GFI MailArchiver for Exchange. Manual. By GFI Software Ltd.

GFI MailArchiver for Exchange Manual By GFI Software Ltd.

http://www.gfi.com Email: info@gfi.com Information in this document is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of GFI Software Ltd. GFI MailArchiver is copyright of GFI SOFTWARE Ltd. 1999-2010 GFI Software Ltd. All rights reserved. Version: MAR-ACM-1-03 Last updated: September 9, 2010 GFI MailArchiver build: 20100315

Contents 1 About GFI MailArchiver 1 1.1 Introduction to GFI MailArchiver 1 1.2 How does GFI MailArchiver work? 1 1.3 GFI MailArchiver licensing 2 1.4 GFI MailArchiver summary page 2 2 Using GFI MailArchiver 5 2.1 Loading GFI MailArchiver 5 2.2 Browsing archived emails 6 2.3 Browsing other mail users emails 9 2.4 Browsing emails in different user mailboxes 10 2.5 Searching email archive stores 11 2.6 Creating and using search folders 18 2.7 Changing the language 21 2.8 Logging in as a different user 22 2.9 Logging off GFI MailArchiver 23 3 Import and export emails 25 3.1 Import emails from Microsoft Exchange Mailboxes 25 3.2 Import emails from PST files locally 37 3.3 Import emails from PST files on the network 48 3.4 Import emails from GFI MailArchiver 2 64 3.5 Import emails from GFI MailEssentials 71 3.6 Exporting emails using the Bulk Export tool 79 4 Outlook Connector 89 4.1 How does the GFI MailArchiver Outlook connector work? 89 4.2 Downloading GFI MailArchiver Outlook Connector 89 4.3 System Requirements 90 4.4 Installing via GPO 91 4.5 Installing without GPO - Manual install 96 5 Archives and database infrastructure 99 5.1 Configuring which emails to archive 99 5.2 Setting up the mail servers to archive 100 5.3 Re-configuring a mail server 103 5.4 Removing a mail server 103 5.5 Setting up databases 104 5.6 Configuring Archive Stores 106 5.7 Selecting an archive store where to archive emails 123 5.8 Configure which archive stores can be browsed and searched 124 5.9 Archive stores management 124 5.10 Attaching a GFI MailArchiver 3 database 127 5.11 Viewing archive store statistics 132 5.12 Re-configuring an archive store 133 5.13 Removing an archive store 133 5.14 Backup Archive Stores 134 GFI MailArchiver for Exchange Manual Contents i

5.15 Managing search indexes 141 5.16 Upgrading the database schema 144 5.17 Moving emails from one database to another 145 6 Access control and auditing 151 6.1 Configuring access control 151 6.2 Managing Policies 153 6.3 Configuring mailbox folder structure retrieval 170 6.4 Database activity auditing 178 6.5 User interaction auditing 183 6.6 Reports 184 7 Troubleshooting and support 193 7.1 Introduction 193 7.2 Installation problems 194 7.3 General issues 195 7.4 Import/Export problems 198 7.5 Outlook connector issues 201 7.6 Knowledge Base 203 7.7 Web Forum 203 7.8 Contact technical support 203 7.9 Build notifications 203 7.10 Documentation 204 8 Glossary 205 9 Index 207 ii Contents GFI MailArchiver for Exchange Manual

1 About GFI MailArchiver 1.1 Introduction to GFI MailArchiver GFI MailArchiver is a powerful, easy-to-use email archiving solution through which you can archive all internal and external email into a central archive store. It also enables you to easily manage email archive stores from its web-based configuration. You can also allow users to browse and search past emails via the web-based interface. GFI MailArchiver also provides Microsoft Outlook integration. 1.2 How does GFI MailArchiver work? GFI MailArchiver operations can be divided in 3 logical stages: Stage 1: Retrieve emails Stage 2: Archive emails Stage 3: Browse archived emails Figure 1 - Typical GFI MailArchiver installation Stage 1: Retrieve emails GFI MailArchiver connects to the journaling mailbox on the Microsoft Exchange Server and collects the emails stored in the journaling mailbox. Stage 2: Archive emails GFI MailArchiver archives the emails to the active database configured, for example Microsoft SQL Server. Stage 3: Browse archived emails GFI MailArchiver for Exchange Manual About GFI MailArchiver 1

Users can browse and search for specific archived emails via the GFI MailArchiver web interface, using Microsoft Internet Explorer. 1.3 GFI MailArchiver licensing For information on GFI MailArchiver licensing, refer to: http://www.gfi.com/products/gfi-mailarchiver/pricing/licensing 1.4 GFI MailArchiver summary page The GFI MailArchiver Summary page enables you to review basic information related to the configuration and status of GFI MailArchiver. Screenshot 1 - GFI MailArchiver Summary page Click Configuration Summary node to display the Summary page. This page provides the following information: 1. License status - Status of GFI MailArchiver licensing Number of licensed users Number of mail enabled users Basic usage statistics. 2. Mailbox folder structure retrieval - Feature status (Enabled/disabled) User under which this feature accesses Microsoft Exchange Server mailboxes. 2 About GFI MailArchiver GFI MailArchiver for Exchange Manual

3. Mail Server Archiving - Journaling mailbox details Feature status (enabled/disabled). 4. Auditing - Server details Database schema details Database Trace status (running/not running). 5. Archive Stores and indexing - Status of archive store Store name Database schema Database type User browsing status (allowed/not allowed) Further archiving status (enabled/disabled). 6. Retention Policies - Retention policy details Legal hold status (on hold/active). GFI MailArchiver for Exchange Manual About GFI MailArchiver 3

2 Using GFI MailArchiver This chapter will guide you how to browse and search through archived emails in GFI MailArchiver. If the account you login with has the required access privileges, you will also be able to browse and search through the emails of your subordinates. 2.1 Loading GFI MailArchiver 1. In Microsoft Internet Explorer, load the following URL http://<hostname>/<gfi MailArchiver virtual folder name> Example: http://win2k3entsvr.master-domain.com/mailarchiver 2. Key in your domain credentials (username and password used to login to Microsoft Windows) when prompted. Screenshot 2 - GFI MailArchiver loading 3. When loading completes, the navigation panel and the content panel are displayed on the left and right hand sides of the screen respectively. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 5

Screenshot 3 - GFI MailArchiver conversations 2.2 Browsing archived emails To browse through your emails, click Browse node in the navigation panel. The Browse Conversations page will display your archived emails grouped by conversation. GFI MailArchiver displays the most recently updated conversations on top. By default, GFI MailArchiver displays the conversations stored in the currently active archive store. If multiple archive stores were created, the Browse Conversations page will list them in the List conversations in archive list. To browse the conversations in a different archive store, select the archive store from the List conversations in archive list. GFI MailArchiver groups emails under a particular conversation using the Microsoft Exchange thread-index field. Since both Microsoft Outlook and Microsoft Exchange OWA generate the thread-index field, GFI MailArchiver groups the emails created using these clients under the correct conversation group. Emails created from other email clients do not contain the thread-index field and therefore GFI MailArchiver will not manage to group these emails under one conversation even if they have the same subject. In such cases, GFI MailArchiver will create a new conversation group for each email, with the email subject as the conversation title. 2.2.1 Expanding a conversation thread In the Browse Conversations page, the conversations are listed underneath the following columns: Conversation Subject - the subject of the conversation Emails - the number of emails forming part of the conversation Last Email - the time when GFI MailArchiver last updated the conversation with a new archived email. To view the emails forming part of a particular conversation, click anywhere on the conversation row. To collapse a conversation and hide the list of emails forming part of the conversation, click anywhere on the conversation row once again. 6 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

Screenshot 4 - Expanded conversations 2.2.2 Viewing emails 1. Click the conversation row to expand conversation and view emails forming part of the conversation. Screenshot 5 - Viewing an email in GFI MailArchiver 2. Click the email to view from the list of emails forming part of the conversation. GFI MailArchiver will display the selected email. NOTE: For security reasons, GFI MailArchiver cleans the email body from any malicious scripts before displaying it. GFI MailArchiver however stores the unaltered email body content in the archive store. If you save an email to disk and then open it with another email client, it might contain malicious scripts. 3. Select any of the following options: Icon Function View email internet headers. Click button to view email internet headers. These are displayed in a panel. Click this button again or select close button to close panel. View whole conversation Click button to view the whole conversation in the mail view window. All emails forming part of the conversation are listed. Click this button again or select close button to close the panel. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 7

Edit email labels (Global and Personal) Enables you to categorize emails through labeling. This feature is useful during searches for specific mail types, e.g. search all emails labeled as important. To add a label: 1. From Available Labels, key in a new email label or select an existing one. 2. Click Label Email to label email with the keyed in or selected label. To remove a previously assigned label: 1. Select a previously assigned label. 2. Click Remove label. Click this button again or select close button to close panel. NOTE: Labels are displayed in the Labels field in black. Labels assigned at an organization level through categorization policies are in red. You cannot remove categorization policies labels from an email. Restore email Restores emails through the OneClick Restore feature that restores an archived email to a specific mailbox or forwards a copy to an email address. In the restore email panel, key in the email address where to send the copy of the current email and click Restore Email. Save email to disk (EML format) Downloads the whole email to disk, including any attachments in Microsoft Outlook Express, Windows Mail, and Mozilla Thunderbird format. In the File download dialog box, select Save, and select the location where to save the file. Save email to disk (MSG format) Downloads the whole email to disk, including any attachments in Microsoft Office Outlook format. In the File download dialog box, select Save, and select the location where to save the file. Print email Displays email in a printer friendly format in a new browser window. Use the print function of your browser to print the email. Show images in email Use this button to display embedded images in the emails viewed. Mark as not SPAM Use this button to mark as not SPAM an email that was previously identified as SPAM by an anti-spam solution. Requires a SPAM retention policy to be set up. Refer to the Spam Retention policies section in this manual for information. 2.2.3 Downloading attachments If the email contains attachments, GFI MailArchiver displays the attachments next to the Attachments field. To view/download attachments: 1. Click the attachment filename. 2. From the File Download dialog box click: Open - to open attachment in the associated application Save - to save the attachment to disk. NOTE: Attachments may contain Viruses or Trojans. Before opening, it is always recommended to save the attachment to disk and scan it with a virus checker. 8 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

Screenshot 6 - Saving an email attachment 2.2.4 Refreshing the conversation lists For performance, GFI MailArchiver caches conversations displayed in the Browse Conversations page. For this reason, GFI MailArchiver might not immediately display new archived emails. To view the latest archived emails in the Browse Conversations page, click the button in the top right corner. 2.2.5 Browsing the conversation pages By default, GFI MailArchiver displays up to 25 conversations per page. If there are more conversations, these are spread out on separate pages. Click on the page links provided in the navigation bar to navigate through the conversation pages. To move to a specific page, key in the page number in the View page box and click Go. 2.3 Browsing other mail users emails GFI MailArchiver gives you the facility to browse other users emails. This depends on the access granted from the GFI MailArchiver access control feature. For information on how to configure user access control, refer to the Access control and auditing section in this manual. 2.3.1 Select a user account to browse 1. Select Conversations Browse. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 9

Screenshot 7 - Logged in with a group manager account 2. Click List conversations for list and select the account name to browse emails for. The emails for the account name selected will be displayed. NOTE: To browse through the emails of all the accounts in the group, click the List conversations for list and select All subordinates. 2.3.2 Viewing the complete list of accounts you can access For a list of all the accounts you can browse and search: 1. Select Conversations Account List. Screenshot 8 - List of all the accounts you can access 2. Click button in the top right corner to refresh the email account list. 2.4 Browsing emails in different user mailboxes GFI MailArchiver enables you to view your archived emails as they would appear in your users mailboxes. NOTE: To view emails in the appropriate folder structure, first configure the Mailbox folder structure retrieval feature. To do this, refer to the Configuring mailbox folder structure retrieval section in this manual. If this feature is not configured, all emails are displayed in the Inbox or Sent folders only. 10 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

2.4.1 Adding mailboxes 1. Select Conversations Mailboxes node. 2. From the viewing pane, expand the User Accounts drop-down. 3. Select the mailbox to add, and click Add user mailbox. 4. Click Save Settings to confirm the added mailbox/es. 2.4.2 Removing mailboxes 1. Select Conversations Mailboxes. 2. From the List of Mailboxes in the right pane, click symbol to remove mailbox. 3. Click Save Settings to confirm the deletion. 2.4.3 Viewing emails 1. Expand Conversations Mailboxes. 2. Select a mailbox and expand mailbox folders. 3. Select email to view - GFI MailArchiver will display the email selected. 2.4.4 Changing mailbox name view To change the way in which the mailbox name is displayed in the left panel: 1. Select Conversations Mailboxes. 2. Under Mailbox View Options, unselect Display full usernames in mailbox tree (e.g. DOMAINNAME\johndoe). 3. Click Save Settings to apply change. 2.5 Searching email archive stores 2.5.1 Simple search The email archive search feature enables you to search through all archived emails for specific correspondence. When you perform a search, GFI MailArchiver will analyze emails and their respective attachments in search for text that matches the specified search correspondence. To search for archived emails: 1. Select Conversations Search node. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 11

Screenshot 9 - Simple search 2. In the search interface that opens by default, key in the search criteria/text. You can use wildcards as follows: NOTE: Use of wildcards is allowed as follows:? - Matches any single character. * - Matches any string of characters. For example: To search for emails containing the word Swiss, you can key in sw??s or sw*s in the Search for box. 3. In the Search through emails from list select the required date range. 4. <Optional> If the user logged in GFI MailArchiver has access to other user accounts, unselect the Search through my emails only option to enable GFI MailArchiver to search through all user accounts. 5. Click Search. Screenshot 10 - Search results after performing a simple search Emails that match the search query specified are displayed below the Search area. GFI MailArchiver displays up to 25 emails per page. If more than 25 emails matched the search query, GFI MailArchiver will spread the emails out on separate pages. To change the amount of emails displayed per page, click the GFI MailArchiver Options node, select the number of emails to list per 12 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

page from the Number of items to display per page list and click Save Settings. To navigate through the search results pages, click on the page links provided. 2.5.2 Advanced search 1. Select Conversations Search node to display search page. 2. Click View Advanced Search Options link to access the advanced search feature. NOTE: To switch back to simple search mode, click View Simple Search Options link. Screenshot 11 - Advanced search Through the advanced search feature, you can specify search queries for specific fields such as subject, recipient, and size. You can also limit your search to emails labeled with a specific label. You can also select the archive stores to search into for emails. GFI MailArchiver lists the available archive stores in the Search in the following archive(s) list. To search through multiple archive stores hold the CTRL key pressed and click the archive store names to include in the search. By default, the advanced search will search only through your mailbox emails. If the user account has access to other user accounts, from the Search through the emails of list: Select All Users to search in all user accounts Select a specific user account to search only the emails of that user account. The GFI MailArchiver advanced search supports search queries on any of the following fields: Size (KB) Message ID Recipient Sender Sent Date Received Date Subject Whole email GFI MailArchiver for Exchange Manual Using GFI MailArchiver 13

Folder Folder/Subfolder NOTE: Use of wildcards is allowed for Message ID, Recipient, Sender, Subject, Whole Email, as follows:? - Matches any single character * - Matches any string of characters. For example: To search for emails containing the word Swiss, you can key in sw??s or sw*s in the Search for box. 2.5.3 Search for emails with a specific label To search for emails with specific categorization policies or labeled with a specific label: 1. Select the Search for emails labeled check box. 2. From the list below the check box, select the label required. Screenshot 12 - Searching for emails with a specific label NOTE: GFI MailArchiver displays personal labels in black and categorization policy labels in red. 3. Clear the Search for emails matching the following conditions check box. NOTE: To search for specific criteria within the emails labeled with a specific label, select the Search for emails matching the following conditions check box and specify the search terms you require as outlined in the following sections. 4. Click Search. 2.5.4 Search by email size To search for emails of a particular size: 1. Select the Search for emails matching the following conditions check box. 2. Select Size (KB) from the fields list. 14 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

3. From the condition list, select the file-size search condition required accordingly: (i.e. IS GREATER THAN, IS SMALLER THAN, or IS EXACTLY. Screenshot 13 - Email size field 4. Specify file size value in the adjacent field and click Search. 2.5.5 Search by Message ID Email headers contain a Message ID field The Message ID is a unique message identifier assigned to every email processed by Microsoft Exchange. For example: F26B97C01FB21C4A34CD9F05062072@master-domain.com To search for emails using the Message ID field: 1. Select the Search for emails matching the following conditions check box. 2. Select Message ID from the fields list. Screenshot 14 - Message ID field 3. Specify the message ID in the adjacent field and click Search. 2.5.6 Search by Recipient or Sender To search for emails from a particular sender or a particular recipient: 1. Select the Search for emails matching the following conditions check box. 2. Select Sender or Recipient from the fields list to search for a sender or recipient respectively. Screenshot 15 - Sender field 3. Specify the email address or Active Directory (AD) display name of the account to search and click Search. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 15

2.5.7 Search by Sent or Received date To search for emails that were sent or received on particular dates: 1. Select the Search for emails matching the following conditions check box. 2. Select Sent Date or Received Date from the fields list to search for emails sent or received on a particular date respectively. Screenshot 16 - Sent date field 3. From the condition list select the search condition required (i.e. IS BEFORE, IS AFTER or IS EXACTLY) 4. Click the button to open calendar, select the required date, and click Search. 2.5.8 Search by email Subject To search for emails having a particular subject: 1. Select the Search for emails matching the following conditions check box. 2. Select Subject from the fields list. 3. Specify the search query in the box to the right of the fields list. Screenshot 17 - Subject field 4. Click Search. 2.5.9 Search throughout the whole email To search for emails that have some specific content anywhere in the email: 1. Select the Search for emails matching the following conditions check box. 2. Select Whole Email from the fields list. 3. Specify the search query in the box to the right of the fields list. Screenshot 18 - Searching the whole email 4. Click Search. 16 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

2.5.10 Searching using multiple search terms If you have specified a search condition and need to add more search conditions: 1. Click Add Condition to add a new condition entry beneath the last condition. NOTE: The conditions are logically ANDed together. This means that an email must satisfy all conditions for GFI MailArchiver to list it in the search results. For example: If you specify the following conditions: Sender is adam@external.com AND Recipient is jsmith@master-domain.com GFI MailArchiver will only list the emails sent from adam@external.com to jsmith@master-domain.com. Screenshot 19 - Adding a condition 2. To add more conditions repeat steps 1 and 2. 3. When all required conditions are added, perform the search by clicking Search. 2.5.11 Removing search conditions To remove a particular search condition, click the of the condition to remove. button to the right If you added multiple search conditions and need to remove all the conditions specified at once, click the Remove All Conditions button. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 17

2.5.12 Viewing emails returned by a search Click on a search result to view email. To view another email, close the email view window by clicking button and click on another email from the search results list. 2.5.13 Sorting search results By default, GFI MailArchiver sorts the search results by relevance, with the most relevant emails listed on top. To sort the search results on a different field, select a sorting field from the Sort results by list and then select a sort order from the list to the right. You can sort the search results on one of the following fields, Relevance, Sent Date, Subject, Sender, Recipient, and Size. Screenshot 20 - Sorting the search results 2.6 Creating and using search folders 2.6.1 What is a search folder? Within GFI MailArchiver, a search folder is a special kind of folder which contents changes dynamically as the search query you based the search folder on finds new matching items. In GFI MailArchiver, you create a search folder based on a search query you define in the Search page. When you access the search folder, GFI MailArchiver will list all the matching archived emails in it. NOTE: The emails listed in a search folder are not stored in the search folder. The search folder stores the search query only. You can therefore create, modify, and delete search folders without losing any archived emails. By default, GFI MailArchiver creates three search folders under the Conversations Search Folders node. These are: Emails in last 7 days: Lists emails sent or received in the last seven days. Emails in last 30 days: Lists emails sent or received in the last thirty days. 18 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

Large email: Lists all emails with a size greater than 1MB. 2.6.2 Creating a search folder 1. Click Conversations Search node. 2. Use the simple or advanced search interface to create the search query to base the search folder on. 3. Click Search to view the emails that match the search query you specified. If the emails returned do not match exactly the emails you were looking for, refine the search query. 4. Click Save as new Search Folder. 5. In the Enter the new Search Folder s name box, specify a descriptive name for the new search folder. Screenshot 21 - Creating a search folder 6. Click Save. GFI MailArchiver will create and add the new search folder under the Conversations Search Folders node. 2.6.3 Viewing the search folder contents To view the contents of the search folder: 1. Expand the Conversations Search Folders node. 2. Click on the search folder to view. GFI MailArchiver will load the search folder selected in the content panel on the right hand side. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 19

Screenshot 22 - Viewing a search folder 2.6.4 Modifying the search folder query To refine or alter the search query of a search folder: 1. Click on the Conversations Search Folders node. 2. In the Search Folders page, click on the button to the right of the search folder to modify. Screenshot 23 - Edit search folder query 3. Modify the search query. Click Search to view the emails that match the search query you specified. If the emails returned do not match exactly the emails you were looking for, refine the search query further. 4. Click Save. NOTE: To create a new search folder, based on the modified search query, click Save as new Search Folder. Specify a descriptive name for the new search folder and click Save next to the name box. 2.6.5 Deleting a search folder NOTE: The emails listed in a search folder are not stored in the search folder. The search folder stores the search query only. 20 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

Therefore, you can delete search folders without losing any archived emails. 1. Click on the Conversations Search Folders node. Screenshot 24 - Search folders list 2. In the Search Folders page, click on the button to the right of the search folder to delete. 2.7 Changing the language By default, the GFI MailArchiver web interface is set to load in English. To change the display language: 1. Click GFI MailArchiver Options node and select the language from the Display GFI MailArchiver in the following language list. Screenshot 25 - Selecting a language for the GFI MailArchiver web interface 2. Click Save Settings. GFI MailArchiver will reload the web interface in the selected language. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 21

NOTE: GFI MailArchiver will always load the configuration part of the user interface in English, irrespective of the preferred language configured. The language preference is stored in a cookie on the computer from where you accessed the GFI MailArchiver web interface. GFI MailArchiver will load the web interface in your preferred language the next time you access it on the same computer. The preferred language selected affects the GFI MailArchiver web interface text only. GFI MailArchiver will display any other text (e.g. email addresses and email content) in the original language. Other settings such as dates are also displayed according to the settings configured in Microsoft Internet Explorer. Example: If the language options of Microsoft Internet Explorer are set to English, but you selected Spanish in GFI MailArchiver, you still would see the dates formatted in English, with month names written in the English language instead of Spanish. To change the language settings of Microsoft Internet Explorer: 1. Select Tools Internet Options from the Microsoft Internet Explorer menu bar. 2. From the General tab, click Languages. 3. Click Add to add the desired language. Screenshot 26 - Microsoft Internet Explorer Language Preference 4. Move the preferred language to the top of the list. To do this, select the preferred language from the list and click Move Up to move the language a level upwards. Repeat this until the preferred language is at the top of the list. 5. Click OK to close the Language Preference dialog box and Internet Options dialog box. 2.8 Logging in as a different user To login using a different user account: 22 Using GFI MailArchiver GFI MailArchiver for Exchange Manual

