Forum Discussion

Lenny_'s avatar
Lenny_
Level 4
10 years ago

Litigation Hold Procedure

Hi Everyone,

I'm looking for some kind of procedure to set up a Litigation Hold on mailboxes and archives.

I have a standard setup of 2 Exchange servers, a Enterprise Vault (first archive policy is "older than a year") and Discovery Accelerator set up on my infrastructure

i must put some mailboxes in legal hold in order to protect everything on it.

But i don't know how to achieve and be sure is "Legal compliant" (I know how to do it in Exchange, but not with Enterprise Vault).

I searched for a procedure or something like that, but didn't find anything.

Can someone help me ? 

Thanks

Enterprise Vault
Information Governance
Legal Hold
Not Applicable
  • Ben_Watts's avatar
    Ben_Watts
    10 years ago

    Enterprise Vault can only place Archived items on Legal Hold, it can't apply legal hold to non-archived items unfortunately.

     

    If you want to apply Legal Hold to everything in a mailbox then you would need to ensure that ALL emails are Archived on a 0 day policy so that everything in a mailbox is archived therefore you can apply legal hold to everything in the mailbox.

     

    If you want to place legal hold against a mailbox, and items which are not archived, then you will need to look into Exchange Legal Holds:-

    2010  -  https://technet.microsoft.com/en-GB/library/ee861123(v=exchg.141).aspx

    2013  -  https://technet.microsoft.com/en-us/library/ff637980(v=exchg.150).aspx

     

    For both Archived and non-archived you will want to combine the two but that is going to be both time consuming and confusing, if not problematic.

    My recommendation is just use EV and either alter the Archiving Policy or accept that holds are only placed on Archived items. Bear in mind that DA will also search, and place holds on, Journal Archives where everything is archived immediately, therefore if you needed an email that hadn't been archived from a users mailbox, it will have been archived from the Journal Mailbox and therefore it will be possible to place a hold against it from there.

     

    Have a read of:-  https://support.symantec.com/en_US/article.DOC6040.html#Discovery_Accelerator

    This is for EV9 but gives you some information which may be of use:-

    http://www.symantec.com/content/es/mx/enterprise/fact_sheets/11703648-1_GA_DS_EV9_Discovery_Accelerator_6-10.pdf

     

     

     

3 Replies

Sort By
  • Lenny_'s avatar
    Lenny_
    Level 4
    10 years ago

    Hi Ben,

    Thank you very much for your high quality answer !

    I will follow your recommandation : I will set a new policy to archive all emails received and then activate the legal hold on it.

     

     

  • Ben_Watts's avatar
    Ben_Watts
    Level 6
    10 years ago

    Enterprise Vault can only place Archived items on Legal Hold, it can't apply legal hold to non-archived items unfortunately.

     

    If you want to apply Legal Hold to everything in a mailbox then you would need to ensure that ALL emails are Archived on a 0 day policy so that everything in a mailbox is archived therefore you can apply legal hold to everything in the mailbox.

     

    If you want to place legal hold against a mailbox, and items which are not archived, then you will need to look into Exchange Legal Holds:-

    2010  -  https://technet.microsoft.com/en-GB/library/ee861123(v=exchg.141).aspx

    2013  -  https://technet.microsoft.com/en-us/library/ff637980(v=exchg.150).aspx

     

    For both Archived and non-archived you will want to combine the two but that is going to be both time consuming and confusing, if not problematic.

    My recommendation is just use EV and either alter the Archiving Policy or accept that holds are only placed on Archived items. Bear in mind that DA will also search, and place holds on, Journal Archives where everything is archived immediately, therefore if you needed an email that hadn't been archived from a users mailbox, it will have been archived from the Journal Mailbox and therefore it will be possible to place a hold against it from there.

     

    Have a read of:-  https://support.symantec.com/en_US/article.DOC6040.html#Discovery_Accelerator

    This is for EV9 but gives you some information which may be of use:-

    http://www.symantec.com/content/es/mx/enterprise/fact_sheets/11703648-1_GA_DS_EV9_Discovery_Accelerator_6-10.pdf

     

     

     

  • Lenny_'s avatar
    Lenny_
    Level 4
    10 years ago

    Small update :

    I found this : https://support.symantec.com/en_US/article.TECH186823.html that answer partially my questions.

    But, does this apply only on archived message ? How to apply to every messages ? a new retention policy with all the emails ?