Enterprise Vault™ PowerShell Cmdlets
- Introducing the Enterprise Vault PowerShell cmdlets
- Archiving: Exchange
- Archiving: FSA
- Get-EVFSAComputerSettings
- Get-EVFSAFileServer
- Get-EVFSAFolder
- Get-EVFSASiteSettings
- Get-EVFSAVolume
- New-EVFSAFileServer
- New-EVFSAFolder
- New-EVFSAVolume
- Remove-EVFSAFileServer
- Remove-EVFSAFolder
- Remove-EVFSAVolume
- Set-EVFSAComputerSettings
- Set-EVFSAFileServer
- Set-EVFSAFolder
- Set-EVFSASiteSettings
- Set-EVFSAVolume
- Archiving: Skype for Business
- Archiving: SMTP
- Get-EVSMTPHoldingFolder
- Get-EVSMTPMessageTrackingLogLocation
- Get-EVSMTPPolicy
- Get-EVSMTPServerSettings
- Get-EVSMTPTarget
- New-EVSMTPPolicy
- New-EVSMTPServerSettings
- New-EVSMTPTarget
- Remove-EVSMTPPolicy
- Remove-EVSMTPTarget
- Set-EVSMTPMessageTrackingLogLocation
- Set-EVSMTPPolicy
- Set-EVSMTPServerSettings
- Set-EVSMTPTarget
- Sync-EVSMTPServerSettings
- Backup
- Get-EVIndexSnapshotLocationBackupMode
- Set-EVIndexSnapshotLocationBackupMode
- Clear-EVIndexSnapshotLocationBackupMode
- Get-IndexLocationBackupMode
- Set-IndexLocationBackupMode
- Clear-IndexLocationBackUpMode
- Get-VaultStoreBackupMode
- Set-VaultStoreBackupMode
- Clear-VaultStoreBackupMode
- Set-EVIndexSnapshotLocation
- Get-EVIndexSnapshotLocation
- Remove-EVIndexSnapshotLocation
- New-EVIndexSnapshot
- Get-EVIndexSnapshot
- Remove-EVIndexSnapshot
- Restore-EVIndexSnapshot
- Get-EVIndexSnapshotRepository
- Remove-EVIndexSnapshotRepository
- Classification
- Disable-EVClassification
- Get-EVClassificationFCITags
- Get-EVClassificationPolicy
- Get-EVClassificationStatus
- Get-EVClassificationTestMode
- Get-EVClassificationVICTags
- Import-EVClassificationFCIRules
- Initialize-EVClassificationVIC
- Set-EVClassificationVICFIPSMode
- New-EVClassificationPolicy
- Publish-EVClassificationFCIRules
- Remove-EVClassificationPolicy
- Set-EVClassificationPolicy
- Set-EVClassificationTestMode
- Databases
- IMAP access
- Indexing
- Records management
- Retention plans
- Roles-based administration
- Sites and servers
- Tasks and services
- Vault stores and archives
Remove-EVArchivePermission
Remove-EVArchivePermission lets you remove the following types of access permissions that are granted or denied to a given user or group on the specified archive.
Table: Access types
Access | Gives permission to |
|---|---|
Read | Read all items in the archive and restore items from it. |
Write | Save items in the archive and retrieve items from it. Users with this access permission also have control of the folders in the archive. For example, they can rename and change permissions on the folders. |
Delete | Delete items from the archive. To allow users to delete items from the archive, you must grant the user delete permission on the archive, select the site setting , and use Set-EVArchive to set -DeleteProtected to $false. |
Note the following:
The user who runs the cmdlet must have the roles-based administration permission to manage the specified type of archive. For example, to manage Exchange Mailbox archives, the user must have the roles-based administration permission "Can manage Exchange Mailbox Archives".
You can use this cmdlet to remove access permissions for users that have Active Directory or Domino Directory accounts. Note that Domino users can have access permissions only on Domino mailbox archives. To remove access permissions for Domino users, you need to install the Notes client and configure the Domino domain on the Enterprise Vault server.
This cmdlet only removes the manually set permissions. You cannot use this cmdlet to remove the automatically set permissions.
This cmdlet does not remove permissions information if the archive is marked for deletion.
The effect of this cmdlet is the same as clearing the check box for a user on the Permissions tab of Archive Properties dialog box.
Remove-EVArchivePermission is provided by the snap-in Symantec.EnterpriseVault.PowerShell.Snapin.dll.
