How to Preserve Mailboxes for In-place eDiscovery in Exchange Server

In this article we look at the process of preserving Exchange mailboxes for performing In-Place e-Discovery.

When an employee ceases to be a part of the organization, their mailboxes are either disabled or deleted. And once a mailbox has been disabled, it gets disconnected from the account of the user, and remains in the mailbox for default period of 30 days. After the mailbox has been disconnected, the Managed Folder Assistant does not process information from it, and none of the retention policies work in this period. Searching the contents of a disconnected mailbox is not possible, once a mailbox has reached the configured period of retention, after being deleted, it will be deleted forever. Much like spam from your email accounts.

To prevent a mailbox from being deleted or disabled, even after its user has left, an organization might choose to preserve those mailboxes, for In-place eDiscovery. For preserving mailboxes, you do not have to do anything, just refrain from disabling them. And make sure that they remain inactive, meaning no more mails are send or received using those mailboxes. To do the same, follow these steps:

1. Use Active Directory Users and Computers, for disabling Active Directory user Accounts. You can also make use of other Active Directory or accounts which provide tools and scripts, thus preventing mailbox logon from using the user account. This will however not prevent users with full access to account from accessing the account. To limit their access, you will have to remove the Full Access permissions.

2. You can also set the limit of incoming and outgoing mails from the mailbox, by setting a size limit for all mails. If you set it to a minimal size of 1 KB, this will prevent from coming in and going out of the mailbox.

3. You can apply multiple other restrictions, like Delivery restrictions, thus preventing others from sending mails to this mailbox.

Key Factors to Keep in Mind

If you wish to preserve your mailboxes by implementing mailbox retention for using them for In-place e-Discovery or messaging retention management (MRM), do not forget to take into consideration employee turnover. For retaining the mailboxes of you ex – employees over a long period of time, you will have to make arrangements for a greater amount of space on your mailbox servers. Retaining a mailbox will also add on to the Active Directory Database, since it will require the associated account to also be retained for similar amount of time. You might be required to make a few more additional changes to the Account Provisioning of the organization, along with the Management Processes. As a matter of abundant caution, it is helpful to keep an Exchange ost file recovery tool handy.

Preserving mailboxes often becomes essential because user accounts often contain certain information which can be of use to the organization at a point in future. Therefore even after an employee stops being a part of an organization, their accounts are retained, to make sure they can still be a part of the In-place e-Discovery search. This is all the more important if the employee was having a privileged account, with confidential information, which the organization would not want.

Author Introduction:

Van Sutton is a data recovery expert in DataNumen, Inc., which is the world leader in data recovery technologies, including repair Outlook pst file corruption and bkf recovery software products. For more information visit www.datanumen.com