Exchange 2010 SP1 offers significant capabilities for data storage and retention, all of which can be greatly enhanced by the addition of third party archiving solutions. These solutions can increase mailbox storage to virtually unlimited capacity, provide for search and discovery, reviews for compliance and internal investigations, disaster recover scenarios, and more, all by maintaining a complete record of all messaging that is kept separate from the Exchange infrastructure.

Exchange has its own archiving solution in place, but many customers choose to go with a more feature rich third-party software package, either to get more features or to separate the archiving function from the Exchange server function. Third-party solutions have three distinctly different methods for accessing messaging data within Exchange. Understanding these methods and how each can impact the performance of your Exchange system is important when shopping for a solution. Each has both pros and cons, depending upon the goals of the archiving, and the system resources of key Exchange server roles within your organization.

1. Journaling

Journaling captures copies of all messages sent using SMTP, and is very good at archiving messages and calendar data when it is sent to or from external users. Journaling can place an additional load on hub transport servers, and won’t capture any changes to messages or calendar data once it is in a user’s mailbox.

2. Crawling

Crawling accesses an archiving mailbox at regular intervals, and copies messages down to the mail archive system from that archiving mailbox. It uses a standard client access protocol, such as IMAP over an SSL connection, to download data securely and without requiring any additional agent on the Exchange server. While it is possible that messages that are created and then hard deleted between intervals could be missed, a shorter polling interval minimizes this. Crawling can place an additional load on mailbox servers.

3. Log shipping

Log shipping is able to archive every transaction including messages and calendar information, and any changes to those, by copying the Exchange logs to the archiving system. The archiving system replays the logs to reproduce the exact state of all data, much like high-availability solutions within Exchange. This is a very effective and low impact way to record all messaging transactions, but is not supported by Microsoft as a third party archiving solution, primarily because many third party applications may inject data back into the Exchange database.

With so many ways to implement archiving, evaluate the archiving solution you are considering based on its performance and potential impact to your system. Depending upon which method your product uses, you could consider scaling up your hub transport or mailbox servers to meet any additional load introduced by journaling or crawling.

Personally, I do not recommend any solution that puts you in an unsupported configuration, so my advice is to stay away from products that use log shipping. While you may not ever need to call Microsoft Support, you don’t want to put yourself into a situation where they cannot help you.

3 Ways to Implement Exchange 2010 Archiving

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Let’s be clear about this before we go any further – yes you could use these techniques to spy on your staff, and yes at face value it may seem as though these techniques serve no purpose other than to spy on staff.  But the reality is that what I’m about to describe can be used quite legitimately within a business for purposes other than outright spying.

There are two features of Exchange Server 2007 that can be used for this – Journaling and Transport Rules.

Exchange Server 2007 Journaling

The best way to think of Journaling is that it is a way to make a copy of emails that match certain sender or recipient conditions.  Typically this is done for regulatory compliance purposes, such as a legal requirement to retain copies of all email received by a government department for Freedom of Information purposes.

When an email is “journaled” it is simply copied to another mailbox.  Basic Journaling will copy all emails sent to and from recipients on a mailbox database to a specified journal mailbox, whereas Premium Journaling allows some more granular control such as per-recipient journaling rules, but the concept remains essentially the same.

A genuine application of Premium Journaling might be to journal all emails sent to or from a customer service email address so that all such communications are kept on record.

Exchange Server 2007 Transport Rules

Transport Rules can be used to achieve the same outcome as Journaling however they have a lot more features available and offer much more granularity.  For example you can use Transport Rules to add disclaimers to emails in Exchange, or block confidential emails.

You can also use Transport Rules as a kind of internal email filtering for inappropriate content.  This would be useful for policing acceptable usage policies.  By configuring a Transport Rule that detects certain words and blind copies any such email to a HR mailbox for inspection an organization might detect and avoid harassment issues within the organization.Similar rules could be configured to detect certain words that refer to trade secrets or confidential information to try and detect anyone discussing those topics with outside parties.

Less ethical uses might include use of Transport Rules to find out who is emailing recruitment firms looking for a new job, or who is discussing romance, religion, or other private matters.

The Email Administrator’s Dilemna

Although the title of this post was designed to be slightly tongue in cheek, the reality is that email administrators can be put into some tough situations by the availability of these features.

Just about any email server product has had the ability to tell from log files who emailed who and at what time, but usually doesn’t include any of the actual email content (sometimes the subject line is logged).  This is for two main reasons – firstly we really don’t care what is in the email itself, we’re only interested in whether or not it got delivered, and secondly logging all of the email content would take up a lot of disk space.

Journaling has been a feature of Exchange Server prior to the 2007 version, but Transport Rules are new to Exchange 2007.  These features can mean a few tricky situations for email administrators to be aware of.

Firstly there are the legal considerations, such as whether the availability of the feature compels you to employ it to protect staff, for example from email harassment.  Another legal consideration is whether the use of these features will result in email administrators being dragged into any legal matters that might spawn from email communications.  From personal experience this is a very real possibility.

Secondly there are the ethical considerations.  If you as the email administrator are directed by a superior to configure a Transport Rule that would effectively spy on an individual within the organization you might be enabling harassment or bullying to take place, which could land you in some hot water if you go along with it.  Again from personal experience this can happen, but usually if the request is from HR or an Internal Audit department it is clearly okay.

So there you have it, two useful and powerful features of Exchange Server 2007 that can be used for a variety of good and evil purposes.  Make sure you understand each feature, its capabilities and limitations, and always consider the legal and ethical implications of the actions you take with them.

How to Spy on Your Staff with Exchange Server 2007

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Depending on your type of business many federal or state regulations may require your company to archive email messages for electronic discovery.  As a smart proactive measure, more companies are voluntarily archiving email to protect themselves in case of a lawsuit. Lately, more are choosing to use Exchange Server journaling as an archiving method.  The question becomes, ‘Is journaling the best business decision?.  Or does implementation of a dedicated archiving solution provide a more secure data retrieval mechanism?’

Journaling and email archiving within Exchange Server are 2 distinct animals. Based on predetermined corporate policy selection criteria, archiving  removes old messages from the Exchange Server. Then the archiving software places the messages in a secure permanent repository. Journaling places a copy of target email messages into a designated mailbox.  This mailbox may usually remain on the same Exchange server as all the other staff email boxes.

The first order of business is to ensure journaling content is tamper-resistant by encrypting the traffic that’s flowing across the network. This makes man in the middle attacks much more difficult to perform.

Exchange server journaling can work as an email archiving solution, but potential data integrity tampering and security are big considerations. If your company is in an industry that is subject to federal or local regulations surrounding email archiving, then your archival solution must eliminate any doubt of tainted data due to tampering. Even in situations where you’re not required to archive email, but are doing so for your own protection, ensuring that your archiving solution is secure is still important. If a lawsuit rears its ugly head, the company’s chances of winning in court may improve dramatically if it can prove its archives are secure and messages could not be tampered with.

Journaling doesn’t offer the same level of archive protection as a dedicated email archiving application.  Dedicated archiving software addresses any tampering or data integrity issues. When it comes to legal or regulatory requests for historical emails and attached documents, dedicated archiving software eliminates any doubts that journaling may have a tendency to pose.

Microsoft Exchange Journaling vs. Archiving

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators