Enterprise Vault™ Administrator's Guide
- About this guide
- Managing administrator security
- Roles-based administration
- Working with predefined RBA roles
- Customizing RBA roles
- Day-to-day administration
- About Exchange mailbox archiving reports
- About starting or stopping tasks or services
- Monitoring journal mailboxes
- About monitoring disks
- About maintaining the SQL databases
- Using SQL Always On availability groups
- About managing vault store groups and sharing
- About managing safety copies
- About managing partition rollover
- About expiry and deletion
- Working with retention categories and retention plans
- Setting up retention folders
- Enabling archiving for new mailboxes
- About moving archives
- How Move Archive works
- About moving mailbox archives within a site
- About moving mailbox archives between sites
- About configuring Move Archive
- Running Move Archive
- Monitoring Move Archive
- PowerShell cmdlets for managing archives
- PowerShell cmdlets for managing archive permissions
- Using Enterprise Vault for records management
- Setting the default record type for users
- Common configuration scenarios
- Searching archives for items marked as records
- Automatically filtering events
- Managing indexes
- About the indexing wizards
- Managing indexing exclusions
- About the indexing PowerShell cmdlets
- Advanced Domino mailbox and desktop policy settings
- Editing the advanced settings for Domino mailbox and desktop policy
- Domino mailbox policy advanced settings
- Archiving General: Domino mailbox policy
- Archiving General: Domino mailbox policy
- Domino desktop policy advanced settings
- Advanced Exchange mailbox and desktop policy settings
- Editing the advanced Exchange mailbox and desktop settings
- Exchange mailbox policy advanced settings
- Archiving General (Exchange mailbox policy advanced settings)
- Archiving General (Exchange mailbox policy advanced settings)
- Exchange desktop policy advanced settings
- Office Mail App (Exchange desktop policy advanced settings)
- Outlook (Exchange desktop policy advanced settings)
- Vault Cache (Exchange desktop policy advanced settings)
- Virtual Vault (Exchange desktop policy advanced settings)
- Advanced Exchange journal policy settings
- Archiving General (Exchange journal policy advanced settings)
- Advanced Exchange public folder policy settings
- Archiving General (Exchange public folder policy advanced settings)
- Advanced SMTP policy settings
- Site properties advanced settings
- Editing site properties advanced settings
- Site properties advanced settings
- Content Conversion (site properties advanced settings)
- File System Archiving (site properties advanced settings)
- IMAP (site properties advanced settings)
- Indexing (site properties advanced settings)
- Skype for Business (site properties advanced settings)
- SQL Server (site properties advanced settings)
- SMTP (site properties advanced settings)
- Storage (site properties advanced settings)
- Content Conversion (site properties advanced settings)
- Computer properties advanced settings
- Editing computer properties advanced settings
- Computer properties advanced settings
- Agents (computer properties advanced settings)
- File System Archiving (computer properties advanced settings)
- IMAP (computer properties advanced settings)
- Indexing (computer properties advanced settings)
- Storage (computer properties advanced settings)
- Task properties advanced settings
- Advanced Personal Store Management properties
- Classification policy advanced settings
- Managing the Storage queue
- Automatic monitoring
- About monitoring using Enterprise Vault Operations Manager
- About monitoring using MOM
- About monitoring using SCOM
- Managing extension content providers
- Exporting archives
- Enterprise Vault message queues
- Customizations and best practice
- Mailbox archiving strategies
- About performance tuning
- Failover in a building blocks configuration
- Appendix A. Ports used by Enterprise Vault
- Appendix B. Useful SQL queries
- Appendix C. Troubleshooting
- Installation problems
- Microsoft SQL Server problems
- Server problems
- Client problems
- Problems enabling or processing mailboxes
- Problems with Vault Cache synchronization
- Identifying and resolving Vault Cache issues on the Enterprise Vault server
- Identifying and resolving Vault Cache issues on an end-user computer
- Problems with Enterprise Vault components
- Troubleshooting: All tasks and services
- Troubleshooting: Directory service
- Troubleshooting: Exchange archiving or Journaling tasks
- Troubleshooting: Storage service
- Troubleshooting: Shopping service
- Troubleshooting: Web Access application
- Troubleshooting: All tasks and services
- Techniques to aid troubleshooting
- How to modify registry settings
- About moving an Indexing service
- Appendix D. Enterprise Vault accounts and permissions
Remove-EVArchivePermission
Remove-EVArchivePermission lets you remove the following types of access permissions that are granted or denied to a given user or group on the specified archive.
Table: Access types
Access | Gives permission to |
---|---|
Read | Read all items in the archive and restore items from it. |
Write | Save items in the archive and retrieve items from it. Users with this access permission also have control of the folders in the archive. For example, they can rename and change permissions on the folders. |
Delete | Delete items from the archive. To allow users to delete items from the archive, you must grant the user delete permission on the archive, select the site setting Set-EVArchive to set -DeleteProtected to $false. , and use |
Note the following:
The user who runs the cmdlet must have the roles-based administration permission to manage the specified type of archive. For example, to manage Exchange Mailbox archives, the user must have the roles-based administration permission "Can manage Exchange Mailbox Archives".
You can use this cmdlet to remove access permissions for users that have Active Directory or Domino Directory accounts. Note that Domino users can have access permissions only on Domino mailbox archives. To remove access permissions for Domino users, you need to install the Notes client and configure the Domino domain on the Enterprise Vault server.
This cmdlet only removes the manually set permissions. You cannot use this cmdlet to remove the automatically set permissions.
This cmdlet does not remove permissions information if the archive is marked for deletion.
The effect of this cmdlet is the same as clearing the check box for a user on the Permissions tab of Archive Properties dialog box.
Remove-EVArchivePermission is provided by the snap-in Symantec.EnterpriseVault.PowerShell.Snapin.dll.
Remove-EVArchivePermission [-ArchiveId] <String> [-Trustee] <String> [-Granted <AccessRight[]> {Read | Write | Delete | All}] [-Denied <AccessRight[]> {Read | Write | Delete | All}] [-WhatIf] [-Confirm] [<CommonParameters>]
Remove-EVArchivePermission [-ArchiveId] <String> [-Trustee] <String> -All [-WhatIf] [-Confirm] [<CommonParameters>]
Table: Remove-EVArchivePermission parameters
Parameter | Description |
---|---|
-ArchiveId (required) | Specifies the ID of the archive for which to remove the access permissions. You can use Get-EVArchive to obtain the required ID. |
-Trustee (required) | The account name of the user or group for which you want to remove access permissions from the specified archive. For Active Directory accounts, type the value in any of the following formats:
For Domino accounts, type the value in any of the following formats:
|
-Granted | The granted access permissions that you want to remove for the user or group: Read, Write, or Delete. Specifying the access type as All removes all the granted permissions for that user or group. You can specify multiple access types by separating them with commas; for example, -Granted Read,Write. |
-Denied | The denied access permissions that you want to remove for the user or group: Read, Write, or Delete. Specifying the access type as All removes all the denied permissions for that user or group. You can specify multiple access types by separating them with commas; for example, -Denied Read,Write. |
-All | Removes all the granted and denied permissions for the user or group from the specified archive. It is that same as specifying -Granted All -Denied All. |
-WhatIf | Shows what would happen if the cmdlet runs. The cmdlet is not actually run. |
-Confirm | Prompts you for confirmation before running the cmdlet. To suppress the confirmation prompt, use the syntax -Confirm:$False. You must include a colon ( : ) in the syntax. |
Remove-EVArchivePermission -ArchiveId 19D...EVServer1 -Trustee EXAMPLE\msmith -Granted Read
Prompts for confirmation, and then removes "Read" from the list of granted access permissions for the user "EXAMPLE\msmith" on the archive with the ID "19D...EVServer1".
Get-EVArchive -ArchiveName msmith | Remove-EVArchivePermission -Trustee EXAMPLE\msmith -Denied Read,Write -Confirm:$false
Pipes the archive ID that is obtained from Get-EVArchive to Remove-EVArchivePermission, and removes "Read" and "Write" from the list of denied access permissions for the user "EXAMPLE\msmith" on the archive "msmith". This command also suppresses the confirmation prompt.
Get-EVArchive -ArchiveName msmith | Remove-EVArchivePermission -Trustee EXAMPLE\msmith -All -Confirm:$false
Pipes the archive ID that is obtained from Get-EVArchive to Remove-EVArchivePermission, and removes all the granted and denied access permissions for the user "EXAMPLE\msmith" on the archive "msmith". This command also suppresses the confirmation prompt.
Get-EVArchive -ArchiveName dsmith | Remove-EVArchivePermission -Trustee dsmith/DominoOrg -Granted All -Confirm:$false
Pipes the archive ID that is obtained from Get-EVArchive to Remove-EVArchivePermission, and removes all the granted and denied access permissions for the Domino user "dsmith" on the archive "dsmith". This command also suppresses the confirmation prompt.
Get-EVArchive | Remove-EVArchivePermission -Trustee EXAMPLE\msmith -All -Confirm:$false
Removes all the access permissions for the user "EXAMPLE\msmith" on all the archives without prompting for confirmation.
For a user or group for which you have removed all permissions, Remove-EVArchivePermission returns a confirmation message on completion. For a user or group that still has some permissions applied, the cmdlet returns a modified object of type EnterpriseVault.Admin.ArchivePermissionEntry, which has the following properties.
Table: Remove-EVArchivePermission properties
Name | Type | Description |
---|---|---|
ArchiveId | String | The ID of the archive to which the user or group has access. |
ArchiveName | String | The name of the archive to which the user or group has access. |
ArchiveType | EV_STG_API_ARCHIVE_TYPE | The Enterprise Vault archive type enumeration. The possible values are as follows:
|
TrusteeId | String | The ID that uniquely identifies the user or group. For Active Directory accounts, the cmdlet displays the security identifier (SID), whereas for Domino Directory accounts the cmdlet displays the UNID. |
Trustee | String | The account name of the user or group. |
TrusteeSource | TrusteeSource | The directory service in which the user or group has an account. "Windows" designates Active Directory, whereas "Domino" designates a Domino Directory. |
TrusteeType | TrusteeType | The Enterprise Vault trustee type enumeration. The possible values are as follows:
|
ManualGranted | AccessRight[] | The manually-granted level of access: Read, Write, or Delete. |
ManualDenied | AccessRight[] | The manually-denied level of access: Read, Write, or Delete. |
AutoGranted | AccessRight[] | The automatically-granted level of access: Read, Write, or Delete. |
AutoDenied | AccessRight[] | The automatically-denied level of access: Read, Write, or Delete. |
See Get-EVArchive.