Archiving Service Administrator Guide

Transcription

1 Archiving Service Administrator Guide This guide introduces the MessageLabs Archiving Service and provides step-by-step instructions for system setup, user management, policy management, reporting and analysis. The content of this guide focuses on the periodic configuration tasks performed by either IT or compliance department staff. Service Version 3.0 Guide Version

2 Table of Contents 1 Preface Guide overview Guide objectives Intended audience Prerequisite knowledge 5 2 Introducing the MessageLabs Archiving service MessageLabs Archiving service overview How the MessageLabs Archiving service works Understanding the archiving process Understanding attachment stubbing Understanding supervision Appliance configuration scenarios External access configuration scenarios 13 3 System setup System requirements Setup overview Network configuration Configuring Exchange 2000/ Configuring Exchange Active Directory configuration Preparing for MessageLabs Appliance configuration Installing the MessageLabs Appliance Configuring a MessageLabs Appliance Changing the MessageLabs Appliance configuration Configuring Exchange for stubbing Installing Proxy for External Access 33 4 Accessing the Archiving interface Introducing the MessageLabs Archiving interface Logging in to and out of the MessageLabs Archiving interface 36 5 Setting up user access rights Understanding user access Assigning user access rights Giving users search access to additional mailboxes Setting up user access from Outlook 38 6 Setting up user groups Understanding MessageLabs Archiving user groups Assigning users to roles or departments Assigning members to partners 41 2

3 7 Setting up rules Rule overview Auto-Tag rules People-based rules Content-based rules File-based rules Date-based rules InfoTag-based rules 47 8 Setting up InfoTags Understanding InfoTags Creating InfoTags Disabling or hiding InfoTags 49 9 Setting up your electronic communications policy About your electronic communications policy About the MessageLabs Policy Engine MessageLabs Policy Engine basics Policy statement entries Retention policy entries Acceptable use policy entries Review policy entries Organizing your policy Activating Your Policy MessageLabs policy documents Setting up supervision review About the review process Review scenarios Supervision reviewers Managing stubbing policies About the stubbing process About stubbing policies Creating, modifying or deleting a stubbing policy Activating or suspending stubbing Changing priority of stubbing policies Disposition of messages About disposition Performing disposition Viewing audit trail About the audit trail Viewing the audit trail 70 3

4 14 Reporting and analysis Overview of available reports Running reports Archive size report activity report user activity report Stubbing Activity report Supervision Summary report Supervision Activity report Supervision History report Policy Violations report Risk report Retention Policy report Disposition History report Policy Versions report Membership report 77 Appendix A: Troubleshooting archiving issues 78 A.1 User directory issues 78 A.2 Archiving issues 80 Glossary 81 4

5 1 Preface 1.1 Guide overview This guide introduces MessageLabs Archiving and provides step-by-step instructions for system setup, user management, policy management, reporting and analysis. The content of this guide focuses on the periodic configuration tasks performed by either IT or compliance department staff. 1.2 Guide objectives This guide will help you: Prepare your environment for installing the MessageLabs Appliance. Install and configure the MessageLabs Appliance for use. Manage user access rights. Manage user groups for use in search and policy functions. Understand how MessageLabs Archiving manages your electronic messaging policy and uses it to drive both archiving and, optionally, supervision tasks. Create and manage an electronic messaging policy and deliver that policy to employees as a published document. Create and manage a stubbing policy. Analyze usage patterns and archive size/growth. Confirm compliance with acceptable use policies. Identify compliance problems that require action. 1.3 Intended audience This guide is designed for the information technology staff who manage the Exchange Server environment and the compliance department staff who are responsible for establishing and enforcing the organization s electronic messaging policy. 1.4 Prerequisite knowledge MessageLabs Archiving uses a web-based user interface that closely simulates a Windows-based environment. You should be familiar with common functions such as selecting multiple items using the Shift key and checking or clearing checkboxes. You should understand your company s existing electronic messaging policy. You should also understand your industry s regulatory obligations. To facilitate the creation of your policy, several templates are available from MessageLabs. While each of these templates was developed with industry experts, ultimately you are responsible for ensuring that you maintain a policy that is appropriate for your organization. 5

