Compliance and Audit Logging

In this chapter, we will cover the following topics:

• Configuring journaling
• Managing archive mailboxes
• Configuring archive mailbox quotas
• Creating retention tags and policies
• Applying retention policies to mailboxes
• Placing mailboxes on retention hold
• Placing mailboxes on in-place hold or litigation hold
• Searching and placing a hold on public folders
• Performing eDiscovery searches
• Performing Compliance searches
• Configuring data loss prevention
• Configuring administrator audit logging
• Searching the administrator audit logs
• Configuring mailbox audit logging
• Searching mailbox audit logs

Introduction

One of the significant changes introduced in Exchange 2010 was the development of the feature called Litigation Hold; this was further developed and ended up in a feature called In-Place Hold in Exchange 2013 and 2016. One more welcomed feature is that it's possible to archive the contents from Lync or Skype for business into mailboxes.

This came together with the new search engine called FAST, which made searches across platforms available (Exchange, SharePoint, and Skype).

The compliance and audit logging features that were introduced in Exchange 2010 still apply to Exchange 2016, with some improvements. Over the years, many organizations have relied on third-party products for archiving and retaining email messages for legal protection and regulatory compliance. Fortunately, this function is now built into the product, along with some very powerful auditing...

Configuring journaling

Journaling in Exchange 2016 is pretty much unchanged from Exchange 2010, but it is still a crucial feature for many organizations worldwide as it helps respond to legal, regulatory, and organizational compliance requirements by recording all or specific email messages. Exchange provides two types of journaling:

• Standard journaling is configured on a mailbox database and journals all messages sent to and from mailboxes located on that database.
• Premium journaling provides more granular journaling by using journal rules. Instead of journaling every single email sent or received by all mailboxes in a database, you can restrict journaling based on recipients or members of distribution groups, and scope (internal, external, or all messages). Premium journaling requires an Exchange Enterprise Client Access License (CAL).

In both journaling methods, a journal...

Managing archive mailboxes

In Exchange 2010, a new personal storage concept was introduced, which still remains in Exchange 2016, called an archive mailbox, or in-place archive. The idea is that you can give one or more users a secondary mailbox that can be accessed from anywhere, just like their regular mailbox, and it can be used to store older mailbox data, thus eliminating the need for a PST file. The benefit of this is that archive mailboxes can be located on a database separate from the primary mailbox, allowing administrators to put low-priority, archived mailbox data on an inexpensive lower tier of storage. In this chapter, we'll take a look at how you can manage archive mailboxes for your users through the Exchange Management Shell.

How to do it...

...

Configuring archive mailbox quotas

As you enable archive mailboxes for end users and set up retention policies (shown later in the chapter), you may find that the default limitations configured for archive mailboxes do not meet your needs. In this recipe, you'll learn how to modify archive mailbox quotas using the Exchange Management Shell.

How to do it...

Let's see how to configure archive mailbox quotas by performing the following steps:

1. To modify the archive quota settings for a single mailbox, use the Set-Mailbox cmdlet:

    Set-Mailbox dsmith -ArchiveQuota 10gb -ArchiveWarningQuota 8gb  

2. To do this in bulk, use the Get-Mailbox cmdlet to retrieve the mailboxes that need to be updated and pipe the results...

Creating retention tags and policies

Retention policies are the recommended method for implementing messaging records management in Exchange 2016. Retention policies use retention tags to apply settings to mailbox folders and individual items. Retention tags are configured with a retention action that can be taken when an item reaches its retention age limit. In this recipe, you'll learn how to create retention tags and policies using the Exchange Management Shell.

How to do it...

There are three types of retention tags that can be used to apply retention settings to a mailbox through a retention policy. The following steps outline the process of creating custom retention tags based on these types and assigning them to...

Applying retention policies to mailboxes

Retention policies are not automatically applied to end user mailboxes and must be set manually using either the Exchange Admin Center or the Exchange Management Shell. In this recipe, you'll learn how to apply retention policies to mailboxes from the command line, which will be useful when performing a retention policy assignment on a large number of mailboxes, or on a regular basis as new mailboxes are created.

How to do it...

Let's see how to apply retention policies to mailboxes by performing the following steps:

1. To apply a retention policy to a mailbox, you use the Set-Mailbox cmdlet, specifying the retention policy name using the -RetentionPolicy parameter. For example...

Placing mailboxes on retention hold

When users go on vacation or are out of the office for an extended period of time, you may need to suspend the processing of the retention policy applied to their mailboxes. This recipe will show you how to use the Exchange Management Shell to place mailboxes on retention hold, as well as how to remove the retention hold and discover which mailboxes are currently configured for retention hold.

How to do it...

Let's see how to place a mailbox on retention hold by performing the following steps:

1. To place a mailbox on retention hold, use the Set-Mailbox cmdlet:

    Set-Mailbox dsmith -RetentionHoldEnabled $True  

2. To remove the retention hold setting from the mailbox, use the same command...

Placing mailboxes on in-place hold or litigation hold

When an organization is dealing with the possibility of a legal action, data such as documents and email messages related to the case will usually need to be reviewed, and an effort to preserve this information must be made. Exchange 2016 allows you to protect and maintain this data by placing mailboxes on In-Place Hold or on Litigation Hold. This prevents users or retention policies from modifying or removing any messages that may be required during the legal discovery process. In this recipe, you'll learn how to manage hold settings for mailboxes from the Exchange Management Shell.

