NetWrix Exchange Mail Archiver Version 1.5 Administrator Guide

Transcription

1 NetWrix Exchange Mail Archiver Version 1.5 Administrator Guide

2 Contents 1. Introduction What is the NetWrix Exchange Mail Archiver? Product Architecture Licensing System Requirements Installing the Product Working with the Product How to View the Archived Messages Archived Mail Viewer ediscovery Search Portal Access to Personal s Using Personal Mailbox Search Advanced Features and Terms Omit and Include Files Journaling User Ongoing Archiving Archiving Wizard (Existing s Archiving)...15 Step Step Step Step Reindex Dialog About NetWrix Products Disclaimer Page 2

3 1. Introduction 1.1. What is the NetWrix Exchange Mail Archiver? The NetWrix Exchange Mail Archiver is an easy to use and scalable archiving solution for Microsoft Exchange that automates e-discovery and compliance processes, improves data storage efficiency, server performance and end-user productivity. The product takes minutes to configure and supports thousands of users. Freeware and Commercial Versions are available. The Exchange Mail Archiver archives all messages to a central location and makes them available for quick e-discovery/compliance responses with protection against content tampering in PST files and mailboxes. Archived messages are stored in a highly compressed format to minimize storage usage and increase Exchange server efficiency, while the original messages are replaced with short URLs making them available to mailbox owners with minimal user impact. The use of Exchange Mail Archiver removes the hassles of PST file maintenance and mailbox quota management: PST files can be completely removed from your Exchange environment without increasing mailbox quotas. Features and Benefits: Highly efficient and centralized archive, searchable by administrators and end users (full-text search by subject and body patterns (*), time frame, and sender/recipient). Reduced storage costs (up to 80%) because of message and attachment compression and data consolidation. Ability to replace actual messages with URL placeholders. (*) Scalable enough to handle thousands of users, no SQL database is required. Does not use any undocumented features and "hooks" in Exchange, making it very reliable and efficient with minimal footprint. Protection of messages against tampering by users to help meet regulatory compliance standards. Supports e-discovery processes and litigation preparedness (e.g. legal hold, authenticity verification). Data can be exported (*) for further review and litigation purposes. Transparency to end users to avoid productivity losses. * - Only available in the Commercial Version Page 3

4 1.2. Product Architecture Figure 1: Product Architecture and Data Flow The data flow diagram above depicts the Ongoing Archiving procedure. The archiving process starts after configuration of the product and proceedes as follows: Messages from your Exchange Servers first go to the Journaling Mailbox and are then archived and saved to Storage. Administrators can review the archived messages using the Archived Mail Viewer and ediscovery Portal (*) while users can access their archived messages using the Personal Mailbox Search. (*) It is possible to use the Mailbox Archiving Wizard to archive existing messages. (*) * - Only available in the Commercial Version Page 4

5 1.3. Licensing NetWrix Exchange Mail Archiver Administrator Guide The NetWrix Exchange Mail Archiver comes in two versions: Freeware and Commercial. The table below outlines the differences between them. Feature Freeware Version Commercial Version Export archived messages into one single package for e-discovery requests. Message search capabilities. No sender/recipient timeframe Yes sender/recipient timeframe full text search by message subject and body Import of existing messages from mailboxes. Exchange storage optimization. No No Yes Yes. Messages and are consolidated and replaced with "stubs" (links to contents) after configurable period of time. End-user transparency. No Fully transparent, integrates with Outlook 1.4. System Requirements The product can be installed on a computer fitting the following system parameters: Operating System: Windows XP x64, Windows 2003 or higher, joined to the same Active Directory domain as the Microsoft Exchange Servers you want to process..net Framework 2.0, 3.0 or 3.5. IIS (for the Commercial Version). If your IIS version is 7.0, make sure that IIS 6.0 management compatibility is enabled Installing the Product The NetWrix Exchange Mail Archiver can be installed on any computer that has access to the domain where the target Exchange Servers are located. Before starting the installation process, carefully review all of the system requirements. To install NetWrix Exchange Mail Archiver, run emafree_setup.msi using the Freeware Version, or emafull_setup.msi using the Commercial Version. The installation wizard guides you step-by-step through the installation process. Page 5

