- Top 10 new features in Windows Server 2012 R2 - Mon, Jun 10 2013
- FREE: Unitrends Enterprise Backup Free Edition – Hyper-V and VMware backup - Tue, Nov 6 2012
- FREE: Remote Desktop Manager – A powerful RDP client - Wed, Sep 19 2012
From time to time, Exchange Administrators are called on to preserve and produce information for legal inquiry. Often times, this occurs without any prior warning and action must be taken immediately upon notification. Because a task like this often just piles more work and time on top of an already busy schedule, I’m hoping to trigger some useful discussion. My goal is that this series of articles, along with reader comment, can become a “go to” resource when email legal inquiry is required in your organization.
Background
If you Google “eDiscovery in Exchange”, or other similar phrases, you’ll find a plethora of results. Many will eventually guide you to purchasing software. When you’ve been tasked with producing email related to specific people or keywords, and time is of the essence, the last thing you want to do is purchase new software and learn how to purchase, install, setup, and use.
I’ve been in this situation a couple times so I’ve had to learn about the process. I want to share what I know to make life easier on you when you are in the same situation.
Most of my experience is using Exchange 2007, but I’ll also be covering Exchange 2010 as there are much better tools built in out of the box.
Be proactive
Before the need for eDiscovery ever arises, I think it’s important to take a few steps to ensure that your email resides in one place. In the past, PST files were a great way to archive email so that the Exchange database storage was used only for current email. Hard drive space was expensive. In contrast, drive space is cheap and Exchange databases are much more mobile. With that in mind, I believe every Exchange organization should prevent the use of PST files.
Let’s say an organization allows an employee to save email to a PST file that lives on a USB drive. There a few problems I have with that. Number one, you now have a user moving some of their email off company computers and essentially becoming the administrator for that email. Number two, the USB drive can be easily taken offsite and now that email is completely out of your control. Number three, when eDiscovery is required, the Exchange administrator may not know that PST file exist.
If the cause of legal inquiry is in fact the hypothetical person we’re discussing, things can get complicated quickly. It looks very bad when both parties submit everything they know and the disgruntled employee can produce 500 more emails than the employer they are suing.
Fortunately, this can all be easily avoided by simply disabling auto-archive and saving to PST files.
Disable Auto-Archive and saving to PST files.
- Distribute group policy to all users disabling saving to PST files.
- Add Outlook .adm to a GPO
- Go to Microsoft Office Outlook/Tools | Options…/Others/AutoArchive
- Disable AutoArchive Settings.
- Go to Microsoft Office Outlook/Miscellaneous/PST Settings. <
- Enable Prevent users from adding new content to existing PST files.
Disable PST files
In the next article in this series, we’ll continue the discussion focusing on what steps you should take when notice is given to preserve email.
