Waiting to Upgrade: Understanding Archiving and ediscovery Limitations in Exchange by Michael Noel and Rick Wilson

Transcription

1 Waiting to Upgrade: Understanding Archiving and ediscovery Limitations in Exchange 2010 by Michael Noel and Rick Wilson

2 Contents Understanding the Business Need for Archiving and ediscovery... 3 Overview of Exchange 2010 Archiving and ediscovery... 4 Upgrading to Exchange 2010 and Potential Downsides... 5 Don t Overlook Third-Party Solutions... 7 Waiting to Upgrade: Understanding Archiving and ediscovery Limitations in Exchange 2010 Microsoft Exchange Server is a powerful enterprise messaging tool that has proven to be very successful over the years. Although Exchange adoption is high, many organizations have found that native support for robust archiving and ediscovery capabilities is lacking and they have turned to third-party solutions to meet their compliance needs Microsoft hopes to change this equation with the release of Exchange For the first time, Microsoft is including native features to help administrators implement archiving and conduct ediscovery. In fact, these features are one of the primary reasons Microsoft cites for upgrading to Exchange But this additional functionality may come at a cost, both in terms of upgrading software and infrastructure. An analyst survey of 999 Microsoft Exchange administrators conducted in late 2009 revealed that only 30 percent of respondents plan to implement Exchange 2010 immediately. Because an upgrade of Exchange Server can be impactful and complex, caution should suggest that organizations seriously examine the limitations of Exchange 2010 s archiving and ediscovery options and before immediately upgrading reflect on the migration challenges they will face. This white paper outlines the various archiving and ediscovery features in Exchange 2010, examines how they work, and discusses various limitations in their deployment. It also focuses on the migration path from older Exchange versions to Exchange 2010 and some of the challenges with these migration approaches. The paper does not hypothesize that an upgrade doesn t make sense at some point; it suggests that archiving and ediscovery needs are generally not the main factors to consider when making a decision to upgrade, and organizations can potentially satisfy their archiving and ediscovery needs today with older versions of Exchange combined with third-party tools. 2 Archiving and ediscovery Limitations in Exchange 2010 Sponsored by Sherpa Software

3 Understanding the Business Need for Archiving and ediscovery In just over a decade, communication has emerged to become our dominant form of business communication and for good reasons. It s easy to use, fairly ubiquitous (especially with the proliferation of mobile devices), and relatively inexpensive to deploy. As a consequence, systems have become a convenient way of not only sharing, but also filing information. The widespread popularity of Microsoft Outlook has exacerbated the use of for long-term storage by making it easy to create, organize, and search multiple folders. Today it s routine to see a user mailbox acting as a storage repository with dozens of folders containing potentially critical business communications. Effectively managing this growing volume of electronically stored information (ESI) requires the implementation of archiving and ediscovery tools to address three key areas of concern: regulatory compliance, legal concerns, and message retention and recovery. Regulatory Compliance Several industries in the United States are required to comply with regulations that govern their business record retention. Examples of regulatory oversight exist in: Banking: FDIC, OCC (Office of the Comptroller of the Currency) Telecommunications: Title 47, Part 42 Pharmaceutical: FDA Title 21, Part 11 Healthcare: HIPAA (Health Insurance Portability and Accountability Act) Defense: DOD standard Brokerage firms: SEC Rule 17a-3 and 17a-4 In most cases, these regulations dictate which type of communications must be preserved and for what period of time that retention must extend. The most expedient way of ensuring that correct information is preserved is by implementing an archiving solution. Archiving policies examine the then (based upon criteria such as age, date, subject, etc.) automatically move messages from the server to a secure offline storage medium. When properly implemented, archiving can guarantee that messages are not discarded or destroyed and thereby fulfill compliance requirements. Legal Concerns For regulated industries, the importance of archiving communications as a means of preserving business critical information is obvious, but what about organizations that do not operate in a regulated industry? Up until 2006, the trend to retain was widely viewed as a nuisance from the standpoint of storage and backup requirements. That changed in December 2006 when several key amendments were instituted in the Federal Rules of Civil Procedure 1. These amendments extended the scope of what might be considered evidence in a legal proceeding to include ESI such as communications and documents. Given this fact, virtually any business might find itself in the position of having to provide access to ESI during the course of litigation. Often times the litigation process begins with an order from the court to preserve ESI relating to the matter. This order triggers a process known as a legal hold where all ESI related to the case must be preserved. In order to satisfy this order, it is not only important to secure the ESI (usually through a process such as archiving) but to have a tool that will search ESI, identify pertinent content, and offer review tools to help you assess the applicability of the data to the legal hold request a process known as ediscovery. Message Retention & Recovery Preserving ESI for compliance or legal purposes is an important step. There is, however, one additional consideration to plan for: retention. Even archived message data has a life cycle. An integral part of the lifecycle management process must include a way to purge information that is no longer required to be maintained (for example, the compliance period is exceeded or the legal hold has been lifted). Exchange Server has no built in mechanism for recovering messages that are deleted, either accidently or deliberately. Historically, recovering deleted messages or mailboxes has been difficult, and many IT organizations have spent countless wasted hours restoring entire databases just to extract individual items. These organizations have found that archiving and journaling strategies that save all messages sent and received can be 1 The Federal Rules of Civil Procedure are the rules that govern civil procedures (or lawsuits) in United States district courts. Sponsored by Sherpa Software Archiving and ediscovery Limitations in Exchange

