Archiving status = Warning:failed to process mailbox
Hi, I have problems with 4 users mailboxes for other hunders there isn't any problem. In Enterprise Vault their archived mailboxes are empty. There are warnings in Archiving reports that users mailboxes' couldn't be archived and the warning is : Archiving status = "Warning:failed to process mailbox". - There isn't any problem in Deployment Scanner. - Operating System Name Windows 2008 R2 Server Standard (full installation) Service Pack 1 64-bit - SQL 2014 version:12.0.4213.0 - Enterprise Vault Version : 11.0.1.3474 - CHF Version 11.0.1.3683 In Dtrace there are some erors it can be related or not: 2479 10:22:23.628 [5376] (StorageArchive) <5736> EV:H Error MAPI_E_NOT_ENOUGH_MEMORY (0x8007000E): Attempting to read the property into a stream... 2480 10:22:23.628 [5376] (StorageArchive) <5728> EV:L The correct propTag value [0x10100003] is different from the dwAlignPad value [0x00000000] 2481 10:22:23.628 [5376] (StorageArchive) <5720> EV:L The correct propTag value [0x10100003] is different from the dwAlignPad value [0x00000000] 2482 10:22:23.628 [5376] (StorageArchive) <5724> EV:H Error MAPI_E_NOT_ENOUGH_MEMORY (0x8007000E): Attempting to read the property into a stream... 4452 10:22:23.691 [5376] (StorageArchive) <5728> EV:H {WriteSavesetCommand::Execute:#98} _com_error exception: [The system cannot find the path specified. (0x80070003)] 4453 10:22:23.691 [5376] (StorageArchive) <5740> EV:L {CSavesetSISData::GetSavesetIdentifier} (Exit) Status: [Success] 4454 10:22:23.691 [5376] (StorageArchive) <5728> EV:L {WriteSavesetCommand::Execute} (Exit) Status: [The system cannot find the path specified. (0x80070003) (anticipated err may not indicate an issue)] 4455 10:22:23.691 [5376] (StorageArchive) <5740> EV:L {CSaveset2::get_VaultId} (Entry) 4456 10:22:23.691 [5376] (StorageArchive) <5728> EV:L {EVCommandExecutor::ExecuteRecoverWithRetry} (Entry) 4457 10:22:23.691 [5376] (StorageArchive) <5740> EV:L {CSavesetOnIStg::get_VaultId} (Entry) 7040 10:22:29.619 [35632] (ArchiveTask) <6464> EV:H :AgentMessageDispenser::ProcessMessages() |Exiting routine |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3683&error=V-437-2429 7041 10:22:29.619 [35632] (ArchiveTask) <18324> EV:H :CAgentSchedule::ProcessSchedule() |The scheduler is shutting down. |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3683&error=V-437-2399 7042 10:22:29.619 [35632] (ArchiveTask) <10092> EV:L {AgentMessageDispenser::ThreadDeInitialise} (Entry) 7589 10:22:29.743 [35632] (ArchiveTask) <30792> EV:L MSMQ Nack Message Handler for Archive Agent Admin Queue stopped |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3683&error=V-437-6423 7590 10:22:29.743 [35632] (ArchiveTask) <30792> EV:L {CQueue::~CQueue} (Entry) Here is another Dtrace log: 4769667 10:23:39.803 [24624] (ArchiveTask) <23076> EV:H 23076:ServiceMain() |Creating entries for all this agents queues |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3683&error=V-437-2321 4769668 10:23:39.803 [24624] (ArchiveTask) <23076> EV:H 23076:ServiceMain() |Ensure that all required queues are available and usable |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3683&error=V-437-2322 Thank you,
Enterprise Vault items in Outlook show waiting icon
Hello, I have installed Enterprise Vault 11 and I have started to archive a couple of test email boxes. Inside the vault, I can search the archives, so they have been archiving correctly, but on Outlook 2010 the icon is showing the timer, rather than the fully achieve item. Also, when you open up an item, there is a bar at the top of the screen that says, "Do not copy, move, or delete this item. Either Enterprise Vault is archiving the item, or it has been archived and is awaiting backup." Can anyone please help?
Virus detected under c:\users\%username%\appdata\roaming\evvc
Hi There, We recently have deployed new AV (System Center Endpoint Protection) and we have started to received notification of infections detected in following location "c:\users\%username%\appdata\roaming\evvc\" for multiple users across desktop estate. Example: ======================================================================================= Malware Name: Ransom:HTML/Tescrypt.A Number of infections: 1 Last detection time(UTC time): 8/3/2015 7:27:30 PM These are the infections of this malware: 1. Computer name: computername.your.domain Domain: YOUR.DOMAIN Detection time(UTC time): 8/3/2015 7:27:30 PM Malware file path: file:_C:\Users\%username%\AppData\Roaming\evvc\EV_OV_514_1d0ce22_70674199_28bd0e2_1a29a8ab0345040200message.txt ======================================================================================= Company has a history of Cryptowall outbreak in past and origin was email attachment, so I believe that there might be some historical emails archived and placed in Enterprise Vault. I am wondering if someone would be able to explain me, how I could search which is the offending email so that I could remove it from the Mailbox items? I believe that there should be a way to search for the GUID (ID?) which is in detection report: EV_OV_514_1d0ce22_70674199_28bd0e2_1a29a8ab0345040200message.txt So would you so kindly help me with this one? Many thanks. System setup: OS: Windows 7 x64 Office: Office 2010 32bit Add-in: Enterprise Vault v:9.0.9377
Enterprise Vault 10.0.4 addin for Outlook 2013 on an Office365 ProPlus Subsciption
Hi I'm still havgin problems installing the Enterprise Vault 10.0.4 addin for Outlook 2013 on an Office365 ProPlus Subsciption on a machine running Windows 8.1. I've ran through the following article numerous times, with no luck at all. https://support.symantec.com/en_US/article.TECH214359.html Has anyone else had a similar problem and found a way around it? As with previous (solved) issues, it appears as an add-in in Outlook, but as 'inactive'. Cheers