1. Click Log Off in the navigation panel. GFI MailArchiver will display a note instructing you to close the browser to complete the log off process. From this page, click Login as a different user. Screenshot 27 - Login as a different user 2. Key in the user name and password of the new user account in the authentication dialog box and click OK. 2.9 Logging off GFI MailArchiver It is highly recommended to log off GFI MailArchiver when you finish browsing and searching through your email. 1. Click Log off in the top right corner of the navigation panel. 2. Close the browser. GFI MailArchiver for Exchange Manual Using GFI MailArchiver 23

3 Import and export emails GFI MailArchiver enables you to extract emails from various email databases and to import them into the GFI MailArchiver archive stores. GFI MailArchiver can import emails from the following email databases: Microsoft Exchange Mailboxes PST files locally PST files on the network GFI MailArchiver 2 GFI MailEssentials Through GFI MailArchiver you can export emails from the Archive Stores, for example, to restore deleted emails. The GFI MailArchiver Bulk Export tool can export emails to a: specific email address folder on disk in.eml or.msg format PST file. For more information, refer to the Exporting emails using the Bulk Export tool chapter of this manual. 3.1 Import emails from Microsoft Exchange Mailboxes 3.1.1 Introduction The GFI PST-Exchange Email Export wizard enables you to extract emails from Microsoft Exchange mailboxes. Emails can then be imported into the GFI MailArchiver archive stores. NOTE: When importing emails to Microsoft SQL Express, ensure that the 4GB limit of the Microsoft SQL Express edition is not exceeded. The table below provides an estimate of the number of Archive Stores based on Microsoft SQL Express required by number of email users/volume Email users Average daily emails per user 20 emails 50 emails 100 emails 20 users Yearly 6 months Quarterly 50 users 6 months Bi-monthly Monthly 100 users Quarterly Monthly - 200 users Monthly - - The process of adding email from Microsoft Exchange Mailboxes to GFI MailArchiver involves the following procedure: GFI MailArchiver for Exchange Manual Import and export emails 25

1. The GFI PST-Exchange Email Export tool extracts emails from Microsoft Exchange mailboxes. 2. The GFI PST-Exchange Email Export tool converts the emails to MIME format. 3. The GFI MailArchiver Import Service processes the extracted emails based on the date of each email. 4. GFI MailArchiver stores emails in the appropriate archive store. 5. Failed emails are placed in a separate folder for review. 3.1.2 Step 1: Configure GFI MailArchiver Import Service Use the GFI MailArchiver Import Service to analyze extracted emails and to store them in the appropriate GFI MailArchiver archive store. NOTE: Before adding data stores in the GFI MailArchiver Import Service, ensure that archive stores are first configured as described in the Setting up databases chapter of this manual. Add new store in the GFI MailArchiver Import Service 1. Click Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Click Add Store to launch the Add new store dialog. 26 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 28 - Selecting the archive store and configuring the date range 4. From the Name drop-down list, select one of the archive stores. (Only archive stores created previously in GFI MailArchiver are shown) 5. From the From and To calendars, specify a date range for this archive store. NOTE: Dates should not overlap with dates specified in other archive stores. 6. Click OK to add the new archive store. 7. To add other archive stores repeat steps 3 to 6. GFI MailArchiver for Exchange Manual Import and export emails 27

Screenshot 29 - Archive stores added in the configuration 8. On configuring all the required archive stores, click Apply Settings and Close to save settings. Change date range for an archive store 1. Select Start Programs GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Configure store. 4. Change the date range from the From: and To: calendars and click OK. 5. Repeat steps 3 and 4 for all archive stores that require modification. 6. Click Apply settings and Close to save and exit configuration. Removing an Import Service Archive Store 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Remove store. 4. Click Apply settings and Close to save and exit configuration. 3.1.3 Importing emails from a remote computer This section only applies when extracting emails from a remote machine. If importing emails from the same machine where GFI MailArchiver is installed then skip to Step 2: Run the GFI PST- Exchange Email Export wizard in this manual. GFI MailArchiver lets you extract email mailboxes located on remote machines. To do this: 28 Import and export emails GFI MailArchiver for Exchange Manual

1. From the GFI MailArchiver machine, navigate to <GFI MailArchiver installation path>\mais\ 2. Share the folder Pickup to give full read and write permissions to the remote machine from where the GFI PST-Exchange Email Export wizard is going to be run. To share a folder: In Windows Server 2003: a. Right-click the Pickup folder and select Sharing and Security b. Select Share this folder and click Permissions button to enter the Permissions dialog. d. Click Add. e. Enter the username of the user where the wizard is going to be run and click Check Names to confirm the user. f. Click OK to add the user in the Permissions dialog. g. In the Permissions dialog select the username added and select the Allow checkbox for Full Control. h. Click OK to save and exit the Permissions dialog. i. Click OK to save and exit the folder properties sharing dialog. In Windows Server 2008: a. Right-click Pickup folder and select Share b. Specify the credentials under which the import/export wizard will run and click Add. c. From the Permission Level drop-down list next to the added user, select Co-owner. d. Select Share and click Done. 3. Return to the path where GFI MailArchiver is installed and copy EEWIZ folder. 4. Paste the folder on the remote machine. 5. Run eewiz.exe and proceed to step 2 of the next chapter. 3.1.4 Microsoft Exchange mailbox access permissions - Grant Permissions The GFI PST-Exchange Email Export tool uses the credentials of the logged-on user when run on the Microsoft Exchange server machine directly. To run the GFI PST-Exchange Email Export tool on a server that is not the Microsoft Exchange 2003/2007/2010 machine, specify a user name and a password. This account needs to be granted full mailbox access ( SendAs and ReceiveAs permissions) on the mailboxes from which emails are to be extracted. NOTE: It is recommended to remove these permissions after extracting the mailboxes. Importing mailboxes remotely from Microsoft Exchange 2003 server 1. Open Exchange System Manager. 2. Navigate to Servers <Server Name> <Storage Group>, right click on the Mailbox Store and select Properties. 3. Select the Security tab. GFI MailArchiver for Exchange Manual Import and export emails 29

4. Click Advanced button and uncheck Allow inheritable permissions checkbox. 5. In the Security dialog box, select Copy. 6. Click OK to apply changes and return to the Mailbox Store Security properties. 7. In the Security tab, select Administrator from the Group or user names. 8. From the Permissions list check the Allow check boxes for Receive As and Send As. 9. Repeat steps 7 and 8 to allow Receive As and Send As permissions for: Domain Admins Enterprise Admins Exchange Domain Servers. 10. Click OK to save settings. 11. Restart the Information Store: a. Navigate to Start Run, type services.msc, and click OK. b. In the Results pane, right-click Microsoft Exchange Information Store service and click Restart. Importing mailboxes remotely from Microsoft Exchange 2007/2010 server 1. Open the Microsoft Exchange Management Shell. 2. Run the following PowerShell commandlet: Add-ADPermission -identity Mailbox Store -User Trusted User -AccessRights GenericAll NOTE: Replace Mailbox Store with the name of the mailbox store that contains the mailboxes to import and Trusted User with the user that will be granted full mailbox access. Example: Add-ADPermission -Identity Mailbox Database -User master-domain\johnsmith -AccessRights GenericAll 3.1.5 Step 2: Run the GFI PST-Exchange Email Export wizard To export emails from Microsoft Exchange mailboxes: 1. Launch the GFI PST-Exchange Email Export wizard by navigating to Start Programs GFI MailArchiver Import Tools GFI PST-Exchange Email Export. NOTE: GFI PST-Exchange Email Export wizard can also be launched from command prompt to apply various conditions to the export process. To do this, from command prompt change the directory to <GFI MailArchiver installation path>\eewiz\ and type one of the following arguments: eewiz.exe /iepf - launch GFI PST-Exchange Email Export wizard and export all emails including emails which were previously exported 30 Import and export emails GFI MailArchiver for Exchange Manual

eewiz.exe /dnmpe - launch GFI PST-Exchange Email Export wizard and the emails to export will not be flagged as exported eewiz.exe /sowner - launch GFI PST-Exchange Email Export wizard and specify an owner for the exported emails during the wizard process eewiz.exe /clear - launch GFI PST-Exchange Email Export wizard and clear export flags for the selected emails before export eewiz.exe /lang <lang> - launch GFI PST-Exchange Email Export wizard in the required language. Replace <lang> with the following code: Language to display English Spanish Italian German Code en-us es-es it-it de-de 2. On the Welcome page, click Next. Screenshot 30 - Select the Microsoft Exchange server 3. Select the applicable Microsoft Exchange Server option and click Next. GFI MailArchiver for Exchange Manual Import and export emails 31

Screenshot 31 - Microsoft Exchange mailbox source 4. Enter the credentials to logon to Microsoft Exchange: Microsoft Exchange 2000/2003/2007: o o Select the Current User checkbox to logon using the credentials of the current user, or Specify the logon credentials in the Exchange Server name, User name and password text boxes. NOTE: To specify a non-default port number or if you have multiple virtual folders, manually alter the connection string in the box on top of the Mailboxes list. For example: http://mailserver:85/myexch/ o If the Microsoft Exchange server you are connecting to requires an SSL connection, select the Use SSL check box. Microsoft Exchange 2007/2010 using Web Services: o o Select the Current User checkbox to logon using the credentials of the current user, or Specify the logon credentials in the User name and password text boxes. 5. To extract emails from the public folders, select the Extract from Public Folders checkbox and skip to step 8. 6. Specify the mailboxes to be added by clicking Add mailbox. In the Active Directory object-picker dialog box, enter a username and click OK. 7. Click Next when all mailboxes are added. The Export wizard will check if the username and password specified have read/write access to the mailboxes specified. 32 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 32 - Select the folders to process 8. The setup will display the email folder structure for the mailboxes specified. Select the folders to extract emails from by selecting the checkbox next to the required folders. Folders that contain no emails cannot be selected. NOTE: To select all the sub-folders underneath a specific folder node, hold the CTRL key pressed and click the check box to the left of the parent folder. Click Next when all the required email folders are selected. Screenshot 33 - Cut off time option GFI MailArchiver for Exchange Manual Import and export emails 33

9. When extracting emails, there might be emails already archived by GFI MailArchiver. These will result in duplicate archived emails. To avoid this occurrence, configure a cut off time so that only emails with a date or time prior to the one specified are archived. From the Date calendar, navigate and specify a year, month, and day as cut off. From the Time section, specify a time. Click Next to proceed. 10. When extracting emails from Public Folders, the Select Owner dialog is displayed. Specify email owner in the Owner text box. Example: If user@testdomain.com is specified in the Owner field, imported public folders emails are displayed under user@testdomain.com. Click Next to proceed. Screenshot 34 - Destination selection page 11. From the Select Destination dialog, select a folder where to store the extracted emails. NOTE 1: To import the emails into the GFI MailArchiver archive store select the location of the GFI MailArchiver Import Service pickup folder: <GFI MailArchiver installation path>\mais\pickup. NOTE 2: To import emails into the GFI MailArchiver archive store when running wizard on a remote machine, specify shared pickup folder on the GFI MailArchiver machine. Click Next to proceed. 12. The wizard is now ready to start the extraction progress. To keep the folder structure of the mailboxes specified, select Export Folder Structure Data checkbox. Click Next to start the extraction process. 34 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 35 - GFI PST-Exchange Email Export wizard finish page 13. When the GFI PST-Exchange Email Export wizard completes the email extraction process, it will display the following information: the total number of emails selected for extraction, the number of emails successfully extracted, the number of skipped emails (emails which were already extracted or emails dated after the cut off time and date), the total number of failed emails - click View Failed Mails Log File button to view details of failed emails, 14. Click Finish to close the GFI PST-Exchange Email Export wizard. 3.1.6 Adding imported emails to the GFI MailArchiver archive stores After running the GFI MailArchiver Email Export wizard, exported emails are saved in.txt format in the destination folder specified. To import the exported emails into a GFI MailArchiver archive store, the exported emails must be placed into the GFI MailArchiver Import Service pickup folder by either: Choosing the GFI MailArchiver Import Service pickup folder as the destination folder when running the wizard, or If emails are already exported, manually move the emails to the pickup folder. Emails in the GFI MailArchiver Import Service pickup folder are processed as follows: Emails are placed in the queue folder so that they can be placed in the appropriate archive store. If an email in the pickup folder has a date that does not fit the date range of any of the archive stores configured or the email is GFI MailArchiver for Exchange Manual Import and export emails 35

corrupted, the import service will move the email to the Unclassified folder. The default paths of these folders are: Pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup Queue folder: <GFI MailArchiver Installation Path>\MAIS\Queue Unclassified folder: <GFI MailArchiver Installation Path>\MAIS \Unclassified 3.1.7 Unclassified emails The GFI MailArchiver Import Service classifies email as unclassified when the date is not within a date range of an archive folder. For each unclassified email, the GFI MailArchiver Import Service will create four files in the Unclassified folder For example: 200903mchnname_112132568200036_[20061123173817].body 200903mchnname_112132568200036_[20061123173817].emc 200903mchnname_112132568200036_[20061123173817].eml 200903mchnname_112132568200036_[20061123173817].enve lope The first part of the file name in the Unclassified folder begins with the year and month in which the email was sent. IMPORTANT NOTE: If 500 or more emails are located in the Unclassified folder, the import process will be suspended. In this case, delete any unwanted emails or import emails to an archive folder: 1. Configure one or more archive folders to cover the dates of the emails to archive. 2. Stop the GFI MailArchiver Import Service by navigating to Start Control Panel Administrative Tools Services. 3. Right-click GFI MailArchiver Import Service and click Stop. 4. Navigate to Unclassified folder. 5. Move all four files of the emails to import to the Queue folder. 6. Return to the services management console, right-click GFI MailArchiver Import Service and select Start. 3.1.8 Microsoft Exchange mailbox access permissions - Revoke Permissions Importing mailboxes on the Microsoft Exchange server There are no permissions to be revoked when running the GFI PST- Exchange Email Export tool directly on the Microsoft Exchange server machine. If the GFI PST-Exchange Email Export tool was run on a machine that is not the Microsoft Exchange 2003/2007/2010 server, user credentials were previously granted Send As and Receive As permissions. It is recommended that after running the GFI PST- Exchange Email Export tool, these permissions are revoked. 36 Import and export emails GFI MailArchiver for Exchange Manual

Importing mailboxes remotely from Microsoft Exchange 2003 server 1. Open Exchange System Manager. 2. Navigate to Servers <Server Name> <Storage Group>, right click on the Mailbox Store and select Properties. 3. Select the Security tab. 4. From Group or user names box select Administrator. 5. From the Permissions list check the Deny option for Receive As and Send As. 6. Repeat steps 4 and 5 to deny Receive As and Send As permissions for: Domain Admins Enterprise Admins Exchange Domain Servers. 7. Click the Advanced button, check the Allow inheritable permissions option and click OK. 8. Click OK to exit the Mailbox Store Properties dialog. 9. Restart the Information Store: a. Navigate to Start Run, type services.msc, and click OK. b. In the Results pane, right-click Microsoft Exchange Information Store service and click Restart. Importing mailboxes remotely from Microsoft Exchange 2007/2010 server 1. Open the Microsoft Exchange Management Shell. 2. Run the following Windows PowerShell commandlet: Remove-ADPermission -identity "Mailbox Store" -User "Trusted User" -AccessRights GenericAll NOTE: Replace Mailbox Store with the name of the mailbox store that contains the mailboxes of the users and Trusted User with the user that was previously granted full mailbox access. Example: Remove-ADPermission -identity "Mailbox Database" - User "master-domain/johnsmith" -AccessRights GenericAll 3.2 Import emails from PST files locally 3.2.1 Introduction The GFI PST-Exchange Email Export wizard enables you to extract emails from PST files. Emails can then be imported into the GFI MailArchiver archive stores. NOTE: If importing emails to Microsoft SQL Express, ensure that the 4GB limit of the Microsoft SQL Express edition is not exceeded. The table below provides an estimate of the number of Archive Stores GFI MailArchiver for Exchange Manual Import and export emails 37

based on Microsoft SQL Express required by number of email users/volume. Email Average daily emails per user users 20 emails 50 emails 100 emails 20 users Yearly 6 months Quarterly 50 users 6 months Bi-monthly Monthly 100 users Quarterly Monthly - 200 users Monthly - - The process of adding emails from PST files to GFI MailArchiver involves the following procedure: 1. The GFI PST-Exchange Email Export tool extracts emails from one or more PST files. 2. The GFI PST-Exchange Email Export tool converts the emails to MIME format. 3. The GFI MailArchiver Import Service processes the extracted emails based on the date of each email. 4. GFI MailArchiver stores emails in the appropriate archive store. 5. Failed emails are placed in a separate folder for review. NOTE 1: Microsoft Outlook must be installed on the machine running the GFI MailArchiver Email Export wizard. NOTE 2: During extraction, emails in PST files are copied and the PST file is left in its original state. 3.2.2 Step 1: Configure GFI MailArchiver Import Service Use the GFI MailArchiver Import Service to analyze extracted emails and store them in the appropriate GFI MailArchiver archive store. NOTE: Before adding data stores in the GFI MailArchiver Import Service, ensure that archive stores are first configured as described in the Setting up databases chapter of this manual. 38 Import and export emails GFI MailArchiver for Exchange Manual

Adding a new store 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Click Add Store to launch the Add new store dialog. Screenshot 36 - Selecting the archive store and configuring the date range 4. From the Name drop-down list, select one of the archive stores. (Only archive stores created previously in GFI MailArchiver are shown) 5. From the From and To calendars, specify a date range for this archive store. NOTE: Dates should not overlap with dates specified in other archive stores. 6. Click OK to add the new archive store. 7. To add other archive stores repeat steps 3 to 6. GFI MailArchiver for Exchange Manual Import and export emails 39

Screenshot 37 - Archive stores added in the configuration 8. On configuring all Archive Stores, click Apply Settings and Close to save settings. Changing date range for an archive store 1. Select Start Programs GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Configure store. 4. Change the date range from the From: and To: calendars and click OK. 5. Repeat steps 3 and 4 for all archive stores that require modification. 6. Click Apply settings and Close to save and exit configuration. Removing an Import Service Archive Store To remove an Import Service Archive Store: 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Remove store. 4. Click Apply settings and Close to save and exit configuration. 3.2.3 Importing emails from a remote computer This section only applies when extracting emails from a remote machine. If importing emails from the same machine where GFI MailArchiver is installed then skip to Step 2: Run the GFI PST- Exchange Email Export wizard in this manual. 1. From the GFI MailArchiver machine, navigate to <GFI MailArchiver installation path>\mais\ 40 Import and export emails GFI MailArchiver for Exchange Manual

2. Share the Pickup folder to give full read and write permissions to the remote machine from where the GFI PST-Exchange Email Export wizard is going to be run. To share a folder: In Windows Server 2003: a. Right-click the Pickup folder and select Sharing and Security b. Select Share this folder and click Permissions button to enter the Permissions dialog. d. Click Add. e. Enter the username of the user where the wizard is going to be run and click Check Names to confirm the user. f. Click OK to add the user in the Permissions dialog. g. In the Permissions dialog select the username added and select the Allow checkbox for Full Control. h. Click OK to save and exit the Permissions dialog. i. Click OK to save and exit the folder properties sharing dialog. In Windows Server 2008: a. Right-click Pickup folder and select Share b. Specify the credentials under which the import/export wizard will run and click Add. c. From the Permission Level drop-down list next to the added user, select Co-owner. d. Select Share and click Done. 3. Return to where GFI MailArchiver is installed and copy EEWIZ folder. 4. Paste the folder on remote machine. 5. Run eewiz.exe. 3.2.4 Step 2: Run the GFI PST-Exchange Email Export wizard Run GFI PST-Exchange Email Export wizard to extract emails from PST file. 1. Navigating to Start Programs GFI MailArchiver Import Tools GFI PST-Exchange Email Export. NOTE: GFI PST-Exchange Email Export wizard can also be launched from command prompt while applying various conditions to the export process. To do this, from command prompt change the directory to <GFI MailArchiver installation path>\eewiz\ and type one of the following arguments: eewiz.exe /iepf - launch GFI PST-Exchange Email Export wizard and export all emails including emails which were previously exported eewiz.exe /dnmpe - launch GFI PST-Exchange Email Export wizard and the emails which are exported are not flagged as exported eewiz.exe /sowner - launch GFI PST-Exchange Email Export wizard and during wizard specify an owner for the exported emails GFI MailArchiver for Exchange Manual Import and export emails 41

eewiz.exe /clear - launch GFI PST-Exchange Email Export wizard and clear export flags for the selected emails before export eewiz.exe /lang <lang> - launch GFI PST-Exchange Email Export wizard in the required language. Replace <lang> with: o o o o en-us - English es-es - Spanish it-it - Italian de-de - German 2. Click Next to proceed. 3. Select Microsoft Outlook PST Files and click Next. Screenshot 38 - Microsoft Outlook personal folders (PST) files 4. Click Add PST File and select PST file to extract. Repeat for each PST file to be added. Click Next when all PST files are added. 42 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 39 - Select the folders to process 5. The setup will display the email folder structure for the PST files specified. Select the folders to extract emails from by selecting the checkbox next to the required folders. Folders that contain no emails cannot be selected. NOTE: To select all the sub-folders underneath a specific folder node, hold the CTRL key pressed and click the check box to the left of the parent folder. Click Next when all the required email folders are selected. Screenshot 40 - Cut off time option GFI MailArchiver for Exchange Manual Import and export emails 43

6. When extracting emails, there might be emails that are already archived by GFI MailArchiver. After extraction, duplicate emails are archived. To avoid this occurrence, configure a cut off time so that only emails with a date/time prior to the date/time specified are archived. From the Date calendar, navigate and specify a year, month, and day as cut off. From the Time section, specify a time. Click Next to proceed. Screenshot 41 - Owner selection page 7. From the Select Owner dialog, specify an owner of the emails in the Owner text box. For example: If user@testdomain.com is specified in the Owner box, the GFI MailArchiver interface will display the imported emails under user@testdomain.com. Click Next to proceed. 44 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 42 - Destination selection page 8. From the Select Destination dialog, select a folder where to store the extracted emails. NOTE 1: To import the emails into the GFI MailArchiver archive store select the location of the GFI MailArchiver Import Service pickup folder: <GFI MailArchiver installation path>\mais\pickup. NOTE 2: To import the emails into the GFI MailArchiver archive store when running the wizard on a remote machine, specify the shared pickup folder on the GFI MailArchiver machine. After selecting the destination, click Next. 9. The wizard is now ready to start the extraction. Select Export Folder Structure Data checkbox, to keep the folder structure of the mailboxes selected. Click Next to start the extraction process. GFI MailArchiver for Exchange Manual Import and export emails 45

Screenshot 43 - GFI PST-Exchange Email Export wizard finish page 10. When the GFI PST-Exchange Email Export wizard completes the email extraction process, the following information is displayed: the total number of emails selected for extraction the number of emails successfully extracted the number of skipped emails (emails which were already extracted or emails dated after the cut off time and date) the total number of failed emails - click View Failed Mails Log File button to view details of failed emails. 11. Click Finish to close the GFI PST-Exchange Email Export wizard. 3.2.5 Adding imported emails to the GFI MailArchiver archive stores After running the GFI MailArchiver Email Export wizard, the exported emails are saved in txt format in the destination folder specified when running the wizard. To import the exported emails into a GFI MailArchiver archive store, the exported emails must be placed into the GFI MailArchiver Import Service pickup folder by either: Choosing the GFI MailArchiver Import Service pickup folder as the destination folder when running the wizard, or If emails are already exported, manually move the emails to the pickup folder. Emails in the GFI MailArchiver Import Service pickup folder are processed as follows: Emails are placed in the queue folder so that they can be placed in the appropriate archive store. If an email in the pickup folder has a date that does not fit the date range of any of the archive stores configured or the email is 46 Import and export emails GFI MailArchiver for Exchange Manual

corrupted, the import service will move the email to the Unclassified folder. The default paths of these folders are: Pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup Queue folder: <GFI MailArchiver Installation Path>\MAIS\Queue Unclassified folder: <GFI MailArchiver Installation Path>\MAIS \Unclassified 3.2.6 Unclassified emails The GFI MailArchiver Import Service classifies email as unclassified when the date is not within a date range of an archive folder. For each unclassified email, the GFI MailArchiver Import Service will create four files in the Unclassified folder, for example: 200903mchnname_112132568200036_[20061123173817].body 200903mchnname_112132568200036_[20061123173817].emc 200903mchnname_112132568200036_[20061123173817].eml 200903mchnname_112132568200036_[20061123173817].enve lope The first part of the file name in the Unclassified folder begins with the year and month in which the email was sent. IMPORTANT NOTE: If there are 500 or more emails in the Unclassified folder, the import process will be suspended. In this case, delete any unwanted emails or import the emails to an archive folder as follows: 1. Configure one or more archive folders to cover the dates of the emails that are required to be archived. 2. Stop the GFI MailArchiver Import Service by navigating to Start Control Panel Administrative Tools Services. 3. Right-click GFI MailArchiver Import Service and click Stop. 4. Navigate to Unclassified folder. 5. Move all four files of the emails to import to the Queue folder. 6. Return to the services management console, right-click GFI MailArchiver Import Service and select Start. GFI MailArchiver for Exchange Manual Import and export emails 47

3.3 Import emails from PST files on the network 3.3.1 Introduction The GFI PST Exporter wizard included with GFI MailArchiver helps in archiving Microsoft Outlook PST files on the network created before installing GFI MailArchiver. GFI PST Exporter is an agentbased utility forming part of the GFI MailArchiver installation. Following is how it works: 1. GFI PST Exporter installs agents on end-user machines. 2. It extracts emails from PST files stored on the end-user machines. 3. The GFI MailArchiver Import Service processes the extracted emails based on the date of each email. 4. GFI MailArchiver stores emails in the appropriate archive store. 5. Failed emails are placed in a separate folder for review. 3.3.2 Step 1: Configure the GFI MailArchiver Import Service Use the GFI MailArchiver Import Service to analyze extracted emails and stores them in the appropriate archive store. NOTE 1: If importing emails to Microsoft SQL Express, ensure that the 4GB limit of the Microsoft SQL Express edition is not exceeded. The table below provides an estimate of the number of Archive Stores based on Microsoft SQL Express required by number of email users/volume. Email users Average daily emails per user 20 emails 50 emails 100 emails 20 users Yearly 6 months Quarterly 50 users 6 months Bi-monthly Monthly 100 users Quarterly Monthly - 200 users Monthly - - 48 Import and export emails GFI MailArchiver for Exchange Manual

NOTE 2: Before adding data stores in the GFI MailArchiver Import Service, ensure that archive stores are first configured as described in the Setting up databases chapter of this manual. Adding a new store 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Click Add Store to launch the Add new store dialog. Screenshot 44 - Selecting the archive store and configuring the date range 4. From the Name drop-down list select one of the archive stores. (Only archive stores created previously in GFI MailArchiver are shown) 5. Specify a date range for this archive store by setting the From and To calendars. NOTE: Dates specified should not overlap with dates specified in other archive stores. 6. Click OK to add the new archive store. 7. To add other archive stores repeat steps 3 to 6. GFI MailArchiver for Exchange Manual Import and export emails 49

Screenshot 45 - Archive stores added in the configuration 8. When all the archive stores are configured, click Apply Settings and Close to save settings. Changing date range for an Archive Store To change the date range of an archive store: 1. Select Start Programs GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Configure store. 4. Change the date range from the From: and To: calendars and click OK. 5. Repeat steps 3 and 4 for all archive stores that require modification. 6. Click Apply settings and Close to save and exit configuration. Removing an Import Service Archive Store To remove an Import Service Archive Store: 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Remove store. 4. Click Apply settings and Close to save and exit configuration. 3.3.3 Step 2: Install GFI PST Exporter 1. Select Start Programs GFI MailArchiver Import Tools Install GFI PST Exporter. 2. Specify the path where to install GFI PST Exporter and click Next. 50 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 46 - GFI PST Exporter Master Service credentials 3. After the setup extracts the files, specify the credentials under which the GFI PST Exporter Master Service will be running and click Install to finalize the installation. 3.3.4 Step 3: Configure the General Settings of GFI PST Exporter 1. Select Start Programs GFI MailArchiver Import Tools GFI PST Exporter Management Console. 2. From the GFI PST Exporter Management Console, click General Settings node. Screenshot 47 - GFI PST Exporter: general settings 3. From the Cut-off date (UTC time) field, specify a cut-off date and time. Only emails dated prior to this date and time will be extracted. GFI MailArchiver for Exchange Manual Import and export emails 51

NOTE: If you set the date and time prior to the installation of GFI MailArchiver, the GFI PST Exporter will extract emails that have not been processed by GFI MailArchiver, avoiding duplicate emails in the archive store. 4. Specify the maximum email size in the Max exportable email size field. Emails larger than the size specified are not be exported. 5. Specify the pickup folder in the GFI MailArchiver pickup folder field where GFI PST Exporter will save the extracted emails. To import the extracted emails into a GFI MailArchiver archive store, specify the pickup folder of GFI MailArchiver Import Service. The default path of the GFI MailArchiver Import Service is: <GFI MailArchiver Installation Path>\MAIS\Pickup NOTE 1: If running GFI PST Exporter on a remote machine, do not specify mapped drives but use the full UNC path: \\server\share. NOTE 2: The import service pickup folder must have full read/write permissions. 6. From the Directory Services section select the Directory Service Type. Screenshot 48 - GFI PST Exporter: General Settings: verify query root 7. Click Verify to launch the Directory Services Verification dialog. Specify the query root or click Auto Detect to auto detect the query root. Key in a valid username for the query root specified and click Test Lookup to verify. Click OK to return to the PST Exporter General Settings. 8. Specify the name of the Microsoft Exchange server in the Microsoft Exchange Server field. 9. In the Domain, Username and Password fields, specify the credentials of a domain controller account. These credentials will be used by the GFI PST Exporter agent to process and extract emails on the end-user machine. Select the Validate on save checkbox to check the credentials specified when confirming the settings. 10. Click Save to save configuration or Revert to cancel all settings. 52 Import and export emails GFI MailArchiver for Exchange Manual

3.3.5 Step 4: Configure the Notification Settings of GFI PST Exporter After configuring the General Settings, GFI PST Exporter can be configured to send email notifications to monitor the PST processing status on end-user machines. 1. Select Start Programs GFI MailArchiver Import Tools GFI PST Exporter Management Console. 2. Select the Notification Settings Node. Screenshot 49 - GFI PST Exporter: notification settings 3. From the Mail Server Type drop down list, select SMTP. 4. Specify the Authorization Method applicable for your mail server. 5. Specify server IP address in the Mail Server Address field. 6. If the authorization method requires authentication, specify a valid username and password in the Username and Password fields. 7. Specify an email address in the From Email Address field. This is the email address shown as the sender of the notification. This address may not be an existing email address and can be dedicated for the GFI PST Exporter notifications Example: PSTexporter@mydomain.com 8. Specify the email address in the To Email Address field to which notifications will be sent. 9. Click Send Test Email to test the connection settings and send a notification test email. 10. Click Save to save the configuration. 3.3.6 Step 5: Configure Computer Groups After configuring the general and notification settings, GFI PST Exporter enables you to organize end-user machines into computer GFI MailArchiver for Exchange Manual Import and export emails 53

groups. For each computer group apply different settings and carry out PST exports separately. Computer groups can be configured by accessing the Computer Groups node from the GFI PST Exporter Management Console. Screenshot 50 - GFI PST Exporter: computer groups Adding new computer groups 1. Click the Create a new Computer Group button. Screenshot 51 - GFI PST Exporter: create a computer group 3. Specify the group name and click OK. 54 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 52 - GFI PST Exporter: computer group properties 4. From the properties dialog click General tab. 5. From the Ownership section, specify who will be the owner of extracted emails for this computer group: To assign a specific owner to all extracted emails, select the All PST s belong to email option and enter the owner email address. To assign ownership to the Microsoft Outlook email profile under which emails were extracted, select Auto detect ownership option. NOTE: Ownership of emails is important since only the specified owner will be able to browse the archived emails. 6. Specify when to send notifications from the Notify when: dropdown list. The settings configured previously in the Notification settings node are used. 7. Click the Sources tab. GFI MailArchiver for Exchange Manual Import and export emails 55

Screenshot 53 - GFI PST Exporter: computer group locations to search 8. In the Restrict to Folders section, manage the path(s) within which PST files can be processed. The conditions you specify apply to all folders and subfolders within the path. The path(s) you specify can be: Local - referring to the end-user machine where the agent is deployed Example: Include, C:\, Local path - to search all files in the local hard drive Mapped - paths that are resolved using a drive letter. UNC - in the format \\server\share Click Add to add the path to the list. 9. Click OK to add the new computer group. Editing Computer Groups To edit computer groups configurations: 1. From the GFI PST Exporter Management Console, select the computer group to edit from the Computer Groups node. 56 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 54 - GFI PST Exporter: edit computer group configuration 2. Click the Edit button to launch the Computer Group Properties dialog. 3. Apply the required changes as explained in steps 4 to 8 in the Adding new computer groups section of this manual. 4. Click OK to save changes. Computer Group Updates The GFI PST Exporter Console displays the status of each computer in a group. To configure when to update the status, select the computer group from the Computer Groups node. In the Update every: dropdown list, select the time interval when to update the status. Click Refresh now to manually update the status. 3.3.7 Step 6: Add end-user machines in computer groups After configuring computer groups, specify which end-user machines belong in each group. To add end-user machines: 1. From the GFI PST Exporter Console, click the Computer Groups node. 2. From the viewing pane, select the computer group to add end-user machines to. GFI MailArchiver for Exchange Manual Import and export emails 57

Screenshot 55 - GFI PST Exporter: add computer 3. Click Add computer button to add a computer to the group. 4. Specify the computer name or IP address (example 192.168.4.50) to add to the group and click OK. End-user machines Configure end-user machines in computer groups by right clicking on the end-user machine and select any of the following options: Remove - delete the selected end-user machine from the computer group. Move to Group - move the selected end-user machine to another computer group. 3.3.8 Step 7: Deploy the GFI PST Exporter agent to enduser machines To extract PST files from end-user machines, the GFI PST Exporter agent must be deployed remotely on the end-user machine. To deploy the agent: 1. From the GFI PST Exporter management console, select the Computer Groups node. 2. From the view pane, select the computer group. 3. Select the computer on which to deploy the agent. 58 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 56 - GFI PST Exporter: deploying the agent 4. Click Deploy button to launch the GFI PST Exporter - Deployment Manager wizard. Screenshot 57 - GFI PST Exporter: deploying the agent 5. Specify the owner of extracted emails for this computer, in the Ownership from field. Ownership options include: GFI MailArchiver for Exchange Manual Import and export emails 59

Leave unchanged - the current owner Group default - the owner specified in the computer group Force auto-detection - force the agent to detect the Microsoft Outlook email profile Force specific owner - specify the email address of the owner that will be assigned to the extracted emails. Enter the owner email address in the Forced owner email address field. Click Next to continue. Screenshot 58 - GFI PST Exporter: remote computer requirements 6. Take note of the pre-requisites required to be able to deploy and run GFI PST Exporter agent on end-user machines. Click Next to start deployment on the end-user machine. NOTE 1: During or after deployment, click the server to view the log of deployment details. NOTE 2: A window may pop-up on the end-user machine informing the user that the agent is being deployed. The window closes automatically once deployment is complete. 7. Click Close when deployment is complete. 3.3.9 Step 8: Process PST files on end-user machines After deploying the GFI PST Exporter agent on end-user machines, you can remotely trigger the agent to start processing PST files on selected machines. To start the extraction process of PST files: 1. From the GFI PST Exporter Management Console, click Computer Groups node. 2. In the view pane, select the computer(s) on which to start processing. 60 Import and export emails GFI MailArchiver for Exchange Manual

3. Click Start button to start processing the PST files on the selected computers. Screenshot 59 - GFI PST Exporter: processing at remote computer 4. The number of emails examined and the number of emails extracted is shown next to each computer. 5. To view the detailed processing status on each machine, select the computer from the navigation pane. 3.3.10 Reports and logs GFI MailArchiver for Exchange Manual Import and export emails 61

Screenshot 60 - GFI PST Exporter: export report GFI PST Exporter can display reports of extracted emails. Through the Reports node, you can view the Export Report, which displays details on processed PST files. Besides details on successful exports, any errors or warnings encountered are also displayed. Information shown includes status, group, and computer names, date, and time when processing attempts were made, and number of emails exported. To view report click Reports Node. You can also print the report or export it in HTML format. End-user machines processing details Besides the export report, you can also view details about processed PST files for each end-user machine. 1. From the GFI PST Exporter navigation pane select the Computer Groups node. 2. Expand the appropriate computer group to list all end-user machines 3. Select the end-user machine sub-node for which to display details. Screenshot 61 - GFI PST Exporter: processing logs 4. To view reports for the selected machine in the viewing pane: Click the Logs tab to view a list of export jobs. Double-click a job to view more details for that particular job. Click the PST tab to view a list of PST files that were processed. Information displayed includes PST file location, process success/failure, and number of emails exported. 62 Import and export emails GFI MailArchiver for Exchange Manual

NOTE: To re-export emails from a PST file, select a PST file and click the re-export button. Exercise caution when doing this, as it may result in duplicate emails being archived. 3.3.11 Adding imported emails to the GFI MailArchiver archive stores The extracted emails are saved in the pickup folder specified in the general settings of GFI PST Exporter. To import the exported emails into a GFI MailArchiver archive store, the exported emails must be placed into the GFI MailArchiver Import Service pickup folder by: Choosing the GFI MailArchiver Import Service pickup folder as the destination folder in the general settings of GFI PST Exporter, or If emails are already exported, manually move the emails to the pickup folder. Emails in the GFI MailArchiver Import Service pickup folder are processed as follows: Emails are placed in the queue folder so that they can be placed in the appropriate archive store. If an email in the pickup folder has a date that does not fit the date range of any of the archive stores configured or the email is corrupted, the import service will move the email to the Unclassified folder. The default paths of these folders are: Pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup Queue folder: <GFI MailArchiver Installation Path>\MAIS\Queue Unclassified folder: <GFI MailArchiver Installation Path>\MAIS \Unclassified 3.3.12 Unclassified emails The GFI MailArchiver Import Service classifies email as unclassified when the date is not within a date range of an archive folder. For each unclassified email, the GFI MailArchiver Import Service will create four files in the Unclassified folder, for example: 200903mchnname_112132568200036_[20061123173817].body 200903mchnname_112132568200036_[20061123173817].emc 200903mchnname_112132568200036_[20061123173817].eml 200903mchnname_112132568200036_[20061123173817].enve lope The first part of the file name in the Unclassified folder begins with the year and month in which the email was sent. IMPORTANT NOTE: If there are 500 or more emails in the Unclassified folder, the import process is suspended. In this case, delete any unwanted emails or import the emails to an archive folder: 1. Configure one or more archive folders to cover the dates of the emails to archive. 2. Stop the GFI MailArchiver Import Service by navigating to Start Control Panel Administrative Tools Services. GFI MailArchiver for Exchange Manual Import and export emails 63

3. Right-click GFI MailArchiver Import Service and click Stop. 4. Navigate to Unclassified folder. 5. Move all four files of the emails to import to the Queue folder. 6. Return to the services management console, right-click GFI MailArchiver Import Service and select Start. 3.4 Import emails from GFI MailArchiver 2 3.4.1 Introduction Since GFI MailArchiver and GFI MailArchiver 2 have different database schema, GFI MailArchiver cannot directly use GFI MailArchiver 2 databases. To archive emails from GFI MailArchiver 2 database, the GFI MailArchiver installation comes complete with a setup to extract emails from GFI MailArchiver 2. NOTE: The GFI MailArchiver 2 Email Export wizard can only export emails from a Microsoft SQL Server database. The process of adding email from a GFI MailArchiver 2 archive to GFI MailArchiver involves the following procedure: 1. The GFI MailArchiver 2 Email Export wizard extracts emails from a GFI MailArchiver 2 email database. 2. The GFI MailArchiver 2 Email Export tool converts the emails to raw format. 3. The GFI MailArchiver Import Service processes the extracted emails based on the date of each email. 4. GFI MailArchiver stores emails in the appropriate archive store. 5. Failed emails are placed in a separate folder for review. 64 Import and export emails GFI MailArchiver for Exchange Manual

3.4.2 Step 1: Configure the GFI MailArchiver Import Service The GFI MailArchiver Import Service is used to analyze extracted emails and stores these emails in the appropriate GFI MailArchiver archive store. NOTE 1: If importing emails to Microsoft SQL Express, ensure that the 4GB limit of the Microsoft SQL Express edition is not exceeded. The table below provides an estimate of the number of Archive Stores based on Microsoft SQL Express required by number of email users/volume. Email users Average daily emails per user 20 emails 50 emails 100 emails 20 users Yearly 6 months Quarterly 50 users 6 months Bi-monthly Monthly 100 users Quarterly Monthly - 200 users Monthly - - NOTE 2: Prior to adding data stores in the GFI MailArchiver Import Service, ensure that archive stores are first configured as described in the Setting up databases chapter of this manual. Adding a new store 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Click Add Store to launch the Add new store dialog. GFI MailArchiver for Exchange Manual Import and export emails 65

Screenshot 62 - Selecting the archive store and configuring the date range 4. From the Name drop-down list select one of the archive stores. (Only archive stores created previously in GFI MailArchiver are shown) 5. Specify a date range for this archive store by setting the From and To calendars. NOTE: Dates specified should not overlap with dates specified in other archive stores. 6. Click OK to add the new archive store. 7. To add other archive stores repeat steps 3 to 6. Screenshot 63 - Archive stores added in the configuration 8. When all the archive stores are configured, click Apply Settings and Close to save settings. Changing date range for an archive store 1. Select Start Programs GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Configure store. 4. Change the date range from the From: and To: calendars and click OK. 5. Repeat steps 3 and 4 for all archive stores that require modification. 6. Click Apply settings and Close to save and exit configuration. Removing an Import Service Archive Store 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration to load the GFI MailArchiver Import Service configuration. 66 Import and export emails GFI MailArchiver for Exchange Manual

2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Remove store. 4. Click Apply settings and Close to save and exit configuration. 3.4.3 Importing emails from a remote computer This section only applies when extracting emails from a remote machine. If importing emails from the same machine where GFI MailArchiver is installed then skip to Step 2: Run the GFI MailArchiver 2 Email Export wizard in this manual. GFI MailArchiver lets you extract GFI MailArchiver 2 databases located on remote machines. To do this: 1. From the GFI MailArchiver machine, navigate to <GFI MailArchiver installation path>\mais\ 2. Share the folder Pickup to give full read and write permissions to the remote machine from where the GFI MailArchiver 2 Email Export wizard is going to be run. To share a folder: In Windows Server 2003: a. Right-click the Pickup folder and select Sharing and Security b. Select Share this folder and click Permissions button to enter the Permissions dialog. d. Click Add. e. Enter the username of the user where the wizard is going to be run and click Check Names to confirm the user. f. Click OK to add the user in the Permissions dialog. g. In the Permissions dialog select the username added and select the Allow checkbox for Full Control. h. Click OK to save and exit the Permissions dialog. i. Click OK to save and exit the folder properties sharing dialog. In Windows Server 2008: a. Right-click Pickup folder and select Share b. Specify the credentials under which the import/export wizard will run and click Add. c. From the Permission Level drop-down list next to the added user, select Co-owner. d. Select Share and click Done. 3. Return to the path where GFI MailArchiver is installed and copy the folder MA2Export. 4. Paste the folder on the remote machine. 5. Run MA2Export.exe. 3.4.4 Step 2: Run the GFI MailArchiver 2 Email Export wizard NOTE: The GFI MailArchiver 2 Email Export wizard does not modify the old GFI MailArchiver 2 database. To extract emails from a GFI MailArchiver 2 Microsoft SQL Server database: GFI MailArchiver for Exchange Manual Import and export emails 67

1. Load the GFI MailArchiver 2 Email Export wizard by navigating to Start Programs GFI MailArchiver Import Tools GFI MailArchiver 2 Email Export. 2. In the welcome screen click Next to continue. Screenshot 64 - Specify SQL Server and authentication method to use 3. From the Server name/ip address specify the server details where the GFI MailArchiver 2 database is stored by: Selecting the Microsoft SQL Server from the list, or Typing the machine name, or Typing the IP address. 4. Under Authenticate through, select the authentication method to connect to the Microsoft SQL Server. Select Windows authentication using the currently logged on user, or Select Microsoft SQL Server Authentication and specify a username and password in the Login ID box and Password box respectively. Click Next to continue. 68 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 65 - Select the GFI MailArchiver 2 database from where to export emails 5. From the GFI MailArchiver 2 database list, select the database to export emails from. Click Next to continue. Screenshot 66 - Select a destination for the exported emails 6. Select the location where GFI MailArchiver 2 Email Export wizard shall save the exported emails. NOTE 1: To import the emails into the GFI MailArchiver archive store select the location of the GFI MailArchiver Import Service pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup. GFI MailArchiver for Exchange Manual Import and export emails 69

