Enterprise Vault™ Administrator's Guide
- About this guide
- Managing administrator security
- Roles-based administration
- Working with predefined RBA roles
- Customizing RBA roles
- Day-to-day administration
- About Exchange mailbox archiving reports
- About starting or stopping tasks or services
- Monitoring journal mailboxes
- About monitoring disks
- About maintaining the SQL databases
- Using SQL Always On availability groups
- About managing vault store groups and sharing
- About managing safety copies
- About managing partition rollover
- About expiry and deletion
- Working with retention categories and retention plans
- Setting up retention folders
- Enabling archiving for new mailboxes
- About moving archives
- How Move Archive works
- About moving mailbox archives within a site
- About moving mailbox archives between sites
- About configuring Move Archive
- Running Move Archive
- Monitoring Move Archive
- PowerShell cmdlets for managing archives
- PowerShell cmdlets for managing archive permissions
- Using Enterprise Vault for records management
- Setting the default record type for users
- Common configuration scenarios
- Searching archives for items marked as records
- Automatically filtering events
- Managing indexes
- About the indexing wizards
- Managing indexing exclusions
- About the indexing PowerShell cmdlets
- Advanced Domino mailbox and desktop policy settings
- Editing the advanced settings for Domino mailbox and desktop policy
- Domino mailbox policy advanced settings
- Archiving General: Domino mailbox policy
- Archiving General: Domino mailbox policy
- Domino desktop policy advanced settings
- Advanced Exchange mailbox and desktop policy settings
- Editing the advanced Exchange mailbox and desktop settings
- Exchange mailbox policy advanced settings
- Archiving General (Exchange mailbox policy advanced settings)
- Archiving General (Exchange mailbox policy advanced settings)
- Exchange desktop policy advanced settings
- Office Mail App (Exchange desktop policy advanced settings)
- Outlook (Exchange desktop policy advanced settings)
- Vault Cache (Exchange desktop policy advanced settings)
- Virtual Vault (Exchange desktop policy advanced settings)
- Advanced Exchange journal policy settings
- Archiving General (Exchange journal policy advanced settings)
- Advanced Exchange public folder policy settings
- Archiving General (Exchange public folder policy advanced settings)
- Advanced SMTP policy settings
- Site properties advanced settings
- Editing site properties advanced settings
- Site properties advanced settings
- Content Conversion (site properties advanced settings)
- File System Archiving (site properties advanced settings)
- IMAP (site properties advanced settings)
- Indexing (site properties advanced settings)
- Skype for Business (site properties advanced settings)
- SQL Server (site properties advanced settings)
- SMTP (site properties advanced settings)
- Storage (site properties advanced settings)
- Content Conversion (site properties advanced settings)
- Computer properties advanced settings
- Editing computer properties advanced settings
- Computer properties advanced settings
- Agents (computer properties advanced settings)
- File System Archiving (computer properties advanced settings)
- IMAP (computer properties advanced settings)
- Indexing (computer properties advanced settings)
- Storage (computer properties advanced settings)
- Task properties advanced settings
- Advanced Personal Store Management properties
- Classification policy advanced settings
- Managing the Storage queue
- Automatic monitoring
- About monitoring using Enterprise Vault Operations Manager
- About monitoring using MOM
- About monitoring using SCOM
- Managing extension content providers
- Exporting archives
- Enterprise Vault message queues
- Customizations and best practice
- Mailbox archiving strategies
- About performance tuning
- Failover in a building blocks configuration
- Appendix A. Ports used by Enterprise Vault
- Appendix B. Useful SQL queries
- Appendix C. Troubleshooting
- Installation problems
- Microsoft SQL Server problems
- Server problems
- Client problems
- Problems enabling or processing mailboxes
- Problems with Vault Cache synchronization
- Identifying and resolving Vault Cache issues on the Enterprise Vault server
- Identifying and resolving Vault Cache issues on an end-user computer
- Problems with Enterprise Vault components
- Troubleshooting: All tasks and services
- Troubleshooting: Directory service
- Troubleshooting: Exchange archiving or Journaling tasks
- Troubleshooting: Storage service
- Troubleshooting: Shopping service
- Troubleshooting: Web Access application
- Troubleshooting: All tasks and services
- Techniques to aid troubleshooting
- How to modify registry settings
- About moving an Indexing service
- Appendix D. Enterprise Vault accounts and permissions
Get-EVArchivePermission
Get-EVArchivePermission returns a list of all the users and groups who have any of the following types of access to the specified archive.
Table: Access types
Access | Gives permission to |
---|---|
Read | Read all items in the archive and restore items from it. |
Write | Save items in the archive and retrieve items from it. Users with this access permission also have control of the folders in the archive. For example, they can rename and change permissions on the folders. |
Delete | Delete items from the archive. To allow users to delete items from the archive, you must grant the user delete permission on the archive, select the site setting Set-EVArchive to set -DeleteProtected to $false. , and use |
Table: Access permission types describes the types of access permissions for which Get-EVArchivePermission returns information.
