Information Discovery Cloud Archiving Services. Getting Started Guide

Transcription

1 Information Discovery Cloud Archiving Services Getting Started Guide Software release date: May 2014

2 Table of Contents I. About this document... 2 Intended audience... 2 Prerequisites... 2 Related documentation... 2 II. Get Organized... 3 Gather design notes... 4 The big picture POP3 Collector for Exchange envelope journaling... 5 The big picture SMTP collector for Exchange envelope journaling... 6 Prepare firewall for POP3 collection... 7 III. New Account Set Up... 8 Phone training available by request... 8 Archive provider tasks creating your new account and Account Owner Administrator... 8 Customer tasks Logging in and configuring the account... 9 Modifying account settings Billing information (read- only) IV. Collectors Non- mail items archived conditionally Draft and deleted items Supported server platforms Microsoft Exchange envelope journaling Working with collectors Adding POP3 Journal Mailbox Collector Exchange Journal Google Apps and SSL connection requirement Adding SMTP collector and trusted network Exchange SMTP SMTP and encryption as a best practice POP3 security with SSL as a best practice Adding Secure POP3 Collector Why use Secure POP3 Journaling? How do I configure Secure POP3 Journaling with Exchange? Configure Secure POP3 Collector in the Hosted Archive Service V. LDAP Integration VI. Test Search Start new test search Simple search

3 I. About this document In this chapter: Intended audience Prerequisites Related documentation Document conventions and symbols Documentation updates Subscription service Support Intended audience This guide is intended for customer administrators that just enabled the Archiving Service. This guide will help customers administrators and search administrator to confirm that archiving is properly enabled and to get quickly ramped up with the service s capability. Prerequisites Prerequisites for installing and using this product include: Concepts and principles of archiving Administrative Knowledge of your mail system Related documentation In addition to this guide, refer to other documents for this product: Cloud Archive Service Administration Guide. E- Discovery Administrator & User Guide. Cloud Archive Service online help accessible through links in the application 2

4 II. Get Organized In this chapter: Gather design notes The big picture POP3 Collector for Exchange envelope journaling The big picture SMTP collector for Exchange envelope journaling Prepare firewall for POP3 collection Microsoft TechNet Exchange journaling resources The archive service is a Software as a Service (SaaS) solution. The objective of this Getting Started Guide is to quickly identify and define the steps required to initially sign up and tune up your archive service within an hour and run a test search within 24 hours. The intended target audience of this document is customer administrators. Refer to the Cloud Archive Service Administration Guide and E- Discovery Administrator & User Guide for comprehensive details on how to leverage all features of your archive service after you have completed the first- day implementation steps. For example, you may wish to create additional users and collectors, fine tune system and user settings, fully explore robust search options, and run reports. This chapter is organized into the following sections: 1. Gather Your Design Notes. 2. The Big Picture POP3 and SMTP Collector high- level graphic overview. 3. Prepare firewall for POP3 Collection. 4. Leverage Microsoft TechNet Exchange Journaling Resources, if needed. 3

5 Gather design notes Get ready! First, gather your archive solution design consultation notes determined together with your archive service provider. These are required in order to begin the first day implementation process. Your design notes should include the following items: 1. Record NEW ACCOUNT SIGN UP HTTPS URL given to you by your archiving provider when you subscribed, for example in the format of: ( OR ( Chapter III, New Account Set Up, describes how to sign up and setup your new archive service account. Get set! 2. Messaging system location: customer premise equipment (CPE) or hosted. 3. Messaging system software vendor: for example, Microsoft Exchange. 4. Type of Collector: POP3 or SMTP. Chapter IV, Collectors, delineates instructions for your type of collector. Items two, three and four above are required to properly configure your archive service collector type. 5. LDAP integration for Microsoft Exchange users. Chapter V, LDAP Integration, delineates the instructions to configure the integration between Microsoft Active Directory (or OpenLDAP, or Novell edirectory) and the Archive service. Go! 6. Run a simple search as a test the next morning. Chapter V, Test Search, describes how to execute a simple search to test and verify that you have configured the archive service successfully. 4

6 The big picture POP3 Collector for Exchange envelope journaling Graphic overview to tune up your POP3 collector The figure above illustrates a high- level overview on steps to tune up your archive service POP3 Collector for Microsoft Exchange Envelope Journaling. Get ready! Refer to Chapter II, New Account Set Up. Get set! Refer to Chapter IV, Collectors. Go! Refer to Chapter V, Test Search. 5