NOTE 2: If running the wizard on a remote machine and want to import the emails into the GFI MailArchiver archive store, specify the shared pickup folder on the GFI MailArchiver machine. Click Next to start the export process. 7. When the export process completes, click Finish to close the GFI MailArchiver 2 Email Export wizard. NOTE: The export process can take several hours to complete depending on the amount of emails stored in the GFI MailArchiver 2 database. 3.4.5 Adding imported emails to the GFI MailArchiver archive stores After running the GFI MailArchiver 2 Email Export wizard, the exported emails are stored in raw format in the destination folder specified when running the wizard. To import the exported emails into a GFI MailArchiver archive store, exported emails must be moved into the GFI MailArchiver Import Service pickup folder by: Choosing the GFI MailArchiver Import Service pickup folder as the destination folder when running the wizard, or If emails are already exported, manually move the emails to the pickup folder. Emails in the GFI MailArchiver Import Service pickup folder are processed as follows: Emails are placed in the queue folder so that they can be placed in the appropriate archive store. If an email in the pickup folder has a date that does not fit the date range of the archive stores configured, or the email is corrupted, the import service will move the email to the Unclassified folder. The default paths of these folders are: Pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup Queue folder: <GFI MailArchiver Installation Path>\MAIS\Queue Unclassified folder: <GFI MailArchiver Installation Path>\MAIS \Unclassified. 3.4.6 Unclassified emails The GFI MailArchiver Import Service classifies email as unclassified when the date is not within a date range of an archive folder. For each unclassified email, the GFI MailArchiver Import Service will create four files in the Unclassified folder, for example: 200903mchnname_112132568200036_[20061123173817].body 200903mchnname_112132568200036_[20061123173817].emc 200903mchnname_112132568200036_[20061123173817].eml 200903mchnname_112132568200036_[20061123173817].enve lope The first part of the file name in the Unclassified folder begins with the year and month in which the email was sent. IMPORTANT NOTE: If there are 500 or more emails in the Unclassified folder, the import process is suspended. In this case, 70 Import and export emails GFI MailArchiver for Exchange Manual

delete any unwanted emails or import the emails to an archive folder as follows: 1. Configure one or more archive folders to cover the dates of the emails that are required to be archived. 2. Stop the GFI MailArchiver Import Service by navigating to Start Control Panel Administrative Tools Services. 3. Right-click GFI MailArchiver Import Service and click Stop. 4. Navigate to Unclassified folder. 5. Move all four files of the emails to import to the Queue folder. 6. Return to the services management console, right-click GFI MailArchiver Import Service and select Start. 3.5 Import emails from GFI MailEssentials 3.5.1 Introduction Since GFI MailArchiver and GFI MailEssentials have different database schema, GFI MailArchiver cannot directly use GFI MailEssentials databases. To archive emails from GFI MailEssentials, the GFI MailArchiver installation comes complete with a setup to extract emails from GFI MailEssentials. NOTE 1: If importing emails to Microsoft SQL Express, ensure that the 4GB limit of the Microsoft SQL Express edition is not exceeded. The table below provides an estimate of the number of Archive Stores based on Microsoft SQL Express required by number of email users/volume. Email users Average daily emails per user 20 emails 50 emails 100 emails 20 users Yearly 6 months Quarterly 50 users 6 months Bi-monthly Monthly 100 users Quarterly Monthly - 200 users Monthly - - NOTE 2: The GFI MailEssentials Email Archive Export wizard can only extract emails from a Microsoft SQL Server database. The process of adding email from GFI MailEssentials to GFI MailArchiver involves the following procedure: GFI MailArchiver for Exchange Manual Import and export emails 71

1. The GFI MailEssentials Email Archive Export tool extracts emails from a GFI MailEssentials archive. 2. The GFI MailEssentials Email Archive Export tool converts the emails to MIME format. 3. The GFI MailArchiver Import Service processes the extracted emails based on the date of each email. 4. GFI MailArchiver stores emails in the appropriate archive store. 5. Failed emails are placed in a separate folder for review. 3.5.2 Step 1: Configure the GFI MailArchiver Import Service The GFI MailArchiver Import Service is used to analyze extracted emails and stores these emails in the appropriate GFI MailArchiver archive store. NOTE: Prior to adding data stores in the GFI MailArchiver Import Service, ensure that archive stores are first configured as described in the Setting up databases chapter of this manual. Adding a new store To add a new archive store in GFI MailArchiver Import Service, 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Click Add Store to launch the Add new store dialog. 72 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 67 - Selecting the archive store and configuring the date range 4. From the Name drop-down list select one of the archive stores. (Only archive stores created previously in GFI MailArchiver are shown) 5. Specify a date range for this archive store by setting the From and To calendars. NOTE: Dates specified should not overlap with dates specified in other archive stores. 6. Click OK to add the new archive store. 7. To add other archive stores repeat steps 3 to 6. GFI MailArchiver for Exchange Manual Import and export emails 73

Screenshot 68 - Archive stores added in the configuration 8. When all the archive stores are configured, click Apply Settings and Close to save settings. Changing date range for an archive store To change the date range of an archive store: 1. Select Start Programs GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Configure store. 4. Change the date range from the From: and To: calendars and click OK. 5. Repeat steps 3 and 4 for all archive stores that require modification. 6. Click Apply settings and Close to save and exit configuration. Removing an Import Service Archive Store To remove an Import Service Archive Store: 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Select the archive store to configure and click Remove store. 4. Click Apply settings and Close to save and exit configuration. 3.5.3 Importing emails from a remote computer This section only applies when extracting emails from a remote machine. If importing emails from the same machine where GFI MailArchiver is installed then skip to Step 2: Run the GFI MailEssentials Email Archive Export wizard. 74 Import and export emails GFI MailArchiver for Exchange Manual

GFI MailArchiver lets you extract GFI MailEssentials email archives located on remote machines. To do this: 1. From the GFI MailArchiver machine, navigate to <GFI MailArchiver installation path>\mais\ 2. Share the folder Pickup to give full read and write permissions to the remote machine from where the GFI MailEssentials Email Archive Export wizard is going to be run. To share a folder: In Windows Server 2003: a. Right-click the Pickup folder and select Sharing and Security b. Select Share this folder and click Permissions button to enter the Permissions dialog. d. Click Add. e. Enter the username of the user where the wizard is going to be run and click Check Names to confirm the user. f. Click OK to add the user in the Permissions dialog. g. In the Permissions dialog select the username added and select the Allow checkbox for Full Control. h. Click OK to save and exit the Permissions dialog. i. Click OK to save and exit the folder properties sharing dialog. In Windows Server 2008: a. Right-click Pickup folder and select Share b. Specify the credentials under which the import/export wizard will run and click Add. c. From the Permission Level drop-down list next to the added user, select Co-owner. d. Select Share and click Done. 3. Return to the path where GFI MailArchiver is installed and copy MEExport folder. 4. Paste the folder on the remote machine. 5. Run MEExport.exe. 3.5.4 Step 2: Run the GFI MailEssentials Email Archive Export wizard NOTE: The GFI MailEssentials Email Archive Export wizard does not modify the old GFI MailEssentials email archive database. To extract emails from a GFI MailEssentials email archive on an SQL server: 1. Launch the GFI MailEssentials Email Archive Export wizard by navigating to Start Programs GFI MailArchiver Import Tools GFI MailEssentials Email Archive Export. 2. From the welcome screen, click Next to proceed. GFI MailArchiver for Exchange Manual Import and export emails 75

Screenshot 69 - Specify SQL Server and authentication method to use 3. From the Server name/ip address, specify the server details where the GFI MailArchiver 2 database is stored by: Selecting the Microsoft SQL Server, or Typing the machine name, or Typing the IP address. 4. Under Authenticate through, select the authentication method to connect to the Microsoft SQL Server. Select Windows authentication using the currently logged on user, or Select Microsoft SQL Server Authentication and specify a username and password in the Login ID box and Password box respectively. Click Next to continue. 76 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 70 - Select the email archive database from where to export emails 5. From the GFI MailEssentials email archive database list, select the database to export emails from. Click Next to continue. Screenshot 71 - Select a destination for the exported emails 6. Select the location where GFI MailEssentials Email Export wizard shall save the exported emails. NOTE 1: To import the emails into the GFI MailArchiver archive store select the location of the GFI MailArchiver Import Service pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup. GFI MailArchiver for Exchange Manual Import and export emails 77

NOTE 2: To import the emails into the GFI MailArchiver archive store, when running the wizard on a remote machine, specify the shared pickup folder on the GFI MailArchiver machine. Click Next to start the export process. 7. When the export process completes, click Finish to close the GFI MailEssentials Email Export wizard. NOTE: The export process can take several hours to complete depending on the amount of emails stored in the GFI MailEssentials database. 3.5.5 Adding imported emails to the GFI MailArchiver archive stores After running the GFI MailEssentials Email Archive Export wizard, the exported emails are saved in raw format in the destination folder specified when running the wizard. To import the exported emails into a GFI MailArchiver archive store, the exported emails must be moved into the GFI MailArchiver Import Service pickup folder by either: Choosing the GFI MailArchiver Import Service pickup folder as the destination folder when running the wizard, or If emails are already exported, manually move the emails to the pickup folder. Emails in the GFI MailArchiver Import Service pickup folder are processed as follows: Emails are placed in the queue folder so that they can be archived in the appropriate archive store. If an email in the pickup folder has a date that does not fit the date range of the archive stores configured, or the email is corrupted, the import service will move the email to the Unclassified folder. The default paths of these folders are: Pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup Queue folder: <GFI MailArchiver Installation Path>\MAIS\Queue Unclassified folder: <GFI MailArchiver Installation Path>\MAIS \Unclassified 3.5.6 Unclassified emails The GFI MailArchiver Import Service classifies email as unclassified when the date is not within a date range of an archive folder. For each unclassified email, the GFI MailArchiver Import Service will create four files in the Unclassified folder, for example: 200903mchnname_112132568200036_[20061123173817].body 200903mchnname_112132568200036_[20061123173817].emc 200903mchnname_112132568200036_[20061123173817].eml 200903mchnname_112132568200036_[20061123173817].enve lope The first part of the file name in the Unclassified folder begins with the year and month in which the email was sent. IMPORTANT NOTE: If there are 500 or more emails in the Unclassified folder, the import process is suspended. In this case, 78 Import and export emails GFI MailArchiver for Exchange Manual

delete any unwanted emails or import the emails to an archive folder as follows: 1. Configure one or more archive folders to cover the dates of the emails that are required to be archived. 2. Stop the GFI MailArchiver Import Service by navigating to Start Control Panel Administrative Tools Services. 3. Right-click GFI MailArchiver Import Service and click Stop. 4. Navigate to Unclassified folder. 5. Move all four files of the emails to import to the Queue folder. 6. Return to the services management console, right-click GFI MailArchiver Import Service and select Start. 3.6 Exporting emails using the Bulk Export tool The GFI MailArchiver OneClick Restore feature enables you to restore individual emails to an email address you define. If you however want to export or restore more than one email at a time, use the GFI MailArchiver Bulk Export tool. Through this tool, you can connect to a GFI MailArchiver installation, search for emails to export and export all of the emails in one go through a: Restore to a specific email address Download to a folder on disk in.eml or.msg format Download to a PST file. The GFI MailArchiver Bulk Export tool is useful to export a set of emails that match specific search criteria, for example, to provide emails to satisfy a litigation support request. 3.6.1 Using the GFI MailArchiver Bulk Export tool 1. Select GFI MailArchiver Bulk Export from the GFI MailArchiver program group in the Start menu. GFI MailArchiver for Exchange Manual Import and export emails 79

Screenshot 72 - The GFI MailArchiver Bulk Export tool 2. In the Connect to GFI MailArchiver dialog: Specify the URL used to connect to GFI MailArchiver in the MailArchiver URL field. NOTE: A list of GFI MailArchiver URLs you successfully connected to in previous sessions is displayed. Specify the account that the GFI MailArchiver Bulk Export tool will use to authenticate with the GFI MailArchiver URL specified. To authenticate with the user account you are using to run the GFI MailArchiver Bulk Export tool, click Current User Account. To specify a particular user account for authentication, click The Following User Account, and then specify a username and password in the User Name box and Password box respectively. Click OK to connect. 80 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 73 - A new Email Search window 3.6.2 Searching for emails 1. From the Search in following archive(s) list, select the GFI MailArchiver archive stores to search in. 2. Click the Search tab and select a search field from the field list (for example Subject), and specify the criteria to look for. NOTE: The GFI MailArchiver Bulk Export tool search feature provides the same functionality as the GFI MailArchiver web based advanced search. Refer to the Advanced search section in this manual for more information. 3. Click Add Condition to add more search conditions. NOTE 1: Conditions are logically ANDed together. This means that an email must satisfy all conditions for the GFI MailArchiver Bulk Export tool to list it in the search results. Example: If you specify the following conditions: Sender is adam@external.com AND Recipient is jsmith@master-domain.com The search will only list the emails sent from adam@external.com to jsmith@master-domain.com. NOTE 2: If you have more than one search condition in the search query, you can remove a search condition by clicking the Remove Condition button. To reset the whole search query, click the New Search button and click OK in the dialog box displayed. 4. To limit your search to emails labeled with specific categorization policy labels, select them from the Filter by Label list. You can select multiple labels from the list by holding the CTRL key pressed while selecting labels. 5. Click Find Now to search. GFI MailArchiver for Exchange Manual Import and export emails 81

Screenshot 74 - GFI MailArchiver Bulk Export tool displaying the search results The GFI MailArchiver Bulk Export tool displays search results underneath the search conditions specified. For each email matching the search condition, the following information is displayed: Subject Sender Recipients Date/Time Size If search operation is taking too long, you can click Stop to interrupt the search. If more than 100 emails match the search criteria specified, the search results would be spread out across different pages each containing a maximum of 100 emails. To navigate to different pages use the navigation buttons underneath the search results table. The number of emails that match the search query is displayed in the bottom right corner of the Email Search window. 3.6.3 Viewing an email from the search results After you perform a search, you might need to review particular emails from the result set to check that they actually contain what you are looking for. Double-click on the email to view. The GFI MailArchiver Bulk Export tool will load the email in a separate window. 3.6.4 Exporting emails When you are satisfied that the emails in the search result meet the criteria you searched for, export the email using one of the following methods: Restore to a specific email address Download to a folder on disk in.eml or.msg format Download to a PST file. 82 Import and export emails GFI MailArchiver for Exchange Manual

Important notes 1. The export process exports a copy of the emails and does not remove the original emails from the archive stores. 2. By default, you can export 5000 emails at a time from the GFI MailArchiver Bulk Export tool. To remove this restriction, uncheck the Restrict Search Results option from the Search tab. WARNING: Unchecking this option is NOT recommended since it can significantly degrade server performance due to processing load. 3.6.5 Restore to a specific email address To restore all the emails returned in the search result set to a specific email address: 1. Click Export Options tab. 2. Click Restore to the following email address and specify the email address where the exported emails shall be sent. Screenshot 75 - Restore emails to a specific email address 3. Select the method used to send messages: Send messages as Original emails Send messages as Attachments. GFI MailArchiver for Exchange Manual Import and export emails 83

Screenshot 76 - Restoring emails process in progress 4. Click Restore to export emails. The GFI MailArchiver Bulk Export tool disables the Email Search window until the export process completes. To stop the export process, click Stop. 3.6.6 Download to a folder on disk 1. Select Export Options tab. Screenshot 77 - Downloading emails to a disk location 84 Import and export emails GFI MailArchiver for Exchange Manual

2. Click Download to folder and in the field specify the path where to store exported emails. You can also click Browse to select the destination visually from the Browse For Folder dialog box. 3. Select the export message format from Download messages in.eml format or Download messages in.msg format radio buttons. 4. Click Download to export emails. 3.6.7 Download to a PST file 1. Select Export Options tab. Screenshot 78 - Downloading emails to a PST file 2. Click Download to PST and in the field specify the path where to create a PST file. You can also click Browse to select the destination folder from the Browse For Folder dialog box. 3. If the Retain Folder Structure checkbox is selected, the folder structure of exported emails is saved in the PST file. In this case, specify a folder name in the Folder Name field. 4. Click Download to export emails. GFI MailArchiver for Exchange Manual Import and export emails 85

Screenshot 79 - Downloading emails process in progress The GFI MailArchiver Bulk Export tool displays the progress of the export process in the status bar of the Email Search window. The bulk export tool disables the Email Search window until the export process completes. To stop the export process, click Stop. In the destination folder selected, the GFI MailArchiver Bulk Export tool creates a new sub-folder, named GFIMArc_Export_ followed by a timestamp. You can copy this folder to another computer or to removable media such as a CD-ROM or DVD-ROM for example. The folder contains a root XML file having the same name as the folder along with one or more sub-folders. If you open the GFIMArc_Export_20060113_1519_1.xml in Microsoft Internet Explorer, it shows a table listing the emails in Folder_1 (page 1). If you export many emails, page navigation numbers are displayed in the footer of the page so that you can list the emails stored in the other sub-folders, for example, Folder_7 (page 7). 86 Import and export emails GFI MailArchiver for Exchange Manual

Screenshot 80 - Exported emails navigation page You can click the links displayed under the Filename column in the table to open and view the email. 3.6.8 Connecting to multiple GFI MailArchiver installations The GFI MailArchiver Bulk Export tool allows you to connect to the same GFI MailArchiver installation from different Email Search windows at the same time. You can also connect to different GFI MailArchiver installations at the same time. To connect and display a new Email Search window, select Connect from the File menu. In the Connect to GFI MailArchiver dialog, specify the GFI MailArchiver URL and credentials to use for authentication. Once connected, you can use the new Email Search window as outlined in the previous sections of this chapter. GFI MailArchiver for Exchange Manual Import and export emails 87

Screenshot 81 - Multiple search windows 3.6.9 Disconnecting from a GFI MailArchiver installation To disconnect from a GFI MailArchiver installation, you can either close the Email Search window or select Disconnect from the File menu. If you have multiple Email Search windows connected, and want to close them all, select Disconnect All from the File menu. 88 Import and export emails GFI MailArchiver for Exchange Manual

4 Outlook Connector The GFI MailArchiver Outlook Connector enables users to synchronize their Microsoft Outlook folders with the data archived by GFI MailArchiver. This connector can be installed via Active Directory Group Policy Objects (GPO) or via manual install. 4.1 How does the GFI MailArchiver Outlook connector work? Through the GFI MailArchiver Outlook Connector, users can access their archived messages from Microsoft Outlook. Figure 2 - How does GFI MailArchiver Outlook connector work? 1. GFI MailArchiver Outlook connector (installed on client machine) initiates a request to synchronize Microsoft Office outlook folders with GFI MailArchiver. 2. GFI MailArchiver retrieves the required email and folder data from the GFI MailArchiver archive store. 3. GFI MailArchiver sends the email data to the Microsoft Office Outlook client machines. 4.2 Downloading GFI MailArchiver Outlook Connector The GFI MailArchiver Outlook Connector can be downloaded from the GFI MailArchiver web interface. 1. Click Outlook Connector node. 2. Select Click here to download link to download GFI MailArchiver Outlook Connector. NOTE: You can make the Outlook Connector node visible only to Administrators or to both Users and Administrators by selecting the Administrators Only or Users and Administrators options respectively. GFI MailArchiver for Exchange Manual Outlook Connector 89

4.3 System Requirements 4.3.1 Software Supported Microsoft Outlook Versions Microsoft Outlook 2003 (including Service Packs 1, 2, 3 or 4) Microsoft Outlook 2007 (including Service Packs 1 or 2) Microsoft Outlook 2010 (x86 and x64 versions) Supported operating systems GFI MailArchiver can be installed on: Microsoft Windows 7 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows Server 2008 Microsoft Windows Server 2003 Microsoft Windows Server 2000 NOTE 1: The machines where GFI MailArchiver Outlook Connector is deployed must be able to connect to the GFI MailArchiver server. NOTE 2: GFI MailArchiver Outlook Connector cannot be installed on the Microsoft Exchange server. NOTE 3: When using a web filtering tool, this must be configured to allow all HTTP requests between GFI MailArchiver server and GFI MailArchiver Outlook Connector. Ensure that the GFI MailArchiver server s IP address, NETBIOS name and DNS name are not blocked by the web filter. For more information, refer to: http://kbase.gfi.com/showarticle.asp?id=kbid003387. Other required components Microsoft Internet Explorer 5 or later. HTTP port 80 (or HTTPS default port 443 for secure connections) - used by GFI MailArchiver Outlook Connector to connect with GFI MailArchiver. 4.3.2 Hardware Processor 1GHz processor or more. Memory Minimum: 512MB RAM Recommended: 2GB RAM Physical Storage 20MB physical disk space required for GFI MailArchiver Outlook Connector installation. More space is required to store email headers and emails for offline access. 90 Outlook Connector GFI MailArchiver for Exchange Manual

4.4 Installing via GPO 4.4.1 Windows Server 2003 NOTE: Make sure that when deploying the 32-bit version of the GFI MailArchiver Outlook Connector, the domain policy used contains only computers with Microsoft Outlook 2010 32-bit version installed. Also ensure to use a domain policy that applies only to computers where Microsoft Outlook 2010 64-bit version is installed when deploying GFI MailArchiver 2010 64-bit edition. 1. Navigate to <Program Files\GFI\MailArchiver\Outlook> and copy: MAROC_32bitOutlook.msi (Installer for Microsoft Outlook 2010 32-bit computers only) MAROC_64bitOutlook.msi (Installer for Microsoft Outlook 2010 64-bit computers only) to a share accessible by all domains. 2. From command prompt, key in mmc.exe and click Enter to launch the Microsoft Management Console. 3. Click File Add/Remove Snap-in and click Add... 4. Select Group Policy Object Editor snap-in and click Add. 5. Click Browse and select the domain policy to edit. 6. Select the domain policy and click OK. 7. Click Finish to close Select Group Policy Object dialog. Click Close to close Add standalone Snap-in dialog and click OK to close Add/Remove Snap-in dialog; to return to the Microsoft Management Console. 8. Navigate to Console Root <domain policy> User Configuration, right-click Administrative Templates, and select Add/Remove Templates. 9. Click Add, browse for the file gfiapps.adm located in: <Program Files\GFI\MailArchiver\Outlook> and click Open. 10. Click Close to return to the Microsoft Management Console. 11. Expand Console Root <domain policy> User Configuration Administrative Templates GFI Applications. GFI MailArchiver for Exchange Manual Outlook Connector 91

Screenshot 82 - Defining the server URL of GFI MailArchiver in GPO 12. From the right pane, double click GFI MailArchiver Server Location policy and select Enabled. In the Server URL text box enter the URL where user machines can access GFI MailArchiver in the form http://<hostname>/<gfi MailArchiver virtual folder name> For example: http://win2k3entsvr.master-domain.com/mailarchiver 13. <Optional> Click Next Setting and configure the following settings. For each option select Not Configured to use the default value or click Enable to specify a custom value. GFI MailArchiver Outlook Connector Data Path Root - specify a different root location where store configurations and local emails are stored on client machines. For example type %MyDocuments% to store in the My Documents folder of the logged on user. GFI MailArchiver Outlook Connector days span - specify the number of days for which emails are synchronized. Only emails received within this time span are accessible through GFI MailArchiver Outlook Connector. GFI MailArchiver Outlook Connector download batch size - Specify how many emails can be downloaded during one synchronization session. 92 Outlook Connector GFI MailArchiver for Exchange Manual

GFI MailArchiver Outlook Connector connection timeout - Specify the timeout period in milliseconds for accessing data from the GFI MailArchiver server. GFI MailArchiver Outlook Connector maximum offline days - Specify the maximum number of days which a user can set for emails offline access. GFI MailArchiver Outlook Connector offline support - Enable or disable offline support. If offline support is enabled, specify the number of days to support offline access. If this setting is enabled: o o Users are not allowed to modify offline access GFI MailArchiver Outlook Connector maximum offline days setting is ignored. 14. Click OK when all settings are configured. 15. Select Console Root <domain policy> Computer Configuration Software Settings. 16. Right click Software installation and select New Package 17. In the Open dialog, locate the share where msi file is saved. NOTE: When selecting the location of the msi file ensure that this is done through My network locations so that the share name in GFI MailArchiver includes the full network share location rather than the local path. 18. Choose the deployment option - select Assigned and OK. 19. GFI MailArchiver Outlook Connector will be installed the next time each client machine is started. To check installation, from Microsoft Outlook, check that a new folder called GFI MailArchiver Mailbox is created. For information on how to use the GFI MailArchiver Outlook Connector, refer to the GFI MailArchiver Outlook connector manual available from: http://www.gfi.com/mar/mar6ocmanual.zip GFI MailArchiver for Exchange Manual Outlook Connector 93

4.4.2 Windows Server 2008 NOTE: Make sure that when deploying the 32-bit version of the GFI MailArchiver Outlook Connector, the domain policy used contains only computers with Microsoft Outlook 2010 32-bit version installed. Also ensure to use a domain policy that applies only to computers where Microsoft Outlook 2010 64-bit version is installed when deploying GFI MailArchiver 2010 64-bit edition. 1. Navigate to <Program Files\GFI\MailArchiver\Outlook> and copy: MAROC_32bitOutlook.msi (Installer for Microsoft Outlook 2010 32-bit computers only) MAROC_64bitOutlook.msi (Installer for Microsoft Outlook 2010 64-bit computers only) to a share accessible by all domains. 2. From command prompt, key in mmc.exe and click Enter to launch the Microsoft Management Console. 3. Click File Add/Remove Snap-in and click Add... 4. Select Group Policy Management Editor snap-in and click Add. 5. Click Browse and select the domain policy to edit. 6. Select the domain policy and click OK. 7. Click Finish to close Select Group Policy Object dialog. Click Close to close Add standalone Snap-in dialog and click OK to close Add/Remove Snap-in dialog; to return to the Microsoft Management Console. 8. Navigate to Console Root <domain policy> User Configuration Policies, right-click Administrative Templates, and select Add/Remove Templates. 9. Click Add, browse for the file gfiapps.adm located in: <Program Files\GFI\MailArchiver\Outlook> and click Open. 10. Click Close to return to the Microsoft Management Console. 11. Expand Console Root <domain policy> User Configuration Policies Administrative Templates GFI Applications. 94 Outlook Connector GFI MailArchiver for Exchange Manual

Screenshot 83 - Defining the server URL of GFI MailArchiver in GPO 12. From the right pane, double click GFI MailArchiver Server Location policy and select Enabled. In the Server URL text box enter the URL where user machines can access GFI MailArchiver in the form http://<hostname>/<gfi MailArchiver virtual folder name> For example: http://win2k3entsvr.master-domain.com/mailarchiver 13. <Optional> Click Next Setting and configure the following settings. For each option select Not Configured to use the default value or click Enable to specify a custom value. GFI MailArchiver Outlook Connector Data Path Root - specify a different root location where store configurations and local emails are stored on client machines. For example type %MyDocuments% to store in the My Documents folder of the logged on user. GFI MailArchiver Outlook Connector days span - specify the number of days for which emails are synchronized. Only emails received within this time span are accessible through GFI MailArchiver Outlook Connector. GFI MailArchiver Outlook Connector download batch size - Specify how many emails can be downloaded during one synchronization session. GFI MailArchiver for Exchange Manual Outlook Connector 95

GFI MailArchiver Outlook Connector connection timeout - Specify the timeout period in milliseconds for accessing data from the GFI MailArchiver server. GFI MailArchiver Outlook Connector maximum offline days - Specify the maximum number of days which a user can set for emails offline access. GFI MailArchiver Outlook Connector offline support - Enable or disable offline support. If offline support is enabled, specify the number of days to support offline access. If this setting is enabled: o o Users are not allowed to modify offline access GFI MailArchiver Outlook Connector maximum offline days setting is ignored. 14. Click OK when all settings are configured. 15. Select Console Root <domain policy> Computer Configuration Policies Software Settings. 16. Right click Software installation and select New Package 17. In the Open dialog, locate the share where msi file is saved. NOTE: When selecting the location of the msi file ensure that this is done through My network locations so that the share name in GFI MailArchiver includes the full network share location rather than the local path. 18. Choose the deployment option - select Assigned and OK. 19. GFI MailArchiver Outlook Connector will be installed the next time each client machine is started. To check installation, from Microsoft Outlook, check that a new folder called GFI MailArchiver Mailbox is created. For information on how to use the GFI MailArchiver Outlook Connector, refer to the GFI MailArchiver Outlook connector manual available from: http://www.gfi.com/mar/mar6ocmanual.pdf 4.5 Installing without GPO - Manual install 1. Copy: MAROC_32bitOutlook.exe (Installer for Microsoft Outlook 2010 32-bit computers only) MAROC_64bitOutlook.exe (Installer for Microsoft Outlook 2010 64-bit computers only) located in <Program Files\GFI\MailArchiver\Outlook> to the client machines on which you would like to install the GFI MailArchiver Outlook Connector. 2. Double click on the file and follow the wizard to install To check installation, from Microsoft Outlook, check that a new folder called GFI MailArchiver Mailbox is created. 3. <Optional>: Add the Outlook connector administrator template that will set up Outlook connector. From command prompt, key in mmc.exe and click Enter to launch the Microsoft Management Console. 96 Outlook Connector GFI MailArchiver for Exchange Manual

Click File Add/Remove Snap-in and click Add... Select Group Policy Object Editor snap-in and click Add. Click Browse and select the domain policy to edit. Select the domain policy and click OK. NOTE: Make sure that when deploying the 32-bit version of the GFI MailArchiver Outlook Connector, the domain policy used contains only computers with Microsoft Outlook 2010 32-bit version installed. Also ensure to use a domain policy that applies only to computers where Microsoft Outlook 2010 64-bit version is installed when deploying GFI MailArchiver 2010 64-bit edition. Click Finish to close Select Group Policy Object dialog. Click Close to close Add standalone Snap-in dialog and click OK to close Add/Remove Snap-in dialog; to return to the Microsoft Management Console. Navigate to Console Root <domain policy> User Configuration, right-click Administrative Templates, and select Add/Remove Templates. Click Add, browse for the file gfiapps.adm located in: <Program Files\GFI\MailArchiver\Outlook> and click Open. Click Close to return to the Microsoft Management Console. For information on how to use the GFI MailArchiver Outlook Connector, refer to the GFI MailArchiver Outlook connector manual available from: http://www.gfi.com/mar/mar6ocmanual.zip GFI MailArchiver for Exchange Manual Outlook Connector 97

5 Archives and database infrastructure 5.1 Configuring which emails to archive By default, GFI MailArchiver archives all emails sent or received by all mail users. If all emails need to be archived then no configuration is required. To configure which emails to archive and the mailboxes to include or exclude for email archiving: 1. From the GFI MailArchiver management console, select Configuration Archiving and User Exclude Options. 2. Under Archiving Options, unselect any emails that you do not want to archive (inbound, outbound or internal). 3. Under User Exclude or Include Options, select Enable Archiving Restriction to configure which users to exclude or include in email archiving. 4. Select one of the following options: Exclusion list Do NOT archive email at all if ANY of the recipients or senders are in the list below Always archive email but users in the list below will not be able to view it Inclusion list Always archive email if ANY of the recipients or senders are in the list below Only archive email if all recipients and senders are in the list below NOTE: For licensing purposes, the number of users in the Exclusion and Inclusion list are used to count the number of GFI MailArchiver licensed users. This is applicable only when the list contains Users and not email addresses. When using an Exclusion list, GFI MailArchiver counts the number of Active Directory mail-enabled users, less the ones in the Exclusion list for licensing purposes. When using an Inclusion list, GFI MailArchiver licenses the number of Active Directory mail-enabled users in the Inclusion list for licensing purposes. When one or more email addresses are added to the list, GFI MailArchiver counts the number of Active Directory mail-enabled users for licensing purposes. 5. Add users to whom the selected restriction shall apply in the list. 6. Click Save Settings to save archiving and user exclude options. GFI MailArchiver for Exchange Manual Archives and database infrastructure 99

5.2 Setting up the mail servers to archive This section will show you how to add the Microsoft Exchange servers from where GFI MailArchiver will collect and archive emails. GFI MailArchiver can collect and archive emails from more than one Microsoft Exchange Server. To collect and archive emails from multiple mail servers simultaneously, you can add the mail servers from the Mail Servers to Archive node. Screenshot 84 - Mail Server to Archive 5.2.1 Adding a Microsoft Exchange mail server Important notes 1. The Exchange Server from which to archive emails must have journaling turned on and have a mailbox configured as the journaling mailbox. Refer to the Getting Started Guide for detailed instructions on how to enable journaling: http://www.gfi.com/mar/mar6gsgmanual.zip Adding a Microsoft Exchange mail server instructions 1. Click Configuration Mail Servers to Archive node. 2. Click Add Mail Server. 100 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 85 - Mail Server Wizard 3. Select whether to archive a local or remote Microsoft Exchange server and click Next. Screenshot 86 - List of journaling mailboxes 4. GFI MailArchiver automatically displays all journaling mailboxes if it is installed on the same machine as Microsoft Exchange server. GFI MailArchiver for Exchange Manual Archives and database infrastructure 101

Select the journaling mailbox from where to collect and archive email and click Next. Screenshot 87 - Selecting a Microsoft Exchange provider 5. Select the provider used in connecting to the journaling mailbox: ExOLEDB - Recommended if GFI MailArchiver is installed on the same machine as Microsoft Exchange Server 2000, 2003 or 2007. IMAP - Recommended if GFI MailArchiver is not installed on the same machine as Microsoft Exchange 2000, 2003 or 2007. Key in the following: o o o o o Server - IP address or server name of remote Microsoft Exchange server. <Optional> IMAP Port - Automatically populated with the default IMAP port value of 143. If you connect IMAP through another port number, key it in the IMAP Port box. <Optional> SSL - Choose this option if you are using IMAP through SSL. Journal Login and Password - Key in the login name and password for the journaling mailbox to access. Mailbox\Folder - Key in the name of the root folder in the mailbox, (usually INBOX), or the full path to the public folder (for example, Public Folders/JournalFolder), that is being used for journaling on the Microsoft Exchange Server. NOTE: Using public folders is not recommended since these do not archive all types of reports. Exchange Web Services - Recommended for Microsoft Exchange 2007 SP1 or 2010 mail servers. Key in: 102 Archives and database infrastructure GFI MailArchiver for Exchange Manual

o o Journal Login and Password - Key in the login name and password for the journaling mailbox to access. Mailbox\Folder - Key in the name of the root folder in the mailbox, (usually INBOX), or the full path to the public folder (for example, Public Folders/JournalFolder), used for journaling on the Microsoft Exchange Server. 6. Click Next to continue. 7. The Mail Server Wizard will try to connect to the mail server selected through the provider and settings configured. If the connection to the mail server succeeds, click Next to continue. NOTE: If connection fails, check values and credentials keyed in and retry. 8. The wizard displays a summary of the settings configured. Click Finish to close wizard. Screenshot 88 - Mail server added in the list of mail servers 9. The mail server is added to the list of mail servers. Click Save Settings to finalize setup. 5.3 Re-configuring a mail server When re-configuring a Microsoft Exchange mail server, you cannot modify all the settings. For example, you cannot change the journaling mailbox from where to collect and archive emails. 1. Select Configuration Mail Servers to Archive node. 2. Click the button to the right of the mail server to re-configure, to display the Mail Server Wizard. 3. Modify the required settings and when finished close the wizard, click Save Settings. 5.4 Removing a mail server 1. Click Configuration Mail Servers to Archive node. 2. Click button to the right of the mail server to remove. 3. Click Save Settings. 5.4.1 Disable/Enable email collection from a mail server To disable/enable email collection and archiving from a mail server: (e.g. for maintenance purposes): GFI MailArchiver for Exchange Manual Archives and database infrastructure 103

1. Click Configuration Mail Servers to Archive node. 2. Click button to the right of the mail server. 3. On the first page of the wizard, uncheck or check the Archive emails from this server option to disable/enable email collection and archiving from the mail server. 4. Click Finish to close wizard. 5. Click Save Settings. 5.5 Setting up databases As an archiving solution, GFI MailArchiver is highly dependent on your database infrastructure setup for high performance in terms of data archival and retrieval. GFI MailArchiver supports 2 different database types: GFI MailArchiver (Firebird) format Microsoft SQL Server 5.5.1 Choosing your database backend GFI MailArchiver can be configured to run in various hardware setups and combinations. The table below shows the typical recommended configurations. These guidelines and configurations may vary according to user activity and daily email flow. Seats Outlook Connector + Folder Sync MS Exchange Firebird MS SQL Local Remote Local Remote <50 51-100 101-150 150-200 200+ Examples Example 1: Network with 51-100 seats and with GFI Outlook Connector and user mailbox folder synchronization: GFI MailArchiver installation location should be on a different server than Microsoft Exchange Server. Firebird database used as database. Example 2: 104 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Network with 101-150 sears without GFI Outlook Connector and user mailbox folder synchronization: Install GFI MailArchiver on the same server as Microsoft Exchange and Firebird database. Example 3: Network with over 200 seats: Install GFI on a different server other than Microsoft Exchange and Microsoft SQL Server. Do not use Firebird database NOTE 1: 200+ seats does not mean that if the you have 1000 seats, the same configuration can be used. In this context, 200+ can be understood as 200-500. It is however always important to consider distributed deployment in cases of high email flow. 5.5.2 Configuring the Firebird database GFI MailArchiver ships with a Firebird database. This database should meet the needs of organizations with fewer email users and an average volume of emails. NOTE: Ensure that the size of each Firebird database never exceeds 2GB. To minimize any potential performance issues, the following setup is strongly recommended when using the Firebird database: Physical HDD 1: Operating System and GFI MailArchiver installation. Physical HDD 2: Firebird database data store. Physical HDD 3: Mail database indexes. The above setup reduces data read/write operations on the same physical hard disk drive to improve performance. Important note: Failing to follow the above recommendations may result in substantial performance degradation. 5.5.3 Configuring the Microsoft SQL Server Setting up a Microsoft SQL server is recommended for larger organizations with a substantial volume of emails to archive. The recommended setup for GFI MailArchiver using a Microsoft SQL Server 2000/2005/2008 database is as follows: Physical HDD 1: Operating System and GFI MailArchiver installation. Physical HDD 2: Microsoft SQLServer data file (.mdf). Physical HDD 3: Microsoft SQL Server log file (.ldf) Physical HDD 4: Mail database indexes. This configuration ensures that different processes are distributed to distinct physical hard disk drives. This eliminates performance loss due to excessive data read/write operations on the same physical hard disk drive. GFI MailArchiver for Exchange Manual Archives and database infrastructure 105

Using Microsoft SQL Express GFI MailArchiver can be used together with Microsoft SQL Express as a lower cost alternative to the full version Microsoft SQL Server. There are however a number of Microsoft SQL Server limitations to consider: Database size can be up to 4GB. It uses 1 CPU only. It uses a maximum of 1GB RAM. It is therefore highly recommended that: 1. Use MS SQL and file system as the backend database. This method uses Microsoft SQL Express as the backend database and a separate location (not a database) for the binary sources files. This saves up on the Microsoft SQL Express space required for archiving. 2. Enable the Use a new archive store when it is full feature within Archive Store Management. This instructs GFI MailArchiver to automatically switch to a new database when the 4GB limit of Microsoft SQL Express is reached. This feature requires that Archive Stores are based on SQL and Filesystem. 3. Monitor database growth on a periodical basis to gain an estimate of how long it will take the SQL Express database to reach its 4 GB limit. Using this estimate create enough databases and Archive stores to cater for your requirements. Important Notes for all Microsoft SQL installations 1. Configure any Microsoft SQL Server to use Mixed Authentication mode for use with GFI MailArchiver. To achieve this: From the Enterprise Manager, right-click on the SQL Server node Properties. Access Security tab and select SQL Server and Windows under Authentication. Save settings. 2. After the first month of archiving, note the database data file size. With this value, estimate the archive database size after six months, for example. If you estimate that your archive database will be larger than 20 GB, you should consider configuring the archive stores management feature of GFI MailArchiver. 5.6 Configuring Archive Stores When GFI MailArchiver archives an email, it stores the following information: Email source in compressed format. This is stored either on disk or in the database. Metadata related to the email. This is always stored in a database. Search index entries updated with email data. The search index is always stored on disk. Within GFI MailArchiver, this data is referred to as an Archive Store. GFI MailArchiver supports three types of archive stores: 106 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Microsoft SQL Server archive store - The email source and metadata is stored in the database. The search index is stored on disk (NTFS). Microsoft SQL Server and (NTFS) file system archive store - The email metadata is stored in the database. The email source and search index are stored on disk (NTFS). GFI MailArchiver database and (NTFS) file system - The email metadata is stored in a Firebird database. The email source and search index are stored on disk (NTFS). By default, GFI MailArchiver creates an archive store based on Firebird and (NTFS) file system and configures GFI MailArchiver to archive emails into it. 5.6.1 Which type of archive store shall I use? Follow the guidelines below when deciding on the type of archive store to use: The GFI MailArchiver database and file system option is recommended for small to medium sized organizations with a low to average volume of emails. Larger organizations should utilize a Microsoft SQL based solution. The Microsoft SQL Server and file system option is recommended for greater flexibility in terms of disk management and space availability. This solution enables the email source to be located on a NAS or SAN different from where the Microsoft SQL server is installed. The Microsoft SQL Server archive store option is recommended for organizations require auditing on their archive stores in terms of database or user activity. This option is the only one that enables this type of auditing. NOTE: For more information on Auditing, refer to the Database activity auditing chapter in this manual. 5.6.2 Configuring an archive store based on Microsoft SQL Server In this type of archive store, archived email metadata and the compressed email binary source are stored in the Microsoft SQL Server database. The search index is stored on disk (NTFS). To configure an archive store based on Microsoft SQL Server: 1. Select Configuration Archive Stores and click Add Archive Store. 2. Key in a name for the new archive store in the Archive Store Name field. NOTE: For ease of use, provide a descriptive name for the new archive store (for example, Jan - Mar 2009 ). This makes it easier to manage the archive stores and helps users select the correct archive store to browse and search through. 3. Select/Unselect the following options: GFI MailArchiver for Exchange Manual Archives and database infrastructure 107

Allow users to browse and search this archive store - Grants network users the ability to browse and search through archived emails in the store. Do not allow further archiving into this archive store - Stops GFI MailArchiver from archiving any further emails in this store. NOTE: This option is useful to attach a Microsoft SQL Server database that contains archived emails for browsing and searching, but do not want to archive further data into the database. Do NOT enable this option for new archive stores. Click Next to continue. Screenshot 89 - Archive Store Wizard 4. Click Microsoft SQL Server database and click Next. 108 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 90 - Select Microsoft SQL Server and authentication method 5. From the Microsoft SQL Server field perform any of the following actions: OR Select the Microsoft SQL Server to store the email data. Key in the IP address or server name of the server hosting the Microsoft SQL server if the Microsoft SQL Server to use is not detected and listed automatically by the wizard. To connect a Microsoft SQL Server on an alternate port, key in port number in the Microsoft SQL Server box using the following format: SQLServerMachineName, PortNumber 6. Select the authentication method to use: Windows Authentication - Uses the credentials of the account displayed in parenthesis next to the option. Microsoft SQL Server Authentication - Key in login name and password. NOTE 1: Ensure that the account used to log on has administrative privileges or is set as the database owner, dbo, on the database. NOTE 2: Credentials are not stored by GFI MailArchiver and are only used to connect and create the necessary schema in the backend database. Click Next to continue. GFI MailArchiver for Exchange Manual Archives and database infrastructure 109

Screenshot 91 - Selecting the Microsoft SQL Server database 7. Select the database to use and click Next. The wizard will connect to the selected database to create and verify the database schema required by GFI MailArchiver. On completion, it displays Database verification successful. Click Next to continue. NOTE: In case this fails, check values and credentials keyed in and retry. 110 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 92 - Specifying the Archiving and Search /Browsing accounts 8. For security purposes, GFI MailArchiver automatically creates two archiving roles: db_marc_archive - used exclusively for archiving (requires write access). db_marc_browse - used exclusively for browsing (requires read only access). Key in a login name and password for both archiving role and browsing role. Also, review the following options: Use the same credentials specified for the archiving role - For added security, it is recommended using different accounts for archiving and browsing. Do NOT enable this option to use different accounts. Create the login accounts specified automatically if they do not exist - For added security it is recommended to specify nonexistent accounts (for both archiving and browsing roles) so that these are created automatically with the correct database roles assigned. Do NOT enable this option to create accounts automatically. Click Next to continue setup. 9. The wizard will connect to the database, create the specified accounts, and assign the respective role. On completion, it displays User creation successful. Click Next to continue. Screenshot 93 - Specifying where to store the search index 10. To speed up search requests GFI MailArchiver creates a search index based on the content of the emails archived. This is stored on disk (NTFS). GFI MailArchiver for Exchange Manual Archives and database infrastructure 111

Key in or select the full path where to store the search index for this archive store. Ensure that the search index is located on a disk with ample free space available since it can consume a lot of disk space. The search index uses more disk space as additional emails get stored in the archive store. NOTE: For best performance, locate the search index on a separate physical drive than where: Microsoft Exchange Server is installed GFI MailArchiver is installed Microsoft SQL Server database is located. Click Next to continue. 11. A summary of the settings is displayed. Review settings and click Finish to complete wizard. Screenshot 94 - New archive store saved in configuration 12. The Archive Stores page lists the newly created archive store. Click Save Settings to save the archive store in the configuration. 5.6.3 Configuring an archive store based on Microsoft SQL Server and file system In this type of archive store, archived email metadata is stored in the Microsoft SQL Server database, while the archived email binary source is stored in compressed format on disk (NTFS). The search index stored on disk (NTFS). To configure an archive store based on Microsoft SQL Server and file system: 1. Select Configuration Archive Stores and click Add Archive Store. 2. Key in a name for the new archive store in the Archive Store Name field. NOTE: For the sake of ease of use, provide a descriptive name for the new archive store (for example, Jan - Mar 2009 ). This makes it easier to manage the archive stores and helps users select the correct archive store to browse and search through. 3. Select/Unselect the following options: 112 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Allow users to browse and search this archive store - Grants network users the ability to browse and search through archived emails in the store. Do not allow further archiving into this archive store - Stops GFI MailArchiver from archiving any further emails in this store. NOTE: This option is useful to attach a Microsoft SQL Server database that contains archived emails for browsing and searching, but do not want to archive further data into the database. Do NOT enable this option for new archive stores. Click Next to continue. Screenshot 95 - Select Microsoft SQL Server database and file system 4. Click Microsoft SQL Server database and file system and click Next. GFI MailArchiver for Exchange Manual Archives and database infrastructure 113

