MICROSOFT EXCHANGE 2013 WHAT EVERY LEGAL PROFESSIONAL SHOULD KNOW
WELCOME Thank you for joining Numerous diverse attendees Today s topic and presenters This is an interactive presentation You will receive slides, recording and survey Coming up next month
SPEAKERS John Collins Director, Discovery Services
WHAT WE WILL COVER TODAY Exchange vs. Outlook Background and context Different ways to acquire and deploy Exchange Major game changers #1: Native/built-in e-mail management #2: Native/built-in ediscovery Time Permitting Related topics Exchange 2013 Resources
EXCHANGE VS. OUTLOOK
EXCHANGE VS. OUTLOOK Exchange Back-end server and infrastructure Where the vast majority of e-mail management configuration occurs Direct access for the chosen few Outlook Client software: how users access their e- mail and other mailbox features Tightly integrated with Exchange
BACKGROUND AND CONTEXT
EXCHANGE 4.0 TO EXCHANGE 2013: THE GAME HAS CHANGED Storage capacity Then: small Now: BIG!
EXCHANGE: THE EXPANDED FOOTPRINT Exchange 2013 2013 Office 365 2010-2011 Exchange 2010 2009 Exchange 2007 2006 Exchange 2003 2003 Exchange 2000 2000 Exchange 5.5 1997 Exchange 4.0 1996 Basic e-mail functionality PLUS Enhanced ediscovery: in-place legal hold; in-place ediscovery; data loss prevention (DLP); Outlook Web App offline Basic e-mail PLUS member of the Office 365 Suite along with Lync and SharePoint E-mail; Instant Messages; call logs; meeting content; voice mails; SharePoint content Basic e-mail functionality PLUS MRM features changed/expanded; legal hold; discovery search; archive mailbox; mailbox moderation Basic e-mail functionality PLUS Premium journaling; unified messaging; messaging records management; transport rules; Exchange Active Sync (EAS) Basic e-mail functionality Basic e-mail functionality Basic e-mail functionality Basic e-mail functionality
THE EXPANDED FOOTPRINT FEATURES / FUNCTIONS Unified Messaging Messaging records management (MRM) In-place archiving In-place hold In-place ediscovery Premium journaling Information rights management S/MIME for message signing and encryption Transport rules Data loss prevention (DLP) Exchange auditing reports
THE EXPANDED FOOTPRINT OFFICE 365 SUITE Lync integration: Instant messages Call logs Meeting content SharePoint integration: Site mailboxes contain Exchange and SharePoint content ediscovery Center to search across SharePoint, Exchange, Lync, and file shares;
EXCHANGE 2013 ACQUISITION OPTIONS HERE, THERE AND EVERYWHERE
ACQUIRING / DEPLOYING EXCHANGE 2013 - OPTION 1: ON-PREMISE Installed in the deploying organization s own data center All infrastructure and data management elements under organization s total control All Exchange configuration settings Backup policies (how long to keep, where to store, etc.) Disaster recovery plan My Data Center
ACQUIRING / DEPLOYING EXCHANGE 2013 - OPTION 2: IN-THE-CLOUD Software as a Service (SaaS) Monthly subscription fee per user Exchange infrastructure located in provider s data centers Cloud options: Subscribe from Microsoft Subscribe from other (non-microsoft) application service providers Features, functions, and level of control vary between providers and plans Availability of e-mail management and ediscovery features will vary
IN-THE-CLOUD FROM MICROSOFT - OPTIONS Standalone Exchange only: no Lync, SharePoint, or Office 2 standalone plans available Office 365 14 plans: small, medium, or large (enterprise) business; education; government Numerous options (Yammer, Project, etc.) Availability of ediscovery and e-mail management features varies depending on plan. For example: Exchange Online Plan 1 does NOT include in-place hold; Plan 2 includes ALL ediscovery features Office 365 Small Business Plans do NOT include ediscovery NOTE! On-prem requires expanded licensing to get full complement of ediscovery and e-mail management features
SERVICE DESCRIPTION SPREADSHEET Details about all features, functions, options Find spreadsheet at http://technet.microsoft.com/en-us/office/dn788955
ALTERNATIVES TO KEEP IN MIND
ALTERNATIVE 1: HYBRID DEPLOYMENTS Standard: on-premise or in-the-cloud Alternative: hybrid deployments where some backend infrastructure is on-premise and some is in-the-cloud My Data Center Microsoft or other hosting provider s data center
HYBRID FYI Mailboxes can be split between on-premise and the cloud Common to see archive mailboxes in-the-cloud while primary mailbox is on-premise Backup and disaster recovery policies and procedures can differ between on-premise and in-the-cloud mailboxes My Data Center Microsoft or other hosting provider s data center
