Retention Hold and Litigation Hold in Exchange 2010

Published 08/16 courtesy of MS Exchange Team

In Exchange 2010, you can place a mailbox on retention hold or legal hold. Both holds serve a different purpose. Its important to understand the functionality provided by both.

Retention Hold: As the Messaging Records Management page in the EMC suggests (see Figure 1), retention hold is used to halt retention policy, which means the Managed Folder Assistant (MFA) does not move or delete items from the mailbox. Its typically used when a user may not have mailbox access for an extended duration, for example, when the users on vacation. You can also use retention hold during the initial phase of MRM deployment and remove it as users become more comfortable with MRM functionality.

Should users access their mailbox when it’s on retention hold, they may notice that items aren’t being deleted or moved to archive. Mailbox size increases as more email accumulates and you may need to raise the users mailbox quotas to ensure mail flow to and from the mailbox isn’t interrupted.

The mailbox owner or any user (or process) with mailbox access can delete messages when the mailbox is on retention hold. Deleted messages are not treated any differently when a mailbox is on retention hold. Deleted items are retained until the deleted item retention period (14 days by default) and then deleted permanently. See the Retention Hold section in Understanding Retention Tags and Retention Policies for more details.

When placing a mailbox on retention hold, you can specify a start date and an end date. This allows you to configure retention hold in advance, and have it end at a predetermined date. Takeaway: retention hold is for planned activity, suspends move or delete actions taken by the MFA. If you havent deployed either MRM feature (Retention Tags or Managed Folders), retention hold is unnecessary.

Note: When you archive-enable a mailbox, the Default Archive and Retention Policy is automatically applied to the mailbox if it doesnt have a retention policy.

Litigation Hold: Litigation hold, also known as legal hold, is used to preserve mailbox items for discovery before and during legal proceedings, investigations or similar events. The goal is to preserve mailbox items from inadvertent or purposeful modification or deletion by the mailbox owner or any user with mailbox access, and also automated deletion by processes such as the MFA. Unlike retention hold, you can’t configure litigation hold to start and end at a specified date – it’s either enabled or not. Until the hold is removed, deleted items are not purged from the mailbox database. If mailbox items are modified, a copy of the original item is also retained. These are returned in Discovery searches performed when the mailbox is on litigation hold. See Understanding Litigation Hold for more details.

When you place a mailbox on litigation hold, Exchange also populates the LitigationHoldDate and the LitigationHoldOwner properties, which can be useful for tracking purposes. Note that an administrator can modify both of these properties. Administrator Audit Logging is the best place if youre looking for reliable audit trail of admin actions.

Tip: You can run a litigation hold report from the Exchange Control Panel by going to Roles & Auditing > Auditing > Run a litigation hold report....

Mailbox quotas for mailboxes on hold

Both types of hold will result in more data being stored in a mailbox. Understandably, both may require some adjustments to storage quotas. Mailboxes on retention hold may require higher mailbox quotas because the MFA doesn’t delete items or move them to the user’s archive mailbox.

Mailboxes on litigation hold don’t require a higher mailbox quota because the user and MFA continue to delete messages, which are then retained in the Recoverable ItemsPurges folder until the hold is removed. In Exchange 2010, Recoverable Items does not count towards the mailbox storage quota because it has its own quota. For details, see Understanding Recoverable Items.

At 20 GB and 30 GB, the Recoverable Items Warning Quota and Recoverable Items Quota are set to fairly high defaults. Depending on how long a mailbox user is on litigation hold and the volume of email the mailbox receives, the Recoverable Items folder may reach its quota limits. It’s recommended that you monitor the size of Recoverable Items folder for mailboxes on litigation hold.

To check Recoverable Items folder size for all mailboxes on litigation hold:

Get-Mailbox -ResultSize Unlimited -Filter {LitigationHoldEnabled -eq $true} | Get-MailboxFolderStatistics –FolderScope RecoverableItems | Format-Table Identity,FolderAndSubfolderSize -Auto

If the Recoverable Items folder is close to its quota limits, you can raise the Recoverable Items Quota for the mailbox – the simple solution and also the recommended one. Alternatively, you can use Search-Mailbox to extract messages from the folder and store them in another mailbox. See Clean Up The Recoverable Items Folder for the step-by-step procedure.

