Review: Symantec Enterprise Vault 2007 Solves E-Mail Archiving Woes

Data archiving has become increasingly important to IT in the past couple of years. Most organizations limit online e-mail storage, forcing end users to archive large e-mail files in local folders. This doesn’t solve the storage problem; in fact, it makes it worse. You are still storing data, but now you’re putting it where it won’t be backed up and isn’t easily searchable.

Symantec Enterprise Vault 2007 offers an option for providing a single archive for data from a number of sources, including Microsoft Exchange and SharePoint Portal Server, IBM Lotus Domino and ordinary file shares. For this review, I focus on the e-mail experience because that’s why IT departments typically deploy Enterprise Vault.

End-User Advantages

First and foremost, users don’t like change, and Symantec Enterprise Vault 2007 minimizes change. Archived e-mail can appear in Outlook like normal messages, albeit with a slightly different icon. Depending on the administrative policy, either the whole message or a limited portion will reside in the user’s mailbox with a link to the whole message and attachments. When a user clicks the link, Outlook accesses Enterprise Vault (instead of Exchange) and brings the attachment or message to the desktop.

Users can also manually add and remove items to comply with mail-server quotas. Buttons can be added to the Outlook interface for these functions, so there’s no extra client software required. Administrators can disable these buttons, and most disable the “retrieve item from archive to mail store” button. This does not prevent the user from viewing an item, just from bringing it back into the Exchange store.

Searching the archive is intuitive. If your organization uses Windows Desktop Search, a button can be added to the search interface to also search the Vault. There’s an advanced search that’s easily accessible in a simple browser interface. Because the index is stored in Microsoft SQL Server, the search is fast — certainly faster than a search of a taxed Exchange store.

For road warriors, Enterprise Vault 2007 includes an offline vault that’s stored locally and synchronized with the Enterprise Vault server when a connection is available. That way, users can search and retrieve items from the archive even when offline. As with most features, an administrator can enable or disable this tool for particular users as necessary.

Why Symantec Enterprise Vault 2007 Works for IT

In my organization, this product has minimized change for users and has given the IT department more flexibility. The product developers seem to have anticipated just about anything an administrator would want to do with Enterprise Vault and have made it easy to manage through Microsoft Management Console. You simply add the Enterprise Vault snap-in to your favorite customized console as another tool in your arsenal.

Configuring it for Exchange involves three steps.

The first step is to create an Exchange Policy. This policy contains a number of options:

• the minimum period (since the last access) for which an item can be archived (For example, if this is set to two weeks, an item that has been accessed in the last two weeks would not be archived.)
• what to do with large items, and whether or not to simply archive messages with attachments only
• whether to archive by age or by percentage of storage limit (Should items more than three months old be archived, or should they automatically archive when the user reaches 75 percent of his mailbox quota?)
• functions (offline vault, retrieve/put into vault) available to the user
• message class (mail item, calendar item or contact item)
• shortcut that is left behind (full message body or characters, for instance)

The second step is to create a Retention Category for the policy. This specifies how long items archived by the policy are to be kept before deletion. The process is as simple as right-click and follow a wizard.

The third step is to create a Provisioning Group. A Provisioning Group can be a Microsoft Windows Active Directory security group, user, distribution list, organizational unit, the entire organization or even a custom LDAP query. Once this group has been created, you apply your policy to the group. It’s likely you will have multiple Provisioning Groups, so you will also need to rank them. If a user falls into multiple groups, the group with the highest ranking will determine which Exchange Policy to apply to a particular message.

As you can see, the process is simple and yet flexible enough to accommodate just about any organization’s needs. One cool idea is to create an Exchange Policy that archives every item immediately, based on a standard Retention Category. Then, if you create a Provisioning Group that holds all disabled user accounts — presto! — whenever an employee leaves and you disable his account, Enterprise Vault will archive and remove all incoming e-mail from Exchange automatically.

There are some other interesting features, too. From the administrator console, you can create a job that searches users’ registries or file systems for Outlook personal folder files, and then import them into the archive. This obviously affects the users, so carefully consider implementation to minimize the impact.

Users can also delete items from their archive. In the event a user accidentally deletes an item (and this is bound to happen), Symantec Enterprise Vault 2007 includes a new Deleted Items Recovery feature that stores items for a specified amount of time (about 14 days). This feature is accessible from the administrator’s console.

Finally, because you can extend Enterprise Vault to cover Windows file shares and SharePoint Server, you can archive whole site collections, certain subsites and even certain lists or Web parts.

Disadvantages

Symantec has made the product easy to configure and has minimized the fallout for users. But there’s still room for improvement.

The advanced search interface is a bit clunky. Although it’s functional — and it’s really sweet that it’s a Web interface — I think Symantec’s Web designers could have adopted a fresher look, one more in line with today’s Web technologies.

Starting with this version, Enterprise Vault has support for Microsoft Office Communications Server 2007, but the archival process is a bit contrived. It involves scheduling a job using the Export Tool and an out-of-the-box configuration file provided by Symantec. You then configure the job to run in real time or in bulk at specific times (say, 2 a.m. each day). That’s not bad, but I expect something more in line with the rest of the tool in the next version.

E-discovery is a fairly big topic in archiving, but without the Discovery Accelerator (DA), you’re limited to the same search functionality the users have, and you’ll need to search one user at a time. For a small shop or one that rarely needs e-discovery, that’s fine. But for a large organization or one that expects litigation often (such as a hospital or an insurance company), DA is necessary and comes at an additional price.

Speaking of price, you need to be prepared for the à la carte pricing model. If you have Veritas Backup Exec, you know what to expect. You pay for what you use. If you need the SharePoint archive agent, it’s extra. If you need the Discovery Accelerator, it’s extra. Then again, if you don’t need either, you won’t have to pay for them.

The archives reside as flat files on a server, but don't forget about the indexes! These indexes can add an additional 12 percent to the size of the archived data. You’ll want to back up the archive and the index (it could take a long time to rebuild), which adds another layer of complexity to your disaster recovery or backup process. In some organizations, integrating an archival product into the disaster recovery strategy can be a challenge, so make sure you’re fully prepared before your start your Symantec Enterprise Vault deployment.