7 The big picture SMTP collector for Exchange envelope journaling Graphic overview to tune up your SMTP collector The figure above illustrates a high- level overview on steps to tune up your archive service SMTP Collector for Microsoft Exchange Envelope Journaling. Get ready! Refer to Chapter III, New Account Set Up. Get set! Refer to Chapter IV, Collectors. Go! Refer to Chapter V, Test Search. NOTE: For more information about the distinction between POP3 (pull) and SMTP (push) methods, see Pull method and Push method. 6

8 Prepare firewall for POP3 collection Next, if you chose a POP3 solution, prepare your network for archive service POP3 collections. If your network already allows external POP3 sessions to your server(s), or you did not choose a POP3 solution, skip this section. It is important that you configure your firewall to allow the archive service to integrate with your messaging server(s). As a best practice, it is recommended that you configure the archive service to use encryption with secure POP3 access to your messaging server(s) to retrieve data regularly based on your collector schedule. The archive service uses Secure Socket Layer/Transport Layer Security to establish a secure POP3 session. All archived data is then encrypted and stored with a unique encryption key. To configure your firewall 1. Use the following typical settings for the internal IP address of your messaging server and POP3 port: a. RFC1918 Class A 10.x.x.x or Class C x.x IP address b. Well- known port 143 or Configure the external, public IP address used by your messaging server by logging in to your firewall administration management interface. a. Select Port Forwarding, network address translation (NAT) or Rules section. b. Create a POP3 port forwarding/nat rule to allow the external archive service traffic from/to your external public IP address to/from your internal private messaging server IP address(es). For example, port 110 to port 110. c. Allow TCP and UDP packets. 3. For increased security, stipulate external traffic from the following archive service IP subnetwork address ranges: Please contact your archiving support contact for the latest IP ranges for your environment. 7

9 III. New Account Set Up In this chapter: Archiving provider tasks creating your new account and Account Owner Administrator First notification of login credentials and URL Customer tasks Logging in and configuring the account Modifying account settings Billing information (read- only) When your company is ready to set up your new account, your archiving provider will initiate the process by creating a general account as well as the first account user, known as the Account Owner Administrator. Upon completion, the archive system will send you login credentials as well as your login URL. Then you will follow the series of steps described in this chapter to complete your account set up process. This chapter, New Account Set Up, covers those aspects of getting started having to do with account configuration. Refer also to the following chapters, User Administration and Collectors, in the Administration Guide for other essential set up tasks. Phone training available by request Your archiving provider provides documentation and videos to help administrators set up this archive service quickly and easily. However, should questions arise, you are welcome to request a 60- minute phone training session from your archiving provider. During the phone call, you will get a brief overview of each tab of the administration module, as well as troubleshooting support required to get the collectors running properly. Archive provider tasks creating your new account and Account Owner Administrator The archive provider pre- sales and support staff will work with you to gather the information needed to create your customer account and the first account user, known as the Account Owner Administrator. Information required by the archive provider to create your new account and Account Owner Administrator To complete the new account sign up process, your archive provider will gather the following information: 1. Account Owner Administrator information User name Password First and last name Phone number 8

10 2. Account site and name information Site name Display name Account type Number of users Address 3. systems in use Exchange Hosted Exchange GroupWise Lotus Notes Zimbra Kerio Google Apps As soon as your archive provider completes the process of creating your new account and the Account Owner Administrator user role, the archive system sends a notification to the Account Owner Administrator s address. Customer tasks Logging in and configuring the account Navigate to the login URL indicated in the initial notification to access the login screen shown below. Login screen Enter the username and password specified by the initial notification, then click Login. NOTE: For security purposes, you will be required to change the Account Owner Administrator password the first time you log in. 9

11 First- time login application landing page The first time you log into the application, you will see the Dashboard page shown below. Initial screen after logging in for the first time About the Account Owner Administrator role At this stage of the process, you have access to the Account Owner Administrator role. Only one Account Owner Administrator exists system- wide and is the only user who may view and modify account information. The Account Owner Administrator can be reassigned, and it cannot be deleted. NOTE: To reassign the Account Owner Administrator role, there must be at least one other user with Account Administrator permissions in the system. From the Account tab, select a user from the Account owner drop- down list. Only those users with Account Administrator permissions will display in the drop- down list. The essential job of the Account Owner Administrator is to take responsibility for the account level settings and configurations, as well as to create other system users as needed with their respective user permissions. See the User Administration chapter, in the Administration Guide for more information about user roles and permissions. 10

