In-Place Hold and Litigation Hold in Exchange 2016

Organizations are required to preserve electronically stored information (ESI) including email, when there is any judicious expectation of litigation exists.

It could be all email related to a specific topic or all email for certain individuals. Depending on the organization’s electronic discovery (eDiscovery) practices, the following measures can be executed to preserve emails:

End users may be asked not to delete the emails; however, users can delete email knowingly or accidentally.
Automated deletion mechanisms such as messaging records management (MRM) can be stopped/ suspended. This could result in filling the user mailbox. In this also users can delete email knowingly or accidentally.
Can copy or move email to an archive to make sure it isn’t deleted, altered, or tampered with. This increases costs.

Failure to preserve email will uncover an organization by legal and financial risks such as scrutiny of the organization’s records retention and discovery processes, adverse legal judgments, sanctions, or fines. In order to overcome these issues and preserver the email/mailbox content Exchange server 2016 has two types of holds called Litigation Hold and In-Place Hold.

Litigation Hold: Litigation Hold uses the LitigationHoldEnabled property of a mailbox. When Litigation Hold is enabled, all mailbox items are placed on hold.

In-Place Hold: In-Place Hold preserves all mailbox and public folder content, including deleted items and original versions of modified items. All such items can be returned in an In-Place eDiscovery search. When a user’s mailbox is placed on an In-Place Hold, the contents in the corresponding archive mailbox (if it’s enabled) are also placed on hold and returned in an eDiscovery search. You can place multiple In-Place Holds on a mailbox, but Litigation Hold is either enabled or disabled for a mailbox.

NOTE: In both Litigation Hold and In-Place Hold, we can specify the duration period to hold items. The duration is calculated from the date a mailbox item is received or created. If a duration isn’t set, items are held indefinitely or until the hold is removed

Let us see how to create in-Place Hold in Exchange 2016:

Open EAC and Navigate to Compliance Management àClick on New:

In New in-place eDiscovery & hold window, provide Name and description for the hold and click on Next:

In the new Window, Specify the mailboxes whose mailbox needs to be on hold and click on Next:

In the search query window select one of the below and click on Next.

Include all content: Select this option to place all content of a mailbox on hold.
Filter based on criteria: Select this option to specify search criteria, like start and end dates, sender and recipient addresses, and message types.

NOTE: Filter Based on Criteria option will be available only when a user is member of Discovery Management Role Group, if not the option will be grayed pout as below:

In In-place Hold settings window select one of the below options and click on Finish to complete:

Hold indefinitely: this option will place the mailbox on hold for indefinite period/ Items on hold will be preserved until you change the hold duration, remove the mailbox (or public folders) from the search, or remove the search.
Specify number of days to hold items relative to their received date: Select this option to hold items for a specific period.

Saving the settings as below:

Before completing will get the warning as below, click on Ok to continue:

Once the operation is successful, will find the confirmation as below and close and finish the task.

Once done will find the in-Place hold as below in EAC:

Using power shell commands:

New-MailboxSearch “Hold-CaseId0o1” -SourceMailboxes “<email address of the mailbox>” -InPlaceHoldEnabled $true

Place an In-Place Hold on all public folders of an organization for one year

New-MailboxSearch -Name “Hold for Public Folders” -AllPublicFolderSources $true -AllSourceMailboxes $false -ItemHoldPeriod 365 -InPlaceHoldEnabled $true