EV Collection Task is failing with 'deleting mail file and rewriting' error.

Problem

Enterprise Vault collection fails at the point of writing the collected messages to local PST files; repeating the error "Error while writing mail file XYZ.pst, deleting mail file and rewriting". The collection job completes with a status of "Partial Success" with 0 items collected.

Error Message

Error in job log (available from the job pickup window at the top of the screen):
Writing batch to mail file EX JOURNAL-617.pst , pending batch count 0
Error while writing mail file EX JOURNAL-617.pst, deleting mail file and rewriting
Writing batch to mail file EX JOURNAL-618.pst , pending batch count 0
Error while writing mail file EX JOURNAL-618.pst, deleting mail file and rewriting

Error in log file <CW_HOME>\logs\CWMsgToPst_output.log:
[8700] INFO  root CWMsgToPst - Created New Profile: EsaMailFileWriter7_cwappadmin PST File: D:\CW\V90\scratch\temp\esadb\dataStore_evidence_repo_a82593ltl2_55969193\EV-temp-0.27.6.81\MailFiles\0\0.63.1.73\EX JOURNAL-618.pst
[8700] ERROR MailFileWriter CWMsgToPst - Message writing to PST store failed:
[8700] ERROR MailFileWriter CWMsgToPst - Message writing to PST store failed:
[8700] ERROR MailFileWriter CWMsgToPst - Message writing to PST store failed:
Note: The logging above shows (highlighted) the user account performing the write to PST. By default this user is the EsaApplicationService user account, but can be different if multiple PST writers have been configured using the property esa.collection.ev.pst_writer_ic_source_accounts.

Error in log file <CW_HOME>\logs\icp-logs\icp-remoteicpjob:
INFO  [collection.ev.MailWriterManagerBase] (pool-13-thread-1:) Mail file writer error 146,017 Message writing to PST store failed:
INFO  [collection.ev.MailWriterManagerBase] (pool-13-thread-1:) Mail file writer error 146,017 Message writing to PST store failed:
INFO  [collection.ev.EVMailPostProcessor] (pool-13-thread-1:) Error while writing mail file EX JOURNAL-618.pst - [#422300] Unexpected error - Too many consecutive mail file writing errors

Cause

The issue is caused by the Outlook PST API not being able to insert message items into a PST on the local Clearwell appliance. This is most often caused by an Outlook Group Policy Object (GPO) setting.

Solution

Ensure that the Outlook GPO setting PSTDisableGrow is disabled for all of the Clearwell user accounts that write message items to PST files. This includes the EsaApplicationService and PSTRetrieverService user accounts (the PSTRetrieverService user account writes messages to a PST file during a native-only export). Note: This also includes the user accounts specified in property esa.collection.ev.pst_writer_ic_source_accounts, if this property has been set to enable multiple PST writers (see the "Veritas Identification and Collection Guide" for more information on this property).

PSTDisableGrow is a Windows Registry-based policy setting. With the Administrative Template files for Office installed, the PSTDisableGrow GPO setting is listed as "Prevent users from adding new content to existing PST files" in the Windows "Group Policy Management Editor" (Figure 1).

Figure 1.

Once the PSTDisableGrow GPO setting has been disabled, log into the Clearwell appliance as each user account and force the change to be applied immediately as follows:
gpupdate /force

Then use the following command to verify the new value of the GPO setting:
gpresult /v /r

The output should show the Registry value is now set to 0 to indicate that the setting is disabled:
                KeyName:     software\policies\microsoft\office\15.0\outlook\pst\pstdisablegrow
                Value:       0, 0, 0, 0
                State:       Enabled

Note: The output above shows "Enabled", but the setting is in fact disabled. In contrast, here’s how the output looks when the setting is enabled:
                KeyName:     software\policies\microsoft\office\15.0\outlook\pst\pstdisablegrow
                Value:       1, 0, 0, 0
                State:       Enabled

The output above also shows the Registry location, under HKEY_CURRENT_USER (Figure 2). The value of "15.0" in the path indicates Office 2013.
Figure 2.

(Earlier revisions of this article described the related Outlook GPO setting DisablePST as also causing this issue. That other GPO setting DisablePST is listed in Windows "Group Policy Management Editor" as "Prevent users from adding PSTs to Outlook profiles and/or prevent using Sharing-Exclusive PSTs". Recent testing with various Clearwell Collection and Export operations has not indicated in any issues when this GPO setting DisablePST is enabled. It therefore appears to have no negative affect on Clearwell. This recent testing was performed using Clearwell version 9.0).