Email Archiving Service Overview and Setup Guide This guide is for the IT administrator – the person that sets up the appliance and deals with Exchange and Active Directory. Service Version: ArchivingP_3.5 2009-07-31 Copyrights This documentation and related technology are governed by a user agreement and shall remain the sole and exclusive property of MessageLabs. No part of this documentation or related technology may be used, reproduced, translated, displayed, distributed, disclosed, stored in a retrieval system or transmitted in any form or by any means without the written permission of MessageLabs, unless otherwise stated in the user agreement. The information contained in this documentation is confidential and proprietary to MessageLabs. Disclaimer MessageLabs does not warrant, guarantee or make any representations or otherwise concerning the contents of this documentation or the applicability thereof. MessageLabs reserves the right to change the contents of this document at any time without prior notification of such updates. Trademarks All brands or product names are trademarks or registered trademarks of their respective companies or organizations. Table of Contents 1  Preface 3  1.1 About this Guide 3  1.2 Intended Audience and Prerequisite Knowledge 3  1.3 Other Sources of Information 3  1.4 Contacting Support 3  2  Introduction to MessageLabs Email Archiving Service 4  2.1 MessageLabs Email Archiving Service Overview 4  2.2 A Hybrid Approach to SaaS Archiving 5  2.3 System Requirements 6  3  How MessageLabs Email Archiving Service Works 7  3.1 MessageLabs Email Archiving Service Uses Journaling Mailboxes 7  3.2 How Journaling Mailboxes Are Populated 8  3.3 Consequences of Using Different Methods for Populating Journaling Mailboxes 9  3.4 How Methods of Populating Journaling Mailboxes Work Together 9  3.5 How Users Interact with Archived Messages 9  4  Network Communication and Security 11  4.1 About Data Encryption 11  4.2 Appliance Connectivity 12  4.3 Connecting Through a Proxy Server 12  5  Planning For MessageLabs Email Archiving Service 13  5.1 Understanding Appliance Purposes 13  5.2 Basic Product Architecture (Single Appliance) 14  5.3 Using Multiple Appliances 15  5.4 Supporting External Access to MessageLabs Email Archiving Service 18  6  Steps in Setting up MessageLabs Email Archiving Service 20  7  Preparing Your System 22  7.1 Creating a User Account and Journaling Mailbox 22  7.2 Optionally, Configuring Journaling 25  7.3 Optionally, Creating and Configuring Managed Custom Folders 27  7.4 Configuring Active Directory 29  7.5 Creating a Test User 31  8  Installing and Configuring Appliance 32  8.1 Connecting Appliance 32  8.2 Configuring First Appliance 33  8.3 Confirming Configuration 34  8.4 Exporting Encryption Key 35  8.5 Configuring Additional Appliances (If Required) 35  8.6 Changing Apliance Configuration 36  8.7 Resetting the Archiving Appliance to its Default Configuration 36  Copyright © MessageLabs 2009 i 8.8 Temporarily Suspending Archiving from a Journaling Mailbox 36  9  Configuring External Access 37  9.1 About Configuring External Access 37  9.2 Load Balancing and Fault Tolerance on the Proxy Server 37  9.3 Installing the Archive Proxy 37  9.4 Setting up the OWA Server 38  10  Setting up User Access 39  10.1  MessageLabs Email Archiving Service Security Groups 39  10.2  Granting Access to MessageLabs Email Archiving Service 40  10.3  Granting Access to Additional Mailboxes 41  11  Giving Access to Archive from Outlook/OWA 42  11.1  Overview 42  11.2  Preconditions 42  11.3  Setting Up Accounts for Outlook Folder Creator 43  11.4  Running Outlook Folder Creator 45  11.5  Scheduling Outlook Folder Creation 46  12  Setting Up Stubbing 47  12.1  About Stubbing 47  12.2  About the Stubbing Process 47  12.3  About the Stubbing Account and Form 48  12.4  About Stubbing Policies 48  12.5  Overview of Stubbing Configuration Steps 49  12.6  Creating User Account for Stubbing 49  12.7  Creating Organizational Forms Library 50  12.8  Publishing Stubbing Forms 52  12.9  Configuring the Appliance for Stubbing 53  12.10  Working with the Stubbing Policy 53  12.11  Enabling or Disabling Stubbing 56  13  Troubleshooting MessageLabs Email Archiving Service 57  13.1  Using the Audit Trail to View Login Activity 57  13.2  Solving Common Problems 57  13.3  Troubleshooting User Directory Issues 58  13.4  Troubleshooting Archiving Issues 61  14  Glosary 62  15  Index 63  Copyright © MessageLabs 2009 ii 1 Preface 1.1 About this Guide This guide introduces MessageLabs Email Archiving Service, provides useful background information about it and explains how to set it up. 1.2 Intended Audience and Prerequisite Knowledge This guide is intended for use by IT staff who manage the Exchange Server environment and will be responsible for setting up and maintaining MessageLabs Email Archiving Service. 1.3 Other Sources of Information This guide covers procedural information for MessageLabs Email Archiving Service setup and configuration. For other information, see: Online Help: Every screen in the MessageLabs Email Archiving Service user interface includes a help button. Click on this button to display information about the steps required to perform tasks on that screen. Policy Creation and Management: Explains how to set up your organization’s electronic messaging policy. Intended for users responsible for policy management, such as compliance and records management staff. Legal Discovery and Supervision: Explains how to search the archive using the MessageLabs Email Archiving Service web interface. Also explains how to carry out discovery and supervision activities. Finding Your Own Messages: Explains basic search processes available from Microsoft Outlook or OWA. Intended for users who will search the archive for messages from their own mailboxes. Reports: Explains available reports and how to generate them. 1.4 Contacting Support Please refer to the information at the end of this guide. Copyright © MessageLabs 2009 3 2 Introduction to MessageLabs Email Archiving Service Chapter Overview This chapter provides background information about MessageLabs Email Archiving Service. It includes the following topics: ƒ MessageLabs Email Archiving Service Overview ƒ A Hybrid Approach to SaaS Archiving ƒ System Requirements 2.1 MessageLabs Email Archiving Service Overview MessageLabs Email Archiving Service provides a complete message archiving solution that can protect your organization from legal liabilities and regulatory risks while improving email storage management and end-user productivity. Its easy-to- implement, easy-to-use web interface offers fully secure email archiving with robust search and discovery, supervision and enforcement features. MessageLabs Email Archiving Service securely stores your electronic messages for the retention period you specify, while keeping them fully searchable and retrievable in real-time (or with a batch process). At any time, archived messages can be easily viewed, retrieved to a user’s email inbox or exported to an Outlook data file. MessageLabs Email Archiving Service includes features used to: ƒ design, edit and maintain an electronic messaging policy, including retention, enforcement and supervision rules ƒ perform advanced and comprehensive searches of a message’s header, body, or attachments, easily meeting even the most stringent discovery requirements ƒ generate reports that help properly assess email patterns and behavior, and help evaluate the effectiveness and enforcement of your policies ƒ manage mailbox sizes, removing storage-intensive attachments from Exchange while keeping those attachments accessible to Outlook users (stubbing) ƒ implement a systematic supervision process for selecting and reviewing the content of electronic messages based on your organization’s policy for acceptable use of email Note: Supervision and stubbing functions are optional and may not be available to all users. Copyright © MessageLabs 2009 4 2.2 A Hybrid Approach to SaaS Archiving On-premise Appliance Cloud Search & Storage Network Pulls data from Exchange for reliability Unlimited scalability Authentication via Active Directory Guaranteed search performance Encryption before data leaves your site Redundant, multi-site storage Hybrid approach MessageLabs Email Archiving Service represents a new approach to outsourcing: the hybrid solution. It provides an integrated archiving solution with robust search and discovery, supervision and enforcement features. Copyright © MessageLabs 2009 5 2.2.1 The Archiving Appliance The Archiving Appliance is a sealed fixed-purpose server (in standard 1U rack mount form) that is installed within your corporate network behind your firewall, to provide the tight integration and security typically only afforded to internal systems. The appliance provides integrates with Microsoft Exchange to ensure reliable, native format message archiving. Its integration with Active Directory facilitates unified login and access control management. Since the appliance is the only holder of your encryption keys (for more information, see “About Data Encryption” on page 11), any processing that involves encryption or decryption happens on the appliance. 