Retention Hold and Litigation Hold in Exchange 2010
Published Aug 16 2011 09:10 AM 85.9K Views
Microsoft

In Exchange 2010, you can place a mailbox on retention hold or legal hold. Both holds serve a different purpose. It's important to understand the functionality provided by both.

Retention Hold: As the Messaging Records Management page in the EMC suggests (see Figure 1), retention hold is used to halt retention policy, which means the Managed Folder Assistant (MFA) does not move or delete items from the mailbox. It's typically used when a user may not have mailbox access for an extended duration, for example, when the user's on vacation. You can also use retention hold during the initial phase of MRM deployment and remove it as users become more comfortable with MRM functionality.

Should users access their mailbox when it’s on retention hold, they may notice that items aren’t being deleted or moved to archive. Mailbox size increases as more email accumulates and you may need to raise the user's mailbox quotas to ensure mail flow to and from the mailbox isn’t interrupted.

The mailbox owner or any user (or process) with mailbox access can delete messages when the mailbox is on retention hold. Deleted messages are not treated any differently when a mailbox is on retention hold. Deleted items are retained until the deleted item retention period (14 days by default) and then deleted permanently. See the Retention Hold section in Understanding Retention Tags and Retention Policies for more details.

When placing a mailbox on retention hold, you can specify a start date and an end date. This allows you to configure retention hold in advance, and have it end at a predetermined date. Takeaway: retention hold is for planned activity, suspends move or delete actions taken by the MFA. If you haven't deployed either MRM feature (Retention Tags or Managed Folders), retention hold is unnecessary.

Note: When you archive-enable a mailbox, the Default Archive and Retention Policy is automatically applied to the mailbox if it doesn't have a retention policy.

Litigation Hold: Litigation hold, also known as legal hold, is used to preserve mailbox items for discovery before and during legal proceedings, investigations or similar events. The goal is to preserve mailbox items from inadvertent or purposeful modification or deletion by the mailbox owner or any user with mailbox access, and also automated deletion by processes such as the MFA. Unlike retention hold, you can’t configure litigation hold to start and end at a specified date – it’s either enabled or not. Until the hold is removed, deleted items are not purged from the mailbox database. If mailbox items are modified, a copy of the original item is also retained. These are returned in Discovery searches performed when the mailbox is on litigation hold. See Understanding Litigation Hold for more details.

When you place a mailbox on litigation hold, Exchange also populates the LitigationHoldDate and the LitigationHoldOwner properties, which can be useful for tracking purposes. Note that an administrator can modify both of these properties. Administrator Audit Logging is the best place if you're looking for reliable audit trail of admin actions.

Tip: You can run a litigation hold report from the Exchange Control Panel by going to Roles & Auditing > Auditing > Run a litigation hold report....

Mailbox quotas for mailboxes on hold

Both types of hold will result in more data being stored in a mailbox. Understandably, both may require some adjustments to storage quotas. Mailboxes on retention hold may require higher mailbox quotas because the MFA doesn’t delete items or move them to the user’s archive mailbox.

Mailboxes on litigation hold don’t require a higher mailbox quota because the user and MFA continue to delete messages, which are then retained in the Recoverable Items\Purges folder until the hold is removed. In Exchange 2010, Recoverable Items does not count towards the mailbox storage quota because it has its own quota. For details, see Understanding Recoverable Items.

At 20 GB and 30 GB, the Recoverable Items Warning Quota and Recoverable Items Quota are set to fairly high defaults. Depending on how long a mailbox user is on litigation hold and the volume of email the mailbox receives, the Recoverable Items folder may reach its quota limits. It’s recommended that you monitor the size of Recoverable Items folder for mailboxes on litigation hold.

To check Recoverable Items folder size for all mailboxes on litigation hold:

Get-Mailbox -ResultSize Unlimited -Filter {LitigationHoldEnabled -eq $true} | Get-MailboxFolderStatistics –FolderScope RecoverableItems | Format-Table Identity,FolderAndSubfolderSize -Auto

If the Recoverable Items folder is close to its quota limits, you can raise the Recoverable Items Quota for the mailbox – the simple solution and also the recommended one. Alternatively, you can use Search-Mailbox to extract messages from the folder and store them in another mailbox. See Clean Up The Recoverable Items Folder for the step-by-step procedure.

This command sets the Recoverable Items Warning Quota and Recoverable Items Quota for a mailbox to 40 GB and 50 GB:

Set-Mailbox “Mailbox User” –RecoverableItemsWarningQuota 40GB –RecoverableItemsQuota 50GB

Note: A user’s archive mailbox also has a Recoverable Items folder. Although the same RecoverableItemsWarningQuota and RecoverableItemsQuota apply to the primary and archive mailbox, they're not combined but calculated separately (i.e., 30 GB for the primary mailbox and 30 GB for the archive, if enabled).

Informing the user about litigation hold or retention hold

When you place a mailbox on litigation hold or retention hold in Exchange 2010, you can populate the comment field using the EMC or the Set-Mailbox cmdlet. The comment shows up in the Backstage area in Outlook 2010 and can be used to inform the user about either hold. You can also include a URL to internal hold policies or other documentation.

Screneshot: Placing a mailbox on litigation hold using Exchange Management Console
Figure 1: Placing a mailbox on litigation hold using the EMC

When you place a mailbox on litigation hold, Exchange alerts you that it may take up to 60 minutes for the change to be processed.

Screenshot: Exchange 2010 alert displayed when placing a mailbox on litigation hold
Figure 2: Warning displayed when you place a mailbox on litigation hold

Although litigation hold is processed by Exchange in that period, the litigation hold comment does not show up in Outlook 2010 until the MFA has processed the mailbox. Depending on the assistant’s work cycle, it may take as long as 1 day (the default work cycle configuration on Exchange 2010) for the comment to be displayed in Outlook. To make the comment show up sooner, you can manually kick off the assistant against a mailbox.

Start-ManagedFolderAssistant “Mailbox User”

To have the assistant process multiple mailboxes, you’ll need to pipe output from the Get-Mailbox cmdlet, which can use recipient filters to filter mailboxes, or use distribution group membership.

Additionally, LitigationHoldEnabled, LitigationHoldDate and LitigationHoldOwner are filterable properties in Exchange 2010. This means you can filter Get-Mailbox output using these properties and start the MFA against all mailboxes you’ve placed on litigation hold on a certain date.

This command retrieves all mailboxes places on litigation hold by Paul Singh after 8/14/2010.

Get-Mailbox –Filter {LitigationHoldEnabled –eq $true –and LitigationHoldDate –gt “8/14/2010” –and LitigationHoldOwner “Paul Singh”} | ft Name,Litigation*

Once you’ve examined the list of mailboxes returned by the above command, you can start the MFA to process them.

Get-Mailbox –Filter {LitigationHoldEnabled –eq $true –and LitigationHoldDate –gt “8/14/2010” –and LitigationHoldOwner “Paul Singh”} | Start-ManagedFolderAssistant

After the Managed Folder Assistant has processed a mailbox, the hold comment is displayed in Outlook 2010. The user is not required to restart Outlook.

Screenshot: Hold comment and link displayed in the Backstage area in Outlook 2010
Figure 3: The hold comment along with any links for more information, if configured, is displayed to the user in Outlook 2010

Exchange 2010 has a number of features to help you meet your organization's compliance goals. For more details, see Messaging Policy and Compliancein Exchange 2010 documentation.

Bharat Suneja

9 Comments
Not applicable

Mistake in one of the commands above for getting the stats.

It should be -FolderScope instead of just -scope

Not applicable

@Jason: Thanks for catching that - fixed!

Not applicable

Something that everyone here should know, however, is that Outlook 2010 will only show these options if it is installed as a stand-alone install or as part of the Office 2010 Professional Plus bundle. All Policy and Archive options are disabled if you install as any other bundle including Standard, Small Business, Home & Student, or Professional.

I spent the past two weeks on the phone with Microsoft Product Support painstakingly troubleshooting this because nobody seemed to know about this limitation! It's buried as a footnote on the Office product comparison chart.

Not applicable

@GoogThings2Life: Thanks for the feedback, and sorry about your experience!

Note, Outlook licensing requirements are listed in

License requirements for Personal Archive and retention policies

(aka.ms/outlooklicensereq) in Microsoft Office documentation. For volume licenses, it lists:

- Outlook 2010 stand-alone

- Outlook 2010 included with Microsoft Office Professional Plus 2010

The doc is also linked from

Understanding Personal Archives > Client Access to Archive Mailboxes

(aka.ms/personalarchives) in Exchange 2010 documentation.

Not applicable

'Litigation Hold: If mailbox items are modified, a copy of the original item is also retained.'

This is also true if a mailbox has been enabled for Single Item Recovery, correct?

Martijn

Not applicable

@Marijn: Correct. Copy-on-write, which saves a copy of the original item, also kicks in when you enable Single Item Recovery for a mailbox. See

Understanding Recoverable Items (http://aka.ms/recoverableitems) for more info.

Not applicable

@Bharat ... No apologies needed from the Exchange Team. But it IS a very *dumb* idea on the part of the Outlook team.

Retention policies and personal archive are features of Exchange... not Outlook. Outlook is just a UI for accessing those features... same as OWA. What's absurd is the fact that after licensing standard and enterprise CALs for your Exchange users to have the feature, we're told that we have to spend an additional $150+/computer for what is essentially a second copy of Outlook OR spend that much on a higher level suite that contains a lot of things we neither want or need in our business. It's blatant double-dipping on the part of the Office team. I mean, how is it logical that the feature is enabled on the standalone copy but not on the standard or small business suites? I hope you'll do me (and your customers) a favor and pass this complaint onto the Outlook product team to fix for the next release or service pack.

Anyway, I do apologize for ranting on this post about the issue, but given the increasing number of posts about this subject it's something that is going to seriously impact your customers more and more.

Not applicable

@GoodThings2Life: I've passed on your feedback to the relevant folks.

Note, you can use OWA to access both Personal Archives and Retention Policies.

Not applicable

Could you please tell why even Ediscovery admin cannot delete the items which is in legal hold using Search-mailbox -deletecontent? You have to remove the mailbox from legal hold first. Thanks.

Version history
Last update:
‎Jul 01 2019 04:01 PM
Updated by: