Understanding Archiving and ediscovery in Exchange 2013 By Michael Noel July 2013
CONTENTS Introduction... 3 Exchange Server 2013 Archiving... 4 Archive Mailbox Feature... 4 Consistent Archive Mailbox Folder Views across Outlook and OWA... 5 Archive Mailboxes as Part of Microsoft s Archiving Strategy... 5 Data Retention and Compliance in Exchange 2013... 6 Deletion and Retention Policies... 6 Legal Hold... 6 Journaling... 7 E-Discovery in Exchange 2013... 8 SharePoint Discovery Portal for Exchange E-Discovery... 8 E-Discovery Search Terms... 8 Search and ediscovery Limitations... 8 Summary... 9 Copyright 2013 Metalogix International GmbH. All rights reserved. Metalogix is a trademark of Metalogix International GmbH. StoragePoint is a registered trademark of BlueThread Technologies, Inc. Microsoft, Exchange Server, Microsoft Office, SharePoint, and SQL Server are registered trademarks of Microsoft Corporation. 2
INTRODUCTION Exchange Server has become, by far, the most common Enterprise messaging platform used worldwide by organizations today. It has proven to be scalable, easy to administer and a rock-solid dependable platform that many businesses have built their communications strategy on. Over those years of adoption, the nature of how email is used has changed. Many organizations now find it challenging to adapt to the sheer volume of mail messages they receive. This massive volume of information is difficult to manage, store, and process, and the legal issues surrounding retention of data are becoming more acute. Microsoft has built new features into Exchange Server 2013, the latest version of Exchange Server, which are meant to address the archiving, retention, and legal compliance issues facing organizations today. These new features provide for new archiving and ediscovery capabilities that were previously not possible out of the box in Exchange Server. Features such as archive mailboxes, the ediscovery center, legal hold, and flexible retention policies give organizations more control over how to manage and handle their mailflow. While impressive, there are some significant limitations to these features that must be understood before an organization determines whether or not to deploy them or whether to look at the third-party space to supplement them with additional ediscovery and archiving capabilities. This white paper focuses on those archiving, ediscovery, and compliance features included in Exchange Server 2013. This paper outlines and discusses how these technologies work, their key benefits, and some potential pitfalls. 3
EXCHANGE SERVER 2013 ARCHIVING ARCHIVE MAILBOX FEATURE One of the most important key features of Exchange Server 2013 in regards to mailbox data management is the concept of the Archive Mailbox, a feature introduced originally in Exchange Server 2010 and expanded in this latest release. The archive mailbox feature allows for the creation of a second, completely separate mailbox for each user that is associated with the primary mailbox of the user account. When enabled, an archive mailbox shows up as a separate set of folders for the end user when they access their mailbox. The user can either manually move items into these mailboxes or the retention policies can be put into place to automatically move those items directly into the archive mailbox. The primary advantage of using an archive mailbox in Exchange Server is that it allows the storage for the primary, active mailbox to be kept on faster, more expensive disk, while the archive mailbox databases can be stored on slower, more read optimized and cheaper storage. At the same time, the archive mailbox is searchable for ediscovery purposes and can be made highly available using Exchange High Availability concepts such as Database Availability Groups (DAGs.) While a promising solution that is notably more complete than what was originally introduced in Exchange Server 2010, there are a few key disadvantages to archive mailboxes which limit their adoption, namely the following: Requires Exchange Enterprise CAL Archive Mailboxes require the more expensive Enterprise Client Access License (CAL), which can make them a more prohibitive option for many organizations. Requires Newer Outlook Versions Users must be using either Outlook 2010 or Outlook 2013 to properly view and utilize the archive mailbox for the primary mailbox and all delegate mailboxes. Archive mailboxes are effectively invisible for any version prior to Outlook 2007 SP2 w/feb11 CU, and are also invisible for the Student and Home Office versions of Outlook 2010. Even those with a patched version of Outlook 2007 will find that they are unable to open the archive mailbox of any delegates as well. This can be a confusing mess for end users. End User Training Because the archive mailbox shows up as a separate set of folders, end users have to be specifically trained to use the mailbox and to understand where messages are automatically moved to if retention policies are enabled. This can be confusing to end users who simply expect that if they have a message stored in the Inbox that it will continue to be there indefinitely. Not a Compliance Solution Because the archive mailbox has no mechanism to save and store messages that may be deleted or modified, it should not be considered to be a compliance solution for mail. 4
