Enterprise Vault for Exchange: in rare circumstances attachments and mail body are not stripped after the item archival

Problem

Items with multiple attachments do keep their original body, attachments and size even after their archival by Enterprise Vault(EV).

The aforementioned has been observed with Microsoft Exchange 2019.

Error Message

There is no error message, the items are correctly archived and indexed during the archiving (either the manual Store in Vault or using the server task) for random items the body and the attachments are not stripped like set within the Enterprise Vault Mailbox Policy. This could cause undesired Exchange mailbox quota usage.

This is an example of how the item would look like pre and post-archiving:

Pre - Archiving (original item):

Post - Archiving (EV Archived item)

Cause

Exchange Server 2019 has introduced a new indexing framework named 'Big Funnel'; the EV archiving and shortcut processing module make multiple calls to IMapiProp::SaveChanges(..).

When EV invokes SaveChanges(..) during the shortcut creation, the Exchange BigFunnel module is activated, causing a race condition wherein the modification made by EV on the item might randomly get rejected with the error code stating some other non-EV entity has already modified the item and EV needs to re-process the item to persists its change. 

Solution

The issue has been fixed in the following release: Enterprise Vault 14.1.1 or higher, which is available from Downloads. 

The aforementioned fix will prevent any new items from being affected by this issue, it is possible to recreate the  shortcuts erroneously created using the RestoreShortcutBody mechanism.

Such shortcut recreation could be a heavy task and likely not all the shortcuts in the users' mailboxes will be affected. For this reason, since EV 14.1.1, it is possible to define a date interval for which the RestoreShortcutBody will run against.

1) Open Registry Editor and navigate to the below reg key -

    On a 64-bit EV system: HKLM\Software\WoW6432Node\KVS\Enterprise Vault\Agents

2) Create the below registry values -

    - A new REG_DWORD integer value with the name RestoreShortcutBody and a value of 1.
    - A new REG_SZ string value with the name RestoreShortcutBodyStartArchiveDate and a date value in ISO8601 format:     yyyyMMddThh:mm:ssZ
    - A new REG_SZ string value with the name RestoreShortcutBodyEndArchiveDate and a date value in ISO8601 format:     yyyyMMddThh:mm:ssZ

For example a date interval from 01-Jul-2020 to 31-Dec-2020 would have such values:

    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KVS\Enterprise Vault\Agents]

    "RestoreShortcutBody"=dword:00000001
    "RestoreShortcutBodyStartArchiveDate"="20200701T01:01:01Z"
    "RestoreShortcutBodyEndArchiveDate"="20201231T01:01:01Z"

Note: Refer to the related article (100017521) to know more about the impacts of using RestoreShortcutBody registry key.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.