EV Audit query question
Hi All, I have stucked in the middle of situation as described below, I'm planning have results of "who & which" deletetion action taken in EV Archiving, Example result which i want to get result of : yyyy archive point deleted by Aaaa user. Query i tried is like ; DECLARE @ArchiveId varchar(112) DECLARE @StartDateTime datetime DECLARE @EndDateTime datetime SET @ArchiveId = '1B29F35DAA512AC47A64558FDF7A614571110000example.local' SET @StartDateTime = '2017-10-05 08:27:48' SET @EndDateTime = '2017-10-05 08:28:37' CREATE TABLE #ArchiveFolders ( VaultEntryId varchar(112) ) INSERT INTO #ArchiveFolders SELECT VaultEntryId FROM [EnterpriseVaultDirectory].[dbo].[ArchiveFolderView] WHERE ArchiveVEID = @ArchiveId SELECT * FROM [EnterpriseVaultAudit].[dbo].[EVAuditView] auditView LEFT JOIN #ArchiveFolders archFolder ON archFolder.VaultEntryId = auditView.Vault WHERE AuditDate BETWEEN @StartDateTime and @EndDateTime AND CategoryName in ('Search', 'Delete') ORDER BY AuditID DROP TABLE #ArchiveFolders This query returns me result of deleted items, however the thing i want to combine this result is "whom archive point" As explained above , Vault section is generated, however generated result is not giving us correct archiving point. with this result it's quite hard to understand taken deletion action. May i ask your support to get best result according to my request?Audit Search
Hi, We have been asked to search through multiple users mailboxes for keywords. This is fine in Exchange, but not how I remember it in Vault. We are running V11 and I have not done this since maybe v8 or v9. First problem. I have no rights to the users archives. Is there a quick way to add the EV admin user to have rights to the all of the Mailbox Archives in EV? I don't want to have to struggle though hundreds of vaults adding in permissions. Next, is there a good way to search through a load (many, but not all) mailbox vaults for certain key words and export that information to PST for example? I know I did this many years ago in an older version, but not sure how now. Hopefully this will be something failrly common and will be easy to do. Many thanks in advance.