Table: Access permission types
Type | Description |
---|---|
Automatic | Permissions that have been set on the target from which Enterprise Vault is archiving, such as an Exchange mailbox. By default, Enterprise Vault synchronizes these permissions with the permissions on the corresponding archive and archive folders. |
Manual | Permissions that an Enterprise Vault administrator has set on the archive. When editing the properties of an archive, an administrator can manually apply permissions to it that override the automatic permissions. |
Note the following:
The user who runs the cmdlet must have the roles-based administration permission to manage the specified type of archive. For example, to manage Exchange Mailbox archives, the user must have the roles-based administration permission "Can manage Exchange Mailbox Archives".
This cmdlet returns permissions information for users that have Active Directory or Domino Directory accounts. To view Domino users, you need to install the Notes client and configure the Domino domain on the Enterprise Vault server.
This cmdlet does not return permissions information if the archive is marked for deletion.
Get-EVArchivePermission is provided by the snap-in Symantec.EnterpriseVault.PowerShell.Snapin.dll.
Get-EVArchivePermission [-ArchiveId] <String> [[-Trustee] <String>] [-Granted <AccessRight[]> {Read | Write | Delete | All}] [-Denied <AccessRight[]> {Read | Write | Delete | All}] [<CommonParameters>]
Table: Get-EVArchivePermission parameters
Parameter | Description |
---|---|
-ArchiveId (required) | Specifies the ID of the archive for which to return the list of access permissions. You can use Get-EVArchive to obtain the required ID. |
-Trustee | Filters the list of access permissions to show those for the specified user or group only. For Active Directory accounts, type the value in any of the following formats:
For Domino accounts, type the value in any of the following formats:
|
-Granted | Filters the list of access permissions to show only those users or groups who have been granted the specified type of access: Read, Write, or Delete. Specifying the access type as All returns a list of users and groups who have been granted all types of access. You can specify multiple access types by separating them with commas; for example, -Granted Read,Write. |
-Denied | Filters the list of access permissions to show only those users or groups who have been denied the specified type of access: Read, Write, or Delete. Specifying the access type as All returns a list of users and groups who have been denied all types of access. You can specify multiple access types by separating them with commas; for example, -Denied Read,Write. |
Get-EVArchivePermission -ArchiveId 19D...EVServer1
Returns a list of all the users and groups who have Read, Write, or Delete access to the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission
Uses the Get-EVArchive cmdlet as the pipeline input to the Get-EVArchivePermission cmdlet and returns a list of all users and groups who have access to the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission | Format-List
Formats the output as a list of properties, which includes some properties that the above commands do not output. For example:
ArchiveId : 19DA8E5040AE76844B9257AD88F4B8098111000EVServer1 ArchiveName : msmith ArchiveType: ARCHIVE_TYPE_MAILBOX TrusteeId : S-1-5-21-1924283671-4217592524-148916455-1131 Trustee : EXAMPLE\msmith TrusteeSource : Windows TrusteeType : User ManualGranted: ManualDenied: AutoGranted: Read,Write,Delete AutoDenied:
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\msmith
Returns permissions only for the Windows trustee "EXAMPLE\msmith" on the specified archive.
Get-EVArchive -ArchiveName dsmith | Get-EVArchivePermission -Trustee "CN=dsmith/O=DominoOrg"
Returns permissions only for the Domino user "dsmith" from the Domino Directory "DominoOrg" on the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\*
Performs a wildcard search and returns a list of all users and groups from the "EXAMPLE" domain who have Read, Write, or Delete access to the specified archive.
Get-EVArchive -ArchiveName dsmith | Get-EVArchivePermission -Trustee "*/abc/DominoOrg"
Returns permissions information for the Domino wildcard entry "*/abc/DominoOrg".
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\* -Granted All
Returns a list of all users and groups from the "EXAMPLE" domain who have been granted All access (Read, Write, and Delete) to the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Trustee EXAMPLE\* -Denied Delete
Returns a list of all users and groups from the "EXAMPLE" domain who have been denied Delete access to the specified archive.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission -Granted Read -Denied Delete
Returns a list of all users and groups who have been granted Read access and denied Delete access to the specified archive.
Get-EVArchivePermission returns an object of type EnterpriseVault.Admin.ArchivePermissionEntry, which has the following properties.
Table: Get-EVArchivePermission properties
Name | Type | Description |
---|---|---|
ArchiveId | String | The ID of the archive to which the user or group has access. |
ArchiveName | String | The name of the archive to which the user or group has access. |
ArchiveType | EV_STG_API_ARCHIVE_TYPE | The Enterprise Vault archive type enumeration. The possible values are as follows:
|
TrusteeId | String | The ID that uniquely identifies the user or group. For Active Directory accounts, the cmdlet displays the security identifier (SID), whereas for Domino Directory accounts the cmdlet displays the UNID. |
Trustee | String | The account name of the user or group. |
TrusteeSource | TrusteeSource | The directory service in which the user or group has an account. "Windows" designates Active Directory, whereas "Domino" designates a Domino Directory. |
TrusteeType | TrusteeType | The Enterprise Vault trustee type enumeration. The possible values are as follows:
|
ManualGranted | AccessRight[] | The manually-granted level of access: Read, Write, or Delete. |
ManualDenied | AccessRight[] | The manually-denied level of access: Read, Write, or Delete. |
AutoGranted | AccessRight[] | The automatically-granted level of access: Read, Write, or Delete. |
AutoDenied | AccessRight[] | The automatically-denied level of access: Read, Write, or Delete. |