12 Modifying account settings After logging in as Account Owner Administrator, click the Admin link to navigate to the Administration Dashboard. Select the Account tab. (Note that only the Account Owner Administrator has access to the Account tab. No other users will be able to see it.) The Account Setup Account Owner field displays the initial Account Owner Administrator information entered by your archive proider during the setup process for your archive service. The Account Owner Administrator can modify this information if desired. You can select the Account owner field drop- down box to reassign the Account Owner to another user with administrator permissions after additional user administrator account(s) are created. (See User Administration chapter, in the Administration Guide for information on user configuration.) Click Update account to apply your edits. The Account Setup Site Name field displays the initial site name entered by your archive provider during the setup process for your archive service. The Site Name field can be modified by entering a new value. If you modify the Site Name field and click Update account, the archive system applies the change and immediately disconnects all active sessions. This action requires users to log in again and establish a new SSL session to the newly created HTTPS URL. Furthermore, inform all your end users of the new Account Site URL if end user access is enabled. End users may want to update their bookmarks. The system in use options allow selection of systems for archival during the New Account Sign Up process. It is possible to modify this configuration by selecting or deselecting the available options. If for some reason your archive provider has not already enabled the service on the backend, the following error message appears: The connection was refused by a firewall or the server. Please check IP/DNS, port and firewall rules and try again. Verify that your security settings are correct and contact your archive provider to ensure that you have identified systems in use to be archived and that they are enabled on the backend by your archive provider. Click Update account to apply any edits to the Account attributes. Set the time zone for the archive system The next account configuration task is to assign your Time zone stipulated in Greenwich Mean Time (GMT). From the Settings tab, select the appropriate time zone from the Time zone drop- down list, and then click Update. My Domains and Organizations The archive service has a facility for you to record the domain(s) that you are performing archiving for. The purpose will be to provide future reporting statistics within the service. Enablement of the feature is accomplished via sign- up of the archiving services, can be applied to the individual account by the AO role user or for the archive provider managing customers accounts via an API call if REST API integration has been accomplished. 11

13 Registering your domain through your Archive Portal The ACCOUNT tab is the location for the domain registration. Logon to the individual archive account; navigate to Admin - > Accounts. Scroll down the page until you locate 'My Domains and Organizations'. Enter your domain; select the 'Add' to provide additional domains. Once complete, press the 'Update Account' button at the bottom of the page. 12

14 Configuring account Subscription, Options, and Logo Account Subscription, Options, and Logo The Account Subscription, Options, and Logo page is displayed above. Account Subscription displays customer account subscription attributes. Account Status and Payment, Extras, and Options attributes are maintained by your archive provider based on your subscription terms. Contact your archive provider to modify service if desired. 13

15 Subscription Status and Payments Status: The archive service displays customer account status if entered by your archive provider through the backend; field options are Trial, Expired Trial, Paid Customer, and Demo. Customer since: The archive service displays day/month/year date when a customer subscribes if entered by your archive provider through the backend. Renewal date: The archive service displays day/month/year date when customer renews their subscription if entered by your archive provider through the backend. Payment Status: The archive service displays customer account payment status if entered by your archive provider through the backend; field value options are: Expired Trial, Past due, Invoice sent, Paid in full, Trial, Demo. Organization type: Available selections are Commercial, Non- Profit, Education, and Government. This data point is for informational purposes only. Organization users: Enter the number of organizational user mailboxes archived. The number of user mailboxes archived should match the number of licenses purchased. This field is used for report billing to indicate the upper limit you wish to set on your usage. The number you enter for this field should reflect the capacity that you intend to use. It is currently reported but not enforced. Subscription extras Historical collection: The archive service has been enabled for the collection of historical from your GroupWise environment. The system will allow historical collection of s from your active post offices. Data migration: The service is enabled to import legacy from a mail system or from a previous archive service. Contact your archive provider for more details. Global RAID Multiple copies: The base subscription to the archive service includes storage at eight physically separate data centers in the United States. Global RAID adds four additional data centers for extra protection. End user access enabled: The archive service displays 'end user access enabled' as Yes or No, as set by your archive provider through the backend. Yes means end users may access their personal archive through My Archive. If no, end users may not access My Archive. 14