6 2 Introducing the MessageLabs Archiving service This chapter explains the MessageLabs Archiving service components and how they interact, and provides a background to your configuration efforts. It also explains choices for configuring the service for internal and external access. 2.1 MessageLabs Archiving service overview MessageLabs provides a complete archiving service that can protect your organization from legal liabilities and regulatory risks while improving storage management and end-user productivity. MessageLabs Archiving s easy-to-implement, easy-to-use application offers fully secure archiving with robust search and discovery, supervision and enforcement features. MessageLabs Archiving infrastructure Securely stores your electronic messages for the retention period you specify while keeping them fully searchable and retrievable in real-time. At any time, archived messages can be easily viewed, retrieved to your inbox, or sent to an Outlook data file. MessageLabs Policy Allows you to design, edit, and maintain your electronic messaging policy, including retention, enforcement, and supervision rules. MessageLabs Discovery Lets you perform advanced and comprehensive searches across the message header, message body, and content of over 250 types of attachments, helping you to easily meet even the most stringent discovery requirements. MessageLabs Stubbing Allows you to manage mailbox sizes by removing storage-intensive attachments from Exchange while keeping those attachments accessible to Outlook users MessageLabs Supervision Allows you to implement a systematic supervision process for selecting and reviewing the content of electronic messages based on your organization s policy for acceptable use of . MessageLabs Reports Provides you with detailed reports to help properly assess patterns and behavior. Additional reports are also available to help evaluate the effectiveness of your policies and their enforcement. 2.2 How the MessageLabs Archiving service works Locally integrated, hosted service The MessageLabs Archiving Service represents a new approach to outsourcing: the hybrid service. It provides an integrated archiving service with robust search and discovery, supervision and enforcement features. Your data resides in encrypted format on the MessageLabs Archiving infrastructure, a highly secure, reliable and scaleable infrastructure based on a distributed network and storage architecture. You are also provided with the MessageLabs Appliance that resides within your corporate network behind your firewall. The MessageLabs Appliance is a sealed fixed-purpose server (in standard 1U rack mount form) that is installed within your corporate network to provide the tight integration and security typically only afforded to internal systems. At the same time, the vast majority of search processing and all of the storage is maintained on the MessageLabs Archiving infrastructure, reducing overhead and maintenance headaches. The MessageLabs Appliance provides integration with Microsoft Exchange to ensure reliable, native format message archiving. Its integration with Active Directory facilitates unified login and access control management. The MessageLabs web-based archiving interface (where authorized users perform searches and optionally review messages) is provided on the MessageLabs Appliance for fast, local response times. Finally, as the MessageLabs Appliance is the only holder of your encryption keys used with the MessageLabs Archiving Encryption, any processing that involves encryption or decryption happens on the MessageLabs Appliance 6

7 2.2.2 Archiving encryption MessageLabs uses a proprietary approach to working with your data called Archiving Encryption. This approach allows MessageLabs to maintain your data without having the encryption keys. Your MessageLabs Appliance has the encryption keys, but does not maintain your data. As a result, your data can never be viewed without access to both your MessageLabs Appliance (which resides within your network) and the MessageLabs Archiving infrastructure. Figure: Graphical representation of the MessageLabs Archiving infrastructure showing how Archiving Encryption works As the MessageLabs Archiving infrastructure will only accept requests from IP addresses tied to the appropriate MessageLabs Appliance, even theft of your MessageLabs Appliance doesn t compromise the security of your data. Since all data within the MessageLabs Archiving infrastructure is encrypted using your keys, even if intruders penetrated the heavily secured infrastructure, they would only see meaningless encrypted data. Certified duplicate copies of your data are maintained in multiple data centers to further guard against modifications Policy driven An electronic communications policy that includes a retention policy can be your organization's best defense against legal liabilities, helping ensure compliance with numerous regulations. If your organization uses , instant messaging or other forms of electronic communications, it is critical that you: Have an electronic communications policy in place. Properly educate your employees on the policy's importance. Consistently enforce your policy. MessageLabs Archiving is policy driven, which means that it forces you to have an electronic communications policy in place and it consistently enforces your policy. 7