4 utilized to simplify the recovery process by making any message, no matter when deleted, subject to recovery on request. Whether an ESI retention need stems from a compliance mandate or prudent records management, preserving data with an archiving policy and having a mechanism to effectively search those archives has emerged as a high priority for administrators and corporate managers. platforms such as Microsoft Exchange have been substantially lacking in features to manage the key areas of ESI retention we have outlined. This void has created an active marketplace for vendors that have developed third-party applications that introduce archiving and ediscovery features for Exchange. It is clear that waning budgets and the fact that many organizations have already standardized on third-party software solutions for their archiving and ediscovery needs is a factor in the upgrade decision. So, is upgrading to Exchange 2010 worth the investment in time, dollars, and training? In the following pages, we will examine some of the features the platform delivers and why they might not be compelling enough to influence the move from an existing Exchange 2003 or 2007 environment. Overview of Exchange 2010 Archiving and ediscovery To Microsoft s credit, Exchange Server 2010 is the first version of Exchange that makes the attempt to include built-in archiving and journaling directly into the product. As with many first attempts, however, major limitations to the functionality should be understood before deploying Exchange Exchange 2010 Archive Mailboxes Exchange 2010, which approaches archiving from a dual-mailbox approach, offers administrators the ability to create a second archive mailbox that is associated with a user s primary database. Policies can be created to automatically move items to an archive mailbox based on the age of the item, or users can manually move items themselves. Administrators can set different storage policies on archive mailboxes than they do on primary mailboxes. While seemingly a good idea, Exchange 2010 s archive mailbox strategy has major limitations. These limitations, which include the following, cripple the flexibility concepts that the archive mailbox feature could conceivably provide: CAL Restrictions: The Exchange Enterprise Client Access License (CAL) is required to use archive mailboxes Lack of Tiered Storage Capability: An archive mailbox cannot exist in a different database than the one where the user s primary mailbox is located. This essentially disallows having the archive mailbox on a slower tier of disk or a slower server, greatly diminishing the benefit of having an archive mailbox. Outlook 2010 Requirement: Outlook 2010 must be used to seamlessly access archiving mailboxes for a user. Older versions of Outlook do not work with archive mailboxes. No Offline Support: Outlook must be directly connected to the Exchange Server to view and act on items in the Archive Mailbox. If Outlook is running offline, it cannot access archived data. End User Training: End users can have a difficult time understanding the concept of the archive mailbox, because it appears as a separate set of folders in Outlook. Not a Compliance Solution: Archiving does not ensure that data is not deleted, which can only be done natively by enacting a legal hold on a mailbox or using Journaling. For these reasons, the native Exchange archiving capabilities are extremely limited. Indeed, there is very little benefit from creating an archive mailbox, because it does not allow you to create multiple tiers of storage and most organizations won t be able to use the mailbox because they are not running Outlook Although Microsoft will likely improve this functionality in the future, few organizations are migrating to Exchange 2010 solely because of this feature. Exchange 2010 Journaling Exchange Server has had journaling capabilities for several years, and Exchange 2010 offers no significant changes. Journaling works by dynami cally making a copy of every message ever received or sent (even if BCCed) by an individual mailbox or all the members of a mailbox database. All of these messages are forwarded to a journal mailbox, which can be configured with retention settings. The purpose of journaling is to create a verifiable and legal trail of all communications sent and 4 Archiving and ediscovery Limitations in Exchange 2010 Sponsored by Sherpa Software

