Enterprise Vault SMTP Journaled messages with BCC external recipient tagged with incorrect message direction (Vault.MsgDirection) value.

Problem

SMTP Journaled messages with external recipients in the ‘BCC’ field are getting tagged with in-correct message direction (Vault.MsgDirection) value. Such a message is getting marked as ‘Internal’ instead of ‘External-Outbound’. This issue is not seen when the external recipient is part of the ‘TO’ or ‘CC’ field.

Note: An internal Vault.MsgDirection is signified with a value of "1". See the referred article below for more information.

The issue can be seen in Enterprise Vault versions 12.4.2 or 12.5.0 onwards.

Error Message

No errors seen

Cause

An explicit issue addressed earlier to handle messages which are bifurcated (split) during transport before reaching Enterprise Vault for the purpose of getting archived. Messages can be bifurcated in O365/Exchange on-premise if a recipient is part of a transport rule (for example – Bypass Spam Filtering).

See the referred article below for more information.

Solution

A configurable registry option is now available with addressed Enterprise Vault versions (14.1.3 and 14.2.1 onwards) which could be set by the administrator, it will override the current behavior and persists with the msg direction value present in the Indexable User XML. This registry would take effect on all new messages that will get archived after it is set.

Steps to implement the registry:

On the EV server, the below custom registry DWORD name with relevant value needs to be created while the EV Storage service is stopped. This value will be read by the EV StorageOnlineOpns module and appropriate action will be taken based on whether the value is set to 0 or 1.

A registry value of '0' indicates that the value of the message direction will not be modified when the message direction by assuming that messages are from non-split messages configurations, whereas '1' indicates it will modify messages direction by reviewing details in P2 messages in the envelope journaled message when a split message situation occurs (if configured as '1' such messages with external recipient in BCC would be marked as internal, which is also the behavior without the registry).

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\Storage]

"OverrideMessageDirection"=dword:00000000

 

Related articles

How to find emails tagged by message direction using Enterprise Vault (EV) advanced web search or Discovery Accelerator (DA) search.

SMTP Journaled Messages can be Tagged with an Incorrect Message Direction (Vault.MsgDirection) Value