ALTERNATIVE 2: MULTI-TENANT VS. DEDICATED PLANS Microsoft s cloud offerings are available in two categories Multi-tenant: application servers, data storage, other infrastructure comprised of SHARED hardware resources Subscribers have some control over the environment s configuration BUT no control over the back-end infrastructure Lower cost than dedicated Dedicated: infrastructure is dedicated to the subscriber NOT SHARED Subscribers have greater control over the environment and some control over the backend infrastructure Organizations with unique security requirements (e.g., government)
MAJOR GAME CHANGER #1 NATIVE / BUILT-IN E-MAIL MANAGEMENT
E-MAIL MANAGEMENT FEATURES IN EXCHANGE In-place archiving Messaging records management (MRM) Create Store Dispose
IN-PLACE ARCHIVING What is it? IMPORTANT! It s not the same as third party archive tools like Enterprise Vault, KVS, etc. An additional mailbox designed to store mass quantities of e- mail Intended to replace.pst files How it works Enable archive for user Users move items into their archive or Exchange retention policy moves items into the archive based on retention policy
MESSAGING RECORDS MANAGEMENT (MRM) What is it? Framework for e-mail management Retain, archive, preserve, and permanently delete e-mail in accordance with Legal, RIM, and business requirements How does it work? Tag paradigm
HOW IT WORKS, STEP 1: SET UP RETENTION TAGS
HOW IT WORKS, STEP 2: ASSIGN TAGS TO POLICIES
HOW IT WORKS, STEP 3: ASSIGN POLICIES TO MAILBOXES
EXAMPLE: SAMPLE RETENTION POLICY Folder or Tag Inbox, Sent Items, Drafts, Conversation History Retention Policy Deleted after 180 days Deleted Items Working Docs Record Tag Contacts, To Do, Notes Voice Mails Deleted after 30 days Working Docs-2 year retention E-mail records-10 year retention Indefinite Deleted after 14 days
TAGS AND POLICIES IN ACTION
MAJOR GAME CHANGER #2 NATIVE/BUILT-IN EDISCOVERY
EDISCOVERY FEATURES IN EXCHANGE In-Place hold In-Place ediscovery
IN-PLACE HOLD User A Mailbox What is it? Put an entire mailbox OR just selected items in a mailbox (or group of mailboxes) on hold How it works: Assign Legal Hold/Discovery Management role to user (non-it person) Create hold using the In-Place ediscovery and Hold dialog/wizard o Scope the hold: ALL mailbox content OR content meeting search criteria Behind the scenes, Exchange Recoverable Items folder locks down items subject to the hold (users unaware hold in place UNLESS they are told) Inbox Deleted Items Recoverable Items Deletions (FKA The Dumpster ) Versions Purges Audits DiscoveryHold Calendar Logging
IN-PLACE EDISCOVERY What is it? Tool which searches across all mailboxes to identify, assess, and collect email How it works Assign Discovery Management/Mailbox Search role to user (non-it person) Exchange automatically full-text indexes content as its created User creates search / scopes collection via In-Place ediscovery and Hold wizard o Keyword Query Language (KQL): Boolean operators, proximity, wildcard What can you do with the search results? o Get estimate of hits and data volume o Assess search results o Export search results
EDISCOVERY FEATURES IN ACTION
FYI: IN-PLACE EDISCOVERY Deduplication based on hash value calculated using: InternetMessageId ConversationTopic IsSentItems BodyTagInfo Unsearchable items: not all attachments are searchable Exchange Search includes certain set of default filters for indexing (.doc,.xls,.ppt,.pdf,.odp,.html, and more (26 different filter types) Encrypted items may not be indexed (S/MIME ) In certain circumstances IRM protected content is not indexed Also, items not typically indexed: audio, video, non-ocr images Elect to include unsearchable items when copying / exporting search results
FYI: IN-PLACE EDISCOVERY, CONT. Limits Discovery search mailboxes can hold only 50 gigabytes of data Maximum # of keywords for a single search is 500 Maximum # of mailboxes that can be searched in a single search for online versions of Exchange is 10,000; 25,000 for on-prem
FYI: IN-PLACE HOLD Can take up to 1 hour for hold to be in effect New items automatically placed on hold If 5 or more scoped holds are applied to a mailbox, ALL items in mailbox are placed on hold Quota! There is a 30 gigabyte default quota on the Recoverable Items folder hold will stop working if the quota is reached Departed employees on hold: don t delete their mailbox! Mailbox should be disabled instead in on-prem environment Office 365 provides inactive mailbox option
THANK YOU E-mail coming tomorrow with slides, recording and survey Visit us online at http://discovermodus.com/webinars/ for more information on next webinar on November 20 th entitled: "Custodian Interviews - How to Leverage a Valuable Opportunity" Live full-day workshop in Washington DC, Nov. 19 th http://discovermodus.com/workshops/ - ESI for Legal Professionals Make sure to visit our website for valuable white papers, blogs and other information at www.discovermodus.com Thank you!
