In this series about eDiscovery (or electronic discovery) you will learn how to preserve and access data in Microsoft Exchange for legal inquiry.

From time to time, Exchange Administrators are called on to preserve and produce information for legal inquiry. Often times, this occurs without any prior warning and action must be taken immediately upon notification. Because a task like this often just piles more work and time on top of an already busy schedule, I’m hoping to trigger some useful discussion. My goal is that this series of articles, along with reader comment, can become a “go to” resource when email legal inquiry is required in your organization.


If you Google “eDiscovery in Exchange”, or other similar phrases, you’ll find a plethora of results. Many will eventually guide you to purchasing software. When you’ve been tasked with producing email related to specific people or keywords, and time is of the essence, the last thing you want to do is purchase new software and learn how to purchase, install, setup, and use.

I’ve been in this situation a couple times so I’ve had to learn about the process. I want to share what I know to make life easier on you when you are in the same situation.

Most of my experience is using Exchange 2007, but I’ll also be covering Exchange 2010 as there are much better tools built in out of the box.

Be proactive

Before the need for eDiscovery ever arises, I think it’s important to take a few steps to ensure that your email resides in one place. In the past, PST files were a great way to archive email so that the Exchange database storage was used only for current email. Hard drive space was expensive. In contrast, drive space is cheap and Exchange databases are much more mobile. With that in mind, I believe every Exchange organization should prevent the use of PST files.

Let’s say an organization allows an employee to save email to a PST file that lives on a USB drive. There a few problems I have with that. Number one, you now have a user moving some of their email off company computers and essentially becoming the administrator for that email. Number two, the USB drive can be easily taken offsite and now that email is completely out of your control. Number three, when eDiscovery is required, the Exchange administrator may not know that PST file exist.

If the cause of legal inquiry is in fact the hypothetical person we’re discussing, things can get complicated quickly. It looks very bad when both parties submit everything they know and the disgruntled employee can produce 500 more emails than the employer they are suing.

Fortunately, this can all be easily avoided by simply disabling auto-archive and saving to PST files.

Disable Auto-Archive and saving to PST files.

  1. Distribute group policy to all users disabling saving to PST files.
  2. Add Outlook .adm to a GPO
  3. Go to Microsoft Office Outlook/Tools | Options…/Others/AutoArchive
  4. Disable AutoArchive Settings.
  5. Go to Microsoft Office Outlook/Miscellaneous/PST Settings. <
  6. Enable Prevent users from adding new content to existing PST files.

eDiscovery in Exchange

Disable PST files

In the next article in this series, we’ll continue the discussion focusing on what steps you should take when notice is given to preserve email.


Leave a reply

Your email address will not be published.


© 4sysops 2006 - 2023


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account