Litigation Hold and In-Place Hold in Exchange 2013 and Exchange Online
Published Dec 11 2013 12:50 PM 115K Views
Microsoft

In Exchange 2010 and Exchange Online, we introduced Litigation Hold to allow you to immutably preserve mailbox content to meet long term preservation and eDiscovery requirements. When a mailbox is placed on Litigation Hold, mailbox content is preserved indefinitely.

Placing a mailbox on Litigation Hold You can place a mailbox on Litigation Hold by using the Exchange Administration Center (EAC) or the Shell (set the LitigationHoldEnabled parameter). In Exchange 2010, you can also use the Exchange Management Console (EMC) to do this.

EAC-LitigationHold1
Figure 1: Enabling Litigation Hold for a mailbox using the EAC in Exchange 2013 and Exchange Online

EAC-LitigationHold2
Figure 2: Adding a note and a URL to inform & educate users placed on Litigation Hold

Preserving items for a specified duration To preserve items for a specified period, we added the LitigationHoldDuration parameter to Exchange Online. This helps you meet your compliance needs by preserving all items in a mailbox for the specified duration, calculated from the date the item was created (date received in case of inbound email). For example, if your organization needs to preserve all mailbox data for seven years, you can place all mailboxes on Litigation Hold and set the LitigationHoldDuration to 7 years (in days).

This functionality is also available in Exchange 2013, allowing you to preserve items for a specified duration in your on-premises organization – one example of how developments in Exchange Online benefit Exchange Server on-premises.

In-Place Hold in Exchange 2013 and Exchange Online

In Exchange 2013 and the new Exchange Online, we introduced In-Place Hold, which allows more flexibility in preserving your data. Hold functionality is integrated with In-Place eDiscovery to allow you to search and preserve using a single wizard or a single cmdlet (New-MailboxSearch). You can use the In-Place eDiscovery & Hold wizard or the cmdlet to search for and preserve items matching your query parameters, known as a query-based In-Place Hold, preserve items for a specified period, known as a time-based hold, and also preserve everything indefinitely, which emulates the old Litigation Hold feature. Check out In-Place eDiscovery and In-Place Hold in the New Exchange - Part I and Part II for more info.

Using Litigation Hold in Exchange 2013 and Exchange Online

If you tried placing a mailbox on Litigation Hold using the EAC or the Shell, both the interfaces displayed an alert message with a recommendation to switch to the new In-Place Hold feature. This recommendation was also reflected in the product documentation.

EAC-LitigationHold3
Figure 3: Warning displayed when using Litigation Hold in the EAC in Exchange 2013

Litigation Hold isn't going away: Since the release of Exchange 2013 and the new Exchange Online, we've received a lot of questions and feedback from you about whether Litigation Hold will be removed. We want to clarify that we do not plan to remove Litigation Hold from Exchange Online or Exchange 2013. We've removed the alert from Exchange Online and in Exchange 2013 SP1. We've also removed the recommendation from Exchange Online and Exchange 2013 documentation.

Use the hold feature that best meets your needs

You can use either hold feature to preserve mailbox data in Exchange 2013 and Exchange Online, based on your preservation needs. Here are some scenarios to help you choose between the two holds.

You want to…Use Litigation HoldUse In-Place Hold
Preserve all items in a mailbox Yes Yes.
To preserve all items, don’t specify any query parameters.
Preserve all items in a mailbox for a specific duration Yes.
Specify the LitigationHoldDuration parameter for the mailbox using the Shell.
Yes.
Create a time-based In-Place Hold. Specify the duration in the In-Place Hold settings in EAC or ItemHoldDuration parameter from the Shell.
Preserve items matching query parameters No.
Litigation Hold preserves all items.
Yes.
Create a query-based In-Place Hold. Specify query parameters such as start date, end date, sender, recipients and keywords.
Specify types of items to preserve (such as email, calendar, notes) No.
Litigation Hold preserves all items.
Yes.
You can use the EAC or the MessageTypes parameter from the Shell.
Specify hold settings for members of a distribution group Yes.
Use the Get-DistributionGroupMembercmdlet in the Shell to pipe distribution group members to the Set-Mailbox cmdlet.1
Yes.
Easily specify distribution groups in the In-Place eDiscovery and Hold wizard in the EAC or in the SourceMailboxes parameter in the Shell. 2
Max users on hold No.
Litigation Hold is a mailbox parameter. No maximum limits apply. You can use the Shell to quickly place all users in an organization on hold.
You can specify a maximum of 10,000 users per In-Place Hold object. To place additional users on hold, you must create another hold.
Place multiple holds on a mailbox No Yes.
You can place a user on multiple In-Place Holds, for example when a user is subject to multiple investigations or legal cases.
Make mailboxes inactive to preserve data in Exchange Online Yes3 Yes
Archive Lync conversations and meeting content to Exchange Yes Yes

1 Distribution group is expanded when you run the command. Future changes to the group require running the command again.
2 Distribution groups are expanded only when you create or refresh the In-Place Hold. Future changes to the group require refreshing the search object.
3 Inactive mailboxes is an Exchange Online feature. The linked documentation is being updated to clarify you can also use Litigation Hold to make a mailbox inactive.