Screenshot 96 - Select Microsoft SQL Server and authentication method 5. From the Microsoft SQL Server field perform any of the following actions: OR Select the Microsoft SQL Server to store the email data. Key in the IP address or server name of the server hosting the Microsoft SQL server if the Microsoft SQL Server to use is not detected and listed automatically by the wizard. To connect a Microsoft SQL Server on an alternate port, key in port number in the Microsoft SQL Server box using the following format: SQLServerMachineName, PortNumber 6. Select the authentication method to use: Windows Authentication - Uses the credentials of the account displayed in parenthesis next to the option. Microsoft SQL Server Authentication - Key in the login name and password. NOTE 1: Ensure that the account used to log on has administrative privileges or is set as the database owner, dbo, on the database. NOTE 2: Credentials are not stored by GFI MailArchiver and are only used to connect and create the necessary schema in the backend database. Click Next to continue. 114 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 97 - Selecting the Microsoft SQL Server database 7. Select the database to use and click Next. The wizard will connect to the selected database to create and verify the database schema required by GFI MailArchiver. On completion, it displays Database verification successful. Click Next to continue. NOTE: In case this fails, check values and credentials keyed in and retry. GFI MailArchiver for Exchange Manual Archives and database infrastructure 115

Screenshot 98 - Specifying the path for the archived emails binary source storage location 8. In the Full path to original emails storage location field specify the full path where to store the archived emails compressed binary source. You can also specify a UNC path where to store the archived email compressed binary source. GFI MailArchiver will use the local system account for authentication. If the local system account does not have the necessary permissions, select the Use the following login and password to access the above UNC path check box and provide a login name and password. NOTE: Locate the archived emails compressed binary source on a disk with ample free space available. Disk space required depends on multiple factors such as, Total number of emails archived/year, Average number of attachments/email, Type of attachments. Example: compressed images, such as jpeg, do not compress much, but text and Microsoft Word documents compress to a much smaller file size. Click Next to continue. 9. The wizard will connect to the selected database and create/verify the database schema. On completion, it displays Database verification successful. Click Next to continue. NOTE: In case this fails, check values and credentials keyed in and retry. Screenshot 99 - Specifying the Archiving and Search /Browsing accounts 116 Archives and database infrastructure GFI MailArchiver for Exchange Manual

10. For security purposes, GFI MailArchiver automatically creates two archiving roles: db_marc_archive - used exclusively for archiving (requires write access) db_marc_browse - used exclusively for browsing (requires read only access). Key in a login name and a password for both archiving role and browsing role. Also, review the following options: Use the same credentials specified for the archiving role - For added security, it is recommended to use different accounts for archiving and browsing. Do NOT enable this option to use different accounts. Create the login accounts specified automatically if they do not exist - For added security it is recommended to specify nonexistent accounts (for both archiving and browsing roles) so that these are created automatically with the correct database roles assigned. Do NOT enable this option to create accounts automatically. Click Next to continue setup. 11. The wizard will connect to the database, create the specified accounts, and assign the respective role. On completion, it displays User creation successful. Click Next to continue. Screenshot 100 - Specifying where to store the search index 12. To speed up search requests GFI MailArchiver creates a search index based on the content of the emails archived. This is stored on disk (NTFS). GFI MailArchiver for Exchange Manual Archives and database infrastructure 117

Key in or select the full path where to store the search index for this archive store. Ensure that the search index is located on a disk with ample free space available, since it can consume a lot of disk space. The search index uses more disk space as additional emails get stored in the archive store. NOTE: For best performance, locate the search index on a separate physical drive than where: Microsoft Exchange Server is installed GFI MailArchiver is installed Microsoft SQL Server database is located. Click Next to continue. 13. A summary of the settings you configured is displayed. Review settings and click Finish to complete wizard. Screenshot 101 - New archive store saved in configuration 14. The Archive Stores page lists the newly created archive store. Click Save Settings to save the archive store in the configuration. 5.6.4 Configuring an archive store based on GFI MailArchiver (Firebird) database and file system To use the Firebird database as your archive store, you are not required to install Firebird on the machine. GFI MailArchiver installation installs the required Firebird support libraries. In this type of archive store, archived email metadata is stored in the GFI MailArchiver (Firebird) database, while the archived email binary source is stored in compressed format on disk (NTFS). The search index is also stored on disk (NTFS). 1. Select Configuration Archive Stores and click Add Archive Store. 2. Key in a name for the new archive store in the Archive Store Name field. NOTE: For the sake of ease of use, provide a descriptive name for the new archive store (for example, Jan - Mar 2009 ). This makes it easier to manage the archive stores and helps users select the correct archive store to browse and search through. 118 Archives and database infrastructure GFI MailArchiver for Exchange Manual

3. Select/Unselect the following options: Allow users to browse and search this archive store - Grants network users the ability to browse and search through archived emails in the store. Do not allow further archiving into this archive store - Stops GFI MailArchiver from archiving any further emails in this store. NOTE: This option is useful to attach a Microsoft SQL Server database that contains archived emails for browsing and searching, but do not want to archive further data into the database. Do NOT enable this option for new archive stores. Click Next to continue. Screenshot 102 - Archive Store Wizard 4. Click GFI MailArchiver database and file system and click Next. GFI MailArchiver for Exchange Manual Archives and database infrastructure 119

Screenshot 103 - Specify storage location for Firebird database 5. Key in or select the full path (including database file name with extension [.fdb]) where to locate the Firebird database. This should be located on a disk with ample free space available, since it utilizes more disk space as the volume of emails stored increases. NOTE: In case of a folder or file name that does not exist, this is automatically created for you. Click Next to continue. 120 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 104 - Specifying the path for the archived emails binary source storage location 6. In the Full path to original emails storage location field, specify the full path where to store the archived emails compressed binary source. You can also specify a UNC path where to store the archived email compressed binary source. GFI MailArchiver will use the local system account for authentication. If the local system account does not have the necessary permissions, select the Use the following login and password to access the above UNC path check box and provide a login name and password. NOTE: Locate the archived emails compressed binary source on a disk with ample free space available. Disk space required depends on multiple factors such as, Total number of emails archived/year, Average number of attachments/email, Type of attachments. Example: Compressed images, such as jpeg, do not compress much, but text and Microsoft Word documents compress to a much smaller file size. Click Next to continue. GFI MailArchiver for Exchange Manual Archives and database infrastructure 121

Screenshot 105 - Database schema created and verified 7. The wizard will create the specified database with the schema required by GFI MailArchiver. When the wizard completes the schema creation and verification, it displays Database verification successful. Click Next to continue. Screenshot 106 - Specifying where to store the search index 122 Archives and database infrastructure GFI MailArchiver for Exchange Manual

8. To speed up search requests GFI MailArchiver creates a search index based on the content of the emails archived. This is stored on disk (NTFS). Key in or select the full path where to store the search index for this archive store. Ensure that the search index is located on a disk with ample free space available, since it can consume a lot of disk space. The search index uses more disk space as additional emails get stored in the archive store. NOTE: For best performance, locate the search index on a separate physical drive than where: Microsoft Exchange Server is installed GFI MailArchiver is installed GFI MailArchiver (Firebird) database is located. Click Next to continue. 9. A summary of the settings you configured is displayed. Review settings and click Finish to complete wizard. Screenshot 107 - New archive store saved in configuration 10. The Archive Stores page lists the newly created archive store. Click Save Settings to save the archive store in the configuration. 5.7 Selecting an archive store where to archive emails In GFI MailArchiver, you can configure multiple archive stores, but GFI MailArchiver can store new email only to a single archive store at a time. This enables you to; for example, create separate archive stores for different time periods. To configure into which archive store to archive new emails: 1. Select Configuration Archive Stores node. GFI MailArchiver for Exchange Manual Archives and database infrastructure 123

Screenshot 108 - Selecting the active archive store 2. From the Archive in the following store list, select the archive store where to archive new emails. 3. Click Save Settings. 5.8 Configure which archive stores can be browsed and searched GFI MailArchiver gives you the ability to hide certain archive stores from the users. For example, you can hide an archive store that contains very old emails and which you do not want users to be able to browse and search. 1. Select Configuration Archive Stores node and click button to the right of the archive store to modify. 2. Check/Uncheck the Allow users to browse and search this archive store check box, to enable/disable users from browsing the archive store. 3. Select Finish to close the wizard and click Save Settings to finalize setup. GFI MailArchiver will update the archive store lists in the Browse and Search pages accordingly. 5.9 Archive stores management Through the GFI MailArchiver Archive Stores Management feature, you can set up a queue of new archive stores that GFI MailArchiver will start archiving to, according to the schedule you configure or when the database size reaches its limit. This feature enables you to: Keep the active archive store size under control; by configuring GFI MailArchiver to periodically (e.g. every quarter) start archiving emails to a new archive store. 124 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Create archive stores for each quarter or year, for example, so that you can better manage which archive stores to allow network users to browse and search. Instruct GFI MailArchiver to swap an archive store with another archive store when it is full. This enables you to use Microsoft SQL Express as an archive store back end. Important information 1. Users cannot browse and search archive stores listed in the Archive Stores Management page, even though the corresponding row under the User Browsing Allowed column is checked. The User Browsing Allowed column in the Archive Stores Management page shows whether users will be able to browse and search the archive store, once GFI MailArchiver starts archiving to it. 2. Five days before GFI MailArchiver starts archiving to the next archive store in the queue, it will test the archive store settings. GFI MailArchiver sends a notification email, to the administrator s email address you configured in the General Settings node, to inform whether the test was successful or not. If the archive store settings fail the test, the schedule is made inactive. You must then check why the first archive store in the queue failed and after you fix the problem re-activate the schedule. 3. When GFI MailArchiver starts archiving to a new archive store according to the schedule you configure, the following actions take place: GFI MailArchiver will remove the archive store from the Archive Stores Management list and move it to the Archive Stores list. GFI MailArchiver will send a notification email, to the administrator s email address you configured in the General Settings node. GFI MailArchiver will check that there are more archive stores in the queue, so that when the time comes for GFI MailArchiver to use a new archive store, one is actually available in the queue. If there are no more archive stores configured in the queue, GFI MailArchiver will inform you of this in the notification email and disable the schedule. 4. When the Use a new archive store when it is full option is selected, the only databases that will be allowed are based on Microsoft SQL Express + file system. If other databases are configured, this option will be disabled. Prerequisites 1. Create a number of archive stores as per instructions in Configuring Archive Stores section in this manual. These archive stores will then be queued by the Archive stores management feature according to the schedule to set up. 2. Before selecting the Use a new archive store when it is full option ensure that the current archive store is based on Microsoft SQL Express + file system. Follow the instructions below before selecting this option: GFI MailArchiver for Exchange Manual Archives and database infrastructure 125

Create a new archive store based on SQL Express + File System. For more information on how to create new archive store, refer to Section 5.6.3, Configuring an archive store based on Microsoft SQL Server and file system, in this manual. Change the archive store to which you are currently archiving email data to the newly created archive store. From the GFI MailArchiver Configuration Archive Stores node, select new archive store from the Archive in the following store option. Configuring archive store management To configure archive stores management: 1. Select Configuration Archive Stores Management node. NOTE: On adding archive stores to the queue, ensure to always select a new database. If you choose the same database for different archive stores in the queue, emails from different periods will be stored in same archive store. This would be confusing for both the users who search and browse the emails, as well as for administrative tasks on the archive store. Screenshot 109 - Archive stores added to the queue 2. Configure the following options: Enable the swap archive store schedule - Select this option to enable the schedule that controls when GFI MailArchiver will start archiving to the archive stores in the queue. 126 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Use a new Archive Store when it is full - Select this option to have GFI MailArchiver to start using a new Archive Store when it fills up. NOTE: This option is highly recommended for environments where Microsoft SQL Server Express is used as a database back-end. Use a new Archive Store on a specific date schedule - Select this option to have GFI MailArchiver start using a new archive store based on a configured schedule. Start schedule on - Select when the first archive store shall become active. For example: To start archiving to the first archive store in the table from the beginning of the year 2009, select January and 2009 from the list. Swap archive store every - Configure how often you want GFI MailArchiver to switch to a new archive store from the table. For example: To use a new archive store every 3 months, key in 3 in the Swap archive store every box. 3. To modify the priority of a particular archive store in the archive stores management queue, click the button or button to the left of the archive store to raise or lower the archive store priority respectively. Click Save Settings. 5.9.1 Re-configuring the schedule settings 1. Select Configuration Archive Stores Management node. 2. Modify the Start schedule on and Swap archive store every settings and click Save Settings. 5.10 Attaching a GFI MailArchiver 3 database Important notes 1. You can only attach GFI MailArchiver 3 databases based on Microsoft SQL Server. As from GFI MailArchiver 5, Microsoft Access databases are not supported any longer. 2. You can only attach a GFI MailArchiver 3 database for browsing and searching. You cannot select an attached GFI MailArchiver 3 database for further archiving, since it is set as read only. 1. Select Configuration Archive Stores node. 2. Click Attach GFI MailArchiver 3 Database. GFI MailArchiver for Exchange Manual Archives and database infrastructure 127

Screenshot 110 - Attaching a GFI MailArchiver 3 database 3. Key in a name for the archive store in the Archive Store Name field. NOTE: For the sake of ease of use, provide a descriptive name for the new archive store (for example, Jan - Mar 2009 ). This makes it easier to manage the archive stores and helps users select the correct archive store to browse and search through. 4. Select/unselect Allow users to browse and search this archive store check box to grant your network users the ability to browse and search through the archived emails. NOTE: The Do not allow further archiving into this archive store check box is selected by default and cannot be changed, since GFI MailArchiver 3 databases are set as read only. Click Next to continue. 128 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 111 - Select Microsoft SQL Server and authentication method 5. From the Microsoft SQL Server field perform any of the following actions: OR Select where the GFI MailArchiver 3 database is stored Key the IP address or server name of the Microsoft SQL Server where the GFI MailArchiver 3 database is stored. To connect to a Microsoft SQL Server on an alternate port, specify the port number in the Microsoft SQL Server box using the following format: SQLServerMachineName, PortNumber 6. Select the authentication method to use: Windows Authentication - Uses the credentials of the account displayed in parenthesis next to the option. Microsoft SQL Server Authentication - Key in the login name and password. NOTE 1: Ensure that the account used to log on has administrative privileges or is set as the database owner, dbo, on the database. NOTE 2: Credentials are not stored by GFI MailArchiver and are only used to connect and verify the schema in the GFI MailArchiver 3 database. Click Next to continue. GFI MailArchiver for Exchange Manual Archives and database infrastructure 129

Screenshot 112 - Selecting the GFI MailArchiver 3 database 7. Click on the database to attach, and click Next. 8. The wizard will connect to the selected database and verify the GFI MailArchiver 3 database schema. On completion, it displays Database verification successful. Click Next to continue. NOTE: In case this fails, check credentials keyed in and retry. Screenshot 113 - Specifying the Archiving and Search /Browsing accounts 130 Archives and database infrastructure GFI MailArchiver for Exchange Manual

9. For security purposes, GFI MailArchiver automatically creates two archiving roles: db_marc_archive - used exclusively for archiving (requires write access) db_marc_browse - used exclusively for browsing (requires read only access). Key in a login name and a password for both archiving role and browsing role. Also, review the following options: Use the same credentials specified for the archiving role - For added security, it is recommend to use different accounts for archiving and browsing. Do NOT enable this option to use different accounts. Create the login accounts specified automatically if they do not exist - For added security it is recommended to specify nonexistent accounts (for both archiving and browsing roles) so that these are created automatically with the correct database roles assigned. Do NOT enable this option to create accounts automatically. Click Next to continue setup. 10. The wizard will connect to the database to create the specified accounts and assign the respective role. When the wizard completes it displays User creation successful. Click Next to continue. Screenshot 114 - Specifying where to store the search index 11. To speed up search requests GFI MailArchiver creates a search index based on the content GFI MailArchiver 3 database. This is stored on disk (NTFS). GFI MailArchiver for Exchange Manual Archives and database infrastructure 131

Key in or select the full path where to store the search index for this archive store. Ensure that the search index is located on a disk with ample free space available, since it can consume a lot of disk space. The search index uses more disk space as additional emails get stored in the archive store. NOTE: For best performance, locate the search index on a separate physical drive than where: Microsoft Exchange Server is installed GFI MailArchiver is installed GFI MailArchiver (Firebird) database is located. Click Next to continue. 12. A summary of the settings configured is displayed. Review settings and click Finish to complete wizard. 13. The Archive Stores page lists the attached GFI MailArchiver 3 database as a new archive store. Click Save Settings to save the archive store in the configuration. Screenshot 115 - GFI MailArchiver 3 database saved in configuration 5.11 Viewing archive store statistics The Archive store statistics enables you to view archive store statistics such as: Database creation date Database size Number of archived emails. To view arc1hive stores statistics: 1. Select Configuration Archive Stores node or Configuration Archive Stores Management node, in the left navigation pane. 2. From the table, click the button to the right of the archive store of your choice. 132 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 116 - Archive Store statistics 3. Click Close in the Archive Store Statistics window when done reviewing the information displayed. 5.12 Re-configuring an archive store When re-configuring an archive store, the archive store type cannot be changed. If, for example, an archive store uses Microsoft SQL Server, this cannot changed to Firebird. All the other settings are reconfigurable. To change the settings of an archive store: 1. Click Configuration Archive Stores node or Configuration Archive Stores Management node. 2. Click button next to the archive store to re-configure and follow the instructions listed in Setting up the mail servers to archive section in this manual to reconfigure archive store. 3. On completion close the wizard and click Save Settings. 5.13 Removing an archive store Archive stores can be removed from the Archive Stores or Archive Stores Management pages. On removal, the information associated with the archive store is not deleted and the following is retained: Archived emails metadata Archived emails compressed binary sources Search index information. 1. Select Configuration Archive Stores node or Configuration Archive Stores Management node. GFI MailArchiver for Exchange Manual Archives and database infrastructure 133

2. Click the button to the right of the archive store to remove. 3. Click Save Settings. 5.14 Backup Archive Stores It is highly recommended to include the GFI MailArchiver Archive Stores in routine server backup procedures. 5.14.1 Online Backup Online backup is done using a backup application which backups Archive Stores without the need to stop the GFI MailArchiver services. For more information refer to http://kbase.gfi.com/showarticle.asp?id=kbid003184. 5.14.2 Offline Backup Offline backup can be done in environments where online backup is not possible. The GFI MailArchiver services must be temporarily stopped while backing up Archive Stores. Backup an Archive Store based on Microsoft SQL Server In this type of Archive Store, the following information is stored: Archived email metadata - Stored in the Microsoft SQL Server database. Compressed email binary source - Stored in the Microsoft SQL Server database. Search index entries - Stored on disk. To backup an Archive Store: 1. From GFI MailArchiver, navigate to Configuration Archive Stores and click to the right of the Archive Store to backup. 134 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 117 - Archive Store based on Microsoft SQL Server statistics 2. Take note of the following information for quick reference: Server Database Path to search index NOTE: Move pointer over the path to view the full path. 3. Launch the Services management console from Start Run and type services.msc. 4. Stop all GFI MailArchiver services. 5. Using the search index path determined in step 2, backup the Archive Stores search indexes, either by manually copying and pasting the search index folder or using a backup utility. GFI MailArchiver for Exchange Manual Archives and database infrastructure 135

Screenshot 118 - Backup an SQL database 6. From the Microsoft SQL Server, launch the Microsoft SQL Server Manager and backup the archive database noted in step 2. To backup a database, right-click on the database and select Tasks Back up. NOTE: A maintenance plan can be created in Microsoft SQL Server to schedule periodic backups of the archive database. 7. Return to the GFI MailArchiver server and from the Services management console, restart all GFI MailArchiver services. Backup an Archive Store based on Microsoft SQL Server and file system In this type of Archive Store, the following information is stored: Archived email metadata - Stored on the Microsoft SQL Server database. Compressed email binary source - Stored on disk. Search index entries - Stored on disk. To backup an Archive Store: 1. From GFI MailArchiver, navigate to Configuration Archive Stores and click to the right of the Archive Store to backup. 136 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 119 - Archive Store based on Microsoft SQL Server and file system statistics 2. Take note of the following information for quick reference: Server Database Path to email binary source Path to search index NOTE: Move pointer over the path to view the full path. 3. Launch the Services management console from Start Run and type services.msc. 4. Stop all GFI MailArchiver services. 5. Using the paths determined in step 2, backup the Archive Stores email binary source and search index, either by manually copying and pasting the folders or using a backup utility. GFI MailArchiver for Exchange Manual Archives and database infrastructure 137

Screenshot 120 - Backup an SQL database 6. From the Microsoft SQL Server, launch the Microsoft SQL Server Manager and backup the archive database noted in step 2. To backup a database, right-click on the database and select Tasks Back up. NOTE: A maintenance plan can be created in Microsoft SQL Server to schedule periodic backups of the archive database. 7. Return to the GFI MailArchiver server and from the Services management console, restart all GFI MailArchiver services. Backup an Archive Store based on GFI MailArchiver (Firebird) database and file system In this type of Archive Store, the following information is stored: Archived email metadata - Stored on disk. Compressed email binary source - Stored on disk. Search index entries - Stored on disk. To backup an Archive Store: 1. From GFI MailArchiver, navigate to Configuration Archive Stores and click to the right of the Archive Store to backup. 138 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Screenshot 121 - Archive Store statistics 2. Store the following paths for quick reference: Path to Firebird database Path to email binary source Path to search index NOTE: Move pointer over the path to view the full path. 3. Launch the Services management console from Start Run and type services.msc. 4. Stop all GFI MailArchiver services. 5. Using the paths determined in step 2, backup the Archive Stores database file, binary files and search indexes, either by manually copying and pasting the files in a backup location or using a backup utility. 6. From the Services management console, restart all GFI MailArchiver services. 5.14.3 Restore a backed up Archive Store Restoring an Archive Store which is added in GFI MailArchiver 1. From GFI MailArchiver, navigate to Configuration Archive Stores and click to the right of the Archive Store to replace. GFI MailArchiver for Exchange Manual Archives and database infrastructure 139

Screenshot 122 - Archive Store statistics 2. From the Archive Store Statistics dialog, note the following properties for quick reference: Type of Archive Store Archive Store Properties Microsoft SQL Server Server Microsoft SQL Server and file system Database Path to search index Server Database Path to email binary source Path to search index Firebird Database Path to Firebird database Path to email binary source Path to search index 3. Launch the Services management console from Start Run and type services.msc. 4. Stop all GFI MailArchiver services. 5. Refer to the location of files noted in step 2 to override the Archive Store files with the restored backup files as follows: Firebird database - replace the Firebird database on disk with the backed up Firebird database SQL database - from the Microsoft SQL Manager right-click the backed up database and select Tasks Restore. 140 Archives and database infrastructure GFI MailArchiver for Exchange Manual

Email binary source - replace the binary folder on disk with the backed up binary folder Search index folder - replace the Search index folder on disk with the backed up Search index folder. 6. From the Services management console, restart all GFI MailArchiver services. Restoring an Archive Store which is not added in GFI MailArchiver 1. Depending on the type of Archive Store to restore, restore the applicable backed up data as follows: Firebird database - restore the Firebird database on disk SQL database - from the Microsoft SQL Manager right-click the backed up database and select Tasks Restore. Email binary source - restore the binary folder on disk Search index folder - restore the search index folder on disk Take note of the paths where all data has been restored. 2. Add the restored Archive Store in GFI MailArchiver ensuring that all paths configured during the wizard, for example search index path or SQL database, are the paths of the restored data. Refer to chapter Configuring Archive Stores to add the restored Archive Store in GFI MailArchiver. 5.15 Managing search indexes The Search Index feature within GFI MailArchiver automatically indexes new email content archived in the corresponding archive store. This constantly updated search enables users to perform precise and fast searches. This section will show you how to configure the frequency with which GFI MailArchiver shall index new archived emails into the search indexes. You will also learn how to force a full search index rebuild, in cases where you might suspect that the search index is no longer valid. Important Notes 1. Search indexes must always reside on a local hard drive. Indexing will not be available if the index path is specified via a UNC path. 2. For best performance, locate the search index on a separate physical drive than where: Microsoft Exchange Server is installed GFI MailArchiver is installed Microsoft SQL Server/Firebird database is located. 3. List of the current search indexes associated with the archive stores are listed in: Configuration Archive Stores - Search indexes in this page have an Online status since these are active. GFI MailArchiver for Exchange Manual Archives and database infrastructure 141

Configuration Archive Stores Management - Search indexes in this page have a Standby status since these are associated with archive stores that are not yet active and therefore there are no emails in them to index. 4. Indexes are used only for searches. Users are always able to view the new archived emails through the browse feature notwithstanding the fact whether emails are indexed or not. Configuring indexing frequency 1. Click Configuration Search Index Management node. Screenshot 123 - Search Index Management 2. From Indexing Schedule select any of the following options: Index new archived emails immediately - New email content is indexed as soon as it is stored in an archive store. This guarantees the most up-to-date search index; users will be able to search for and find the latest archived emails. This index schedule can degrade performance due to the updating frequency - depending on the amount of emails archived. Index new archived emails every - Search index are updated with the latest archived emails at a fixed interval, e.g. every half an hour, every hour, every two hours. This index schedule is recommended since it strikes the right balance between update frequency and performance hit. Index new archived emails every day at - Email content is updated on a daily basis at a preset time. This option enables you to schedule indexing during off peak hours. Search for emails that archived during the last 24 hours will not be possible due to emails that are not yet indexed. 3. Click Save Settings. 142 Archives and database infrastructure GFI MailArchiver for Exchange Manual

5.15.1 Configuring the Language Analyzer Introduction Word Breaking is the decomposition of text into individual text tokens, or words. Many languages, especially those with Roman alphabets, have an array of word separators (such as white space) and punctuation that are used to discern words, phrases, and sentences. Word breakers must rely on accurate language heuristics to provide reliable and accurate results. Word breaking is more complex for character-based systems of writing or script-based alphabets, where the meaning of individual characters is determined from context. For example, in Japanese, a query that contains the term "??" ("Kyouto") does not match a document that contains "???" ("Tokyo"). The word breaker does not separate the characters in "???" ("Tokyo"), so the erroneous term "??" ("Kyouto") is not in the index. A proper "Word Breaker" is vital for the proper indexing of the most of the Asian languages (e.g. Japanese, Chinese, and Arabic) and certain dialects of other languages Important notes The GFI MailArchiver language analyzer is enabled by default. It is highly recommended that for optimal indexing performance this is not disabled. Setting up the Language Analyzer From the Language Analyzer section: Select/Unselect Enable Auto Language Analyzer to enable/disable Language Analyzer. Select a default language from the Default Language drop down list. NOTE: If the desired language is not listed in the Default Language drop down list, add the required language from the Regional settings option within the Microsoft Windows control panel. 5.15.2 Rebuilding a search index Rebuilding a search index enables you to rebuild indexes that you think are no longer returning the correct search results or became somehow corrupted. Important notes Rebuilding a search index might take several hours, depending on the amount of emails stored in the respective archive store. During an index rebuild, users will not be able to find emails in that archive store through the search feature. GFI MailArchiver for Exchange Manual Archives and database infrastructure 143

Rebuilding a search index impacts performance on the server, since this is a processor and hard disk intensive operation. It is recommended that this procedure is undertaken during off peak hours, e.g. after office hours. Rebuilding a search index 1. Click Configuration Search Index Management node. 2. Click Rebuild Index link to the right of the search index to rebuild. 3. Click Save Settings. 5.15.3 Pausing indexing Indexing can be paused and restarted through the play/pause buttons. This enables you to pause lengthy indexing operations during peak hours and continue at a time of low activity, e.g. after office hours. NOTE: Pausing an index during a merge stops users from finding emails in that archive store through the search feature. Pausing a rebuild does enable users to use the archive store. 5.15.4 Search index states The different states of a GFI MailArchiver search indexes: Initializing - this is the status when the search index is being created. An index is not expected to stay in this state for more than 10 minutes. Invalid - this indicates that the search index is most likely to be corrupt. It is recommended to rebuild the index from GFI MailArchiver Configuration Search Index Management node. Click Rebuild Index to rebuild. Merging - GFI MailArchiver maintains sub-indexes which are smaller versions of the main index. These are used to increase the performance of the search index. Sub-indexes for an archive store are merged to the main search index when a number of subindexes are created or automatically at 2:00am. Merging Paused - the merging process is manually paused from the GFI MailArchiver Configuration. The index will remain in this state until the Resume Index button is clicked. Online - the search index is online. Pending - this state shows that the search index will start rebuilding shortly. Rebuilding - this indicates that the indexer is indexing a database. The duration of rebuilding an index depends on the size of the database being indexed. Rebuilding Paused - the rebuilding process is manually paused from the GFI MailArchiver Configuration. The index will remain in this state until Resume Index button is clicked. 5.16 Upgrading the database schema All the schema of GFI MailArchiver databases can be upgraded to the latest schema using the Bulk Schema Upgrader. 144 Archives and database infrastructure GFI MailArchiver for Exchange Manual

To upgrade the GFI MailArchiver databases schema or verify that you are using the latest database schema: 1. From the GFI MailArchiver machine, navigate to <GFI MailArchiver installation path>\bulkschemaupgrader and launch BulkSchemaUpgrader.exe. Screenshot 124 - The Bulk Schema Upgrader 2. Select the databases to upgrade and click Upgrade. NOTE: When upgrading the database schema of an SQL database, when prompted enter the credentials of the System Administrator, SA user, or the database owner, dbo role. 5.17 Moving emails from one database to another As described in previous sections, GFI MailArchiver supports various types of Archive Stores where emails can be archived. The software enables you to move emails from one database to another or to many others databases. This feature is only applicable when moving the original emails source stored on disk of a Firebird database or Microsoft SQL Server file system. Emails cannot be moved from a Microsoft SQL Server database when the source is stored on the SQL database. Examples: A Firebird database becomes very large in size and hence slow to load data, so the administrator decides to switch to a Microsoft SQL Server database. An SQL file system stored on disc, stores emails of one whole year. It is recommended to separate the emails to multiple databases, for example one database for each month. Important Notes 1. It is highly recommended to backup the archive stores before moving emails. This process is described in the Backup Archive Stores chapter of this manual. 2. Moving emails between archive stores requires a high amount of computer processing resources and can reduce the performance of the GFI MailArchiver server substantially. GFI MailArchiver for Exchange Manual Archives and database infrastructure 145

3. The folder structure of emails is lost when moving emails, however the emails can be resynchronized to retrieve the folder structure. The folder structure of emails deleted from the mailbox is permanently lost. 4. Ensure that the new database where emails are going to be moved to, is added in the GFI MailArchiver Archive Stores. This process is described in the Configuring Archive Stores chapter of this manual. 5. Multiple databases can be created to cover different emails date ranges. 5.17.1 Step 1: Configure the GFI MailArchiver Import Service The GFI MailArchiver Import Service is used to analyze the source database binary files and moves these files in the appropriate archive store. Adding a new store 1. Select Start Program GFI MailArchiver Import Tools GFI MailArchiver Import Service Configuration. 2. Click Change Settings to access the archive stores. 3. Click Add Store to launch the Add new store dialog. Screenshot 125 - Selecting the archive store and configuring the date range 4. From the Name drop-down list select the archive store where emails are going to be moved to. 5. Specify the date range for this archive store by setting the From and To calendars. 146 Archives and database infrastructure GFI MailArchiver for Exchange Manual

NOTE: Dates specified should not overlap with dates specified in other archive stores. 6. Click OK to add the new archive store. 7. To add other archive stores covering different date ranges, repeat steps 3 to 6. Screenshot 126 - Archive stores added in the configuration 8. When all the archive stores are configured, click Apply Settings and Close to save settings. 5.17.2 Step 2: Remove the source Archive Stores from GFI MailArchiver Remove the source Archive Stores from GFI MailArchiver before migration to avoid corruption of data. To do this, in GFI MailArchiver navigate to Configuration Archive Stores and click the delete button next to the source database. NOTE: It is recommended to store the binary path of the source database for reference in the next step, prior to the removal of the archive store. Screenshot 127 - The binary path of an archive store GFI MailArchiver for Exchange Manual Archives and database infrastructure 147

5.17.3 Step 3: Move binary files to the GFI MailArchiver Import Service GFI MailArchiver includes a command line tool which moves all binary files of a database to the GFI MailArchiver Import Service Pickup folder. To move the binary files: 1. Launch Microsoft Windows command prompt and change the directory to <GFI MailArchiver installation path>\mais\bin. 2. Execute movebix.exe as follows: movebix.exe <source binary path> <GFI MailArchiver pickup folder> Where: Source binary path - the binary folder of the GFI MailArchiver Firebird database. GFI MailArchiver pickup folder - the folder from which GFI MailArchiver Import Service picks up emails and stores them in the appropriate archive store. The default pickup folder path is <GFI MailArchiver installation path>\mais\pickup. Example: movebix.exe c:\program Files\GFI\MailArchiver\Databases\Defa ult\binary c:\program Files\GFI\MailArchiver\MAIS\Pickup Screenshot 128 - Running movebix.exe in command prompt NOTE: Binary files can also be copied instead of moved by using copybix.exe instead of movebix.exe. 3. Repeat this command for every database to be moved. Email binary files from the source path are now moved to the GFI MailArchiver Pickup folder and will be processed by the GFI MailArchiver Import Service. 5.17.4 Moving emails to the GFI MailArchiver archive stores After moving the binary files to the GFI MailArchiver Import Service pickup folder, emails are processed as follows: Emails are placed in the queue folder so that they can be placed in the appropriate archive store. 148 Archives and database infrastructure GFI MailArchiver for Exchange Manual

If an email in the pickup folder has a date that does not fit the date range of the archive stores configured, or the email is corrupted, the import service will move the email to the Unclassified folder. The default paths of these folders are: Pickup folder: <GFI MailArchiver Installation Path>\MAIS\Pickup Queue folder: <GFI MailArchiver Installation Path>\MAIS\Queue Unclassified folder: <GFI MailArchiver Installation Path>\MAIS \Unclassified. Unclassified emails The GFI MailArchiver Import Service classifies email as unclassified when the date is not within a date range of an archive folder. For each unclassified email, the GFI MailArchiver Import Service will create four files in the Unclassified folder, for example: 200903mchnname_112132568200036_[20061123173817].bod y 200903mchnname_112132568200036_[20061123173817].emc 200903mchnname_112132568200036_[20061123173817].eml 200903mchnname_112132568200036_[20061123173817].env elope The first part of the file name in the Unclassified folder begins with the year and month in which the email was sent. IMPORTANT NOTE: If there are 500 or more emails in the Unclassified folder, the import process is suspended. In this case, delete any unwanted emails or import the emails to an archive folder as follows: 1. Configure one or more archive folders to cover the dates of the emails that are required to be archived. 2. Stop the GFI MailArchiver Import Service by navigating to Start Control Panel Administrative Tools Services. 3. Right-click GFI MailArchiver Import Service and click Stop. 4. Navigate to Unclassified folder. 5. Move all four files of the emails to import to the Queue folder. 6. Return to the services management console, right-click GFI MailArchiver Import Service and select Start. 5.17.5 Step 4: Restoring the mailbox folder structure of moved emails. When emails are moved or copied from one database to another, the mailbox folder structure is lost. The mailbox folder synchronization process needs to be restarted to import the folder structure of moved emails. NOTE 1: Resynchronizing the mailbox folder structure requires a high amount of computer processing resources and can reduce the performance of the GFI MailArchiver server substantially. NOTE 2: The folder structure of moved emails that were deleted from the Microsoft Exchange mailbox is permanently lost. GFI MailArchiver for Exchange Manual Archives and database infrastructure 149

To resynchronize the folder structure: 1. From the GFI MailArchiver server, navigate to <GFI MailArchiver installation folder>\core\umpolling\. 2. Delete all files of type.dat. 3. Navigate to Start Run and type services.msc. 4. Right-click GFI MailArchiver Core Service and select Restart. 150 Archives and database infrastructure GFI MailArchiver for Exchange Manual

6 Access control and auditing 6.1 Configuring access control By default, Active Directory (AD) users can browse and search only through their emails. In GFI MailArchiver, you can however configure: Full access group - Enables users in AD groups to browse and search through all the emails stored in all the archive stores. NOTE: Since emails may contain confidential information it is highly recommended to select members of this groups with extreme care. Group managers - Enables users that have a management or supervisory role in your organization to browse and search through the emails of all the users forming part of that AD group. User access control - Enables specific users to browse and search the emails of other users. This feature enables, for example, to grant a user access to emails of another user who no longer forms part of your company, and whose AD account was deleted. 6.1.1 Configuring the Full Access Group 1. Select Configuration Access Control node. 2. From Full Access Group, select an AD group from the Full Access Group list. Screenshot 129 - Access control page 3. Click Save Settings. GFI MailArchiver for Exchange Manual Access control and auditing 151

6.1.2 Configuring group managers 1. Select Configuration Access Control node. Screenshot 130 - Selecting an AD user from the manager list 2. From Group Managers, select an AD user from the Manager list. 3. From the Has access to Group list select the AD group that the AD user manages. The selected AD user is granted access to browse and search through the emails of all the AD users that are part of the selected AD group. 4. Click Add Manager. 5. Repeat to add more group managers to the list. 6. Click Save Settings. 6.1.3 Configuring user access control 1. Click Configuration Access Control node. 152 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 131 - Selecting an AD user from the user list 2. From User Access Control select an AD user from the User list. 3. From Has access to User list, select the AD to access. NOTE: Users which AD account is deleted, will have (Deleted) displayed next to the account name in the Has access to User list. 4. Click Add User. 5. Repeat to add more user access control entries to the list. 6. Click Save Settings. 6.1.4 Removing Managers or Users from the lists To remove AD users listed under Group Managers or User Access Control: 1. Select Configuration Access Control node. 2. Click the button to the right of the AD user to remove from list. 3. Repeat to remove more AD users. 4. Click Save Settings. 6.2 Managing Policies 6.2.1 Retention policies Retention policies enable you to control for how long to keep certain types of emails in the archive stores. These are useful to control the archive store size by deleting emails that are no longer required and to satisfy legal requirements. GFI MailArchiver for Exchange Manual Access control and auditing 153

Example: configure a retention policy that deletes emails with specific keywords or phrases in the body or subject, sent, or received from particular email addresses or domains, after 90 days. How are retention policies applied? GFI MailArchiver checks email content against any retention policies configured at the time of archiving. GFI MailArchiver first checks email against the highest priority retention policy. If the email matches the configured conditions, retention policy is associated with the email. If the email does not match the highest priority retention policy, GFI MailArchiver will check against the next retention policy configured, according to priority. This process is repeated until email either matches a configured retention policy or there are no more retention policies. In this case, GFI MailArchiver will forever store the email in the archive store since no retention policies are associated with it. Important notes 1. Retention policies created or modified after GFI MailArchiver has already stored an email in an archive store will not affect that email. This is because GFI MailArchiver checks emails against retention policies only at the time of archiving. 2. An email can match only one retention policy. Thus, the priorities you assign to the retention policies are very important. 3. Any email that matches a retention policy where the configured action is delete email immediately is discarded immediately without ever being stored in an archive store. 3. Any email that matches a retention policy where the configured action is set to delete after a number of days, is stored in an archive store. On the preconfigured time elapsing, GFI MailArchiver will then purge the email from the archive store. Creating a retention policy 1. Select Configuration Retention Policies node. 2. Click Add Retention Policy. 154 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 132 - Retention Policy Wizard 3. Key in a descriptive name for the retention policy in the Retention Policy Name box. Also, ensure that the Retention policy in effect option is selected. Click Next to continue. Screenshot 133 - Subject keywords GFI MailArchiver for Exchange Manual Access control and auditing 155

4. Configure a list of email subject keywords to which new retention policy would apply for any email which: email subject contains any of the keywords specified, and meets any other conditions configured Key in a keyword or phrase in the box to the left of the Add button, and click Add to add a keyword or phrase. Repeat to add more keywords. Select the Match whole words check box to match whole word only. Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply retention policy if box. Click Next to continue. Screenshot 134 - Body keywords 5. Configure a list of email body keywords to which new retention policy would apply, for any email which: email body contains any of the keywords specified, and meets any other conditions configured Key in a keyword or phrase in the box to the left of the Add button, and click Add to add a keyword or phrase. Repeat to add more keywords. Select the Match whole words check box to match whole word only. Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply retention policy if box. Click Next to continue. 156 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 135 - Email Sender 6. Configure a list of active directory users or senders to which new retention policy would apply for any email which: sender contains any of the active directory user or senders specified, and meets any other conditions configured. Add email senders as follows: Active Directory users - Select User from the list in-line with Add button and click Add Senders - Key in sender email address (local email or external email address) in the textbox in-line with Add button and click Add. NOTE: @ sign must always be present in sender email address specified. Wildcard characters are also supported as follows:? - matches any letters For example:???n@?aster-domain.com will match both john@master-domain.com and joan@faster-domain.com. * - matches complete words For example: *@master-domain.com Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply retention policy if box. Click Next to continue. GFI MailArchiver for Exchange Manual Access control and auditing 157

Screenshot 136 - Email recipient 7. Configure a list of active directory users or recipients to whom new retention policy would apply for any email which: recipient contains any of the active directory users or recipients specified, and meets any other conditions configured. Add email recipients as follows: Active Directory users - Select User from the list in-line with Add button and click Add Recipients - Key in recipient email address in the textbox in-line with Add button and click Add. NOTE: @ sign must always be present in recipient email address specified. Wildcard characters are also supported as follows:? - matches any letters For example:???n@?aster-domain.com will match both john@master-domain.com and joan@faster-domain.com. * - matches complete words For example: *@master-domain.com Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply retention policy if box. Click Next to continue. 158 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 137 - Retention policy action 8. Specify the action GFI MailArchiver shall take on emails that match this retention policy. Available options are: Deleted immediately - Deletes email on receipt. Emails matching this policy are not archived by GFI MailArchiver. Deleted from the archive store after - Delete emails after a specific number of days. Configure the number of days by selecting this option and typing the number of days in the Days field below. NOTE: The Delete from archive store after: option does not delete emails at the same time of when the expiry was configured but at 23:00. Example: If a policy is set on November 1 at 09:00 to delete emails from archive store after 30 days, emails are not deleted on December 1 at 09:00 but on December 1 at 23:00. Click Next to continue. 9. Review settings and conditions configured and click Finish. GFI MailArchiver for Exchange Manual Access control and auditing 159

Screenshot 138 - Saved retention policy 10. GFI MailArchiver lists new retention policy in the table. Click Save Settings. Modifying retention policies 1. Select Configuration Retention Policies node. 2. Click button to the right of the retention policy to modify. Use the instructions listed in Creating a retention policy section in this manual. 3. Click button to the right of the corresponding entry (keywords, AD users, or email addresses) to remove from any of the lists. 4. On completion, click Finish and select Save Settings. NOTE: When modifying the conditions of a retention policy, emails present in an archive store are not affected. This does not apply however to the delete actions. Example: A policy changes from delete in 60 days to delete in 90 days, the emails in the archive store that have that retention policy applied to them, will be deleted after being stored for 90 days in the archive store, instead of 60 days. Removing a retention policy 1. Select Configuration Retention Policies node. 2. Click the button to the right of the retention policy to remove. 3. Click Save Settings. NOTE: If you remove a retention policy, GFI MailArchiver will never delete the emails stored in the archive stores that had that retention policy applied to them. GFI MailArchiver checks that the retention 160 Access control and auditing GFI MailArchiver for Exchange Manual

policy associated with an email still exists before it deletes the email from the archive store. Modifying the retention policy priority Within GFI MailArchiver, emails can match only one retention policy. The priorities assigned to the retention policies are therefore very important for the correct operation of GFI MailArchiver. 1. Select Configuration Retention Policies node. 2. Rise or lower the retention policy priority by clicking or buttons to the left of the retention policy. Repeat until all the retention policies are in the required priority. 3. Click Save Settings. Creating a retention policy to match all emails A retention policy that matches all emails comes in handy in a situation where, for example, you are required to keep all financial emails for 5 years, all administrative emails for 2 years, and all sales emails for 1 year, but delete all other emails to keep the archive store size under control. Important Notes Configuring a match all emails retention policy and assigning it a wrong priority, could cause GFI MailArchiver deleting all emails from the archive stores configured. Ensure to use this feature with extreme care. Create a retention policy which matches all emails 1. Select Configuration Retention Policies node. 2. Create the required retention policies following the instructions listed in Creating a retention policy section in this manual. For Example: Financial Emails - 5 year; Administrative Emails - 2 year; Sales Emails - 1 year 3. Create another retention policy that matches all emails by specifying: * in the subject or body list, or *@* in the sender or recipient list. GFI MailArchiver for Exchange Manual Access control and auditing 161

Screenshot 139 - Match all emails warning 4. The Retention Policy Wizard will display a warning in red on the last page. 5. Modify the priorities of the retention policies as required, but always give the match all emails retention policy the lowest priority (i.e. set it as the last one in the list). Refer to the Modifying the retention policy priority section in this manual. Screenshot 140 - Match all emails retention policy scenario 162 Access control and auditing GFI MailArchiver for Exchange Manual

6. Click Save Settings. Enable / disable a retention policy 1. Select Configuration Retention Policies node, in the left navigation pane. 2. Click button to the right of the retention policy to modify. 3. Select or clear the Retention policy in effect check box, to enable/disable the retention policy respectively. 4. Click Finish to close the wizard. 5. Click Save Settings. Legal Hold The Legal Hold feature within GFI MailArchiver enables you to suspend all retention policies in effect. Use this function to have GFI MailArchiver not delete any email for the duration of, for example, legal proceedings. To use this feature: 1. Select Configuration Retention Policies node. 2. Click Hold Retention Policy / Resume Retention Policy to hold/resume retention policies. NOTE: On resuming retention policies, any emails not deleted during the duration of the hold are deleted. Spam Retention policies By default, emails marked as spam are archived with all other emails and GFI MailArchiver does not discriminate between valid emails and emails marked as SPAM by GFI MailEssentials. Within GFI MailArchiver, you can set up Spam retention policies that enable you to delete Spam immediately on archival or after a specific number of days. Creating a spam retention policy also enables users to browse emails marked as spam and to mark them as Not Spam. This causes the Spam Retention policy not to delete such emails. To create a spam retention policy: 1. Select Configuration Retention Policies node. 2. Click Add SPAM Retention Policy. 3. In the Retention Policy Wizard dialog, click Next to continue. 4. Select the Retention Policy Action: Delete immediately - Emails marked as SPAM are deleted immediately on archival NOTE: Exercise caution with this option since false positives (emails incorrectly marked as spam) are also deleted. Delete from archive store after: - Deletes emails marked as SPAM after a specific number of days. Click Next to continue. 5. Review the information in the last screen of the Retention Policy Wizard and click Finish to finalize setup. GFI MailArchiver for Exchange Manual Access control and auditing 163