6 2. Working with the Product To start the program configuration utility go to Start All Programs NetWrix Exchange Mail Archiver Exchange Mail Archiver. Figure 2: Configuration Utility Main Window 1. The Enable Ongoing Archiving option is responsible for turning the product on/off. 2. The Managed Exchange Organization field should point at the target Exchange Organization. Enter the domain name followed by Exchange Organization name where your Exchange Servers are located. 3. The Archive messages to field specifies a folder on your computer, where the archived messages should be stored. 4. The Store archived s for field specifies the number of months the s are to be kept in the Page 6

7 storage folder for. NetWrix Exchange Mail Archiver Administrator Guide 5. The Remove old s daily option enforces the product to remove the old messages on a daily basis instead of the monthly one. 6. The Store s indefinitely option overrides any other old s deletion options, preventing any of the s from being deleted at all. 7. The Specify button opens the Exchange Mail Archiver Journaling Mailbox Setup dialog. 8. The Keep archived s in mailboxes option leaves the messages in traget mailboxes despite any products archiving activity. 9. The Replace archived s with URL placeholders after option waits for a customizable amount of days before cleaning target mailboxes off the messages being already archived. The option, being enabled, significantly lowers your Exchange Server disk usage by replacing the actual messages with stubs containing URL links to their archived copies. Clicking on these URLs opens the clicked message through Personal Mailbox Search portal in your web browser (*). 10. The Delete archived from mailboxes after option does exactly the same as the one above except for leaving but a single stub with a generic link to Personal Mailbox Search portal. 11. The Send notifications to field must contain an address the reports are to be sent to. The reports usually contain information like the number of archived messages and errors occurred during Ongoing Archiving. 12. The SMTP server name and port fields must contain the server name and port of and SMTP server used to send the reports. 13. The Sender address is the one displayed in the From field of the reports. 14. The Verify button sends a test message to the specified mailbox, using the specified SMTP settings. 15. The Archive button is used to Import previously existing messages to the database. This is useful if you want to archive messages existed prior to the products initial usage. It can also be used for reconsolidation of the archive. For more info please see the Archiving Wizard section. 16. The Apply button validates the settings and makes the product running with these settings. However, it is necessary to enter credentials for a user profile that will run the scheduled task: Figure 3: Account Credentials Request Specify the account that will be used to run the messages archiving scheduled task and click OK. * - Only available in the Commercial Version Page 7

8 Note: The account must have write access to the folder with archived s and have enough rights to create domain user and Exchange mailbox. The task can be modified using Windows Task Scheduler. 17. If it is the first time product configuration, the following two more sequential operations are automatically proposed: Setup journaling via Exchange Mail Archiver Journaling Mailbox Setup; Archive existing messages via Archiving Wizard. The following dialog box appears on initital Archiving Wizard launch, where you have to click Yes if you want to archive all existing messages: 18. After everything described above is complete, the configuration is saved and a scheduled task is created. Page 8

9 3. How to View the Archived Messages 3.1. Archived Mail Viewer To view the archived messages, use NetWrix Archived Mail Viewer. To launch the Viewer, go to Start All Programs NetWrix Exchange Mail Archiver Archived Mail Viewer. Figure 4: Archived Mail Viewer Main Window NOTE: Features From sender, To recipient and Text to search are only available in the Commercial Version. Choose the dates to show the messages between and click View. You default web browser will open and show you the list of the messages found: Figure 5: Exchange Mail Archiver Report Example You may click View to display the corresponding message. The message will be opened in your default application associated with.eml files (for example, Microsoft Outlook Express, Microsoft Mail, etc.). Page 9

10 3.2. ediscovery Search Portal NetWrix Exchange Mail Archiver Administrator Guide ediscovery Search Portal (*) implements an interface that allows administrators to browse through all the archived messages and search for certain message by custom criteria. The access to the portal should be restriced to anyone but a trusted administrator since the data retrieval facility may allow undesired information leaks. Figure 6: ediscovery Search Portal This form allows specifying search criteria quite precisely: 1. The Dates between filter sets the message temporal signature bounds delimiting the scope of messages taken in consideration during search. 2. The Sender(s) field allows searching messages sent from a specified sender(s). Multiple sender addresses should be separated with commas. 3. The Recipient(s) field allows searching messages sent for specified recipient(s). Multiple sender addresses should be separated with commas. 4. The Text to search filter implies a powerful text-searching engine used to pick archived messages matching specific content. For text search syntax explanation, click the (?) sign next to the option name to get a detailed help on it. 5. The Remember search criteria option simply retains all the fields entries while exiting the portal and entering it again. 6. The Load Keywords allows loading some template for the Text to search field from a text file. The template may be created manually using Notepad or a similar text editor, as well as saved using the Save Keywords button. * - Only available in the Commercial Version Page 10

