2.8 Archiving Exchange and Office 365

How Message Deletion Works in Exchange

When users delete messages in Outlook, the messages are moved, by default, to the trash.

When users empty their trash, deleted items are moved to the mostly hidden Recoverable Items folder, where they are kept for 14 day before being removed from the disk.

In the interim, users can right-click the Trash to recover items, but they can also purge the items, which immediately deletes them.

If a hold is in place, purged items are moved to a Purged folder that is not user-accessible and kept there until the hold is lifted.

Set Retain Profile/Miscellaneous to Include Recoverable Items

In Retain, set Profile/Miscellaneous to Include user's recoverable items.

Setting Up a Distribution List

Placing the Distribution List under a 90-day Hold

Finding How Many Mailboxes Were Placed Under Hold

You can determine how many mailboxes were placed under hold with the following script:

((Get-Mailbox).InPlaceHolds).Count

Create a Retain Impersonation User

In the O365 Exchange Admin Center, create a Retain Impersonation user with a mailbox, making sure to give it a license.

Give the Impersonation user the proper rights. Under Permissions, create a new Admin Role (e.g. Retain Impersonation Management), add the ApplicationImpersonation right and the Retain Impersonation user as a member .

Create a Retain Administrator User

Retain needs a user with Administrator rights to download the address book from Office 365 every day with the Office 365 Address Book Synchronization Script. This can be an existing administrator account or you can create a separate one. It needs to have sufficient rights to see all the users in the address book.

Setting Up Access to Shared Mailboxes for the Impersonation User

Impersonation rights allow the Retain user to enter other mailboxes but those rights do not extend to shared mailboxes. To access a shared mailbox, the Retain user needs rights to each shared mailbox that is to be archived. These rights can be granted through the Exchange Management Shell.

For example, If the shared mailbox is owned by John Doe and your Retain impersonation account is Retain, you would issue the following command in an Exchange Management Shell (EMC):

Add-MailboxPermission -Identity "John Doe" -User Retain -AccessRights FullAccess -InheritanceType All -AutoMapping $false

Synchronizing the Address Book Using Office 365 (Microsoft GraphAPI)

To enable Retain for access to the Office 365 Address Book through the GraphAPI, it must first be registered on the Microsoft Azure Portal and then the information must be added to the Retain module:

Synchronizing the Address Book Using PowerShell Scripts

Retain includes two PowerShell scripts (under the Tools menu) for extracting address book information from Office 365.

Both scripts download the Office 365 address book and save it in two .csv files.

PowerShell Sync Script 1.0 saves the username and password in plaintext in the script.

PowerShell Sync Script 4.0 encrypts the password to a separate file.

Retain cannot archive members of the distribution lists if theHiddenFromAddressListsEnabled field: is set to True.

If using multiple modules, you must create separate folders for the script and the resulting .csv files. The folder location that Retain should pull the .csv file data from is set in the module as detailed below. You must also create a scheduled task for each script.

retain.bat
"C:\Program Files (x86)\WinSCP\winscp.com" /command ^
 "option batch abort" ^
 "option confirm off" ^
 "open scp://[user]:[password]@[retain server address]" ^
 "cd /opt/beginfinite/retain/RetainServer/WEB-INF/cfg" ^
 "option transfer binary" ^
 "put [file location on windows]*.csv" ^
 "close" ^
 "exit"

#Specify that all commands are run on the command line, while using ^ to split long lines for readability.
 "C:\Program Files (x86)\WinSCP\winscp.com" /command ^
# Automatically abort script on errors
 "option batch abort" ^
# Disable overwrite confirmations that conflict with the previous
 "option confirm off" ^
# Connect replacing your own username, password and retain server address
 "open scp://[user]:[password]@[retain server address]" ^
# Change remote directory
 "cd /opt/beginfinite/retain/RetainServer/WEB-INF/cfg" ^
# Force binary mode transfer
 "option transfer binary" ^
# Upload the file to current working directory
 "put [file location on windows]*.csv" ^
# Disconnect
 "close" ^
# Exit WinSCP
 "exit"

Granting Access to a Site Collection

For Retain to archive an attached document in Exchange, the Retain user must be added as a Site Collection Administrator in SharePoint/OneDrive.

