MICROSOFT EXCHANGE 2013 WHAT EVERY LEGAL PROFESSIONAL SHOULD KNOW

Transcription

1 MICROSOFT EXCHANGE 2013 WHAT EVERY LEGAL PROFESSIONAL SHOULD KNOW

2 WELCOME Thank you for joining Numerous diverse attendees Today s topic and presenters This is an interactive presentation You will receive slides, recording and survey Coming up next month

3 SPEAKERS John Collins Director, Discovery Services

4 WHAT WE WILL COVER TODAY Exchange vs. Outlook Background and context Different ways to acquire and deploy Exchange Major game changers #1: Native/built-in management #2: Native/built-in ediscovery Time Permitting Related topics Exchange 2013 Resources

5 EXCHANGE VS. OUTLOOK

6 EXCHANGE VS. OUTLOOK Exchange Back-end server and infrastructure Where the vast majority of management configuration occurs Direct access for the chosen few Outlook Client software: how users access their e- mail and other mailbox features Tightly integrated with Exchange

7 BACKGROUND AND CONTEXT

8 EXCHANGE 4.0 TO EXCHANGE 2013: THE GAME HAS CHANGED Storage capacity Then: small Now: BIG!

9 EXCHANGE: THE EXPANDED FOOTPRINT Exchange Office Exchange Exchange Exchange Exchange Exchange Exchange Basic functionality PLUS Enhanced ediscovery: in-place legal hold; in-place ediscovery; data loss prevention (DLP); Outlook Web App offline Basic PLUS member of the Office 365 Suite along with Lync and SharePoint ; Instant Messages; call logs; meeting content; voice mails; SharePoint content Basic functionality PLUS MRM features changed/expanded; legal hold; discovery search; archive mailbox; mailbox moderation Basic functionality PLUS Premium journaling; unified messaging; messaging records management; transport rules; Exchange Active Sync (EAS) Basic functionality Basic functionality Basic functionality Basic functionality

10 THE EXPANDED FOOTPRINT FEATURES / FUNCTIONS Unified Messaging Messaging records management (MRM) In-place archiving In-place hold In-place ediscovery Premium journaling Information rights management S/MIME for message signing and encryption Transport rules Data loss prevention (DLP) Exchange auditing reports

11 THE EXPANDED FOOTPRINT OFFICE 365 SUITE Lync integration: Instant messages Call logs Meeting content SharePoint integration: Site mailboxes contain Exchange and SharePoint content ediscovery Center to search across SharePoint, Exchange, Lync, and file shares;

12 EXCHANGE 2013 ACQUISITION OPTIONS HERE, THERE AND EVERYWHERE

13 ACQUIRING / DEPLOYING EXCHANGE OPTION 1: ON-PREMISE Installed in the deploying organization s own data center All infrastructure and data management elements under organization s total control All Exchange configuration settings Backup policies (how long to keep, where to store, etc.) Disaster recovery plan My Data Center

14 ACQUIRING / DEPLOYING EXCHANGE OPTION 2: IN-THE-CLOUD Software as a Service (SaaS) Monthly subscription fee per user Exchange infrastructure located in provider s data centers Cloud options: Subscribe from Microsoft Subscribe from other (non-microsoft) application service providers Features, functions, and level of control vary between providers and plans Availability of management and ediscovery features will vary

15 IN-THE-CLOUD FROM MICROSOFT - OPTIONS Standalone Exchange only: no Lync, SharePoint, or Office 2 standalone plans available Office plans: small, medium, or large (enterprise) business; education; government Numerous options (Yammer, Project, etc.) Availability of ediscovery and management features varies depending on plan. For example: Exchange Online Plan 1 does NOT include in-place hold; Plan 2 includes ALL ediscovery features Office 365 Small Business Plans do NOT include ediscovery NOTE! On-prem requires expanded licensing to get full complement of ediscovery and management features

16 SERVICE DESCRIPTION SPREADSHEET Details about all features, functions, options Find spreadsheet at

17 ALTERNATIVES TO KEEP IN MIND

18 ALTERNATIVE 1: HYBRID DEPLOYMENTS Standard: on-premise or in-the-cloud Alternative: hybrid deployments where some backend infrastructure is on-premise and some is in-the-cloud My Data Center Microsoft or other hosting provider s data center