CONSISTENT ARCHIVE MAILBOX FOLDER VIEWS ACROSS OUTLOOK AND OWA The design of the User Interface options for Exchange Server 2013 mailboxes focuses a considerable amount of attention on making the views of a mailbox nearly identical across device types. This applies to users who access their mailboxes and associated archive mailboxes across Outlook Web App (OWA) or Outlook 2013. The Search experience has been streamlined to allow for a similar search experience from each client type. Search results are displayed from the primary mailbox as well as the archive mailbox. That said, it should be noted that these search capabilities and visual improvements are only available if the client is using Outlook 2010 or Outlook 2013. ARCHIVE MAILBOXES AS PART OF MICROSOFT S ARCHIVING STRATEGY Microsoft s adoption of archive mailboxes is in line with its position on archiving, in which they propose that organizations move all mail data, including data which may be archived in local PST files, into the mail store where it can be managed and controlled. Their stance is that storage is getting much cheaper and organizations can simply add more disk storage to an environment as the repository increases in size. While this argument is quite persuasive, many organizations don t anticipate exactly how quickly an information store can grow over time if all items are kept indefinitely within the platform. Doing the math, if the average user within an organization sends and receives 200 messages a day that average 75KB each, that user s mailbox could total 18GB within five years alone. These calculations can be quite sobering, especially if you also need to multiply these values by the number of DAG replicas that are setup to provide for high availability. Subsequently, many organizations are trying to determine if it makes sense to store mail data indefinitely or if deletion policies that clean out old data after a certain period of time make more sense. 5
DATA RETENTION AND COMPLIANCE IN EXCHANGE 2013 DELETION AND RETENTION POLICIES In this version of Exchange Server, Microsoft has added improved capabilities to automatically delete and/ or archive items to archive mailboxes through the use of retention policies that can be defined for specific mailboxes or en masse from the Outlook Web App or Outlook 2013. Administrators can choose to have the end users choose their own policies or can dictate which ones apply. Different retention and/or deletion policies can be added to different folders within a user s mailbox. For example, the Inbox could have a policy set that automatically deletes items older than 1 year old, but users could be given another folder that has a policy that archives the items after 3 years. End users are notified what the policy of a folder is simply by viewing a status bar that appears at the top of the folder in either OWA or Outlook 2010/2013. The main criticism with Microsoft s approach to deletion and retention policies is that they rely too much on the end user to define policies, which they are often reluctant to do. Forcing the policies on the users, on the other hand, can force users into creative behaviors to try to bypass policies, such as archiving items in the Deleted Items folder. LEGAL HOLD A crucial set of features added in Exchange Server from a compliance perspective are the Legal Hold capabilities. Legal Hold in Exchange Server is a legal compliance feature that locks in a mailbox and allows for all changes and deletions to be captured, stored, and made searchable by auditors as necessary. Putting a mailbox on Legal Hold effectively forces all deleted or modified mail items, calendar appointments, tasks, or contact objects to be stored in a hidden Recoverable Items Store. They remain in this store indefinitely until Legal Hold has been removed from the mailbox. While primarily used as a legal compliance tool, some organizations also put high-profile mailboxes on Legal Hold to allow for users to be able to recover their items more easily, as it is possible to grant end user s access to restore items from the Recoverable Items Store. It is also possible to make it invisible to the end user that they are under Legal Hold if necessary or, if policy dictates, notify them directly via their mail client. The biggest downside to Legal Hold is storage. If nothing is ever deleted, the size of the information store grows much larger, much faster. 6
JOURNALING For several versions now, Exchange Server has maintained a journaling feature that can be used to keep track of all communications sent or received within an organization. With journaling turned on, two copies of every message that is sent or received is stored, one in the mailbox it was intended for and another in a journal mailbox. There are two types of journaling that are possible in Exchange Server 2013, depending on how Exchange is licensed. For those with only Exchange standard CALs, only the standard journaling options are possible, which require journaling to be turned on for all mailboxes within a specific mail store. Organizations with Enterprise CALs can use a form or journaling called Premium Journaling, however, which allows for journaling to be enabled on a mailbox by mailbox basis. The biggest drawback to the journaling feature within Exchange 2013 is the massive size in which the journaling mailbox can grow if it is not emptied on a regular basis. Indeed, the journal mailbox typically resides within its own mail store and often on its own disk volume. But since it receives a copy of all messages sent and received, it can grow very large very quickly, which can become a huge issue in the long run if not addressed properly. 7