Granting Access to Multiple Site Collections

If you need to provide site collection administration access to multiple collections, consider a soluction, such as the SharePoint Online Management Shell script.

Providing OpenID Access (Modern Authentication) to Users

Retain 4.9.1 lets users access Retain via a Log in with Office 365 button.

Retain redirects users to Office 365 and they then have 10 minutes to log in.

After successfully authenticating, users can access their Retain archive.

Configure the Exchange Module for Office 365

The Exchange module must be configured in the Retain Server before any communication between Retain and an existing Exchange message system can occur. Open the Retain management page on the Retain Server, and select Module Configuration.

Select the ‘Configure’ option in the Exchange module. A new window or tab opens with the module configuration.

Core Settings Tab

The Core Setting Tab allows you to disable all jobs and disable users logging into Retain.

The module needs to be enabled on this page to make it active in the Retain system.

The module can be given a name.

The Send Method lets you send Exchange items to an external system using FTP or SMTP.

In most cases this should be disabled so that items are archived in Retain.

To select the SMTP Forwarding or FTP features, you must first add and configure them in the Module Forwarding Tab on the Server Configuration page, otherwise the drop-down list is empty.

Normally all the checkbox options on this tab are enabled. It is rare that you would ever deselect any of them. Two cases where you might, would be: troubleshooting (as instructed by Technical Support), and retiring an old email system.

The Enable Address Book Caching function allows Retain to regularly cache the online email systems address book and synchronize it with Retain. This is critical for administration, authentication, and archiving purposes. It is recommended to cache the Address Book once every 24 hours to keep the Retain storage system up to date. By default, maintenance is set to cache the Address Book once every 24 hours.

The Enable Authentication checkbox determines if end-user authentication is performed when the user logs into Retain. If it is deselected, the Retain system cannot authenticate the user against the email system and the user cannot log in unless another authentication method is enabled.

The Enable Jobs checkbox determines if configured data retrieval jobs are ever passed to the Worker. Even if the individual job is fully configured and enabled, if this checkbox is switched off, no jobs configured for this module can be processed.

The Message body allows the administrator to decide whether to store either the HTML or plain text message body, or both.

Send Method

The Send Method lets you send Exchange items to an external system using FTP or SMTP.

In most cases this should be disabled so that items are archived in Retain.

To select the SMTP Forwarding or FTP features, you must first add and configure them in the Module Forwarding Tab on the Server Configuration page, otherwise the drop-down list is empty.

Impersonation Tab

If the Impersonation and Core Settings tabs are not completely configured with the correct information, the hosted system cannot be archived correctly.

Hosted Services Tab

Refresh the Address Book

After saving changes, return to the Retain Server's Module Configuration page, and trigger a refresh of the Address Book.

Depending on the size of the address book, it may take several minutes to return with information, but a successful configuration returns a correct address book cache date and no errors. The date should reflect the date when the address book refresh was triggered.

The Status may show “Address Book Cache Never Run” or may list commonly mis-configured or missed items if the Refresh job fails.

Once the status is configured and the Address Book has been cached, Retain can connect to and archive messages from the Exchange server. The system is ready to have workers, schedules, profiles, and jobs configured, and those options now appear on the main administrative interface.

The Address Book is refreshed whenever the button is pressed, during the nightly maintenance cycle, and before each job.

Configure the Exchange Module for Exchange without Access to Active Directory

The Exchange module must be configured in the Retain Server before any communication between Retain and an existing Exchange message system can occur. Open the Retain management page on the Retain Server, and select Module Configuration.

Select the ‘Configure’ option in the Exchange module. A new window or tab opens with the module configuration.

Core Settings Tab

The Core Setting Tab allows you to disable all jobs and disable users logging into Retain.

The module needs to be enabled on this page to make it active in the Retain system.

The module can be given a name.

The Send Method lets you send Exchange items to an external system using FTP or SMTP. In most cases this should be disabled so that items are archived in Retain. To select the SMTP Forwarding or FTP features, you must first add and configure them in the Module Forwarding Tab on the Server Configuration page, otherwise the drop-down list is empty.

Normally all the checkbox options on this tab are enabled. It is rare that you would ever deselect any of them. Two cases where you might, would be: troubleshooting (as instructed by Technical Support), and retiring an old email system.

The Enable Address Book Caching function allows Retain to regularly cache the online email systems address book and synchronize it with Retain. This is critical for administration, authentication, and archiving purposes. It is recommended to cache the Address Book once every 24 hours to keep the Retain storage system up to date. By default, maintenance is set to cache the Address Book once every 24 hours.

The Enable Authentication checkbox determines if end-user authentication is performed when the user logs into Retain. If it is deselected, the Retain system cannot authenticate the user against the email system and the user cannot log in unless another authentication method is enabled.

The Enable Jobs checkbox determines if configured data retrieval jobs are ever passed to the Worker. Even if the individual job is fully configured and enabled, if this checkbox is switched off, no jobs configured for this module can be processed.

The Message body allows the administrator to decide whether to store either the HTML or plain text message body, or both.

Send Method

The Send Method lets you send Exchange items to an external system using FTP or SMTP. In most cases this should be disabled so that items are archived in Retain. To select the SMTP Forwarding or FTP features, you must first add and configure them in the Module Forwarding Tab on the Server Configuration page, otherwise the drop-down list is empty.

Impersonation Tab

If the Impersonation and Core Settings tabs are not completely configured with the correct information, the hosted system cannot be archived correctly.

Enter the Impersonation user credentials.

Hosted Services Tab

Refresh Address Book

After saving changes, return to the Retain Server's Module Configuration page, and trigger a refresh of the Address Book.

Depending on the size of the address book, it may take several minutes to return with information, but a successful configuration returns a correct address book cache date and no errors. The date should reflect the date when the address book refresh was triggered.

The Status may show “Address Book Cache Never Run” or may list commonly mis-configured or missed items if the Refresh job fails.

Once the status is configured and the Address Book has been cached, Retain can connect to and archive messages from the Exchange server. The system is ready to have workers, schedules, profiles, and jobs configured, and those options now appear on the main administrative interface.

The Address Book is refreshed whenever the button is pressed, during the nightly maintenance cycle, and before each job.

Supported Exchange Forest Configurations

Retain supports:

Retain does NOT support multiple linked Exchange Forests. Ensure that the Exchange Settings have been configured correctly before continuing the Exchange module setup.

Exchange Prerequisites required for Retain

There are several prerequisites that need to be done in Exchange for Retain to successfully archive the mailbox databases:

Create the Retain Global Catalog User

To connect with Exchange, Retain needs a user with appropriate rights. This can be accomplished by using an existing user, or by creating a new one. It is recommended to create a new user for Retain archiving. If creating a new user, ensure that the user is an active user account and that the password does not change to ensure Retain can access mail without changing settings. This user is sometimes called a ‘service account’. Retain calls this user the ‘global catalog user’.

The user created or used for Retain must be a “mailbox-enabled user” with read access to see all other users, groups, resources, and Exchange Servers in the Exchange Forest. The user is utilized by both the Retain Server and the Worker for LDAP lookups in Active Directory. The Retain user also must have Exchange impersonation rights to every mailbox user on every server in the organization to be archived. The Retain user MUST NOT be a member of any Exchange Administrator group, as Exchange denies impersonation rights for all administrator accounts.

Additional permissions need to be added to the user created for Retain. The quickest way to add these rights is through the Exchange Management Shell.

After creating the new user in Active Directory, open the Exchange Management Shell.

Grant Impersonation Permissions to the Retain user.

In Exchange 2013 and 2016 Impersonation permissions can be granted in the Exchange Admin Center under Permissions.

Under Admin Roles create a new role (e.g. Retain Impersonation Management). Add the role "ApplicationImpersonation" and add the Retain User as a member.

You can also accomplish this via PowerShell commands using the Exchange Management Shell.

The commands required are different depending on the version of the Exchange Server. Exchange 2010, and 2013 require only one command per Exchange system to be issued, whereas Exchange 2007 requires the commands to be run on every Exchange server in the Exchange system to grant required permissions. If the Exchange system contains mixed 2007, 2010, and 2013 servers, the different commands must be completed on one server of each type.

Room and Equipment Resources

To archive Room and Equipment Resources, or to restore them, the Retain user, or Service Account, must also have delegation rights. These commands must be issued manually for each Room and Equipment or resource mailbox on every relevant server. This is required for 2013 and 2016.

These commands must be issued:

(‘Retain’ is used here as the name of the Service Account, or Retain user, and the ‘Mailbox Database’ should be changed to the appropriate name.)

(NOTE: every time a new Room and Equipment or resource mailbox is added, the first command must be re-run. )

Basic Authentication

Retain requires Basic Authentication to be enabled on each CAS Exchange server in the system for Autodiscover and EWS.

In Exchange Admin Center, go to Servers, then go to the Virtual Directories tab.

To check if this worked, run the following PowerShell cmdlets:

For EWS:

Get-WebServicesVirtualDirectory | ft server,basicauthentication

For Autodiscover:

Get-AutoDiscoverVirtualDirectory | ft server,basicauthentication

On Exchange systems prior to 2013 you may need to set basic authentication manually.

Open “Server Manager” on the Exchange server.

Configure an Exchange Module for On-Premise Exchange

The Exchange module must be configured in the Retain Server before any communication between Retain and an existing Exchange message system can occur. Open the Retain management page on the Retain Server, and select Module Configuration.

Select the ‘Configure’ option in the Exchange module. A new window or tab opens with the module configuration.

Core Settings

The module needs to be enabled on this page to make it active in the Retain system.

The module can be given a name.

The Send Method lets you send Exchange items to an external system using FTP or SMTP. In most cases this should be disabled so that items are archived in Retain. To select the SMTP Forwarding or FTP features, you must first add and configure them in the Module Forwarding Tab on the Server Configuration page, otherwise the drop-down list is empty.

Normally all the checkbox options on this tab are enabled. It is rare that you would ever deselect any of them. Two cases where you might, would be: troubleshooting (as instructed by Technical Support), or retrieving an old email system.

The Enable Address Book Caching function allows Retain to regularly cache the online email systems address book and synchronize it with Retain. This is critical for administration, authentication, and archiving purposes. It is recommended to cache the Address Book once every 24 hours to keep the Retain storage system up to date. By default, maintenance is set to cache the Address Book once every 24 hours.

The Enable Authentication checkbox determines whether end-user authentication is performed when the user logs into Retain. If it is deselected, the Retain system cannot authenticate the user against the email system and the user cannot log in unless another authentication method is enabled.

The Enable Jobs option determines whether job retrieve data and pass it to the Worker. Even if the individual job is fully configured and enabled, if this option is disabled, no jobs configured for this module can be processed.

The Message body allows the administrator to decide whether to store either the HTML or plain text message body, or both.

Send Method

The Send Method lets you send Exchange items to an external system using FTP or SMTP. In most cases this should be disabled so that items are archived in Retain. To select the SMTP Forwarding or FTP features, you must first add and configure them in the Module Forwarding Tab on the Server Configuration page, otherwise the drop-down list is empty.

Impersonation

If the Impersonation and Core Settings tabs are not completely configured with the correct information, the hosted system cannot be archived correctly.

Hosted Services

This tab is not used with an On-premise Exchange system.

Exchange Forest

Retain needs to know where to access the Global Catalog Host and existing domains before any archiving can be accomplished.

Open the “Exchange Forest” tab and enter the IP address or hostname of the Global Catalog Host.

Click on the Green Plus sign to add a search base. This should be set to the highest level of the LDAP domain so the entire address book can be found. For example: DC=exchange2013,DC=qa,DC=gwava,DC=com

Retain uses Active Directory extensively when integrating with Exchange. Its uses include: populating the address book, authentication, and access to the Exchange System.

There are settings required for Exchange, see Exchange Prerequisites required for Retain.

On the Exchange Forest tab, you configure all the Active Directory information you need for an Exchange forest. There is no need to fill out any information on the User Forest tab unless the users exist in a separate forest from the Exchange Forest.

On the Exchange Forest tab, specify whether to use SSL or not for the Global Catalog Security and the search base, (use of SSL with the Global Catalog Security and search base is highly recommended). The search base is the LDAP path to where Retain starts searching for valid Exchange users.

The Global Catalog Port defaults depend on whether SSL is used for security or not. (SSL is strongly recommended. Default ports are 3268 for plain text, and 3269 for SSL.) Adjust as appropriate for your system.

You also must provide the credentials of an Active Directory user. This user is special It must have full read rights to Active Directory, be a mailbox-enabled, user, and be granted various Impersonation and Delegation rights. More on this is discussed in Exchange Prerequisites required for Retain. The username must be in UPN format, (user principal name).

This search base, in LDAP form, must be high enough in the tree to include ALL users, groups, and servers. Multiple search bases can be specified, though it often results in a less efficient interface. These are LDAP search bases which allow Retain to resolve all users, groups, and servers of interest in the forest.

After the Search Base has been added, test the connection to ensure information and connection works. The test performs a simple login to confirm that the user exists, the Exchange Server is reachable, and that the credentials are accepted. The test does not confirm impersonation or delegation rights necessary for the Service Account.

If the test results in an error stating: “FAILURE: User doesn't exist or is not mail enabled,” It indicates that the user’s mailbox is unavailable. A mailbox is not required for Retain to utilize the specified user. If the user Retain utilizes does not have a mailbox, this error may be ignored. However, if the user specified does have a mailbox, this may indicate connection issues.

If the test results in an error with an LDAP error code 49 it is an authentication error. The important bit of information is what comes after the data field. That is the LDAP connection error code that applies to this case.

The Exchange Forest tab is the only tab required by the Server and the Worker to archive mail from the Exchange system. The User Forest tab, however, is required for Exchange systems utilizing a resource forest, to allow the end user to log in to Retain.

If the system contains a Resource Forest, enable the checkbox on the Exchange Forest tab and save changes. If the Resource Forest checkbox is not enabled, the User Forests tab is non-functional and all settings contained on that tab are ignored. The checkbox must be unchecked in a single forest Active Directory deployment, and it must be checked in a multiple forest Active Directory deployment.

Check all information to ensure that it is correct and save changes, and then configure the User Forest if required.

User Forest

The User Forest must have an entry for each user forest attached to the system.

Select the green ‘+’ button and input the LDAP information required by the Forests’ Global Catalog server: IP address or hostname, port, security, (SSL is strongly recommended), and all search bases to include all the users. No administrative credentials are required. Each end user’s provided credentials are used on login.

Delegates

You can set Retain to use delegate rights with On-Premise Exchange.

Finishing On-Premise Exchange

Save all changes before closing the Exchange Module page.

Refresh Address Book

After saving changes, return to the Retain Server's Module Configuration page, and trigger a refresh of the Address Book.

Depending on the size of the address book, it may take several minutes to return with information, but a successful configuration returns a correct address book cache date and no errors. The date should reflect the date when the address book refresh was triggered.

The Status may show “Address Book Cache Never Run” or may list commonly misconfigured or missed items if the Refresh job fails.

Once the status is configured and the Address Book has been cached, Retain can connect to and archive messages from the Exchange server. The system is ready to have workers, schedules, profiles, and jobs configured, and those options now appear on the main administrative interface.

The Address Book is refreshed whenever the button is pressed, during the nightly maintenance cycle, and before each job.

Exchange Distributions Lists

You can create distribution list in Exchange Admin Center to manage information dissemination. Retain queries Exchange for a list of users in each distribution list. While you can create a distribution list in Active Directory Users and Computers these changes are not reflected in Exchange and therefore Retain is unaware of them. If you want to rename a distribution group it must be done in Exchange or Retain will not see it.

Distribution lists can be hidden in Exchange. If a distribution list is hidden, Retain cannot see the users associated with the distribution list and cannot archive the distribution list. The distribution list will be marked as (hidden) in Job | Mailboxes | Distribution Lists.