11 7. The Search button commences the search process Access to Personal s Using Personal Mailbox Search Personal Mailbox Search (*) is a web portal that lets users to browse through the archived messages from their personal (and other allowed if any) mailbox and search for certain messages by custom criteria. The figure below displays an example of the search web page: Figure 7: Personal Mailbox Search The form highly resembles the ediscovery Search Portal described above with only one major exception. The scope of search is strictly limited by the logged in user access rights and only allows searching among the logged in user personal messages. Thus the Personal Mailbox Search should be made available to end users. * - Only available in the Commercial Version Page 11

12 4. Advanced Features and Terms NetWrix Exchange Mail Archiver Administrator Guide This section describes advanced product functionality that may be used for fine-tuning the product settings and getting most out of it Omit and Include Files There are several configuration text files, known as omit and include files, located in the main product directory. The list below describes exact file identities and usability: OmitServers.txt contains NETBIOS names, each on a separate string, of the exchange servers to be excluded from the archiving process. By default the file is empty. Include s.txt contains wildcard masks for addresses, each on a separate line, subjected to archiving. By default, the only entry is the * wildcard which permits archiving for all addresses. Omit s.txt contains wildcard masks for addresses, each on a separate line, ignored during archiving process. By default the file is empty. For example, if the Include s.txt file only contains a * string (as by default) and the Omit s.txt only contains an administrator@* string, then all the s, except for the ones having the administrator mail nick name, are subjected to archiving Journaling User The journaling user is a special user used for retrieving all messages passing the managed Exchange Servers and to access other user mailboxes during the existing s archiving procedure. Thus the created/selected journaling user must have administrator rights for managed Exchange Servers and journaling rules for all mailbox databases and managed Exchange Servers. The journaling user is created/selected on the first time of clicking Apply on the main form. It may also be changed later by clicking the Specify button on the configuration utility. Exchange Mail Archiver Journaling Mailbox Setup A task credentials dialog box appears. Specify a Journaling User, an Exchange Server and a Storage group that will further be used as the journaling mailbox: Figure 8: Journaling Exchange Server and Storage Group Selection The form allows either creating a new Journaling User or pointing to an existing one: Page 12

13 Create new user automatically a new user is created and granted administrator right for all the Exchange Servers except for the ones listed in the Omit Files. The following parameters should be specified if this option is chosen: User name the new user s name, without a domain. The new user will be created in the selected Exchange Server domain. Exchange server The Exchange Server, where the user is created. Storage group the storage group where the new user is to be created (applicable to Exchange 2003 and 2007 only). Specify an existing user an existing user is chosen to be the Journaling User. The user is also given the Exchange Server administrator rights if he does not have them. User name an existing users name with domain separated by slash. Password the existing user s password. After a journaling user has been created/selected, it is given Exchange Servers administrator rights for all Exchange Servers except for the ones listed in the OMIT FILES. Click OK and wait for the configuration to finish: Figure 9: Progress Upon the progress completion the following window pops up: Click OK. Product configuration is now finished. Figure 10: Completion Message Page 13

14 4.3. Ongoing Archiving NetWrix Exchange Mail Archiver Administrator Guide The Ongoing Archiving is one of the main features of this product. Each time it is lauched by the scheduled task or manually, it performs archiving of all new content of managed Exchange Servers. The process is conducted according to settings configured from the main configuration utility. Do not mix up the Ongoing Archiving an operation performed over new messages with the existing messages archiving done by the Archiving Wizard. Working with the Ongoing Archiving, consider the following statements: Journaling is set up by configuring the msexchmessgejournalrecipient property on all the mailbox databases of managed Exhange Servers; The servers listed in the OmitServer.txt are naturally excluded from the whole process; The correctness of the journaling setings is checked each time the scheduled task runs; If a user changes managed Exchange Servers journaling parameters manually, the settings are automatically restored; In case of adding a new mailbox database to a managed Exchange Server, its journaling will be enabled during the next scheduled task launch; Journaling parameters are deleted from every mailbox database if the corresponding server is listed in OmitServers.txt. However, if a previously existed journaling user is used, the journaling parameters are not reset; Journaling only affects messages that correspond to the conditions described in Omit s.txt and Include s.txt. Page 14

