Error Message

There is no error message shown for this issue. However, the incorrect behavior is visible in a Dtrace of the specific process: ArchiveTask (for mailbox archiving) or JournalTask (for journal archiving).

The correct distribution list name is identified when the task initializes the filter:
(JournalTask)    <22964>    EV:L    {CNameList::AddDLNameToList:#95} Adding entry [#1] [Sales] to [DL] list

However, the name of the other distribution list is shown when the actual membership polling is performed:
(JournalTask)    <34084>    EV:L    {CDLHelper::ContainsRecipient:#1070} [user 1] [user1@ev.local] not found in DL [Sales_Americas]

This is a known issue present in some versions of Enterprise Vault.

The MAPI functionality to find distribution list by name does not allow a search for only exact matches. It can only search for a match "at the start of the property identified" and "only up to the length of the search string." This is effectively a "starts with" search. Thus the function returns all distribution lists that start with the name specified in the rule.

Further logic is then employed by EV's tasks to narrow these results to the exact name specified in the rule; unfortunately, in the EV versions listed above, this logic contains an error that results in the incorrect name being selected from the results.

This issue has been addressed in Enterprise Vault 12.1.1, which is available from the Download Center.


Workaround

In earlier versions of EV make sure that any distribution list referenced in a

message attribute in a custom filter rule does not have a name that matches the start of another distribution list's name. To test this, type
Get-DistributionGroup MyGroupName* in the Exchange Management Shell. If more than one result is returned, the list will fall victim to this issue, and the rule will process the membership of a distribution list other than the one specified in the rule. If only one result is returned, then the correct list's membership will be processed.