Dynamic Distribution Lists cannot be seen by Retain because they only create a user list when a message is sent. Remember to refresh the address book if you want to see the latest list changes.

Shared Mailboxes, Rooms and Equipment

Impersonation rights allow the Retain user to enter other mailboxes but those rights do not extend to shared mailboxes. To access a shared mailbox the Retain user would need delegate rights to each shared mailbox that is to be archived. These rights can be granted through the Exchange Management Shell.

If the shared mailbox is owned by “John Doe” and your Retain impersonation account is "Retain", you would issue the following command in an Exchange Management Shell (EMC):

Add-MailboxPermission -Identity "John Doe" -User Retain -AccessRights FullAccess -InheritanceType All -AutoMapping $false

Exchange Message Dredging Process Overview

How does Retain get messages from Exchange?

enterMailbox
Discovered endpoint

2015-09-25 12:00:07,256 TRACE [RTWQuartzScheduler_Archive_Worker-1] com.gwava.caapi.MailboxArchivingStats: enterMailbox: JDoe@RETAIN.GWAVAUTAH
2015-09-25 12:02:14,177 DEBUG [RTWQuartzScheduler_Archive_Worker-1] com.gwava.ews.archiveimpl.process.ExchangeUser: Discovered endpoint: https://ad.test.sys/ews/exchange.asmxscreen

2015-07-22 00:25:25,056 TRACE [Thread-1341102] com.gwava.ews.RetainExchangeWebserviceFactory: retry, exception :
javax.xml.ws.WebServiceException: java.net.SocketException: Software caused connection abort: recv failed
at com.sun.xml.ws.transport.http.client.HttpClientTransport.readResponseCodeAndMessage(Unknown Source)
...
at com.gwava.ews.archiveimpl.process.CursorFetchThread.run(CursorFetchThread.java:1334)
Caused by: java.net.SocketException: Software caused connection abort: recv failed
at java.net.SocketInputStream.socketRead0(Native Method)
...
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:318)
... 27 more
2015-07-22 00:25:25,056 DEBUG [Thread-1341102] com.gwava.ews.RetainExchangeWebserviceFactory: EWS request failed: null. Will retry after 2 seconds

Exchange Journaling Mailbox

Using Exchange Journaling Mailbox is not recommended, but there are some situations where it is a viable option.

According to a Microsoft technician, they recommend at least 1 journaling mailbox per mail server. Exchange can only effectively support mailboxes under 5 - 10G. Exchange experiences performance issues when the Inbox exceeds 2500-5000 messages. http://blogs.technet.com/b/exchange/archive/2005/03/14/395229.aspx

This means that, once you enable a journaling mailbox, you should begin archiving its contents and using the Retain option to delete the items from the mailbox once archived. However, if there are delays in getting those journaling mailboxes archived, you should watch the size. If it gets to 5G, turn it off and re-route email to another journaling mailbox until you get all of them archived and emptied out.

Important note: As Retain archives the journal mailbox it creates a list of messages to be deleted but only sends the delete request when it exits the mailbox. If the job fails before it exits then the messages won't be deleted. Limiting the scope of the job to allow Retain to finish the job successfully ensures that the messages are deleted.

Large Attachments and/or Messages Cannot Be Archived From Exchange

Symptoms you may notice when experiencing problems with default IIS limitations:

15:15:15,668 RetainServerCommunication - Attempt to connect, but Server returned HTTP status (404): Not found (this line is typically repeated several times over the course of 5 minutes) 15:15:15,668 RetainServerCommunication - Giving up...too many retries! 15:15:15,668 ArchiveAttachment - Send a nice healthy blob:Archive: ERROR: Fatal Error Result=AddedEMails: 0, emailID=null, parentID=null 15:15:15,691 JobUtilities - HandleArchivingException

*Note: IIS is not supported by GWAVA. These are suggested methods for allowing Retain to archive large emails through IIS. For further information visit the MicroSoft support pages: http://www.iis.net/configreference/system.webserver/security/requestfiltering/requestlimits Some other useful information can also be found on the IIS forums: http://forums.iis.net/t/1066272.aspx

This may not be as much of an issue in Retain installations that were created with 3.x and later. The RetainWorker will now communicate, by default, directly to the RetainServer on port 48080 thereby bypassing IIS. If you'd like to change this for an older installation, change the connection address of the worker. See the manual (look up "Worker Configuration") for your particular installation for more information. You may still have this be an issue on your Exchange server when Retain tries to collect from it if there are message attachments or messages that are larger than whatever IIS is set to allow through. This would be a setting on the Exchange side that would need to be changed. Default is 30000000 bytes.

For getting exports out of Retain you can also choose to bypass IIS and use http://(RetainIP):48080/RetainServer. IIS integration is more of a convenience to point users at Retain so that you don't have to deal with port information in a URL and other advantages that this can provide.

IIS, by default, limits the amount of data that can be imported by Retain. You can remove, or at least mitigate, this limitation by changing 4 settings. This example will be assuming you'd like to archive files up to 931 MB.

Moving Users to a New Exchange Domain

If you need to move your users to a new Exchange domain without changing their email addresses (for example from user@organization.local to user@organization.org) you will need to use the moveMailboxes tool to keep the users associated with their existing archive, otherwise a new archive will be created for all users.

Exchange Concurrent Connection Limits

If jobs fail with the error: 421 4.3.2 The maximum number of concurrent connections has exceeded a limit, closing transmission channel.

It may be because we are hitting the maximum inbound connections per source limit connecting to Exchange. You will need to increase the MaxInboundConnectionPerSource parameter. See “Understanding message rate limits and throttling” for details.

Profile Functions

The Profile Functions tell the Retain Server what to do with the mail it archives from the messaging system. If Archiving is not enabled, mail will not be archived by Retain.

Archive Mark

Some users may opt to use the Archive Mark for messages that have been archived by Retain. The archive mark is a custom flag and may be modified, therefore is not secure and should not be used for compliance. Archive Mark slightly degrades job performance. Check the check box to enable Archive Mark for the selected profile.

When the Archive Mark is active, Retain creates a custom column for mail, called “RetainArchived” which users and administrators may add to their email client to view mail which has been archived. The “RetainArchived” column indicates an archived mail item by displaying a ‘1’ in the message row, while remaining blank when the message is not archived.

Messaging System Deletion

For systems where the administrator wishes to have archived messages removed from the system automatically, the Messaging System Deletion option may be used. Messaging System Deletion will remove messages from a mailbox after they are archived, according to the time frame specified in the settings. The amount of time to keep messages is specified in days. The recommended setting depends on the archiving scheme in the system. For example, if messages are to persist in the system for 30 days, then the system deletion setting should be set to 30 and enabled. A setting of 0 will remove messages from the system as soon as they are archived. Be sure to configure the system before enabling the setting in the profile.

However, it is recommended that the messaging system do the deletion rather than Retain.

Date Range to Scan

The Date Range to Scan instructs Retain to scan for, and archive, messages after, or before, a certain date. This is useful if only specific chunks or areas of mail are to be archived.

New Items: All items that have not been archived by Retain since the last time the job ran.

All Items in Mailbox: All items in the mailbox starting from 1/1/1970, duplicates will be processed but not stored if they already exist in Retain's archive.

Number of days before job start date and newer: Only items from the relative number of days from the time the job began will be archived. E.g. messages that came into the email system less than 7 days ago.

Number of days from job start date and older: Only items previous to the relative number of days from the time the job began will be archived. E.g. messages that came into the email system more than 7 days ago.

Specify custom date range: Only items between two absolute dates will be dredged.

Specify custom date range relative to job start: Only items between two relative dates will be dredged. E.g. messages that came into the email system between 7 and 5 days ago.

It is recommended to archive all New items.

Advance Flags

Enabling "Don't Advance Timestamp" will not update the timestamp flag. Items that are dredged will still be considered new by Retain the next time the job runs.

This is useful when troubleshooting, but is generally not used for normal jobs.