16 Options Select applicable check boxes to enable the archive service to integrate with third party server software, client software, and compliance capabilities, or provide end users with HTTPS access. Options are: Enable GroupWise server integration: Select this checkbox to enable GroupWise integration with your GroupWise server. Enable POP3 integration: Select this checkbox to enable POP3 integration with your (Microsoft Exchange) mail server. Enable SMTP integration: Select this checkbox to enable SMTP integration with your Microsoft Exchange server. Enable NSF integration: Select this checkbox to enable LotusLive integration with your LotusLive server. Enable Lotus On- Premise Collection: Select this checkbox to enable the collector configuration page for your Lotus On- Premise collection. Enable Physcial Media and S3 Imports: Select this checkbox to be able to generate imports jobs from the admin section in the archive system. Enable compliance edition: Select this checkbox to enable compliance edition, which gives you access to Random search, search alert, and twice the standard maximum export size. Enable end user access to the archive (required for LDAP authentication): Select this checkbox to enable end users to connect to the archive service. Enable Outlook Client integration: Select this checkbox to enable integration with Microsoft Outlook Clients. Password expiration: Enter the number of days after which passwords expire. Leaving it blank or set at 0 means that your password will never expire. Intrusion lock: Stipulate the number of failed login attempts that triggers an account lock out. Available selections are: Off (disabled) 3 5 (default) 7 10 Account locked for: Stipulate the amount of time that a user account will be locked if intrusion checks fail: Indefinite (admin must enable) 15 minutes 30 minutes 60 minutes Any user role can potentially get locked out. If an Account Owner Administrator becomes locked out, they can: 1) Log in after the configured account lock period has expired; 2) Request a password reset from the initial login page; 3) Unlock the Account Owner Administrator by going to the Users tab and selecting the edit link next to the locked out user. 15

17 Using your company s logo You can upload your company s logo by clicking the Choose File button. The logo must be either PNG or JPEG format and be 200 pixels wide or less. The company logo displays on the initial HTTPS URL at logon, on the Administration Account UI, and on the Administration, Search, and My Archive Dashboards. Billing information (read- only) The read- only billing information form shown in the figure below is collected and entered into the archive service by your archive provider for your reference only. Account Setup Billing Information 16

18 IV. Collectors In this chapter: Non- mail items archived conditionally Draft and deleted items Supported server platforms Microsoft Exchange envelope journaling Working with collectors Adding POP3 Journal Mailbox Collector Exchange Journal Adding SMTP collector and trusted network Exchange SMTP SMTP and encryption as a best practice POP3 security with SSL as a best practice This chapter has the following objectives: 1. To describe the basic concept of Collectors. 2. To identify and define Collectors web- based User Interface attributes. 3. To describe all Collector types and configuration options. Collectors gather your data for archive storage. The basic concept of Collectors is to collect messages and attachments from your Microsoft Exchange systems for archiving. To determine the steps necessary to setup your archive service collectors, consider these two questions: 1. Where is my system located, customer premise equipment (CPE) or hosted? 2. What type of transport mechanism do I want to use to archive mail, POP3 or SMTP? Archive SaaS and Connectors Diagram The figure above illustrates three scenarios that answer the two questions posed. It shows Archive SaaS cloud with redundant, load balanced archive systems and connectors to the following mail systems: 1. SMTP hosted Microsoft Exchange Envelope Journaled mailbox 2. SMTP customer premise equipment (CPE) Microsoft Exchange Envelope Journaled mailbox 3. POP3 CPE Microsoft Exchange Envelope Journaled mailbox 17

19 Concept of Collectors Push and Pull Methodologies The figure above illustrates two collector methods possible for retrieving , POP3 or Pull, and SMTP or Push. The solid line shows the direction of the initial collector connection established to retrieve messages and the dotted line shows the direction of the retrieval of archived messages by the customer from the archive cloud. Pull method The archive service is configured with a Post Office Protocol (POP3) Collector that initiates a connection, at midnight GMT by default, to the source server and pulls all messages from the configured folders to the archive system. The timing of the connection to the source server can be changed by your archive provider Support to meet your requirements. This pull method utilizes POP3 IETF standard specifications and is used by the archive service for all platform- specific collectors, except SMTP. Push method The source system is configured to push envelope journaled messages to a unique Simple Mail Transfer Protocol (SMTP) address on the archive system. The time to initiate the connection is configured on the source system. This push method utilizes SMTP IETF standards and is used by the archive service for all SMTP Collectors. NOTE: SMTP collection will collect, index, and archive s up to 75MB in size by default. 18