2.2.2 The MessageLabs Network This highly secure, reliable and scalable infrastructure is based on a distributed search and storage architecture. This is where your data resides, in encrypted format. The vast majority of search processing and all of the storage is maintained on the MessageLabs Network, reducing overhead and maintenance headaches. The archive securely stores your electronic messages and is accessible either through the web interface, or, for end-user searching functions, through Outlook/OWA. 2.3 System Requirements The appliance must be connected as described in “Appliance Connectivity” on page 12. For users who will access the user interface, a Windows PC with Internet Explorer version 6 or higher is needed. Internet Explorer must be configured to allow JavaScript and popups. Note: Limited search functionality is available for users using Firefox. Microsoft Exchange must be installed, with the following versions and service packs supported: ƒ Exchange 2000, Service Pack 3. ƒ Exchange 2003, Service Pack 1. ƒ Exchange 2007, Service Pack 1. Note: External access, including OWA access, is available for Exchange 2003 and 2007 only. Exchange custom managed folders and organization-wide journaling (Hub Transport) require Enterprise CALs for Exchange 2007. Copyright © MessageLabs 2009 6 3 How MessageLabs Email Archiving Service Works Chapter Overview This chapter explains the details of how MessageLabs Email Archiving Service works to solve different business challenges. It includes the following topics: ƒ MessageLabs Email Archiving Service Uses Journaling Mailboxes ƒ How Journaling Mailboxes Are Populated ƒ Consequences of Using Different Methods for Populating Journaling Mailboxes ƒ How Users Interact with Archived Messages 3.1 MessageLabs Email Archiving Service Uses Journaling Mailboxes How MessageLabs Email Archiving Service uses journaling mailboxes To populate the archive, the Archiving Appliance retrieves messages from specific mailboxes on your Exchange Server: these are called journaling mailboxes. It copies groups of messages into a “batch” subfolder of the journaling mailbox, then retrieves the messages, encrypts them and sends them to the archive. When the appliance receives confirmation from the archive that the batch of messages has been fully archived, it deletes the batch subfolder from the journaling mailbox. This “pull and confirm” process ensures that no information is lost, even in the event of a network or appliance failure. Copyright © MessageLabs 2009 7 3.2 How Journaling Mailboxes Are Populated 3.2.1 Populating Journaling Mailboxes Using Microsoft Exchange Journaling This method is useful for legal discovery and compliance needs: all messages are captured, regardless of user action. Exchange journaling (available for Exchange 2000, 2003 or 2007) places a copy of each message that is sent or received into a journaling mailbox. In Exchange 2000/2003, message journaling is enabled for a mailbox store (a database used to organize multiple mailboxes). In Exchange 2007, message journaling can be enabled either for individual mailbox databases (each of which contains multiple mailboxes) or for the entire organization. 3.2.2 Populating Journaling Mailboxes Using Exchange Managed Folders This method is useful for record management purposes. Users identify different classes of critical business messages that should be archived. Microsoft Exchange 2007 allows administrators to deploy a special set of managed folders to the Outlook or OWA interface for end users. These folders facilitate consistent organization of information across user mailboxes. Users choose, either manually or via rules, messages to place in these folders. Folders can be configured to place messages in a journaling mailbox. 3.2.3 Populating Journaling Mailboxes Using MessageLabs Email Archiving Service Stubbing This method is useful to optimize storage, reducing the storage needs of the Exchange system. Stubbing is an optional background process that replaces email attachments (which are stored in Exchange) with a much smaller “stub” that points to a copy of the attachment that is stored in the archive. Sometimes the original attachment cannot be located — for example, it may pre-date journaling, have changed since journaling began, or be in a mailbox that does not use journaling. In that case, MessageLabs Email Archiving Service can place a copy of the attachment in the journaling mailbox so it can be archived. The original attachment can then be stubbed. Special retention policies can be defined for stored attachments. 3.2.4 Importing Messages into the Archive MessageLabs Email Archiving Service can import legacy messages and attachments from a variety of sources directly into the archive. Copyright © MessageLabs 2009 8