Retention Category Mailbox and Journal

[Yannick_FR]

Questions around retention and compliance with EV8:
If a vaulted user email is archive with a 5 years retention category and journaling is enable (with a retention category set "forever" for journaling), does this mail will be deleted from the journal archive mailbox after 5 years or retain forever?

Thanks, Y.
Hi Everyone,

[Liam_Finn1]

Forever because the most restrictive policy will apply to the stored items

[JesusWept3]

yup, just keep this in mind for when you start expiring items or delete users mailboxes expecting to free up some disk space, because if you're archiving everyone that gets journaled, then you will have the attachments shared between the user and the journal mailbox (if they share between each other), so if that email has been journaled and archived, and then you delete the users archive, the majoirty of the attachments and items won't be removed because its still dependant on the journal

[GertjanA]

This is one of the reasons in the previous company I worked for, we decided to use 2 VaultStoreGroups, 1 for journaling, 1 for mbx archiving.

Journaling retention was 6 months, mailretention indefinite. Journal archives all in 1 VSG, share within group, Mbx in other VSG, share within group. Eventually items in JournalArchives that are shared would be removed.

I've had a lengthy discussion on this, and the outcome was as JW describes. If you share journaling and mbx archives, you cannot indicate/predict what will be archived by which retention first, and thus cannot influence the one that gets the first pointer.

Meaning:
Mail sent from user a to user b, gets journaled (and archived), with attachment. Attachment gets stored and SIS'ed by journal archiving first.
Mail gets archived from mailbox, get's reference to SIS-part. After 6 months, journal item should expire. Because there are references, the attachment will not get deleted, as the items in the users archive do not expire. This leads to a build up in the journalarchive of items unable to be removed due to references from user archives. Splitting the stores in VSG's will get the items expire in the end. They will however be stored twice. Once for journaling, once for mailboxes.

GJ

[Yannick_FR]

Same as GJ, I always split my VSG in two, one for journaling, one for mailbox user. We do loose the gain from SIS but it is easier to manage your partition and storage growth.

To come back to the retention category, the idea behind is not to release space but all archived email need to be deleted for Compliance purpose after a certain period in the journal archive and the mailbox archive using the same retention category (7 different retentions category are set in my case). Basically an email with a 5 year retention period will need to be gone from the entire vault after 5 years. Not sure you can do it as there is only on retention period applying to the journaling, but is it technically feasible in EV?

---------------------------------------------------------------
 question and answer from Scanner: "Forever because the most restrictive policy will apply to the stored items", I am not sure to get that.

In a scenario of 1  Store (and same partition) for Journal and Mailbox: I understand that the archive email will not be accessible from the user after 5 years, but will remain "forever" accessible in the journal mailbox.

In a scenario of 2 Store (one for Journal, one for Mailbox): Same as above (at least it will release space in the Mailbox Store but it is not the subject.)
-----------------------------------------------------------------

[GertjanA]

Hi Yannick,

I've been reading up on filtering lately. You should be able to set what to filter on, and apply specific retention categories to items matchinv the filter rule.

Setting up Exchange Archiving, chapter 14 to 16. I picked out:

In the <CONTENTCATEGORIES> section of Custom Properties.xml, you define the content categories that you want to apply to filtered messages. A content category defines a group of settings that are to be applied to an item when it is archived. The settings can include the following:
■ The retention category to assign to the item
■ The destination archive
■ A list of the additional message properties that Enterprise Vault is to index

Perhaps check with Sym-consulting for help?

Have fun!

GJ

[Liam_Finn1]

Gertjian,

I see your point but this only applies if your Journal retention is less than your mailbox archive journal.

Normally the retentions are the other way around with Journaling having the longer retention. so the policies would apply like this.....

Email is journaled with attachment (6 year retention), Email is archived from users mailbox (3 month create shortcut, 6 month remove from users mailbox but still searchable, 1 year remove from users mailbox)

After one year the email is removed from the users mailbox so the pointer in the database for the mailbox database is removed. All data still remains as it is being held by the Journaling policy. 

After 6 years expiry runs. Finds email and attachment  have expired and deletes them

[Liam_Finn1]

Yannick,

To answer your question
When you archive an item from both mailbox archiving and journaling two retention policies are applied to the item. In most cases the mailbox policy is the most restrictive meaning it has the longer retention of the two. When expiry is run the most restrictive policy (journaling in this case) would have highest restrictions (keep forever) so the mailbox policy would have no effect on the items other than removing the item from the users mailbox but both items would still be held by the journal policy of keep forever.

In your case when you need to delete for compliance purposes what some companies do is set journaling to Keep Forever then once a year do a manual expiry run. This is achieved by setting the number of days old from the date you run the expiry 

Example
My retention category is set to keep forever
If today I wanted to delete anything older than Jan 1 2005, I would set the retention to 2002 days old and then do a run now on Expiry

[GertjanA]

Hi Liam,

Interesting. The 2 implementations I've seen until now, it is the otherway around. Journaling has limited retention (6 months to 3 years), and mailbox has indefinite (both)

Thanks.

Good idea to run expiry manually.

[Liam_Finn1]

Gertjan,

From what I have seen the mailbox retention is used to save space and decrease size of mailbox whereas Journaling is used for compliance and Legal discover both of which normally have longer retention periods (average 6 years)

[Yannick_FR]

I am looking at the Group Journaling Filtering from the Setting up Exchange Archiving PDF , as all my initial Retentions Category for users are base on groups in AD.
I can create a group journaling rule with retention category based on the one already set for users mailboxes.

I will test that it in a lab today and update the thread on Monday.
Thanks a lot for the help.

[Yannick_FR · Accepted solution]

The idea was to archive email in the journaling with a different retention policy based on the AD group of the recipient. Exactly the same EV is doing it for mailboxes.
However if an email is received bu the journaling with 2 recipients having a different retention period then the most restrictive retention should apply (the longer one)


If I cannot set a custom rule base on AD group, I will do it base on Distribution List which is possible. I will create a DL for each retention policy and add the users into the DL.
Then if an email is sent to a user, the custom filter will check in which DL the user is and archive the email with retention of this DL.

The xml file will be set with the most restrictive DL on the top the page in the ruleset. So if there are 2 recipients in the email, the most restrictive retention will apply first an archive the email.

Y.