15 4.4. Archiving Wizard (Existing s Archiving) The Archiving Wizard allows archiving existing messages from user mailboxes from selected Exchange Servers. The operation is performed under journaling user credentials and for all mailboxes matching the Omit s.txt and Include s.txt filter settings. The Archiving Wizard is available from the products main configuration utility, after clicking the Archive button and from Start All Programs NetWrix Exchange Mail Archiver Mailbox Import Wizard. Step 1 On this welcoming step, carefuly read the Archiving Wizard description and click Next. Step 2 This step allows selecting Exchange servers to be processed: Figure 11: Completion Message Mark the servers you want to archive the messages from. Click Next. The Full archiving option, if enabled, makes the wizard to process the servers from anew, as if there was no previous archiving. That means that no matter if part of the messages is already archived; the whole server will be processed. Duplicate messages already existing in the archive are skipped. Page 15

16 Step 3 Behold the archiving progress Figure 12: Completion Message Step 4 Review the archiving results and click Finish Reindex Dialog The Reindex is a feature of Exchange Mail Archiver, used to: Restore the storage if it gets damaged; Switch from version 1.1 to version 1.5 of the product. To launch the Reindex Dialog, go to the product installation folder and run EMA.exe with the /repair key. Page 16

17 5. About NetWrix Products NetWrix Exchange Mail Archiver Administrator Guide Solutions developed by NetWrix Corporation help organizations to meet compliance standards, simplify identity management, and reduce IT infrastructure costs. The product line includes solutions for change management, identity management, virtualization, and Active Directory troubleshooting. Enterprise Management Suite: NetWrix Enterprise Management Suite is a rich collection of all NetWrix products combined together into one integrated solution. The suite is well-maintained and regularly updated with new versions and completely new products that all customers are entitled to as long as their maintenance is up to date. Change Reporter Suite: The Change Reporter Suite is an integrated solution for automated tracking and reporting of all critical changes in the entire IT infrastructure, including Active Directory, file servers, Microsoft Exchange, filer appliances such as NetApp or EMC, virtual and physical infrastructure, SQL Server databases. Everything is centrally audited, consolidated, and presented in easy to understand reports with before and after values of all who, what, when and where modifications. Identity Management Suite: The NetWrix Identity Management Suite brings convenience, enhanced security, and brings sensible benefits to everyone within an organization. The solution resolves account lockouts, forgotten passwords and password expiration problems, while also providing user account de-provisioning and privileged password management. Active Directory Change Reporter: Full-featured Active Directory auditing and compliance solution with full coverage of AD, Group Policy, Exchange, and object-level rollback capabilities. Tracks who changed what, when, and where in Active Directory and related systems. USB Blocker: USB Blocker enforces centralized access control to prevent unauthorized use of removable media that connects to computer USB ports memory sticks, removable hard disks, ipods, and more. File Server Change Reporter: File server and filer appliance auditing solution. Supports Windows servers, NetApp Filers, EMC appliances. SQL Server Change Reporter: Auditing and reporting solution to monitor changes to SQL servers, instances, database schema, logins and roles, etc. Privileged Account Manager: Shared access to privileged accounts with automatic password maintenance. Non-owner Mailbox Access Reporter: Track users who access other user s mailboxes and report unauthorized access to mailboxes of C and VP-level accounts. Password Manager: product gives end users the ability to securely manage their passwords and resolve account lockout incidents in a self-service fashion without involvement of help desk personnel. Account Lockout Examiner: detects, diagnoses, and resolves account lockouts in real time to reduce administrative costs associated with manual resolution of account lockouts. Full list of products: For more information, please visit or call our toll-free number: Page 17

18 6. Disclaimer The information in this publication is furnished for information use only, does not constitute a commitment from NetWrix Corporation of any features or functions discussed and is subject to change without notice. NetWrix Corporation assumes no responsibility or liability for any errors or inaccuracies that may appear in this publication. NetWrix is a registered trademark of NetWrix Corporation. The NetWrix logo and all other NetWrix product or service names and slogans are registered trademarks or trademarks of NetWrix Corporation. Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarks are property of their respective owners NetWrix Corporation. All rights reserved. Page 18