Bharat Suneja

Updates

  • 12/11/2013: Added 'Specify types of items to preserve' row to comparison table.
  • 12/11/2013: Added 'ItemHoldDuration' parameter to comparison table.
  • 8/12/2014: Updated max mailboxes per In-Place Hold limit to 10,000 mailboxes. Added link to Place all mailboxes on hold. Added another row to table for archiving Lync content to Exchange.
  • 6/3/2015: Changed the Litigation Hold column for "Archive Lync conversations and meeting content to Exchange" row in table to "Yes". Litigation Hold also enables you to archive Lync content in Exchange. Removed the following text:
    "To archive Lync Online IM conversations to Exchange Online, you must place a mailbox on In-Place Hold. In on-premises deployments, you can configure Lync Server to archive to Exchange Server without placing the user on In-Place Hold."

18 Comments
Not applicable
@Arjun Tank: In the left pane in the eDiscovery search preview, you'll see All Items followed by each mailbox (that returned items matching your query), the number of items returned from the mailbox and their total size. Selecting the mailbox shows messages

returned from that mailbox. You can't search within search results in the preview. Thanks for the feedback!

Not applicable
We have a Legal requirement to preserve all users' email for X number of years and would like to not have an extra manual step where someone creating a new hire's mailbox has to remember to apply a Hold to their mailbox in Exchange Online. We were not able to find a way to configure In Place Hold or Legal Hold to automatically apply to all mailboxes that support this feature (we have some Kiosk but most are E3 users). Are we missing something or do we have to always remember to add the user to an existing In Place Hold?

- Jeff

Not applicable

@TPBrennan: You bring up a good point! As long as the mailbox is on Litigation Hold / In-Place Hold, mailbox content is preserved.

Are you trying to protect against inadvertent deletion of user account?

  • If a mailbox is on hold, you can't delete it using Exchange tools (EAC/EMS).
  • Remove-Mailbox cmdlet does have the
  • IgnoreLegalHold parameter to force removal. But EMS cmdlets are and can be audited and also cmdlets and individual parameters can be controlled using

    RBAC.

  • You may be able to delete the account using Active Directory tools, in which case what you're saying would be true. We do not support using Active Directory tools to modify/remove Exchange attributes. You can use
  • Active Directory split permissions model to separate Exchange and Active Directory management.

  • Exchange Online does support
  • inactive mailboxes for eDiscovery, but that's more of a license reuse scenario to lower cost rather than the inadvertent user account removal scenario.

  • As far as intentional or malicious action (removal of user account/data destruction) is concerned, it can be argued that all data is susceptible to the same risks from entities with authorized access (admins, etc.).
  • Not applicable
    @Jeff at Belkin: You have to remember to add new users to an In-Place Hold or Litigation Hold. You could script this to occur at fixed times (depending on the volume of new mailboxes created in your org) in on-premises and Office 365 cloud and hybrid orgs.
    Not applicable
    Litigation Hold is not quite fool proof and the mailbox contents will not necessarily be retained indefinitely. If the underlying AD account is deleted the mailbox is disconnected and cannot be searched. I have not had a chance to test yet; but, will it then be removed after the standard deleted mailbox retention time?
    Not applicable

    Nice one. Cheers :)

    Not applicable

    Great Article.. Thanks... :)

    Not applicable

    Nice article with a handy comparison.  When will we see litigation/in-place hold (and eDiscovery) for Public Folders?

    Not applicable

    @Deva, @Shakthravi & Jeff: Thanks!

    @Jeff: Thanks for the suggestion, passing it on the team.

    Not applicable

    Nice comparison!

    Not applicable

    Excellent article Exchange team! Good comparison of the two features.

    Not applicable

    Several of my customers require preservation of distribution group membership at the time a message was sent/received to meet their compliance requirements. This feature is currently not supported by the In-Place Hold and Litigation Hold features in Exchange 2013 and requires journaling. Journaling however is not an "In-Place" function since it creates multiple copies of messages and increases storage requirements. To help my customers not need the combination of journaling plus a third-party archiving tool I would like to see In-Place support for preserving DL membership. Will this become available in future CU's or a service pack?

    Not applicable

    Thanks

    with such great features I want to place myself in hold:)

    Not applicable

    @Sander Valkhoff: Note that if the messages are in mailboxes and preserved via In-Place Hold or Litigation Hold, they'll show up in eDiscovery searches. But you're right - holding in-place doesn't provide the expanded distribution group info that Journal reports do.

    Thanks for the feedback.

    Not applicable
    Are there any updates on the eDiscovery search preview feature? It looks very limited and broken. We cannot search or look for specific mailbox which are on hold rather it displays all the items at once. It would be nice to have search functionality in

    the preview page instead of copying the results to the discovery search mailbox and searching it in outlook.

    Not applicable
    Thanks for the quick reply! I have another question, I cannot find any documentation around an informational message in the ediscovery page "Keyword statistics are available for searches of 100 mailboxes or fewer." Does this mean it won't return results

    in the preview for anything 100 mailboxes or above? The documentation states the limit is 5000 mailboxes per inplace hold search entry.

    Not applicable
    Hi Bharat, I have configured a mailbox to use in-place hold but when i run Get-MailboxSearch -InPlaceHoldIdentity i can not find TargetMailbox : Target is this mean in-place hold is not working? serach also failed.
    Not applicable
    Hi Bharat!

    How fast that settings applies to mailboxes? Is it works immediate after turning on or it work with some delay? Are there any difference between that two features?
    Version history
    Last update:
    ‎Jul 01 2019 04:16 PM
    Updated by: