Enterprise Vault™ PowerShell Cmdlets
- Introducing the Enterprise Vault PowerShell cmdlets
- Archiving: Exchange
- Archiving: FSA
- Get-EVFSAComputerSettings
- Get-EVFSAFileServer
- Get-EVFSAFolder
- Get-EVFSASiteSettings
- Get-EVFSAVolume
- New-EVFSAFileServer
- New-EVFSAFolder
- New-EVFSAVolume
- Remove-EVFSAFileServer
- Remove-EVFSAFolder
- Remove-EVFSAVolume
- Set-EVFSAComputerSettings
- Set-EVFSAFileServer
- Set-EVFSAFolder
- Set-EVFSASiteSettings
- Set-EVFSAVolume
- Archiving: Skype for Business
- Archiving: SMTP
- Get-EVSMTPHoldingFolder
- Get-EVSMTPMessageTrackingLogLocation
- Get-EVSMTPPolicy
- Get-EVSMTPServerSettings
- Get-EVSMTPTarget
- New-EVSMTPPolicy
- New-EVSMTPServerSettings
- New-EVSMTPTarget
- Remove-EVSMTPPolicy
- Remove-EVSMTPTarget
- Set-EVSMTPMessageTrackingLogLocation
- Set-EVSMTPPolicy
- Set-EVSMTPServerSettings
- Set-EVSMTPTarget
- Sync-EVSMTPServerSettings
- Backup
- Get-EVIndexSnapshotLocationBackupMode
- Set-EVIndexSnapshotLocationBackupMode
- Clear-EVIndexSnapshotLocationBackupMode
- Get-IndexLocationBackupMode
- Set-IndexLocationBackupMode
- Clear-IndexLocationBackUpMode
- Get-VaultStoreBackupMode
- Set-VaultStoreBackupMode
- Clear-VaultStoreBackupMode
- Set-EVIndexSnapshotLocation
- Get-EVIndexSnapshotLocation
- Remove-EVIndexSnapshotLocation
- New-EVIndexSnapshot
- Get-EVIndexSnapshot
- Remove-EVIndexSnapshot
- Restore-EVIndexSnapshot
- Get-EVIndexSnapshotRepository
- Remove-EVIndexSnapshotRepository
- Classification
- Disable-EVClassification
- Get-EVClassificationFCITags
- Get-EVClassificationPolicy
- Get-EVClassificationStatus
- Get-EVClassificationTestMode
- Get-EVClassificationVICTags
- Import-EVClassificationFCIRules
- Initialize-EVClassificationVIC
- Set-EVClassificationVICFIPSMode
- New-EVClassificationPolicy
- Publish-EVClassificationFCIRules
- Remove-EVClassificationPolicy
- Set-EVClassificationPolicy
- Set-EVClassificationTestMode
- Databases
- IMAP access
- Indexing
- Records management
- Retention plans
- Roles-based administration
- Sites and servers
- Tasks and services
- Vault stores and archives
Set-EVArchivePermission
Set-EVArchivePermission lets you grant or deny the following types of access permissions to a given user or group on the specified archive.
Table: Access types
Access | Gives permission to |
|---|---|
Read | Read all items in the archive and restore items from it. |
Write | Save items in the archive and retrieve items from it. Users with this access permission also have control of the folders in the archive. For example, they can rename and change permissions on the folders. |
Delete | Delete items from the archive. To allow users to delete items from the archive, you must grant the user delete permission on the archive, select the site setting , and use Set-EVArchive to set -DeleteProtected to $false. |
Note the following:
The user who runs the cmdlet must have the roles-based administration permission to manage the specified type of archive. For example, to manage Exchange Mailbox archives, the user must have the roles-based administration permission "Can manage Exchange Mailbox Archives".
You can use this cmdlet to set access permissions for users that have Active Directory or Domino Directory accounts. Note that Domino users can have access permissions only on Domino mailbox archives. To add Domino users, you need to install the Notes client and configure the Domino domain on the Enterprise Vault server.
This cmdlet only grants or denies the manually set permissions. You cannot use this cmdlet to change the automatically set permissions.
The cmdlet adds the specified permissions to the existing permissions the user or group has on the archive, it does not overwrite the existing permissions. For example, if the user or group already has read access on the specified archive and you specify -Grant Write, then Enterprise Vault grants the user or group both read and write access permissions on the specified archive.
The -Grant and -Deny parameters are mutually exclusive for a given access type, which means that setting one clears the other. For example, if the user or group is denied read access on the specified archive, and you specify -Grant Read, then the cmdlet grants read access permissions to the user or group.
The value that is specified in -Deny takes precedence over the one specified in -Grant. For example:
If you specify the access type as -Grant All -Deny Delete, the cmdlet grants the read and write access to the user or group, but denies the permission to delete items from the archive.
If you specify the access type as -Grant Delete -Deny All, Enterprise Vault denies the user or group all access permissions on the archive even though you have chosen to allow the user or group to delete items from the archive using -Grant Delete.
This cmdlet does not update permissions information if the archive is marked for deletion.
The effect of this cmdlet is the same as selecting the check box for a user on the Permissions tab of Archive Properties dialog box.
Set-EVArchivePermission is provided by the snap-in Symantec.EnterpriseVault.PowerShell.Snapin.dll.
Set-EVArchivePermission [-ArchiveId] <String> [-Trustee] <String> [-Grant <AccessRight[]> {Read | Write | Delete | All}] [-Deny <AccessRight[]> {Read | Write | Delete | All}] [-WhatIf] [-Confirm] [<CommonParameters>]
Table: Set-EVArchivePermission parameters
Parameter | Description |
|---|---|
-ArchiveId (required) | Specifies the ID of the archive for which to set the access permissions. You can use Get-EVArchive to obtain the required ID. |
-Trustee (required) | The account name of the user or group for which you want to add or update access permissions on the specified archive. For Active Directory accounts, type the value in any of the following formats:
For Domino accounts, type the value in any of the following formats:
|
-Grant | The access permissions that you want to grant to the user or group on the specified archive: Read, Write, or Delete. Specifying the access type as All grants all types of access to the user or group. You can specify multiple access types by separating them with commas; for example, -Grant Read,Write. |
-Deny | The access permissions that you want to deny to the user or group on the specified archive: Read, Write, or Delete. Specifying the access type as All denies all types of access to the user or group. You can specify multiple access types by separating them with commas; for example, -Deny Read,Write. |
-WhatIf | Shows what would happen if the cmdlet runs. The cmdlet is not actually run. |
-Confirm | Prompts you for confirmation before running the cmdlet. To suppress the confirmation prompt, use the syntax -Confirm:$False. You must include a colon ( : ) in the syntax. |
Set-EVArchivePermission -ArchiveId 19D...EVServer1 -Trustee EXAMPLE\msmith -Grant read
Grants the user "EXAMPLE\msmith" read access permission on the archive with the ID "19D...EVServer1".
Get-EVArchive -ArchiveName msmith | Set-EVArchivePermission -Trustee EXAMPLE\msmith -Deny d
Pipes the archive ID that is obtained from Get-EVArchive to Set-EVArchivePermission and denies the Windows user "EXAMPLE\msmith" delete permission on the archive "msmith".
Get-EVArchive -ArchiveName dsmith | Set-EVArchivePermission -Trustee dsmith/DominoOrg -Deny d
Pipes the archive ID that is obtained from Get-EVArchive to Set-EVArchivePermission and denies the Domino user "dsmith" from the Domino Directory "DominoOrg" delete permission on the Domino Mailbox archive "dsmith".
Get-EVArchive -ArchiveName msmith | Set-EVArchivePermission -Trustee Example\Supervisors -Grant All -Deny R, W
WARNING: You have specified the same permissions in the Grant and Deny parameters. The permissions specified in the Deny parameter will take precedence. The cmdlet will add permissions 'Deny: R, W'.
Confirm Do you want to continue? [Y] Yes [N] No [S] Suspend [?] Help (default is "Y"): Y
Displays the warning and prompts for confirmation to proceed. If you choose 'Yes', the command grants the group "EXAMPLE\Supervisors" delete access permissions and denies the read and write access permissions on the archive "msmith".
Get-EVArchive -ArchiveName msmith | Set-EVArchivePermission -Trustee EXAMPLE\Supervisors -Grant Delete -Deny All -Confirm:$false
Displays the warning, and then denies the group "EXAMPLE\Supervisors" read, write, and delete access permissions on the archive "msmith" without asking for confirmation.
Get-EVArchive -ArchiveName msmith | Get-EVArchivePermission | ForEach-Object { Set-EVArchivePermission -ArchiveId 19D...EVServer1 -Trustee $_.Trustee -Grant $_.ManualGranted -Deny $_.ManualDenied }
Pipes the archive ID that is obtained from Get-EVArchive and the list of access permissions from Get-EVArchivePermission and copies the access permissions that are granted on the archive "msmith" to the archive with ID "19D...EVServer1".
Set-EVArchivePermission returns an object of type EnterpriseVault.Admin.ArchivePermissionEntry, which has the following properties.
Table: Set-EVArchivePermission properties
Name | Type | Description |
|---|---|---|
ArchiveId | String | The ID of the archive to which the user or group has access. |
ArchiveName | String | The name of the archive to which the user or group has access. |
ArchiveType | EV_STG_API_ARCHIVE_TYPE | The Enterprise Vault archive type enumeration. The possible values are as follows:
|
TrusteeId | String | The ID that uniquely identifies the user or group. For Active Directory accounts, the cmdlet displays the security identifier (SID), whereas for Domino Directory accounts the cmdlet displays the UNID. |
Trustee | String | The account name of the user or group. |
TrusteeSource | TrusteeSource | The directory service in which the user or group has an account. "Windows" designates Active Directory, whereas "Domino" designates a Domino Directory. |
TrusteeType | TrusteeType | The Enterprise Vault trustee type enumeration. The possible values are as follows:
|
ManualGranted | AccessRight[] | The manually-granted level of access: Read, Write, or Delete. |
ManualDenied | AccessRight[] | The manually-denied level of access: Read, Write, or Delete. |
AutoGranted | AccessRight[] | The automatically-granted level of access: Read, Write, or Delete. |
AutoDenied | AccessRight[] | The automatically-denied level of access: Read, Write, or Delete. |