Litigation hold

[Giacomo]

I just read a good article on how to stop EV Archiving for a user when they are on Litigation Hold in Exchange: https://www-secure.symantec.com/connect/blogs/exchange-2010-litigation-hold-and-ev#comment-10743491

In my opinion this will simply keep EV from archiving new content from a user that is on Exchange Litigation Hold.  Thereby avoiding the user from accumulating deleted items and versions in the Exchange Dumpster.  I'm thinking that if the user is on litigation hold Exchange, wouldn't you also need to put the mailbox archive on legal hold to retain that data? 

Is there a good way to simply manage EV archives and Exchange 2010 Litigation Hold based on a common process?  I'm open to using DA, AD groups, and/or scripts to manage this.  The important thing is that I need to ensure that a single action triggers a litigation hold against Exchange and EV for the affected users.

Thanks in advance.

Giacomo

[AndrewB]

seems rather redundant to me. i would leverage EV journal archiving and then use a scheduled search in DA with the parameters/terms you need for the hold.

[Giacomo]

Thanks for the reply Andy.

I'm dealing with a brand new implemenation of EV (Journal and Mailbox) Archiving.  Most data will not exist in the Journal Archive for quite a while and therefore if we simply use EV Journal there is the significant risk of deletion of data happening in the Exchange mailboxes for users if we take them off of legal hold in Exchange,  At the very least, this is a concern until we reach our steady state mailbox archive period of 90 days (when Mailbox Archive kicks in).  Does that mean that I should either wait until 90 days after our journaling has started to archive any mailboxes currently in Exchange Litigation Hold?  This way, mail will either be in the Journal (newer than 90 days) or in the Mailbox Archive (older than 90 days).  I'm trying to prevent any loss of data in the transition between Exchange and EV.

Perhaps there is a best practice doc on managing legal hold?

Thanks,

Giacomo

[AndrewB]

we had a customer with the same concern and spent a lot of time archiving their entire backlog of email from exchange for this purpose using a zero-day mailbox archiving policy (without creating shortcuts) to bridge the gap. it was understood that this is an "after the fact" archiving process and users may have deleted important records over time which means it's not 100% compliant like a journal would be. it was certainly a challenge but having everything in one place and not having to manage two seperate legal holds might be worth it.

[Giacomo]

Andy,

Thanks for the insight.  Once you move the users to be archived with EV on a zero-day policy you are good from that point forward.  

I still have some hesitation on this as the users currently on Lit Hold in Exchange would have a good deal of data in their Exchange Dumpster and that will not be archived and may be very relevant for discovery.  I've got to give this some serious thought and check with my Client to ensure that they're willing to take on the risk of some data being lost in the transition.

Also, on a long term basis, the authoritative info would be in the compliance journal as that would be tamper proof (The user could delete items even before the zero-day archive runs).  Based on the legal hold process, though, we may need to not expire relevant journal archives until this legal hold is lifted.

Giacomo