cancel
Showing results for 
Search instead for 
Did you mean: 

Litigation Hold Procedure

Lenny_
Level 4
Partner

Hi Everyone,

I'm looking for some kind of procedure to set up a Litigation Hold on mailboxes and archives.

I have a standard setup of 2 Exchange servers, a Enterprise Vault (first archive policy is "older than a year") and Discovery Accelerator set up on my infrastructure

i must put some mailboxes in legal hold in order to protect everything on it.

But i don't know how to achieve and be sure is "Legal compliant" (I know how to do it in Exchange, but not with Enterprise Vault).

I searched for a procedure or something like that, but didn't find anything.

Can someone help me ? 

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

Ben_Watts
Level 6
Employee Accredited

Enterprise Vault can only place Archived items on Legal Hold, it can't apply legal hold to non-archived items unfortunately.

 

If you want to apply Legal Hold to everything in a mailbox then you would need to ensure that ALL emails are Archived on a 0 day policy so that everything in a mailbox is archived therefore you can apply legal hold to everything in the mailbox.

 

If you want to place legal hold against a mailbox, and items which are not archived, then you will need to look into Exchange Legal Holds:-

2010  -  https://technet.microsoft.com/en-GB/library/ee861123(v=exchg.141).aspx

2013  -  https://technet.microsoft.com/en-us/library/ff637980(v=exchg.150).aspx

 

For both Archived and non-archived you will want to combine the two but that is going to be both time consuming and confusing, if not problematic.

My recommendation is just use EV and either alter the Archiving Policy or accept that holds are only placed on Archived items. Bear in mind that DA will also search, and place holds on, Journal Archives where everything is archived immediately, therefore if you needed an email that hadn't been archived from a users mailbox, it will have been archived from the Journal Mailbox and therefore it will be possible to place a hold against it from there.

 

Have a read of:-  https://support.symantec.com/en_US/article.DOC6040.html#Discovery_Accelerator

This is for EV9 but gives you some information which may be of use:-

http://www.symantec.com/content/es/mx/enterprise/fact_sheets/11703648-1_GA_DS_EV9_Discovery_Accelerator_6-10.pdf

 

 

 

View solution in original post

3 REPLIES 3

Lenny_
Level 4
Partner

Small update :

I found this : https://support.symantec.com/en_US/article.TECH186823.html that answer partially my questions.

But, does this apply only on archived message ? How to apply to every messages ? a new retention policy with all the emails ?

Ben_Watts
Level 6
Employee Accredited

Enterprise Vault can only place Archived items on Legal Hold, it can't apply legal hold to non-archived items unfortunately.

 

If you want to apply Legal Hold to everything in a mailbox then you would need to ensure that ALL emails are Archived on a 0 day policy so that everything in a mailbox is archived therefore you can apply legal hold to everything in the mailbox.

 

If you want to place legal hold against a mailbox, and items which are not archived, then you will need to look into Exchange Legal Holds:-

2010  -  https://technet.microsoft.com/en-GB/library/ee861123(v=exchg.141).aspx

2013  -  https://technet.microsoft.com/en-us/library/ff637980(v=exchg.150).aspx

 

For both Archived and non-archived you will want to combine the two but that is going to be both time consuming and confusing, if not problematic.

My recommendation is just use EV and either alter the Archiving Policy or accept that holds are only placed on Archived items. Bear in mind that DA will also search, and place holds on, Journal Archives where everything is archived immediately, therefore if you needed an email that hadn't been archived from a users mailbox, it will have been archived from the Journal Mailbox and therefore it will be possible to place a hold against it from there.

 

Have a read of:-  https://support.symantec.com/en_US/article.DOC6040.html#Discovery_Accelerator

This is for EV9 but gives you some information which may be of use:-

http://www.symantec.com/content/es/mx/enterprise/fact_sheets/11703648-1_GA_DS_EV9_Discovery_Accelerator_6-10.pdf

 

 

 

Lenny_
Level 4
Partner

Hi Ben,

Thank you very much for your high quality answer !

I will follow your recommandation : I will set a new policy to archive all emails received and then activate the legal hold on it.