Litigation hold was introduced in Exchange 2010, and it still remains in Exchange 2016. Although it is recommended that you use the in-place hold feature instead, which is better suited for most scenarios, we will show you how to use both...

Searching and placing a hold on public folders

It is now also possible to search for content in public folders and place that same content on hold by using eDiscovery. This is important as many organizations still make extensive use of public folders to keep data, and not being able to easily search that data can only bring issues when trying to respond to legal requests.

In this recipe, we will see how to place a hold on public folder content using the Shell.

How to do it...

To place all content in all public folders on in-place hold for an unlimited hold duration, you use the following cmdlet:

    New-MailboxSearch -Name "All PFs Hold" -AllPublicFolderSources $True -AllSourceMailboxes $False -EstimateOnly -InPlaceHoldEnabled...

Performing eDiscovery searches

Exchange 2016 provides the ability to search through mailboxes for content that might be required during an investigation, such as a violation of organizational policy or regulatory compliance, or due to a lawsuit. Although this can be done through the Exchange Admin Center, you may need to do this from the command line. In this recipe, you'll learn how to perform discovery searches from the Exchange Management Shell.

How to do it...

To perform an eDiscovery search, we also use the New-MailboxSearch cmdlet. This cmdlet can be used to create a mailbox search and either get an estimate of search results, place search results on in-place hold, or copy them to a Discovery mailbox.

After you...

Performing Compliance searches

Another new feature introduced in Exchange 2016 is Compliance Search, which allows administrators to search all mailboxes in the organization. While In-Place eDiscovery is limited to search only up to 10,000 mailboxes, compliance search does not have such limitation, which is extremely helpful for large organizations that need to perform organization-wide searches.

Compliance search uses the New-ComplianceSearch cmdlet we already looked at in the Deleting messages from mailboxes using Compliance Search recipe from Chapter 4, Managing Mailboxes. Using this cmdlet, we can search all mailboxes in the organization and then use in-place eDiscovery to perform other eDiscovery-related tasks, such as placing mailboxes on hold or exporting search results.

In this recipe, we will look at how we can leverage the New-ComplianceSearch cmdlet to determine which...

Configuring data loss prevention

Data Loss Prevention (DLP), is a system designed to detect a potential data breach/leakage incident in a timely manner and prevent it. When this happens, sensitive data such as personal or company information (credit card details, social security numbers, and so on) is disclosed to unauthorized users either with malicious intent or by mistake. This has always been crucial for most companies as loss of sensitive data can be very damaging for a business. Since Exchange 2013, and further improved in 2016, Microsoft has made it possible to enforce compliance requirements for such data and control how it is used in email. DLP is the feature that allows administrators to manage sensitive data in Exchange.

In this recipe, we will look at how we can configure DLP using the Shell to help prevent accidental data leakage.

...

Configuring administrator audit logging

Administrator audit logging allows you to track the cmdlets that are being run within your Exchange organization. The log entries provide details about the cmdlets and parameters used, such as when a command was executed, which objects were affected by the command, and the user who ran the cmdlet. In this recipe, you'll learn how to configure the options used to define the administrator audit logging settings in your environment.

How to do it...

For new installations of Exchange 2016, administrator audit logging is enabled by default. Let's perform the following steps to configure administrator audit logging:

1. To determine the current configuration, use the Get-AdminAuditLogConfig...

Searching the administrator audit logs

You can use the Exchange Management Shell to search the administrator audit logs and generate reports based on the cmdlets and parameters used to modify objects within your Exchange environment. There are two ways in which we can view the audit logs from the Exchange Management Shell, and in this recipe, we'll take a look at both methods.

How to do it...

Let's see how to perform an administrator audit log search by performing the following steps:

1. To perform a synchronous administrator audit log search in the Shell, we can use the Search-AdminAuditLog cmdlet:

    Search-AdminAuditLog -Cmdlets Set-Mailbox '
    -StartDate 6/1/2017 '
    -EndDate 6/30/2017 '
 ...

Configuring mailbox audit logging

In every organization, there are always mailboxes with sensitive information. These might be the mailboxes of the CEO, directors, users from the HR or Payroll departments, or simply mailboxes for which you have to perform discovery actions to demonstrate compliance with regulatory or legal requirements. Although normally administrators are not concerned with the content of users' mailboxes, there might be someone less honest that attempts to access someone's mailbox in order to obtain information of value for their own benefit.

Administrators can implement Mailbox Audit Logging and run audit reports to obtain details regarding actions taken on a mailbox. After enabling an audit for one or more mailboxes and configuring the level of detail that we want to capture, audit entries are captured in the Audit subfolder of the Recoverable Items...

Searching mailbox audit logs

Similar to searching the admin audit logs, there are two ways to search mailbox audit log entries using the Shell:

1. By using the Search-MailboxAuditLog cmdlet to synchronously search mailbox audit log entries for a single mailbox, and displaying the search results in the Shell.
2. Alternatively, you can create a mailbox audit log search to asynchronously search mailbox audit logs for one or more mailboxes, and then have the search results sent to a specified email address as an XML attachment. To create the search, you use the New-MailboxAuditLogSearch cmdlet.

In this recipe, we will see how to perform both types of searches.

How to do it...

1. To search all actions performed by delegates on the CEO...