would not mind, a case reference too so I can co-ordinate the relevant support guys in teh background

Regards

Paul

[Shashikanth_L]

Hi Paul,

I was able to add the permission back to the DB on the EV and asked user to check the status, but user was not able to access the mail in EV, so I had tried to do the provision for the user DB alone, but when try to serarch the user, i cant find his name.

When i click on Synchronize Individual mailboxes and search for the user name i dont find his name in the list.

As I am new to the EV don't know how to do the DTRACE, please guide me. I had not yet created Case as of now.

[Paul_Honey]

OK, you were talking about a different 'list' to tthe one I was expecting. Can you check if this user is actually listed in a Domino provisioning group - EVSite - Targets - Domino - DominoDomainName - Provisioning Group??

Regards

Paul

[Shashikanth_L]

Where should i check the user name.

Am I looking at the correct place, how to check the user list from hear.

[Paul_Honey]

You are in the right place, but have quite a few different Provisioing Groups so you would need to manually open each one to discover who and how they target users. I fear you may discover in some of these groups that Domino groups are added, rather than individual user names, so there would be another layer of complexity to detemine if and and how this probloem user is currently being provisioned.

So, this method may helpr. Right click on EVSite - Targets - Domino and select 'Display Policies Assigned to Mailboxes'. Then in the window that appears try and search for your problem user as below.

If it finds them, it should also list which provisioning group causes this policy assignment in the results. Screenshot these results and attach to a reply here

Then double click / open the provisioning group in question and see what type of targets it contains. If it contains individual mailbox targets (envelope icon), is one of them your problem user? If it contains Domino group targets (2 people icon), does your problem user defintiely reside in one of those Domino groups in the Domino Directory?

Again, screenshotting your results here will help me understand your environment further and possible causes for the issue

Regards

Paul

[Shashikanth_L]

As per you sujjestion, I had opened that window and typed the name i was looking for, but unfortunately it did not displayed the name.

[Paul_Honey]

So, I would hazard a guess that this user is no longer a target within any of your provisioning groups and has been inadvertently removed from provisioning at some point.

You really should consider opening a case with Support for further help on this

Nesxts teps I would try would be to open each of your provisioning groups and understand how your users have been added to them as targets - i.e. are they added as individuals or memebers of Domino groups. Then you need to figure out which provisioing group this problem user should be in, maybe try and determine how or why they have been removed from it at some point, and then re-add them, ensure that they are enabled, re-run provisioning, re-check that they then have an assigned policy, check to see if provisioning has now updated the archive permissions to be in line with the mail file ACL, and after all of that, check that they can access their data again.

Regards

Paul

[Shashikanth_L]

I had raise a case and the Case # 07804741, I am waiting for engineer to call me back or email me.

[Paul_Honey · Accepted solution]

Shashikanth,

I understand from support's investigation that this user is in fact in the process of being migrated from Domino to Exchange and the Domino Provisioning Report revealed that, whilst the user still has a person document in the Domino Directory, it has been updated to “Other Internet Mail” as part of your migration workflow. EV will therefore logically no longer recognise, nor provision this user as a valid Domino mail user.

If this user is still accessing their old Domino mail and EV shortcuts via a Notes client and Domino server, despite having been migrated according to the person document update, then you will need to manually manage Domino permissions on that archive, which I understand from Support you have now done.

I hope that resolves this forum thread too

Regards

Paul

[Shashikanth_L]

Hi Paul,

User was using Lotus notes to access the EV and i had checked the permission on the mail file inthe domino server and permissions seems to be fine.

I had done the following to resolve the issue.

First I had manually don the provisioning on the mail file, and I could see that the user permissions got disappered after i had done the provisioning. As it is not picking the correct ACL from the domino, I had created a new group and added user name to that group and added to the ACL of mail file in Domino. once the permission is replicated to all the domino servers then i had done the provisioning then the group permission got update and user was able to access the EV.