19 HYBRID FYI Mailboxes can be split between on-premise and the cloud Common to see archive mailboxes in-the-cloud while primary mailbox is on-premise Backup and disaster recovery policies and procedures can differ between on-premise and in-the-cloud mailboxes My Data Center Microsoft or other hosting provider s data center

20 ALTERNATIVE 2: MULTI-TENANT VS. DEDICATED PLANS Microsoft s cloud offerings are available in two categories Multi-tenant: application servers, data storage, other infrastructure comprised of SHARED hardware resources Subscribers have some control over the environment s configuration BUT no control over the back-end infrastructure Lower cost than dedicated Dedicated: infrastructure is dedicated to the subscriber NOT SHARED Subscribers have greater control over the environment and some control over the backend infrastructure Organizations with unique security requirements (e.g., government)

21 MAJOR GAME CHANGER #1 NATIVE / BUILT-IN MANAGEMENT

22 MANAGEMENT FEATURES IN EXCHANGE In-place archiving Messaging records management (MRM) Create Store Dispose

23 IN-PLACE ARCHIVING What is it? IMPORTANT! It s not the same as third party archive tools like Enterprise Vault, KVS, etc. An additional mailbox designed to store mass quantities of e- mail Intended to replace.pst files How it works Enable archive for user Users move items into their archive or Exchange retention policy moves items into the archive based on retention policy

24 MESSAGING RECORDS MANAGEMENT (MRM) What is it? Framework for management Retain, archive, preserve, and permanently delete in accordance with Legal, RIM, and business requirements How does it work? Tag paradigm

25 HOW IT WORKS, STEP 1: SET UP RETENTION TAGS

26 HOW IT WORKS, STEP 2: ASSIGN TAGS TO POLICIES

27 HOW IT WORKS, STEP 3: ASSIGN POLICIES TO MAILBOXES

28 EXAMPLE: SAMPLE RETENTION POLICY Folder or Tag Inbox, Sent Items, Drafts, Conversation History Retention Policy Deleted after 180 days Deleted Items Working Docs Record Tag Contacts, To Do, Notes Voice Mails Deleted after 30 days Working Docs-2 year retention records-10 year retention Indefinite Deleted after 14 days

29 TAGS AND POLICIES IN ACTION

30 MAJOR GAME CHANGER #2 NATIVE/BUILT-IN EDISCOVERY

31 EDISCOVERY FEATURES IN EXCHANGE In-Place hold In-Place ediscovery

32 IN-PLACE HOLD User A Mailbox What is it? Put an entire mailbox OR just selected items in a mailbox (or group of mailboxes) on hold How it works: Assign Legal Hold/Discovery Management role to user (non-it person) Create hold using the In-Place ediscovery and Hold dialog/wizard o Scope the hold: ALL mailbox content OR content meeting search criteria Behind the scenes, Exchange Recoverable Items folder locks down items subject to the hold (users unaware hold in place UNLESS they are told) Inbox Deleted Items Recoverable Items Deletions (FKA The Dumpster ) Versions Purges Audits DiscoveryHold Calendar Logging

33 IN-PLACE EDISCOVERY What is it? Tool which searches across all mailboxes to identify, assess, and collect How it works Assign Discovery Management/Mailbox Search role to user (non-it person) Exchange automatically full-text indexes content as its created User creates search / scopes collection via In-Place ediscovery and Hold wizard o Keyword Query Language (KQL): Boolean operators, proximity, wildcard What can you do with the search results? o Get estimate of hits and data volume o Assess search results o Export search results

34 EDISCOVERY FEATURES IN ACTION

35 FYI: IN-PLACE EDISCOVERY Deduplication based on hash value calculated using: InternetMessageId ConversationTopic IsSentItems BodyTagInfo Unsearchable items: not all attachments are searchable Exchange Search includes certain set of default filters for indexing (.doc,.xls,.ppt,.pdf,.odp,.html, and more (26 different filter types) Encrypted items may not be indexed (S/MIME ) In certain circumstances IRM protected content is not indexed Also, items not typically indexed: audio, video, non-ocr images Elect to include unsearchable items when copying / exporting search results

36 FYI: IN-PLACE EDISCOVERY, CONT. Limits Discovery search mailboxes can hold only 50 gigabytes of data Maximum # of keywords for a single search is 500 Maximum # of mailboxes that can be searched in a single search for online versions of Exchange is 10,000; 25,000 for on-prem

37 FYI: IN-PLACE HOLD Can take up to 1 hour for hold to be in effect New items automatically placed on hold If 5 or more scoped holds are applied to a mailbox, ALL items in mailbox are placed on hold Quota! There is a 30 gigabyte default quota on the Recoverable Items folder hold will stop working if the quota is reached Departed employees on hold: don t delete their mailbox! Mailbox should be disabled instead in on-prem environment Office 365 provides inactive mailbox option

38 THANK YOU coming tomorrow with slides, recording and survey Visit us online at for more information on next webinar on November 20 th entitled: "Custodian Interviews - How to Leverage a Valuable Opportunity" Live full-day workshop in Washington DC, Nov. 19 th - ESI for Legal Professionals Make sure to visit our website for valuable white papers, blogs and other information at Thank you!

39 RELATED TOPICS

40 RELATED TOPICS Journaling Enables an organization to capture a copy of every message sent and received o Can be configured to capture only internal, only external, or all messages o Can limit journaling to specific users or distribution groups (requires Exchange Enterprise CAL) Outlook Web App (OWA) Offline Provides offline access VIA BROWSER to ; users can also create new messages, see contacts and calendar items (and create new ones) Local database created to store items (up to 3 days of content or 150 items for each folder) Administrator can disable user s ability to turn this feature on

41 RELATED TOPICS, CONT. Auditing Administrator actions: everything an administrator can do can be tracked, including: create, delete, move mailbox; conduct a discovery search; place a mailbox on legal hold Mailbox auditing: who did what and when in a mailbox, including : deletions, item creation, and delegate access Transport rules Configure Exchange to look for specific conditions in messages Take a variety of actions: o Redirecting messages, silently dropping the messages, forwarding messages for approval, or applying Rights Management templates

42 RELATED TOPICS, CONT. Data Loss Prevention (DLP) Built on top of transport rules Helps to identify, monitor, and protect sensitive data through content analysis Content analysis based on complex policy templates o Custom o Out of the box: U.S. Social Security Number, U.S Bank Account Number Certain actions can be taken based on analysis (delete, submit for approval, add disclaimer, etc.)

43 CONSIDERATIONS FOR DISCOVERY If using Lync with Exchange: Instant Messages? Call logs? If using Exchange Unified Messaging: Transcribed voice mail messages (Outlook Voic Preview) Audio playback Text preview of voice mail Contextual contact actions

44 RESOURCES

45 EXCHANGE 2013 RESOURCES Technet.microsoft.com Tony Redmond book Microsoft Office 365 Administration book Exchange Team Blog Quentin Christensen Blog (ediscovery product manager)

46 FILE FORMATS INDEXED BY EXCHANGE SEARCH chg.150).aspx

47 KEYWORD QUERY LANGUAGE (KQL) ary/dn774955(v=exchg.150).aspx

48 FYI-IN-PLACE ARCHIVING Must be enabled (default setting is off) Works like the primary mailbox and is fully searchable Not accessible in offline (Cached Exchange) mode Only accessible via Outlook or OWA; no mobile client or Outlook for Mac support Is fully integrated into management and ediscovery features and functions Native.pst ingestion tools available to move accumulated.pst files into archive

49 FYI: MESSAGING RECORDS MANAGEMENT (MRM) Mobile clients don t display retention policies or tags Some exceptions (Outlook Web App Mobile on iphone) Voice mail messages can have a unique retention tag Example: permanently delete after 14 days Biggest challenges in implementing MRM: Cultural: users may be accustomed to keeping forever Disruptive and time consuming: asking users to classify may be a non-starter

50 HOW MODUS CAN HELP Seminars and Training: ediscovery, Management, and Compliance Exchange 2013 and Office 365 Full or half-day programs Review and deep dive explanation of features and functions for the entire Compliance suite o Management o ediscovery o Data Loss Prevention (DLP) o Information Rights Management (IRM) Includes IT, RIM, and Legal aspects What questions to ask clients

51 HOW MODUS CAN HELP Matter Specific Consulting How to Identify, Preserve, and Collect and Other Data from Exchange 2013 and Office 365 Identification, collection, and preservation in Exchange and Office 365 Response Plans: how to leverage Exchange and Office 365 ediscovery features in your ediscovery response