This command sets the Recoverable Items Warning Quota and Recoverable Items Quota for a mailbox to 40 GB and 50 GB:

Set-Mailbox “Mailbox User” –RecoverableItemsWarningQuota 40GB –RecoverableItemsQuota 50GB

Note: A user’s archive mailbox also has a Recoverable Items folder. Although the same RecoverableItemsWarningQuota and RecoverableItemsQuota apply to the primary and archive mailbox, theyre not combined but calculated separately (i.e., 30 GB for the primary mailbox and 30 GB for the archive, if enabled).

Informing the user about litigation hold or retention hold

When you place a mailbox on litigation hold or retention hold in Exchange 2010, you can populate the comment field using the EMC or the Set-Mailbox cmdlet. The comment shows up in the Backstage area in Outlook 2010 and can be used to inform the user about either hold. You can also include a URL to internal hold policies or other documentation.

Figure 1: Placing a mailbox on litigation hold using the EMC

When you place a mailbox on litigation hold, Exchange alerts you that it may take up to 60 minutes for the change to be processed.

Figure 2: Warning displayed when you place a mailbox on litigation hold

Although litigation hold is processed by Exchange in that period, the litigation hold comment does not show up in Outlook 2010 until the MFA has processed the mailbox. Depending on the assistant’s work cycle, it may take as long as 1 day (the default work cycle configuration on Exchange 2010) for the comment to be displayed in Outlook. To make the comment show up sooner, you can manually kick off the assistant against a mailbox.

Start-ManagedFolderAssistant “Mailbox User”

To have the assistant process multiple mailboxes, you’ll need to pipe output from the Get-Mailbox cmdlet, which can use recipient filters to filter mailboxes, or use distribution group membership.

Additionally, LitigationHoldEnabled, LitigationHoldDate and LitigationHoldOwner are filterable properties in Exchange 2010. This means you can filter Get-Mailbox output using these properties and start the MFA against all mailboxes you’ve placed on litigation hold on a certain date.

This command retrieves all mailboxes places on litigation hold by Paul Singh after 8/14/2010.

Get-Mailbox –Filter {LitigationHoldEnabled –eq $true –and LitigationHoldDate –gt “8/14/2010” –and LitigationHoldOwner “Paul Singh”} | ft Name,Litigation*

Once you’ve examined the list of mailboxes returned by the above command, you can start the MFA to process them.

Get-Mailbox –Filter {LitigationHoldEnabled –eq $true –and LitigationHoldDate –gt “8/14/2010” –and LitigationHoldOwner “Paul Singh”} | Start-ManagedFolderAssistant

After the Managed Folder Assistant has processed a mailbox, the hold comment is displayed in Outlook 2010. The user is not required to restart Outlook.

Figure 3: The hold comment along with any links for more information, if configured, is displayed to the user in Outlook 2010

Exchange 2010 has a number of features to help you meet your organizations compliance goals. For more details, see Messaging Policy and Compliancein Exchange 2010 documentation.

Bharat Suneja

Exchange Answers

Retention Hold and Litigation Hold in Exchange 2010

Mailbox quotas for mailboxes on hold

Informing the user about litigation hold or retention hold

Recent SharePoint Questions

More Articles By

Uncovering the new RPC Client Access Service in Exchange 2010 (Part 3)

Exchange ActiveSync and iPhone OS 3.1

AppRiver Exchange Hosting - Voted MSExchange.org Readers Choice Award Winner - Exchange Hosting

More Articles Under "Blogs"

The Elusive Kingston SSDNow 40 Gb Solid State Drive

Exchange Server 2010 Released

Windows 2008 R2 Support Coming for Exchange 2007

Most Viewed Content

Exchange Answers

Retention Hold and Litigation Hold in Exchange 2010

Share This Article

Mailbox quotas for mailboxes on hold

Informing the user about litigation hold or retention hold

Recent SharePoint Questions

More Articles By

Uncovering the new RPC Client Access Service in Exchange 2010 (Part 3)

Exchange ActiveSync and iPhone OS 3.1

AppRiver Exchange Hosting - Voted MSExchange.org Readers Choice Award Winner - Exchange Hosting

More Articles Under "Blogs"

The Elusive Kingston SSDNow 40 Gb Solid State Drive

Exchange Server 2010 Released

Windows 2008 R2 Support Coming for Exchange 2007

Most Viewed Content