MSExchangeGuru.com

In-Place hold is an e-discovery feature introduced with Exchange server 2013. In-place hold helps an Administrator to decide what items under mailbox to hold and how much time to hold.

Using this we can achieve various tasks with respect to Mail Preservation. Mail preservation is precarious if the company is faced with litigation and needs to perform any electronic discovery (Any process in which electronic data is stored and can be accessed via intent to use it as evidence).

In Exchange 2013, we can use In-Place Hold for the following purposes:

• Place the complete user mailboxes on hold
  
• Preserve any mailbox items already deleted by users or automatic deletion processes such as MRM
  
• Use query-based In-Place Hold to search and retain the items matching with specified conditions
  
• Preserve items for infinite period of time or for a specific duration
  
• We can place user mailbox on multiple holds for different analyses
  
• Keep In-Place Hold transparent from the user by not having to suspend MRM
  
• Enable In-Place eDiscovery searches of things that are placed on hold
  

We will see how to create in-place hold

In order to place a mailbox on hold, the administrator/any user who is doing this task must be added to discovery management role-based access control (RBAC) role group or assign the legal hold and mailbox search management role. In-place hold uses recoverable items to folder to keep the items which are under hold.

Using EAC:

EACàCompliance ManagementàIn-Place eDiscovery & holdàNew as below

Provide the name and description as below:

Specify the mailboxes to be on hold

Specify the duration for the hold:

 

Using Powershell:

Create In-place hold:

New-MailboxSearch "Hold-CaseId130" -SourceMailboxes "Paul@ MSExchanGeguru.Local " -InPlaceHoldEnabled $true
						

To verify:

Get-MailboxSearch

To remove in-place hold:

Set-MailboxSearch “Hold-CaseId130” -InPlaceHoldEnabled $false

Remove-MailboxSearch “Hold-CaseId130”

 

 

Note:

1. Using EAC, we cannot select more than 500 resources for in-place hold
   
2. We can keep maximum of 10,000 mailboxes under one in-place hold. If we want to keep more then we need to create multiple in-place holds.
   
3. In-place hold settings may take up to 60 mins to take effect, depending on your Active Directory topology and replication latency.
   
4. If you want to keep more than 10,000 mailboxes/entire mailboxes in an organization on hold, recommended and easiest method is to use Litigation hold feature. Using Litigation hold we can keep entire mailboxes in an organization on hold at a time using shell command.
   

Place a mailbox on Litigation Hold:

Using EAC:

EACàRecipientsàMailboxesàselect the mailbox which needs to be place on litigation hold and Edit

 

 

In Mailbox propertiesàMailbox featuresàLitigation holdàEnable

Under the new window you can leave the message to the user which mailbox is under litigation hold, which will appear for the user when they open the mailbox with outlook 2010 and or later:

Click on Save and you will receive a warning as below, click ok on the warning window:

You can verify the same under EAC as below:

Using Powershell:

Enable Litigation Hold for infinite duration:

Set-Mailbox test4@ MSExchanGeguru.Local –LitigationEnabled $true

Enable LitigationHold for specific period:

Set-Mailbox test3@ MSExchanGeguru.Local –LitigationEnabled $true –LitigationHoldDuration 365

To remove the Litigation hold:

Set-Mailbox test3@MSExchanGeguru.Local –LitigationHoldEnabled $false

In order to place all mailboxes in an organization on litigation hold for 1 year use the below command:

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -ne “DiscoveryMailbox”} | Set-Mailbox -LitigationHoldEnabled $true -LitigationHoldDuration 365

NOTE:

Litigation Hold setting may take up to 60 minutes to take effect.

Ratish Nair

Microsoft MVP | Exchange Server

Team @MSExchangeGuru

Posted August 21st, 2014 under Exchange 2013. RSS 2.0 feed. Leave a response, or trackback.