RELATED TOPICS
RELATED TOPICS Journaling Enables an organization to capture a copy of every message sent and received o Can be configured to capture only internal, only external, or all messages o Can limit journaling to specific users or distribution groups (requires Exchange Enterprise CAL) Outlook Web App (OWA) Offline Provides offline access VIA BROWSER to e-mail; users can also create new messages, see contacts and calendar items (and create new ones) Local database created to store items (up to 3 days of content or 150 items for each folder) Administrator can disable user s ability to turn this feature on
RELATED TOPICS, CONT. Auditing Administrator actions: everything an administrator can do can be tracked, including: create, delete, move mailbox; conduct a discovery search; place a mailbox on legal hold Mailbox auditing: who did what and when in a mailbox, including : deletions, item creation, and delegate access Transport rules Configure Exchange to look for specific conditions in messages Take a variety of actions: o Redirecting messages, silently dropping the messages, forwarding messages for approval, or applying Rights Management templates
RELATED TOPICS, CONT. Data Loss Prevention (DLP) Built on top of transport rules Helps to identify, monitor, and protect sensitive data through content analysis Content analysis based on complex policy templates o Custom o Out of the box: U.S. Social Security Number, U.S Bank Account Number Certain actions can be taken based on analysis (delete, submit for approval, add disclaimer, etc.)
CONSIDERATIONS FOR DISCOVERY If using Lync with Exchange: Instant Messages? Call logs? If using Exchange Unified Messaging: Transcribed voice mail messages (Outlook Voicemail Preview) Audio playback Text preview of voice mail Contextual contact actions
RESOURCES
EXCHANGE 2013 RESOURCES Technet.microsoft.com Tony Redmond book Microsoft Office 365 Administration book Exchange Team Blog Quentin Christensen Blog (ediscovery product manager)
FILE FORMATS INDEXED BY EXCHANGE SEARCH http://technet.microsoft.com/enus/library/ee633485(d=printer,v=ex chg.150).aspx
KEYWORD QUERY LANGUAGE (KQL) http://technet.microsoft.com/libr ary/dn774955(v=exchg.150).aspx
FYI-IN-PLACE ARCHIVING Must be enabled (default setting is off) Works like the primary mailbox and is fully searchable Not accessible in offline (Cached Exchange) mode Only accessible via Outlook or OWA; no mobile client or Outlook for Mac support Is fully integrated into e-mail management and ediscovery features and functions Native.pst ingestion tools available to move accumulated.pst files into archive
FYI: MESSAGING RECORDS MANAGEMENT (MRM) Mobile clients don t display retention policies or tags Some exceptions (Outlook Web App Mobile on iphone) Voice mail messages can have a unique retention tag Example: permanently delete after 14 days Biggest challenges in implementing MRM: Cultural: users may be accustomed to keeping email forever Disruptive and time consuming: asking users to classify e-mail may be a non-starter
HOW MODUS CAN HELP Seminars and Training: ediscovery, E-mail Management, and Compliance Exchange 2013 and Office 365 Full or half-day programs Review and deep dive explanation of features and functions for the entire Compliance suite o E-mail Management o ediscovery o Data Loss Prevention (DLP) o Information Rights Management (IRM) Includes IT, RIM, and Legal aspects What questions to ask clients
HOW MODUS CAN HELP Matter Specific Consulting How to Identify, Preserve, and Collect E-mail and Other Data from Exchange 2013 and Office 365 Identification, collection, and preservation in Exchange and Office 365 Response Plans: how to leverage Exchange and Office 365 ediscovery features in your ediscovery response