6.2.2 Categorization policies Categorization policies enable you to categorize emails at the organization level, by labeling emails based on content before they are stored in the archive stores. Example: Configure a categorization policy that labels emails with the label Sales if they contain the keyword advert in the body or subject, and are sent or received by the following address, sales@master-domain.com. Categorization policies are useful when you want to limit your search to emails with a specific label. The fact that GFI MailArchiver labels the email at the organization level before archiving, guarantees that all emails that fit the conditions specified in the categorization policy have the correct label. Although GFI MailArchiver supports user level labeling of emails, relying on end users to label emails correctly is not reliable since a user might forget to label an email. In addition, if a categorization policy labels an email, all the users who have access to that particular email will be able to see the label and they can search for all the emails categorized with that label. How are categorization policies applied to emails? GFI MailArchiver checks the content of an email against any categorization policies configured at the time of archiving. If one or more categorization policies match the email content, GFI MailArchiver labels the email with the labels configured in the matching categorization policies. Important notes 1. Categorization policies created or modified after GFI MailArchiver has already stored an email in an archive store will not affect that email. This is because GFI MailArchiver checks emails against categorization policies only at the time of archiving. Creating a categorization policy 1. Select Configuration Categorization Policies node. 2. Click Add Categorization Policy. 3. In the Categorization Policy Name field, key in a descriptive name for the categorization policy. Ensure that the Categorization policy in effect check box is selected and click Next to continue. 164 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 141 - Subject keywords 4. Configure a list of subject keywords to which new categorization policy would apply for any email which: Keyword contains any of the keywords specified in the email subject, and meets any other conditions configured. Add subject keywords by keying in the keywords in the field to the left of the Add button and click Add. Repeat for all keywords to include. Select the Match whole words check box to match whole word only. Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply categorization policy if box. Click Next to continue. GFI MailArchiver for Exchange Manual Access control and auditing 165

Screenshot 142 - Body keywords 5. Configure a list of email body keywords to which new categorization policy would apply for any email which: Body text contains any of the keywords specified in the email subject, and Meets any other conditions configured. Add body keywords by keying in the keywords in the field to the left of the Add button and click Add. Repeat for all keywords to include. Select the Match whole words check box to match whole word only. Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply categorization policy if box. Click Next to continue. 166 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 143 - Email Sender 6. Configure a list of active directory users or senders to which new categorization policy would apply for any email which: sender contains any of the active directory user or senders specified, and Meets any other conditions configured. Add email senders as follows: Active Directory users - Select User from the list in-line with Add button and click Add Senders - Key in sender email address (local email or external email address) in the textbox in-line with Add button and click Add. NOTE: @ sign must always be present in sender email address specified. Wildcard characters are also supported as follows:? - matches any letters For example:???n@?aster-domain.com will match both john@master-domain.com and joan@faster-domain.com. * - matches complete words For example: *@master-domain.com Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply categorization policy if box. Click Next to continue. GFI MailArchiver for Exchange Manual Access control and auditing 167

Screenshot 144 - Email recipient 6. Configure a list of active directory users or recipients to whom new categorization policy would apply for any email which: recipients contains any of the active directory user or senders specified, and Meets any other conditions configured. Add email recipients as follows: Active Directory users - Select User from the list in-line with Add button and click Add Senders - Key in recipient email address (in the textbox in-line with Add button and click Add. NOTE: @ sign must always be present in sender email address specified. Wildcard characters are also supported as follows:? - matches any letters For example:???n@?aster-domain.com will match both john@master-domain.com and joan@faster-domain.com. * - matches complete words For example: *@master-domain.com Conditions that must be satisfied by the email for the retention policy to apply are displayed in the Apply categorization policy if box. Click Next to continue. 168 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 145 - Categorization policy action 7. Specify the label you want GFI MailArchiver to assign to the emails that match this categorization policy. Select an existing categorization label from the list or else specify a new label. Click Next to continue. 8. Review the settings and conditions configured and click Finish. Screenshot 146 - Saved categorization policy 9. GFI MailArchiver will list the new categorization policy in the table. Click Finish to finalize setup. GFI MailArchiver for Exchange Manual Access control and auditing 169

Modifying categorization policies Important notes If you re-configure the conditions of a categorization policy, emails present in an archive store are not affected. Modifying categorization policies 1. Select Configuration Categorization Policies node. 2. Click button to the right of the categorization policy to modify. Follow the instructions listed in Creating a categorization policy section in this manual. 3. Click button to the right of the corresponding entry (keywords, AD users or email addresses) to remove from any of the lists. 4. On completion, click Finish and select Save Settings. Removing a categorization policy 1. Select Configuration Categorization Policies node. 2. Click button to the right of the categorization policy to remove. 3. Click Save Settings. NOTE: If you remove a categorization policy, GFI MailArchiver will not modify the emails already stored in the archive stores. For example: If an email was labeled Sales through a categorization policy, GFI MailArchiver will not remove the Sales label if you delete the corresponding categorization policy. Enable / disable a categorization policy 1. Select Configuration Categorization Policies node. 2. From the table, click button to the right of the categorization policy to modify. 3. Check/Uncheck the Categorization policy in effect check box, to enable/disable the categorization policy respectively. 4. Click Finish to close the wizard. 5. Click Save Settings. 6.3 Configuring mailbox folder structure retrieval User mailbox structure retrieval enables users to view the folder structure set up for each individual user set up in Microsoft Exchange. When configured, the folder structure of the users mailbox is replicated in the GFI MailArchiver archive stores and can be viewed in the: Mailboxes in GFI MailArchiver user interface Folders created by GFI MailArchiver Outlook Connector. 170 Access control and auditing GFI MailArchiver for Exchange Manual

How does mailbox folder structure retrieval work? Figure 3 - User mailbox structure retrieval Retrieve mailbox folder structure for all users. Save retrieved mailbox folder structure within the GFI MailArchiver archive store. GFI MailArchiver retrieves the mailbox folder structure from archive store GFI MailArchiver displays email conversations within the retrieved archive stores to users. Important Notes 1. If emails are manually moved from Sent Items folder to another folder, this change will not be replicated in GFI MailArchiver Archive Stores if Cached Exchange Mode is enabled on the users Microsoft Outlook account settings. For more information about Cached Exchange Mode refer to the General issues section in Troubleshooting. 6.3.1 Step 1: Create a dedicated user A dedicated user is required for User mailbox structure retrieval. The procedure how to create a user in Active Directory depends on the operating system of the domain controller: GFI MailArchiver for Exchange Manual Access control and auditing 171

Microsoft Windows Server 2000/2003 Microsoft Windows Server 2008 NOTE 1: In a Microsoft Exchange 2010 environment, skip to Step 2: Grant user access to all users mailboxes. NOTE 2: The dedicated user does not require a mailbox to be attached. Microsoft Windows Server 2000/2003 1. Click Start Settings Control Panel Administrative Tools Active Directory Users and Computers. 2. Expand <Domain Name> Users node and right click Users New User. 3. Key in First name, Last name, Full name and User logon name and click Next. 4. Key in Password and Confirm password values, unselect User must change password at next logon option, select User cannot change password and select Password never expires. Click Next to continue setup. 5. Unselect Create an Exchange mailbox option and click Next. 6. Review new user details and click Finish to create new user. Proceed to Step 2: Grant user access to all users mailboxes. Microsoft Windows Server 2008 1. Click Start Run and key in cmd, and OK. 2. Key in: dsadd user <UserDN> -pwd <password> -disabled no Where: Parameter <UserDN> -pwd <Password> Example: Description Specifies the distinguished name of the user object to be added. Sets <password> value. Specifies the password to be used for the user account. If this parameter is set to *, you are prompted for a user password. dsadd user CN=masynch,CN=Users,DC=masterdomain,DC=Com -pwd Password1 -disabled no Proceed to Step 2: Grant user access to all users mailboxes. 6.3.2 Step 2: Grant user access to all users mailboxes From the Microsoft Exchange Server, grant the user created in step 1 above access to all users mailboxes. The procedure to grant access depends on the version of Microsoft Exchange Server: Microsoft Exchange 2000/2003 Microsoft Exchange 2007 (not SP1/SP2/SP3) Microsoft Exchange 2007 SP1/SP2/SP3 172 Access control and auditing GFI MailArchiver for Exchange Manual

Microsoft Exchange 2010 Microsoft Exchange 2000/2003 1. Login to the Microsoft Exchange Server 2000/2003 machine and from the Microsoft Exchange System Manager, expand Server node from the appropriate administrative group. Right click the server and click Properties. 2. Select Security tab. 3. If the user that is allowed to access all user mailboxes is added in Group or user names box, then proceed to Step 3: Assign user logon rights to the GFI MailArchiver machine. If the user that is allowed to access all user mailboxes is NOT added in Group or user names box, click Add to add the user. Screenshot 147 - Allow full control to user who has full control on all user mailboxes 4. In the permissions list, click Allow next to Full Control to grant full control permissions to the user just created. Proceed to Step 3: Assign user logon rights to the GFI MailArchiver machine. Microsoft Exchange 2007 (not SP1/SP2/SP3) 1. Open the Exchange Management Shell. GFI MailArchiver for Exchange Manual Access control and auditing 173

2. Run the following Windows PowerShell commandlet Add-ADPermission -identity Mailbox Store -User Trusted User -AccessRights GenericAll Example: Add-ADPermission -Identity Mailbox Database -User master-domain\masynch - AccessRights GenericAll Repeat the procedure described above for each mailbox store database required. Proceed to Step 3: Assign user logon rights to the GFI MailArchiver machine. Microsoft Exchange 2007 SP1/SP2/SP3 1. Open the Exchange Management Shell. 2. Run the following Windows PowerShell commandlet: foreach ($exchangeserver in Get-ExchangeServer) { } if ($exchangeserver.serverrole -match 'ClientAccess') { } Add-ADPermission -Identity $exchangeserver.distinguishedname -User 'domain\user' -ExtendedRights ms-exch-epi- Impersonation Example: foreach ($exchangeserver in Get-ExchangeServer) { } if ($exchangeserver.serverrole -match 'ClientAccess') { } Add-ADPermission -Identity $exchangeserver.distinguishedname -User 'master-domain\masynch' -ExtendedRights ms- Exch-EPI-Impersonation Repeat the procedure described above for each mailbox store database required. Proceed to Step 3: Assign user logon rights to the GFI MailArchiver machine. Microsoft Exchange 2010 1. Launch the Exchange Management Shell. 2. Key in: 174 Access control and auditing GFI MailArchiver for Exchange Manual

New-mailbox -name name -userprincipalname name@domain.com -organizationalunit users Example: New-mailbox -name masynch -userprincipalname masynch@masterdomain.com -organizationalunit users 3. Key in a password and hit Enter to create the new user. 4. Run the following PowerShell commandlet: New-ManagementScope -name "MAUMPolling" - recipientrestrictionfilter {recipienttype -eq "UserMailbox"} 5. Run the following PowerShell commandlet: New-ManagementRoleAssignment -name "MAUMPollingRA" -role:applicationimpersonation -user "masynch@domain.com" -customrecipientwritescope "MAUMpolling" Example: New-ManagementRoleAssignment -name "MAUMPollingRA" -role:applicationimpersonation - user "masynch@mydomain.com" - customrecipientwritescope "MAUMpolling" Repeat the procedure described above for each mailbox store database required. Proceed to Step 3: Assign user logon rights to the GFI MailArchiver machine. 6.3.3 Step 3: Assign user logon rights to the GFI MailArchiver machine The user dedicated to the User mailbox structure retrieval feature must have logon rights on the GFI MailArchiver machine. This procedure depends on which machine GFI MailArchiver is installed on: GFI MailArchiver installed on a domain member server GFI MailArchiver installed on the domain controller GFI MailArchiver installed on a domain member server 1. From the domain controller machine, navigate to Control Panel Administrative Tools Active Directory Users and Computers. 2. Right-click the user dedicated to the User mailbox structure retrieval and click Properties. 3. Select Account tab and click Log On To. 4. Select either All computers to allow log in to all domain member computers or select The following computers and add the GFI MailArchiver server name to allow login only to the GFI MailArchiver machine. 5. Click OK to apply changes. 6. Load command prompt and key in gpupdate to refresh the local and Active Directory-based Group Policy settings. GFI MailArchiver for Exchange Manual Access control and auditing 175

Proceed to Step 4: Configure Mailbox folder structure retrieval in GFI MailArchiver. GFI MailArchiver installed on the domain controller Windows Server 2003 1. Navigate to Control Panel Administrative Tools and select Domain Controller Security Policy. 2. Expand Local Policies and click User Rights Assignment 3. From the right pane, double click Allow log on locally 4. Click Add User or Group and key in the user configured in the GFI MailArchiver Mailbox Synchronization configuration. 5. Load command prompt and key in gpupdate to refresh the local and Active Directory-based Group Policy settings. Proceed to Step 4: Configure Mailbox folder structure retrieval in GFI MailArchiver. Windows Server 2008 1. Navigate to Start Run and type gpme.msc. 2. In Domains/OUs tab, double click Domain Controllers and launch the Default Domain Controllers Policy. 3. Navigate to Default Domain Controllers Policy Computer Configuration Policies Windows Settings Security Settings Local Policies User Rights Assignment. 4. From the right pane, double click Allow log on locally. 5. Click Add User or Group and key in the user dedicated to User folder structure retrieval. 6. Load command prompt and key in gpupdate to refresh the local and Active Directory-based Group Policy settings. Proceed to Step 4: Configure Mailbox folder structure retrieval in GFI MailArchiver. 6.3.4 Step 4: Configure Mailbox folder structure retrieval in GFI MailArchiver 1. From GFI MailArchiver, navigate to GFI MailArchiver Configuration Mailbox Folder Structure Retrieval. 2. Select Enable GFI MailArchiver to copy the mailbox folder structure checkbox. 3. Select the connection method to Microsoft Exchange: Traditional Message Application Programming Interface (MAPI): Use this option if you are using Microsoft Exchange Server 2000/2003/2007. Exchange Web Services: Use this option if you are using Microsoft Exchange 2007 SP1 and later only. 4. Key in the Login Name and Password for the user dedicated to Mailbox folder structure retrieval. NOTE: Specify login name in domain\username format. 176 Access control and auditing GFI MailArchiver for Exchange Manual

5. Click Test access to mailboxes button to text access to mailboxes. If test fails, check credentials and retest. 6. <Optional> Click Add New Policy to create a policy that excludes specific folders from being replicated. Key in policy name and click Next. Add folders to exclude and click Next. To apply new policy to selected users only, select Apply for selected users only option and key in the users to which this folder applies. Click Next and Finish to finalize the new policy setup. 7. Click Save Settings to complete setup. 6.3.5 Upgrade old Archive Stores to enable Mailbox Folder Structure Retrieval Archive Stores from GFI MailArchiver versions 4 or 5 can be upgraded to support Mailbox Folder Structure Retrieval using the Email Hash Generator wizard included with GFI MailArchiver. NOTE 1: Ensure that the database schema of the Archive Stores are upgraded using the Bulk Schema Upgrader as described in Upgrading the database schema chapter of this manual. NOTE 2: Email messages must be stored in the Microsoft Exchange Mailbox Store for the Email Hash Generator to be effective. To upgrade old archive stores using the Email Hash Generator wizard: 1. From the GFI MailArchiver machine, navigate to <GFI MailArchiver installation path>\emailhashgenerator and run HashGenerator.exe. 2. Click Next. 3. Select the type of database used and click Next. Screenshot 148 - Email Hash Generator Wizard - SQL Server GFI MailArchiver for Exchange Manual Access control and auditing 177

4. Enter the details of the database selected in the previous step: Microsoft SQL Server database - Specify the name or IP address of the server where the Microsoft SQL Server database is hosted and define the authentication credentials. GFI MailArchiver database and file system - Click Browse to select the path of the GFI MailArchiver Firebird database. 5. Click Next to start updating the database. 6.4 Database activity auditing GFI MailArchiver database activity auditing uses the tracing capabilities of Microsoft SQL Server to record all activity affecting the GFI MailArchiver archive databases. Trace data is stored in a text file in a user specified location on the Microsoft SQL Server machine. There is one trace file per server, containing trace data from all archive stores hosted on the server. The Microsoft SQL Server service holds an exclusive lock on the trace file, ensuring that the file cannot be tampered with. Through a link in the auditing section of the GFI MailArchiver Management Console, you can then trigger the process to upload trace files into the auditing database. Following the upload, you can view auditing reports through the Auditing Reports page in the console. Important note 1. GFI MailArchiver can only audit archive stores based entirely on Microsoft SQL Server. Archive stores based on any of the following systems cannot be audited: Microsoft SQL Server database and file system GFI MailArchiver (Firebird) database and file system. 6.4.1 Configuring database activity auditing 1. Select Auditing Settings node. 178 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 149 - Database Activity Auditing 2. Select edit settings button next to the Microsoft SQL Server for which to enable database auditing. Screenshot 150 - Auditing Database Wizard: list of archive stores 3. The welcome dialog lists all archive stores hosted on the specified Microsoft SQL Server. Click Next to continue. GFI MailArchiver for Exchange Manual Access control and auditing 179

Screenshot 151 - Auditing Database Wizard: authentication method 4. Select the authentication method to use to connect to the Microsoft SQL Server. If you choose the Microsoft SQL Server Authentication option, specify the administrator credentials to use. Click Next to continue. Screenshot 152 - Auditing Database Wizard: specify auditing database 5. Specify the auditing database to use, where all database activity auditing data will be stored. You can choose either to create a new 180 Access control and auditing GFI MailArchiver for Exchange Manual

auditing database or to use an existing one. In the latter case, choose the database from the list displayed. Click Next to continue. Screenshot 153 - Auditing Database Wizard: specify the SQL Server credentials 6. Specify the SQL Server credentials to assign to the auditing role. If the account you specified does not exist, you can choose to have it created automatically. Click Next to continue. NOTE: The credentials you specify here are used by GFI MailArchiver to read/write from the auditing database. The credentials specified cannot have sysadmin or database owner privileges associated with them. GFI MailArchiver for Exchange Manual Access control and auditing 181

Screenshot 154 - Auditing Database Wizard: specify whether to enable tracing 7. Specify whether to enable tracing on GFI MailArchiver archive stores. If you enable tracing, specify the path on the Microsoft SQL Server machine where the trace files will be stored. Click Next to continue. NOTE: You should lock down the location where you store the Microsoft SQL Server trace files through NTFS permissions, so that only the Microsoft SQL Server Service can access the location. This, together with the exclusive lock held by the Microsoft SQL Server service, ensures that the data in the trace files cannot be tampered with. 182 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 155 - Auditing Database Wizard: finalize configuration 8. The final wizard dialog summarizes the configuration settings you have specified. Click Finish to confirm and close the wizard. 9. Click the Save Settings button in the Auditing Settings page to save configuration. 6.4.2 Uploading trace files to the auditing database To upload trace files to the auditing database: 1. Select Auditing Settings node. 2. In the Database Activity Auditing section of the Auditing Settings page, select the Microsoft SQL Server(s) for which to upload trace files. Select the Microsoft SQL Server(s) that have the check mark symbol ( ), denoting that auditing is enabled for the server(s). To upload the trace file, click on the upload icon. 6.5 User interaction auditing Through the GFI MailArchiver user interaction-auditing feature, you can record all users activity whilst they are using the GFI MailArchiver web interface to browse email archive stores. When user interaction auditing is enabled, you can view relevant auditing reports through the Auditing Reports page in the console. Prerequisites 1. To enable user interaction auditing, first configure an auditing database in Microsoft SQL Server. Refer to Configuring database activity auditing section in this manual. GFI MailArchiver for Exchange Manual Access control and auditing 183

6.5.1 Configuring user interaction auditing To configure user interaction auditing: 1. Select Auditing Settings node. 6.6 Reports Screenshot 156 - User Interaction Auditing 2. In the User Interaction Auditing section, select the Enable user interaction auditing option. 3. Select the Microsoft SQL Server on to which interaction-auditing data will be stored, from the drop down list. 4. Click the Save Settings button for the configuration to be saved and take effect. Auditing reports are based on data generated by database activity auditing and user interaction auditing. You can view the auditing reports from within the GFI MailArchiver management console. 184 Access control and auditing GFI MailArchiver for Exchange Manual

Screenshot 157 - Auditing reports Database activity auditing reports: o Configuration Management o Access Control o Data Integrity o Bulk Import o Retention Policy o Data Leakage Prevention User interaction auditing report: o User Audit Trail Accessing Reports 1. Select Auditing Reports node and select the desired report from the Auditing Reports page. 2. Perform the following actions: Sort and filter reports: click the sorting and filtering button, located at the top of each report page. Print reports: click on the print report button, located at the top of each report page. NOTE: Bulk Import and Retention Policy auditing reports are located under the data handling auditing reports category. To access these reports, select Auditing Reports Data Handling Reports. GFI MailArchiver for Exchange Manual Access control and auditing 185

6.6.1 Configuration management auditing report Screenshot 158 - Configuration management auditing report Use this report to list all the configuration changes made in GFI MailArchiver. Information displayed includes: User who made the changes Changes effected Clicking on any configuration change in the list will bring up a window with further detailed information. 6.6.2 Access control auditing report Screenshot 159 - Access control auditing report 186 Access control and auditing GFI MailArchiver for Exchange Manual

Use this report to list all the changes made to the access control configuration of GFI MailArchiver. Information displayed includes: User who made the changes The user affected by the change What permissions were changed 6.6.3 Data integrity auditing report Screenshot 160 - Data integrity auditing report Use this report to list all the changes made to the GFI MailArchiver archive stores and auditing databases, which were not carried out through the GFI MailArchiver services. Information displayed includes: Event type Microsoft SQL server and database affected Database user affected Action taken Machine from which action originated. The following report options are available: To view trace data for a specific Microsoft SQL Server, click on the Select Microsoft SQL Server button, located at the top of the report page, and select the server from the drop-down list. To group the list by event type, click on the Group by event type button, located at the top of the report page. GFI MailArchiver for Exchange Manual Access control and auditing 187

To group the list by date, click on the Group by date button, located at the top of the report page. Clicking on any database change in the list will bring up a window with detailed information on that change. 6.6.4 Archived emails auditing report Screenshot 161 - Archived emails auditing report Use this report to list the number of emails archived in GFI MailArchiver Archive Stores per day. Information displayed includes: Date Name of archive store Number of archived emails 6.6.5 Bulk import auditing report Screenshot 162 - Bulk import auditing report 188 Access control and auditing GFI MailArchiver for Exchange Manual