5 received, regardless of whether they have been deleted or tampered with later on. Journaling requirements are a must for many governmental and industry compliance laws that dictate that certain communications be tracked and stored so that they can later be searched to validate compliance. Out of the box, Exchange offers two types of journaling: standard journaling and premium journaling. Standard journaling only allows you to turn on journaling for all members of a specific database; premium journaling allows you to turn on journaling for an individual mailbox or for all members of a specific distribution group. The biggest drawback to the native Exchange journaling is that you have no easy way to manage the data that is put into the journal mailbox, where all messages are sent. Depending on the size of the organization, this journal mailbox can get extremely large very quickly. Most organizations using journaling use third-party software to extract the contents of the journal mailbox for storage elsewhere or use journaling approaches that do not use the native journal functionality in Exchange. It should be reiterated that there are no significant improvements in Exchange 2010 for journaling, and the new archiving functionality does not replace journaling requirements. Subsequently, the need for better journaling is not a factor that leads to Exchange 2010 migrations. Legal Holds and Retention Policies Exchange Server 2010 includes native legal hold capability, which can be turned on for specific mailboxes by a compliance or legal officer who has been delegated the ability to initiate legal holds. In legal hold scenarios with Exchange 2010, all items deleted by the user are not removed completely, but rather are sent into a special area called the Recoverable Items Folder, which is not visible to the end user. This allows a user to still comply with quotas and perform normal operations but still allow for all messages, either deleted or not, to be searched for legal reasons. While useful in some cases, many organizations are dictated by legal departments to simply export mailboxes to PST archives for lawsuits regardless of whether legal holds are in place. As the legal industry catches up with the technology industry, however, this situation may be improved. ediscovery and Message Search The ability to search and find messages across multiple mailboxes and/or journals is critical for many of the compliance requirements listed earlier. Exchange 2010 includes improved Exchange Search functionality that is turned on by default, allowing organizations to perform fast and indexed search across their personal mailbox. In addition, certain individuals, such as compliance officers, can be given the capability to perform Multiple Mailbox Search across multiple accounts for legal or compliance reasons. Although improved over the search capabilities of previous versions of Exchange, several major limitations to Exchange Search remain that you should understand. These limitations restrict how Exchange Search is used, and limit its ability to be a primary factor for upgrade for most organizations. The biggest drawbacks to Exchange Search in Exchange 2010 are the following: Default Search Filters Limited: Standard Microsoft Office formats can be indexed by Exchange 2010, but there is limited support for other common formats such as the popular PDF file format. By default, the content of PDF messages is subsequently unsearchable. No Public Folder Search: Organizations with a significant investment in public folders will find that they cannot search across public folder data using the native Exchange Search functionality. Localization and Language Limitations: s written in multiple languages are not indexed by Exchange Search. In addition, queries made in a specific language must match the locale of the local computer doing the search. Encrypted Messages Not Indexed: Messages encrypted with S/MIME encryption are not able to be indexed and are subsequently not searchable. Upgrading to Exchange 2010 and Potential Downsides Many organizations are postponing an upgrade to Exchange Server 2010 because it lacks major archiving and ediscovery features. These limiting factors could be more easily mitigated if Microsoft Sponsored by Sherpa Software Archiving and ediscovery Limitations in Exchange

6 provided for a smooth upgrade path to Exchange 2010 from legacy versions of Exchange Server, but unfortunately the upgrade path is not very smooth. Several major limitations to the upgrade process can make it challenging for many organizations. These limiting factors provide more reasons to postpone migrations that do not need to happen immediately. Version Upgrade Limitations Microsoft supports upgrades to Exchange Server 2010 only for Exchange versions 2003 and Older versions of Exchange Server must first be upgraded to one of these versions before a migration to 2010 can take place. Rather than perform a two-phase upgrade, this effectively means that many organizations currently running Exchange 2000 can first migrate to Exchange 2003 or Exchange 2007 and then take the opportunity to migrate to 2010 at some point in the future. Lack of In-Place Upgrade No matter which legacy version of Exchange is currently used, you can t perform an in-place upgrade on any Exchange system. All servers need to be completely rebuilt before they can be provisioned as a new Exchange 2010 system. Effectively, if the hardware of your current Exchange environment is still capable and robust, it reduces the advantages that could be obtained by migrating to Special Connector Issues Certain third-party connectors such as fax software and unified messaging require specific versions of Exchange server to operate properly. If migrating directly from Exchange 2003 to Exchange 2010, the Exchange organization is specifically disallowed from ever having an Exchange 2007 server added in the future. What this means is that connectors that only run in Exchange 2007 could never be added to that organization, unless the migration process involves provisioning a 2007 server before adding the first 2010 server. For this reason, many organizations decide to first go to Exchange 2007 before migrating directly to Exchange Changes in Server Roles and Clustering Microsoft changed the clustering options in Exchange Server significantly over previous versions. It is no longer possible to use a Shared Storage cluster model when deploying Clusters. Instead, the only clustering approach supported is one using Database Availability Groups (DAGs). DAG concepts allow a mailbox database to be replicated to multiple server locations, up to 16 locations for an individual mailbox. Although this approach provides for unique High Availability and Disaster Recovery options, it has a significant drawback. When configuring a mailbox server for DAG replicas, the cluster service is utilized. When the cluster service is used, the Windows Network Load Balancing service cannot be used at the same time on the same system. Because the Client Access Server (CAS) role, used directly by clients for access to mailboxes in Exchange 2010, relies heavily on load balancing for its availability, this leads to a challenge making Exchange highly available for smaller organizations. In other words, it s impossible to make a two-server Exchange 2010 deployment fault tolerant because you can t run DAG and CAS with Windows Network Load Balancing at the same time on the same two servers. Instead, you re required to have a minimum of four servers to accomplish a high availability goal, which can limit the appeal of DAG with Exchange OWA Migration Challenges The trickiest part of an Exchange 2010 migration is the challenge of migrating legacy Outlook Web Access to the new Exchange 2010 Outlook Web App (OWA). Exchange 2010 s OWA has been changed in such a way that it is incompatible with existing OWA servers, whether they are Exchange 2003 or Exchange 2007, and an Exchange 2010 server cannot front-end connections made to a legacy mailbox. In other words, a user cannot access their Exchange 2003/2007 mailbox directly through an Exchange 2010 OWA server; instead, the user must be issued a referral to an Exchange 2003/2007 OWA server. For internal-only environments, issuing a referral and telling a legacy OWA client to use a different OWA server is not a critical issue, because the referral is automatic. However, for external OWA situations, such as those where OWA is accessed by a single external namespace like webmail.companyabc.com, a second published namespace must be created for the referrals to work properly. For example, an organization would need to set up and publish both webmail.companyabc.com and legacywebmail.companyabc.com, and then 6 Archiving and ediscovery Limitations in Exchange 2010 Sponsored by Sherpa Software

7 configure Exchange 2010 to make the referral to the new legacy webmail name. Typically, this requires replacing existing Secure Sockets Layer (SSL) certificates with new certificates, which can be expensive and time consuming. Don t Overlook Third-Party Solutions It is hard to argue against selecting the Exchange 2010 platform for a new messaging system deployment. On the other hand, existing Exchange 2003 or 2007 customers should conduct a thorough assessment of the true costs involved before embarking on the upgrade. The challenges outlined in this document, while not insurmountable, make it more difficult to justify an Exchange 2010 migration especially if satisfying an archiving or ediscovery need is the primary business need for the project. Vendors specializing in archiving and ediscovery solutions, such as Sherpa Software, offer a variety of products to supplement older versions of Exchange. Here are a few compelling business reasons to consider augmenting your current Exchange version with a third-party solution: Third-party tools are very mature. The products have evolved over time to include a wide array of features based on real-world customer feedback and satisfy even the most complex business requirements. Third-party tools are expressly designed to work with existing Microsoft products (both Exchange and Office), so there is no disruption to the existing messaging environment. The return on investment proposition is very attractive. In many cases, an incremental cost of less than $20 per user can deliver both archiving and ediscovery functionality. With Exchange 2010, as is often the case, Microsoft has provided a very limited core set of archiving and ediscovery features as an initial release. Recent news about service pack 1 for Exchange 2010 has promised additional features related to its archiving and ediscovery capabilities, prompting many companies to adopt a wait-and-see approach to their upgrade strategy. Creatively supplementing your existing Exchange environment with third-party tools for archiving and ediscovery can make that wait very comfortable indeed. Michael Noel is an MVP for SharePoint Server and an MCSE+I. Currently a partner at Convergent Computing in the San Francisco Bay Area, Michael s writings and worldwide public speaking experience leverage his real-world expertise designing, deploying, and administering IT infrastructure for his clients. Rick Wilson, Product Manager at Sherpa Software, works extensively with their Microsoft Exchange solutions. With more than 25 years of IT experience from application development to hands-on technical support Rick has touched every facet of solutions development and design. Perhaps more importantly he understands business. With a BS degree in Business Administration and some practical experience operating his own consulting practice, Rick has developed an understanding of how IT systems must deliver business value. Sponsored by Sherpa Software Archiving and ediscovery Limitations in Exchange