I am at the one post a day area with all of the time I
am spending on real work and Active Directory 3rd edition. This post
wins....
I would set my hair on fire before trying to whip
up a quick event sink to do anything with any form of compliance (or actually
any Exchange Event Sink doing anything).
There are two plugins I would NEVER write quickly and
not put through months of monstrous scaling, crap data, and security tests prior
to moving into production. Event Sinks that plug into Exchange and Password
Filters that plug into LSASS. One of my customers now has a Sink that has caused
so many issues in the past year that I would consider never running any event
sink from any one ever again. I can't imagine how much money has been spent on
troubleshooting it but I expect the costs so far exceed the cost of the product
that the product could cost 10 times more and still not top the troubleshooting
costs.
I haven't been following all of the emails in the
story "exploits of a new job or how I got thrown under a bus one fine day"
but from what I have seen, just migrate the domains already into a properly
functioning forest. Blood is squirting out the eyes, ears, and nose and we seem
to me worried that our shoes aren't tied and are wearing mismatched socks. If we
could see properly, we could tie our shoes and properly pick two green
socks.
Not trying to be mean but that is my impression from
the posts I have seen on the varioud issues.
The archive sink plus a bit of FSO and CDO coding
could give you that.
joe has probably already written a utility so that you
wouldn't have to do any coding. :-) j/k
The
Archive Sink provides the capability of storing all messages to a flat file. It
is an event sink that archives each email message handled by a specified SMTP
Virtual Server to a flat file (more specifically, an EML file). This file
contains the complete text of a message; including headers, body, MIME
separators, etc. It is relatively simple to process each individual file as
appropriate (such as storing it into a SQL database, for example) and then
deleting the file.
As with
Message Journaling/Archiving, the Archive Sink does not, by default, include BCC
recipients or process various system messages. Options are available to enable
inclusion of those messages.
If you
choose to use the Archive Sink, disk usage of the files can grow at a quick
pace; since SIS (Single Instance Storage) does not apply to the generated
EML files.
For
information about acquiring, installing, and using the Archive Sink, please see
Microsoft KB 871110 (How to install and use the Archive Sink utility in Exchange
Server 2003). For more information about event sinks, see the Microsoft Exchange
Server 2003 Software Development Kit (SDK), available at http://microsoft.com/exchange/downloads.
My company is tied in to a specific archive solution. they want to
outsource the whole archive thing.
this solution uses mapi and needs a dedicated journal mailbox server.
however due to my AD issues, i can't install a new exchange server.(no root
domain. no SA or EA access. writtien about ad infinitum in older posts..)
so, i want to specifiy a contact with the smtp addy of the archive company
smarthost as an archive mbox and route that out a dedicated smtp
connector.
however, i know the archive contact will rewrite, at least,the envelop
header of the email and thus put us out of compliance.
my question is, is there an event sink i could write that would somehow
keep the original header and strip the envelop rewrite? make it look just like a
copy of the orginial email like a true archive mbox would.
i know a previous company called Assentor did this somehow but i'm not sure
how.
any help in this would be great.
thanks!!