E-DISCOVERY IN EXCHANGE 2013 SHAREPOINT DISCOVERY PORTAL FOR EXCHANGE E-DISCOVERY One of the most visible and significant changes made in Exchange 2013 is the how ediscovery search features work in comparison with previous versions of the software. Search within Exchange 2013 now utilizes a SharePoint 2013-based portal site that provides auditors with the ability to search across Exchange primary and archive mailboxes as well as across SharePoint 2013 sites and Lync 2013 instant message stores. E-DISCOVERY SEARCH TERMS The search engine for ediscovery is based on the Microsoft FAST Search engine, which allows for more complex search options, including BOOLEAN search strings, to be utilized. In addition, much more advanced reporting is possible with query statistic options and custom reports. The ability to delegate search off to auditors is baked into the ediscovery portal as well, restricting them to only being able to search across mailboxes and sites that have been pre-selected, and giving them the ability to quickly export out the results. SEARCH AND EDISCOVERY LIMITATIONS The single biggest complaint with the ediscovery center in Exchange 2013 is that it is not self-supporting and must be installed within a SharePoint 2013 farm. Many organizations may not have SharePoint in place, or may be using common older versions of SharePoint such as SharePoint 2010 or 2007. For those organizations, a limited SharePoint farm must be installed and maintained in order to run the ediscovery portal site, which can be a significant challenge. 8
SUMMARY The improvements Microsoft made to Exchange Server 2013 are significant and address many of the common issues that organizations faced with older versions. However, it is critical that organizations fully understand what these new features entail, how it will affect their daily business and how to use these features to their full potential. In particular, organizations must plan for the growth of content stored within Exchange Server. The amount of content across platforms is growing at unprecedented rates and email is no exception. When taking into account archive mailboxes, journaling and Legal Hold features, the rate of growth will continue to skyrocket within your organization. It is a best practice to know what the size of your email archive is today and plan appropriately for a significant spike in the coming months and years. Email retention is a crucial aspect of a successful email archive plan and the new capabilities in Exchange Server 2013 gives more power to organizations in setting retention policies, either to specific mailboxes or en masse. While the criticism around these policies focuses on relying on the end user too much, there are options for organizations to create a retention policy that best suits their needs. It is another best practice to learn about your organization s email usage to determine what policy works best, whether that is to automatically delete items after 1 year or archiving them after 3 years. The added features for ediscovery is arguably the most significant change to Exchange Server 2013 as it utilizes a SharePoint 2013-based portal site to search across primary and archive mailboxes in addition to SharePoint 2013 sites and Lync 2013 instant message stores. Based on the Microsoft FAST Search Engine, these new features significantly enhance search and should provide better ediscovery. However, the limitation is for organizations that do not have SharePoint 2013, either because they have not deployed SharePoint or are on SharePoint 2007 or SharePoint 2010. In conclusion, the enhancements to Exchange Server 2013 should provide you with a better way to manage your email archives, but there are limitations that could disrupt your plans. Third-party email archiving products, such as Metalogix Archive Manager, will assist in overcoming these limitations and ensure that your email archiving plan is successful and appropriately meeting your particular needs. 9
ABOUT METALOGIX Metalogix provides content infrastructure software to improve the use and performance of enterprise content. For over a decade, Metalogix has transformed the way commercial and government organizations manage terabytes of content to improve knowledge sharing and collaboration. Today, more than 7,500 customers rely on the company s products to upgrade, migrate, organize, store, archive and replicate content on Microsoft SharePoint, Exchange and Cloud platforms. Metalogix is a privately held company backed by Insight Venture Partners and Bessemer Venture Partners. ABOUT THE AUTHOR Michael Noel is a world renown expert in information management, identity and security, and business continuity with over 20-years of real world experience helping organizations achieve efficiencies in information systems. In 2012, Michael achieved a milestone only a handful of experts can claim which is to be a paid public speaker on all 7 continents in the world in a single year. Michael meets with executives and technologists around the world to understand global trends in information access, management, and compliance support so that he can share that knowledge and help others better prepare for information system challenges ahead of them. Michael has written over 2 dozen global bestselling books and has spoken in over 100 cities and countries around the globe. METALOGIX 5335 Wisconsin Ave NW, Suite 510, Washington DC 20015 sales@metalogix.com www.metalogix.com 1.202.609.9100 10