Blog

Exchange 2013 Legal Hold

Create a custom retention policy for retained mailboxes In addition to enabling the archive mailbox and automatically extending archiving for Litigation Hold or Persistent Hold mailboxes, you can also create a custom retention policy for hold mailboxes. This allows you to apply a retention policy to archived mailboxes that is different from the default MRM policy applied to mailboxes that are not in the archive. This allows you to apply retention tags specifically designed for queued mailboxes. This includes creating a new retention tag for the Recoverable Items folder. To put all mailboxes in an organization in evidence for 1 year, use the following command: Items in the Recoverable Items folder are not charged for the user`s mailbox quota. In Exchange, the Recoverable Items folder has its own quota. For Exchange, the default values for the RecoverableItemsWarningQuota and RecoverableItemsQuota mailbox properties are set to 20 GB and 30 GB, respectively. Use the Set-MailboxDatabase cmdlet to change these values for a mailbox database for Exchange Server 2013. Use the Set-Mailbox cmdlet to modify them for individual mailboxes. EACàCompliance ManagementàIn-Place eDiscovery & holdàNew as follows Indefinite holding: The scenario of indefinite detention is similar to holding litigation. It is intended to preserve mailbox items so that you can meet eDiscovery requirements. During the litigation or investigation period, items are never deleted. The duration is not known in advance, so no end date is configured.

To store all mail items indefinitely, do not specify query or duration parameters when you create an in-place hold. Place place a mailbox in evidence retention to preserve all the contents of the mailbox, including deleted items and original versions of changed items. When you place a user`s mailbox on litigation hold, the contents of the user`s archive mailbox (if enabled) are also put on hold. Deleted and modified items are retained for a period of time or until you delete the mailbox from the suspension for litigation. All of these mailbox items are returned in an in-place eDiscovery search. Many organizations require users to be notified when they are put on hold. Additionally, if a mailbox is pending, there is no need to stop the retention policies that apply to the mailbox user. Because messages continue to be deleted as expected, users may not notice that they are pending.

If your organization requires that pending users be notified, you can add a notification to the Mailbox user`s Retention Comment property and use the RetentionUrl property to link more information to a Web page. Outlook 2010 and later displays the notification and URL in the Backstage box. You must use the Shell to add and manage these properties for a mailbox. Click View Details to check when and by whom the mailbox was placed in the Hold for Litigation box. You can also view or change the values in the optional Test duration (days), Rating, and URL fields. Exchange 2013, Microsoft Lync 2013, and Microsoft SharePoint 2013 provide an integrated preservation and eDiscovery environment that allows you to store and search for items across data stores. Exchange 2013 enables you to archive Lync Server 2013 content to Exchange, eliminating the need for a separate SQL Server database to store archived Lync content. The built-in retention and eDiscovery feature in SharePoint 2013 lets you store and search data across all stores from a single console. DiscoveryHold: When a user is placed on In-Place Hold, deleted items are moved to that folder.

When the Mailbox Wizard processes the mailbox, it evaluates the messages in that folder. Items that correspond to the compliance retention request are retained for the retention period specified in the query. If no waiting period is specified, items are retained indefinitely or until the user is removed from the hold. A critical issue has been reported with evidence-taking behavior in Exchange Server 2013 and Office 365. When you set an Exchange 2013 mailbox to In-Place Hold or Litigation Hold, Microsoft Lync 2013 content (such as IM conversations and files shared in an online meeting) is archived to the mailbox. When you search the mailbox by using the eDiscovery Center in Microsoft SharePoint 2013 or in-place eDiscovery in Exchange 2013, any archived Lync content that matches the search query is also returned to the search results. You can also limit the search to Lync content that is archived in the mailbox. Great post! Can you provide an explanation of direct archiving in Exchange 2013? I have a hard time getting it right with archiving, but to no avail.

Thanks in advance! EACàRecipientsàMailboxestoselect the mailbox that needs to be put on hold for litigation and modify […] In-Place Hold feature of Microsoft Exchange 2013 – […] In Exchange 2010, the Allowed Retention Date role provided users with sufficient permissions to set the suspension for mailbox litigation. In Exchange 2013, you can use the same permission to place mailboxes in an unlimited or time-based compliance store. However, to create a query-based compliance store, the User must be assigned the Mailbox Search role. Both roles are assigned to the Discovery Management role group. Duration-based hold: In permanent retention and litigation retention, you can specify a retention period for items. The duration is calculated from the date a mailbox item was received or created. Stay transparent to the user by not having to stop risk management (MRM). To enable archiving of Lync content to your Exchange 2013 mailbox, you must configure Lync 2013 integration with Exchange 2013. More information, see the following topics: If you have an Exchange hybrid deployment, the following conditions apply when you move (integrate) an on-premises Exchange 2013 mailbox to Exchange Online in Microsoft 365 or Office 365: In Exchange Server 2013, the default storage limit for the Recoverable Items folder is also 30 GB. We recommend that you regularly monitor the size of this folder to make sure it does not reach the limit.

For more information, see Recoverable Items Folder. This issue occurs when a user uses OWA to delete or move a folder from a delegated mailbox that is in the archive to another mailbox if that mailbox is also open in OWA but not in the archive. Items are retained based on the retention settings of the delegate`s own mailbox, not the delegate mailbox settings. The delegate can move or delete individual items in a folder, and the items are retained as expected. blogs.technet.com/b/exchange/archive/2013/12/11/litigation-hold-and-in-place-hold-in-exchange-2013-and-exchange-online.aspx Under Litigation Hold: Disabled, click Enable to move the mailbox to the litigation hold. Versions: If a user has enabled In-Place Hold or Litigation Retention, mailbox items must be protected from manipulation or modification by the user or a process. This is achieved through a copy-to-write process. When a user or process changes certain properties of a mailbox item, a copy of the original item is stored in the Versions folder before the change is committed. The process is repeated for subsequent changes.

Items captured in the Versions folder are also indexed and returned in In-Place eDiscovery searches. Once they are no longer retained, copies of the Versions folder are deleted by the managed folder wizard. If a mailbox is placed simultaneously on one or more in-place and litigation holds (without delay), all items are retained indefinitely or until the retention areas are deleted. If you delete litigation retention and the user is still stored on one or more in-place holds, items that meet the criteria for permanent retention are retained for the duration specified in the retention settings. If you move a Litigation Hold mailbox in Exchange 2010 to an Exchange 2013 Mailbox server, the Litigation Hold setting still applies to ensure that compliance requirements are met during and after the move. In-Place Hold is an eDiscovery feature introduced with Exchange Server 2013. In-Place Hold helps an administrator decide what to keep under mailbox and how long to keep.