20 Non- mail items archived conditionally Non- mail items, such as tasks and calendar items, do not get collected if there is only a single person involved. When non- mail items are created, the archive service collector does not archive them if it is not between two or more people. Specifically, if a calendar item is relevant to only one person, it is not archived. If non- mail items involve multiple parties, then they are archived. Draft and deleted items Draft and deleted items are not explicitly collected even when you may have selected those options in the archive service. By default the journal mailbox is equipped with a Draft and Deleted Items folder. However, through normal administration of a journal mailbox, no journal items should be placed in the Draft and Deleted Items folder. POP3 protocol as it relates to draft and deleted items Because of POP3 s protocol, if you delete an item in your Inbox by selecting it and pressing the Delete button, or by right- clicking it and selecting Delete, it is now in the Deleted Items folder and it is marked for deletion. Whereas if you drag an from your Inbox into the Deleted Items folder, the is not actually marked for deletion as far as POP3 is concerned. If you drag a draft item from your Inbox into the Draft folder, the archive service would collect and archive that. A work in progress that has not been sent is in a work in progress status and would not be collected. Items with a deleted status that are in the Deleted Items folder, or items with a draft status will not be collected. By default, the archive service displays the folders for Calendar, Deleted Items, Inbox, Drafts, and Sent Items. Supported server platforms On- premise server platforms The archive service currently supports two Collector object types: POP3 and SMTP. This is true for Microsoft Exchange 2003, 2007, and 2010 for on- premise servers. Hosted platforms The archive service supports Google Apps E- Mail, but limited to individual mailbox collections. No POP3 journaling is supported. The archive system support Microsoft Office

21 client integration Microsoft Outlook 2003, 2007 and 2010 are supported. Both have the ability to access the search functionality of the archive system through the client. Supported web browsers Internet Explorer 7.x Internet Explorer 8.x Internet Explorer 9.x Firefox 3 and above Safari 4 Safari 5 Google Chrome Both the 32- and 64- bit versions of the browsers are supported as applicable. Microsoft Exchange POP3 example One organization s unique and secure virtual stack is configured with an POP3 Collector that collects mail to be archived from the Microsoft Exchange server located onsite at the organization. Microsoft Exchange SMTP example A second organization's unique and secure virtual stack is configured with an SMTP Collector that collects mail to be archived from the organization's hosted SMTP server, co- located in the organization s Cloud Archive. Microsoft Exchange envelope journaling Microsoft Exchange 2003/2007/2010 utilizes Envelope Journaling. The concept of Envelope Journaling is to provide a company or organization with a method to enforce policies to comply with regulations regarding communication. A journaling agent monitors traffic for a given information store mailbox and all messages are copied to an envelope journaled mailbox. The envelope journaled mailbox is configured to connect to the archive service via SMTP for archiving and thereby captures and uploads all communication for forensic analysis if required, or any search function, through the Cloud Archive. Microsoft also offers an option called Microsoft Exchange Premium journaling. With Premium journaling, it is possible to perform more granular journaling with journal rules. This option allows an organization to configure journaling to capture individual recipients or members of distribution groups. Refer to Microsoft Exchange documentation for more information about this option. Please refer to the selected links below from the Microsoft TechNet Exchange Server TechCenter for more information on how to configure Exchange Envelope Journaling and SMTP. 20

22 NOTE: When SMTP journaling is used, the archive service does not maintain folder information for archived s. SMTP collection will collect, index, and archive s up to 75MB in size by default. Envelope Journaling and Microsoft Exchange 2003/2007 How to Create a Custom SMTP Recipient for Exchange Server 2003 Journaling us/library/bb124642(exchg.65).aspx How to enable standard journaling (not required with dedicated journaling server) us/library/bb124786%28exchg.65%29.aspx How to enable envelope journaling us/library/aa996378%28exchg.65%29.aspx Journaling and Microsoft Exchange 2010 Understanding Journaling us/library/aa aspx Create and Configure a Journaling Mailbox us/library/bb aspx Understanding Journaling in a Mixed Exchange 2003 and Exchange 2010 Environment us/library/aa aspx 21

23 Working with collectors Account owner and account administrator roles The only two user roles that have permissions to configure Collectors are Account Owner and Account Administrator. Users with one of these roles can configure Collectors through the archive service Administrator Collectors UI. Default Administration Collectors UI The figure above displays the Cloud Archive for E- Mail default Collectors HTTPS User Interface. The default Collectors HTTPS User Interface lists all previously configured Available Collectors. To quickly view a given mailbox, enter the mailbox name in the Mailbox name field to dynamically filter the record set being displayed. To edit a given mailbox, click its associated Edit link to its right. To create a new collector with its associated configurations, click the appropriate button. The proper steps to configure each collector type are explicitly delineated later in this chapter. Add POP3 Journal Mailbox Collector Configure SMTP Collector To view the collection history of all collectors, click Collection History to display each collection's Collector ID, the number of items archives, and the KBs or MBs of data collected. To manually initiate a collection, click Collect Now. A message displays at the top of the page stating 'Your request is queued for processing' by the archive service. The requested collection process initiates in approximately one hour to collect and ingest messages into your archive. 22

24 Account Options It is important to verify that your Account OPTIONS (see above) are configured to allow the archive service to interoperate with the appropriate system and collector type. If the archive service is not enabled to interoperate with a given system or collector type the associated GUI button to click does not appear on the Collectors UI. 23

25 Adding POP3 Journal Mailbox Collector Exchange Journal Add Journal Mailbox Collector Exchange Journal Navigate to the archive service Administration Collectors tab and click Add POP3 Journal Mailbox collector. The Add Journal Mailbox collector page displays (see above). To add an Exchange Collector for Microsoft Exchange mail servers, follow these steps: 1. Populate Server Name field with unique label for this mail system. 2. Toggle Interval dropdown box and choose Nightly, Weekly, or Monthly. 3. Populate IP/DNS field with public IP address or fully qualified domain name (FQDN). 4. Populate Port field with port number to establish a POP3 session from the archive service to the mail system. IETF POP3 well- known port numbers are 110 and 995, verify and enter port used on the mail system. 24

26 5. Select Use SSL checkbox if the mail server is configured for SSL. 6. Toggle Authentication Method dropdown box and select MD5 if enabled on the mail system. Default value is None. 7. Populate Username field with mailbox account username used to authorize archive service access. 8. Populate Password field with mailbox account username's password to authorize archive service access. 9. Toggle Max message size and select one of these values: 5MB, 10MB, 20MB, 30MB, 40MBs, 50MBs or 75MBs 10. Check Options Inactive checkbox to test, as a best practice. Deselect when you are ready to move from staging to production. 11. Click Test Config If parameters are correct a congratulations message is displayed. Click Add Collector to add the new POP3 Collector. The new Exchange POP3 Collector is then displayed in the Available Collectors UI. If parameters are incorrect an error message is displayed with possible solutions. 25

27 Google Apps and SSL connection requirement While configuring POP3 on a Google Apps instance, Test Config is successful only when the port is specified as 995 and the SSL checkbox is checked. Google Apps only allows SSL connections. Add POP3 Journal Mailbox Collector and Available Collectors - UI for Exchange Journal The figure above displays an example of an 'Add POP3 Journal Mailbox Collector UI. The figure below shows an example of a new Exchange collector type displayed in Available Collectors UI after successfully adding an Exchange POP3 Collector. 26

28 A new Exchange Collector type displayed Adding SMTP collector and trusted network Exchange SMTP Make sure you are logged in as Account Owner Administrator, then navigate to Administration - Account Options. Account Options Enable SMTP integration Account Options Enable SMTP integration is enabled by default, see figure above. To disable SMTP collections, log on to archive service Administration Account UI and deselect the Enable SMTP Integration checkbox. Click Update account at the bottom of the page to confirm modification. The archive service queues and processes the SMTP integration request and automatically generates a unique mailbox name hash. The mailbox SMTP address is then displayed on the Collectors UI. The mailbox SMTP alias is the address used to configure Microsoft Exchange Envelope Journaling as the recipient of forwarded messages from Exchange envelope journaled mailbox to the archive service Collector mailbox via SMTP. When SMTP Collection is enabled for the first time, the following message appears at the top of the Account page: SMTP Collection is enabled but you have not added any SMTP Trusted Networks. The Archive will not receive SMTP data until you define your SMTP Trusted Network.' 27

29 Configure SMTP collector Click Configure SMTP collector button to begin setup of the archive service to establish SMTP sessions between the archive service network and organization's server network. Add Trusted Network - SMTP Click Add Trusted Network shown in the figure above. New Trusted Network IP Range 28

30 In the NEW TRUSTED NETWORK UI (shown figure above) IP Range field enter the unique public IP address of your mail system, or IP subnetwork address of the segment where your system resides, in standard Classless Interdomain Routing (CIDR) IPv4 format, for example, dotted decimal address/# of subnetmasked bits. Click Create. SMTP Trusted Networks The figure above shows the SMTP TRUSTED NETWORK UI that now displays the new trusted network you just added (and any other previously configured SMTP trusted networks). NOTE: SMTP collection will collect, index, and archive s up to 75MB in size by default. SMTP and encryption as a best practice The Cloud Archive for E- Mail supports secure SMTP over TLS using STARTTLS. While this is not required, it is recommended as a best practice, and it is available for those who wish to take advantage of the additional security. By configuring your SMTP sending server with a preference to SMTP/TLS when delivering journal , the TCP session will be encrypted. POP3 security with SSL as a best practice Whenever possible, it is recommended as a best practice to use SSL to encrypt the connection between the archive and your server. If SSL encryption is not possible, please consider using SMTP instead of POP3. Use SSL certificates created by reputable certificate of authorities (CA) to ensure the best possible secure connection. Try to avoid self- signed certificates since they may not pass tests to verify the true owner. You can create your own firewall rules to accept only inbound POP3 connections from the archive's published IP address ranges. You can also use NAT and port redirection to obscure your public POP3 port (110 or 995) to a random high number. 29

31 Adding Secure POP3 Collector Secure POP3 journaling is making journaled messages available in a POP3 mailbox that is accessible to your archive provider's archiving process. The POP3 mailbox will be checked daily by your archive provider s archiving process for mail to archive, once the mail is securely archived it will be deleted from the POP3 mailbox. Secure POP3 can be used to fetch with any platform supporting that protocol. The mail system will need to support some type of journaling functionality or the system would need to be configured to BCC copies to a mailbox. Why use Secure POP3 Journaling? By configuring Secure POP3 Journaling, all s are extracted from the Journal mailbox on your internal server to your archive. Once your archive has downloaded all the s from the Secure POP3 server and uploaded it to the archive, s will be automatically deleted from the Secure POP3 server and the archive will close the connection to the server. How do I configure Secure POP3 Journaling with Exchange? To configure Secure POP3 Journaling, there are multiple configuration steps, which are required in your Exchange environment, as well as other changes, which need to be made to your archiving account. It is important to follow the steps to ensure that all applicable s are journaled. Note: To implement Secure POP3S, a valid SSL certificate (public, or in certain instances a self- signed certificate) is required. Your archive provider strongly recommends the use of public trusted certificates. Before enabling Journaling on your Exchange server ensure the following have been completed: 1. Create a new Dedicated Journal Mailbox within Active Directory. (e.g. ArchiveJournal) Note: Ensure the password settings are configured to not expire, the user cannot change the password and the account will not lock out. 2. Set the Microsoft Exchange Secure POP3 service to start automatically, start the service. 3. Configure your company s network firewall to allow port 995 (encrypted) communications to the Exchange server containing the journal mailbox from the archive service IP address. 4. Configure Exchange Journaling: Exchange How to Enable Exchange Journaling us/library/aa996378%28exchg.65%29.aspx Exchange How to Enable Standard Journaling us/library/bb124786%28exchg.65%29.aspx Exchange Configure Authentication for Secure POP3 30

32 us/library/bb124498(v=exchg.141).aspx Configure Secure POP3 Collector in the Hosted Archive Service To set up the Secure POP3 collector in the Archive user interface, follow these steps: 1. Login into your Archive account as the Account Administrator. 2. Select Collectors page. 3. Click on Add POP3 Journal Mailbox Collector (note: if you do not see the Collectors tab, be sure you are logged in with an account that has Administrator credentials). 4. Follow the steps described in the screenshots below. Add Journal Mailbox Collector POP3 31

33 To verify that your collector has been setup properly, you can use the Perform POP3 Test Collection button. The feature performs a Secure POP3 collection, which will collect 200 messages but DOES NOT delete the s from the mail server. This feature can be used even if the collector is set to INACTIVE. Configure POP3 Collector Test Collection Note: Once successfully configured, the Collection History counts (button under Collectors tab) will reflect mail collected via Secure POP3 collection, as well as the Dashboard statistics under the Data Collected Since YYYY- MM- DD field. 32

34 V. LDAP Integration LDAP integration is designed to help your streamline user provisioning, management, and authentication. This feature relieves the administrator(s) from the hassles of manually managing archive users. In order to configure LDAP integration, please follow these steps: NOTES: LDAP needs to be enabled by your archive provider administrator to appear in the Account Admin settings page. The sn, given name, mail, username, and password have to be filled out on the LDAP server for integration to successfully complete. 1. Log on to your Archive as an administrator and go to Administration - Settings - LDAP integration tab. Administration Settings LDAP integration 2. Provide your LDAP server connection settings: a. LDAP server Hostname or IP address for the LDAP server. b. Port Enter the port number: 636 can be used for LDAP over SSL. LDAP server connection 3. Provide your username and password for the LDAP integration account: a. Service User Name Enter the distinguished name of an account with permission to search the LDAP directory. This is basically an account with permission to query the LDAP server. b. Service Password Password on the network, for read- access only to the LDAP server. 33

35 LDAP User name and password 4. Describe how the service should locate and identify archive users: a. Base DN The distinguished name of the users container or Active Directory tree. b. User Filter The filter that should be used to identify users that should have access to the archive. User filter is a LDAP filter string that is used to select those records within the base DN. c. Pull in all e- mail aliases associated with user accounts Select this checkbox to synchronize all e- mail addresses associated with user accounts. This will pull primary, aliases, and all proxy addresses for your end users, populating their My Archive accounts accordingly. LDAP Base DN and user filter NOTES: By default, servers that are performing user authentication and management connect to the LDAP server using LDAP over SSL (port 636). The administrator is not able to choose to use standard LDAP (port 389 by default) rather than LDAP over SSL (port 636). The administrator can provide any port number as long as it is configured with his LDAP server and uses a secure (SSL) connection 5. Test your configuration. It is important that you test your LDAP configuration before saving any settings you provided above. a. Test User Name Provide a user name for a user account that should have access to the archive. It will be used to validate the settings you provided above. b. Test Password Provide a password for the test account. This password will not be saved. c. Click on Test Config to test the accuracy of your LDAP configuration settings. 34

36 LDAP Testing your LDAP configuration NOTES: Test config fails In case your configuration test fails, you will see a message displayed below the Test Config button telling you what errors there are and which fields need to be modified. Test config succeed In case your configuration test succeed, you will see a message displayed below the Test Config button telling you that your LDAP configuration settings are accurate. 6. Once you are done testing your LDAP configuration and that the archive system has validated your LDAP configuration settings, click on Save Settings to save your settings and enable LDAP integration. LDAP Save settings 35

37 VI. Test Search In this chapter: Start new test search The archive service HTTPS Search UI is a secure, web- based user interface for users to create, execute, manage, view, and export searches. The archive service Search functionality is based on the concept to provide you - the search administrators - with the capability to efficiently and effectively query archived message data within stringent security parameters. The objective of this chapter is to identify and define steps to execute a simple search as proof- of- concept to verify connectivity and a successful search. Determine desired parameters to configure a simple search. For example, create a search named Test, optional tag of test, and a range of this month if you uploaded recent data set for testing, with a search term you know would invoke a hit, such as your company's product name or school superintendent name if you work for a school system. After you initiate a collection cycle by clicking Collect Now, wait approximately 12 to 24 hours to allow the archive service to establish a session with your message server so that it can retrieve and archive message data. The time required to execute a search depends on the number of GB or TB of data to search and criteria, ranging from milliseconds upwards. Refer to the E- Discovery Administrator & User Guide for comprehensive details about the system's extensive search features. Dashboard Statistics Log in as Account Owner Administrator and view your default dashboard. If your archive service collection cycle completed successfully, your dashboard statistics will be updated. If updated, follow the instructions to execute a simple search. If not updated, wait and check again later. 36

38 Start new test search Search Archive User Interface 1. Click Start new search to initiate configuration of a new simple search. A Simple search is the easiest method to run a search with basic criteria. 37

39 Simple search Start New Search - Simple tab 2. Create New Search - Simple tab is selected by default. a. Populate the Name field. 38

40 Start New Search - Simple tab - Search terms b. Populate the Search terms field with search criteria. Separate multiple search terms with a comma delimiter. For a simple test search, you may wish to try 'YourCompanyName' or 'SEC' or any term you know appears in archived messages to guarantee a return. c. (Optional) Choose one of two options to Limit Search within a date range: - Click the Range field dropdown box to select preconfigured date range. - Click the calendar icon to define custom date range Begins on parameter. Click the calendar icon to define custom date range Ends on parameter. Note that if you leave the Ends on parameter empty, the search will automatically include the most current results each time you run it. This would be beneficial for an on- going investigation. d. (Optional) Populate the Tags field or click Tags link to view previously created Tags. Tags are optional and not required for your test search. Tags are used to categorize searches. You use tags to expeditiously review searches associated with a given tag. For example, harassment. e. (Optional) Select from the drop- down legal hold menu whether you want to display 1) all results 2) only results on legal hold 3) exclude results on legal hold. Note that this field can be used as the unique search criteria. f. (Optional) Click the Permissions link to and assign user permissions. Options are Access, Change Scope, and Export. g. (Optional) Enter a Note to describe the search. h. Click Save and display results to execute your search and display results, or i. Click Save and return to list saves your search and returns to DISPLAYING ALL SAVED SEARCHES search list with your newly created search added to the saved search list. Review search results to verify successful setup and tune up of your archive service. Congratulation! If search results are unexpected, double- check your search terms are known working goods, or try modifying criteria to ensure parameters selected will invoke search result data set returned. Please contact your service provider if further assistance is required. 39