Enterprise Vault™ Administrator's Guide

Note the following:

• The user who runs the cmdlet must have the roles-based administration permission to manage the specified type of archive. For example, to manage Exchange Mailbox archives, the user must have the roles-based administration permission "Can manage Exchange Mailbox Archives".

• You can use this cmdlet to set access permissions for users that have Active Directory or Domino Directory accounts. Note that Domino users can have access permissions only on Domino mailbox archives. To add Domino users, you need to install the Notes client and configure the Domino domain on the Enterprise Vault server.

• This cmdlet only grants or denies the manually set permissions. You cannot use this cmdlet to change the automatically set permissions.

• The cmdlet adds the specified permissions to the existing permissions the user or group has on the archive, it does not overwrite the existing permissions. For example, if the user or group already has read access on the specified archive and you specify -Grant Write, then Enterprise Vault grants the user or group both read and write access permissions on the specified archive.

• The -Grant and -Deny parameters are mutually exclusive for a given access type, which means that setting one clears the other. For example, if the user or group is denied read access on the specified archive, and you specify -Grant Read, then the cmdlet grants read access permissions to the user or group.

• The value that is specified in -Deny takes precedence over the one specified in -Grant. For example:

  • If you specify the access type as -Grant All -Deny Delete, the cmdlet grants the read and write access to the user or group, but denies the permission to delete items from the archive.

  • If you specify the access type as -Grant Delete -Deny All, Enterprise Vault denies the user or group all access permissions on the archive even though you have chosen to allow the user or group to delete items from the archive using -Grant Delete.

• This cmdlet does not update permissions information if the archive is marked for deletion.

• The effect of this cmdlet is the same as selecting the check box for a user on the Permissions tab of Archive Properties dialog box.

• Set-EVArchivePermission -ArchiveId 19D...EVServer1 -Trustee EXAMPLE\msmith -Grant read

  Grants the user "EXAMPLE\msmith" read access permission on the archive with the ID "19D...EVServer1".

• Get-EVArchive -ArchiveName msmith | Set-EVArchivePermission -Trustee EXAMPLE\msmith -Deny d

  Pipes the archive ID that is obtained from Get-EVArchive to Set-EVArchivePermission and denies the Windows user "EXAMPLE\msmith" delete permission on the archive "msmith".

• Get-EVArchive -ArchiveName dsmith | Set-EVArchivePermission -Trustee dsmith/DominoOrg -Deny d

  Pipes the archive ID that is obtained from Get-EVArchive to Set-EVArchivePermission and denies the Domino user "dsmith" from the Domino Directory "DominoOrg" delete permission on the Domino Mailbox archive "dsmith".

• Get-EVArchive -ArchiveName msmith | Set-EVArchivePermission -Trustee Example\Supervisors -Grant All -Deny R, W

  WARNING: You have specified the same permissions in the Grant and Deny parameters. The permissions specified in the Deny parameter will take precedence. The cmdlet will add permissions 'Deny: R, W'.

  Confirm Do you want to continue? [Y] Yes [N] No [S] Suspend [?] Help (default is "Y"): Y

  Displays the warning and prompts for confirmation to proceed. If you choose 'Yes', the command grants the group "EXAMPLE\Supervisors" delete access permissions and denies the read and write access permissions on the archive "msmith".

• Get-EVArchive -ArchiveName msmith | Set-EVArchivePermission -Trustee EXAMPLE\Supervisors -Grant Delete -Deny All -Confirm:$false

  Displays the warning, and then denies the group "EXAMPLE\Supervisors" read, write, and delete access permissions on the archive "msmith" without asking for confirmation.

• Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission | ForEach-Object { Set-EVArchivePermission -ArchiveId 19D...EVServer1 -Trustee $_.Trustee -Grant $_.ManualGranted -Deny $_.ManualDenied }

  Pipes the archive ID that is obtained from Get-EVArchive and the list of access permissions from Get-EVArchivePermission and copies the access permissions that are granted on the archive "msmith" to the archive with ID "19D...EVServer1".

• See Get-EVArchive.

• See Get-EVArchivePermission.

• See Remove-EVArchivePermission.