Remove-EVArchivePermission [-ArchiveId] <String> [-Trustee] <String> [-Granted <AccessRight[]> {Read | Write | Delete | All}] [-Denied <AccessRight[]> {Read | Write | Delete | All}] [-WhatIf] [-Confirm] [<CommonParameters>]
Remove-EVArchivePermission [-ArchiveId] <String> [-Trustee] <String> -All [-WhatIf] [-Confirm] [<CommonParameters>]
Table: Remove-EVArchivePermission parameters
Parameter | Description |
|---|---|
-ArchiveId (required) | Specifies the ID of the archive for which to remove the access permissions. You can use Get-EVArchive to obtain the required ID. |
-Trustee (required) | The account name of the user or group for which you want to remove access permissions from the specified archive. For Active Directory accounts, type the value in any of the following formats:
For Domino accounts, type the value in any of the following formats:
|
-Granted | The granted access permissions that you want to remove for the user or group: Read, Write, or Delete. Specifying the access type as All removes all the granted permissions for that user or group. You can specify multiple access types by separating them with commas; for example, -Granted Read,Write. |
-Denied | The denied access permissions that you want to remove for the user or group: Read, Write, or Delete. Specifying the access type as All removes all the denied permissions for that user or group. You can specify multiple access types by separating them with commas; for example, -Denied Read,Write. |
-All | Removes all the granted and denied permissions for the user or group from the specified archive. It is that same as specifying -Granted All -Denied All. |
-WhatIf | Shows what would happen if the cmdlet runs. The cmdlet is not actually run. |
-Confirm | Prompts you for confirmation before running the cmdlet. To suppress the confirmation prompt, use the syntax -Confirm:$False. You must include a colon ( : ) in the syntax. |
Remove-EVArchivePermission -ArchiveId 19D...EVServer1 -Trustee EXAMPLE\msmith -Granted Read
Prompts for confirmation, and then removes "Read" from the list of granted access permissions for the user "EXAMPLE\msmith" on the archive with the ID "19D...EVServer1".
Get-EVArchive -ArchiveName msmith | Remove-EVArchivePermission -Trustee EXAMPLE\msmith -Denied Read,Write -Confirm:$false
Pipes the archive ID that is obtained from Get-EVArchive to Remove-EVArchivePermission, and removes "Read" and "Write" from the list of denied access permissions for the user "EXAMPLE\msmith" on the archive "msmith". This command also suppresses the confirmation prompt.
Get-EVArchive -ArchiveName msmith | Remove-EVArchivePermission -Trustee EXAMPLE\msmith -All -Confirm:$false
Pipes the archive ID that is obtained from Get-EVArchive to Remove-EVArchivePermission, and removes all the granted and denied access permissions for the user "EXAMPLE\msmith" on the archive "msmith". This command also suppresses the confirmation prompt.
Get-EVArchive -ArchiveName dsmith | Remove-EVArchivePermission -Trustee dsmith/DominoOrg -Granted All -Confirm:$false
Pipes the archive ID that is obtained from Get-EVArchive to Remove-EVArchivePermission, and removes all the granted and denied access permissions for the Domino user "dsmith" on the archive "dsmith". This command also suppresses the confirmation prompt.
Get-EVArchive | Remove-EVArchivePermission -Trustee EXAMPLE\msmith -All -Confirm:$false
Removes all the access permissions for the user "EXAMPLE\msmith" on all the archives without prompting for confirmation.
For a user or group for which you have removed all permissions, Remove-EVArchivePermission returns a confirmation message on completion. For a user or group that still has some permissions applied, the cmdlet returns a modified object of type EnterpriseVault.Admin.ArchivePermissionEntry, which has the following properties.
Table: Remove-EVArchivePermission properties
Name | Type | Description |
|---|---|---|
ArchiveId | String | The ID of the archive to which the user or group has access. |
ArchiveName | String | The name of the archive to which the user or group has access. |
ArchiveType | EV_STG_API_ARCHIVE_TYPE | The Enterprise Vault archive type enumeration. The possible values are as follows:
|
TrusteeId | String | The ID that uniquely identifies the user or group. For Active Directory accounts, the cmdlet displays the security identifier (SID), whereas for Domino Directory accounts the cmdlet displays the UNID. |
Trustee | String | The account name of the user or group. |
TrusteeSource | TrusteeSource | The directory service in which the user or group has an account. "Windows" designates Active Directory, whereas "Domino" designates a Domino Directory. |
TrusteeType | TrusteeType | The Enterprise Vault trustee type enumeration. The possible values are as follows:
|
ManualGranted | AccessRight[] | The manually-granted level of access: Read, Write, or Delete. |
ManualDenied | AccessRight[] | The manually-denied level of access: Read, Write, or Delete. |
AutoGranted | AccessRight[] | The automatically-granted level of access: Read, Write, or Delete. |
AutoDenied | AccessRight[] | The automatically-denied level of access: Read, Write, or Delete. |
See Get-EVArchive.