Search <book_title>...

Enterprise Vault™ PowerShell Cmdlets

Last Published: 2022-09-04

Product(s): Enterprise Vault (14.3)

Get-EVArchivePermission

Get-EVArchivePermission returns a list of all the users and groups who have any of the following types of access to the specified archive.

Table: Access types

Access	Gives permission to
Read	Read all items in the archive and restore items from it.
Write	Save items in the archive and retrieve items from it. Users with this access permission also have control of the folders in the archive. For example, they can rename and change permissions on the folders.
Delete	Delete items from the archive. To allow users to delete items from the archive, you must grant the user delete permission on the archive, select the site setting Users can delete items from their archives, and use Set-EVArchive to set -DeleteProtected to $false.

Table: Access permission types describes the types of access permissions for which Get-EVArchivePermission returns information.

Table: Access permission types

Type	Description
Automatic	Permissions that have been set on the target from which Enterprise Vault is archiving, such as an Exchange mailbox. By default, Enterprise Vault synchronizes these permissions with the permissions on the corresponding archive and archive folders.
Manual	Permissions that an Enterprise Vault administrator has set on the archive. When editing the properties of an archive, an administrator can manually apply permissions to it that override the automatic permissions.

Type

Description

Automatic

Permissions that have been set on the target from which Enterprise Vault is archiving, such as an Exchange mailbox.

By default, Enterprise Vault synchronizes these permissions with the permissions on the corresponding archive and archive folders.

Manual

Permissions that an Enterprise Vault administrator has set on the archive.

When editing the properties of an archive, an administrator can manually apply permissions to it that override the automatic permissions.

Note the following:

The user who runs the cmdlet must have the roles-based administration permission to manage the specified type of archive. For example, to manage Exchange Mailbox archives, the user must have the roles-based administration permission "Can manage Exchange Mailbox Archives".
This cmdlet returns permissions information for users that have Active Directory or Domino Directory accounts. To view Domino users, you need to install the Notes client and configure the Domino domain on the Enterprise Vault server.
This cmdlet does not return permissions information if the archive is marked for deletion.

Get-EVArchivePermission is provided by the snap-in Symantec.EnterpriseVault.PowerShell.Snapin.dll.

Syntax

Get-EVArchivePermission [-ArchiveId] <String> [[-Trustee] <String>] [-Granted <AccessRight[]> {Read | Write | Delete | All}] [-Denied <AccessRight[]> {Read | Write | Delete | All}] [<CommonParameters>]

Parameters

Table: Get-EVArchivePermission parameters

Parameter	Description
-ArchiveId (required)	Specifies the ID of the archive for which to return the list of access permissions. You can use Get-EVArchive to obtain the required ID.
-Trustee	Filters the list of access permissions to show those for the specified user or group only. For Active Directory accounts, type the value in any of the following formats: domain\user domain\group hostname\localuser hostname\localgroup For Domino accounts, type the value in any of the following formats: CN=user/O=org group (org) /org* /orgunit/org. For example, /abc/DominoOrg.
-Granted	Filters the list of access permissions to show only those users or groups who have been granted the specified type of access: Read, Write, or Delete. Specifying the access type as All returns a list of users and groups who have been granted all types of access. You can specify multiple access types by separating them with commas; for example, -Granted Read,Write.
-Denied	Filters the list of access permissions to show only those users or groups who have been denied the specified type of access: Read, Write, or Delete. Specifying the access type as All returns a list of users and groups who have been denied all types of access. You can specify multiple access types by separating them with commas; for example, -Denied Read,Write.

Examples

Get-EVArchivePermission -ArchiveId 19D...EVServer1
Returns a list of all the users and groups who have Read, Write, or Delete access to the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission
Uses the Get-EVArchive cmdlet as the pipeline input to the Get-EVArchivePermission cmdlet and returns a list of all users and groups who have access to the specified archive.

Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission | Format-List

Formats the output as a list of properties, which includes some properties that the above commands do not output. For example:

ArchiveId : 19DA8E5040AE76844B9257AD88F4B8098111000EVServer1
ArchiveName : msmith
ArchiveType: ARCHIVE_TYPE_MAILBOX
TrusteeId : S-1-5-21-1924283671-4217592524-148916455-1131
Trustee : EXAMPLE\msmith
TrusteeSource : Windows
TrusteeType : User
ManualGranted: 
ManualDenied:
AutoGranted: Read,Write,Delete
AutoDenied:

Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\msmith
Returns permissions only for the Windows trustee "EXAMPLE\msmith" on the specified archive.
Get-EVArchive -ArchiveName dsmith | Get-EVArchivePermission -Trustee "CN=dsmith/O=DominoOrg"
Returns permissions only for the Domino user "dsmith" from the Domino Directory "DominoOrg" on the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\*
Performs a wildcard search and returns a list of all users and groups from the "EXAMPLE" domain who have Read, Write, or Delete access to the specified archive.
Get-EVArchive -ArchiveName dsmith | Get-EVArchivePermission -Trustee "*/abc/DominoOrg"
Returns permissions information for the Domino wildcard entry "*/abc/DominoOrg".
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\* -Granted All
Returns a list of all users and groups from the "EXAMPLE" domain who have been granted All access (Read, Write, and Delete) to the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\* -Denied Delete
Returns a list of all users and groups from the "EXAMPLE" domain who have been denied Delete access to the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Granted Read -Denied Delete
Returns a list of all users and groups who have been granted Read access and denied Delete access to the specified archive.

Output

Get-EVArchivePermission returns an object of type EnterpriseVault.Admin.ArchivePermissionEntry, which has the following properties.

Table: Get-EVArchivePermission properties

Name	Type	Description
ArchiveId	String	The ID of the archive to which the user or group has access.
ArchiveName	String	The name of the archive to which the user or group has access.
ArchiveType	EV_STG_API_ARCHIVE_TYPE	The Enterprise Vault archive type enumeration. The possible values are as follows: ARCHIVE_TYPE_DOMINO_JOURNAL ARCHIVE_TYPE_DOMINO_MAILBOX ARCHIVE_TYPE_FILE_SYSTEM ARCHIVE_TYPE_INTERNETMAIL ARCHIVE_TYPE_JOURNAL ARCHIVE_TYPE_MAILBOX ARCHIVE_TYPE_PUBLIC_FOLDER ARCHIVE_TYPE_SHARED ARCHIVE_TYPE_SHAREPOINT ARCHIVE_TYPE_SMTP
TrusteeId	String	The ID that uniquely identifies the user or group. For Active Directory accounts, the cmdlet displays the security identifier (SID), whereas for Domino Directory accounts the cmdlet displays the UNID.
Trustee	String	The account name of the user or group.
TrusteeSource	TrusteeSource	The directory service in which the user or group has an account. "Windows" designates Active Directory, whereas "Domino" designates a Domino Directory.
TrusteeType	TrusteeType	The Enterprise Vault trustee type enumeration. The possible values are as follows: User Group Wildcard Unknown DeletedUser
ManualGranted	AccessRight[]	The manually-granted level of access: Read, Write, or Delete.
ManualDenied	AccessRight[]	The manually-denied level of access: Read, Write, or Delete.
AutoGranted	AccessRight[]	The automatically-granted level of access: Read, Write, or Delete.
AutoDenied	AccessRight[]	The automatically-denied level of access: Read, Write, or Delete.

Related cmdlets