8 2.3 Understanding the archiving process Understanding Exchange Journaling (Exchange 2000/2003) Microsoft Exchange 2000/2003 features a capability called message journaling which, when enabled for a mailbox store (a database used to organize multiple mailboxes), places a copy of each message that is sent or received in a journaling mailbox. Of the three types of journaling that can be enabled, the MessageLabs Archiving service uses Bcc journaling. If a message is addressed to multiple internal recipients that belong to the same mailbox store, it is copied only once to the journaling mailbox. As a result, the archiving service only archives a single copy of the message. There must be one journaling mailbox per mailbox store Understanding Exchange Journaling (Exchange 2007) Microsoft Exchange 2007 features a capability called message journaling, which places copies of each message sent or received in a journaling mailbox. You can enable journaling either for individual mailbox databases (each of which contains multiple mailboxes) or for the entire organization. If you choose to enable journaling for individual mailbox databases, you configure those databases to copy all their messages to a specific journaling mailbox. You will need one journaling mailbox per mailbox database. If you choose to enable journaling for the entire organization, you use a Journal Agent on the Hub Transport server, through which all messages pass, to specify the location of the organization s journaling mailbox How MessageLabs Archiving uses journaling mailboxes The MessageLabs Appliance accesses the journaling mailbox to retrieve messages for processing. It copies groups of messages (batches) into a batch subfolder of the journaling mailbox, then retrieves the messages, encrypts them and sends them to the secure Archive. When the MessageLabs Appliance receives confirmation from the archive that the batch of messages has been fully archived, it deletes the batch subfolder from the journaling mailbox. This pull and confirm process ensures that no information is lost, even in the event of a network or appliance failure. 8

9 2.4 Understanding attachment stubbing What It Is Attachment stubbing is a background process that replaces attachments (which are stored in Exchange) with a much smaller stub that points to the copy of the attachment that is stored in the MessageLabs Archive. The original attachment can be retrieved from the archive at any time for viewing or forwarding purposes What the user sees The message appears the same as the original message. However, a stubbed attachment appears as an HTM file, which allows for the retrieval of the original attachment from the MessageLabs Archive rather than from Exchange. Figure: User view of stubbing How It Works On a nightly basis (the exact time is configurable), a stubbing process visits mailboxes and replaces attachments with stubs. The mailboxes this service visits, and the rules it uses to determine what attachments to stub, are defined in a stubbing policy. Unlike archiving, which happens as soon as a message is sent or received, stubbing occurs at a point in the future (for example, 30 days after a message is sent or received). 2.5 Understanding supervision MessageLabs Supervision allows your company to set up a process for systematically reviewing electronic messages for compliance with your acceptable use policy entries. Setting up and using this module involves: Defining what acceptable use means and how to recognize it. This is done through your electronic messaging policy. Identifying messages that may not be acceptable. This is done by the system. Either all such messages or only a random sample of them are moved to a review queue accessible only to authorized users. Randomly sampling messages to be spot-checked by someone to see if they are acceptable. The system performs the sampling and moves the messages to the review queue. Reviewing messages for compliance. This may be the responsibility of a single individual or a group of people. Supervision can be set up so that one person can decide whether or not a message is acceptable or so that experts in particular areas (such as human rights) need to be involved in that decision. Analyzing compliance and risk, performed by senior managers or executives using MessageLabs reports. 9

10 2.6 Appliance configuration scenarios Your needs may be satisfied by a single MessageLabs Appliance. However, for a high volume of data, or geographically-separated local area networks, you may require additional appliances. This section describes the various possibilities, from the basic configuration of a single MessageLabs Appliance, to cases that address situations of high load or physical separation The Basic Configuration Figure: A single MessageLabs Appliance at a location with one Exchange Server The basic installation, which is appropriate for a small to medium-sized company, consists of a single MessageLabs Appliance that archives messages from a single Exchange Server. The above figure illustrates this arrangement. While this is the simplest configuration, it illustrates many of the requirements for more complex arrangements: The MessageLabs Appliance must connect to the Exchange Server and Active Directory locally, not over a wide area network connection. If you have multiple locations with their own Exchange servers, you will need at least one appliance at each location. During configuration of your first MessageLabs appliance, your company s unique encryption key is generated for you. If you require additional appliances, the same key will be needed for all other appliances. 10

11 2.6.2 Multiple MessageLabs Appliances at a Single Location Figure: Three MessageLabs Appliances at a single location The above figure illustrates the situation where the volume of traffic or search usage patterns requires extra processing power, which is achieved by assigning specific purposes to separate MessageLabs Appliances. Archiving, exporting, and stubbing are background batch processes, so it is acceptable that they build a backlog periodically. Search and other user interface tasks are interactive, requiring immediate responsiveness, which is why it may be desirable to isolate them from batch processing. This arrangement illustrates these additional points: A MessageLabs Appliance can serve one or more of four general purposes: Archiving messages Serving the user interface Exporting messages Stubbing attachments All purposes must be covered. No matter what the division, each purpose must be assigned to at least one appliance. Purposes can be shared across appliances in order to balance loads. Any of the purposes can be assigned to any MessageLabs Appliance, so any number of appliances may be called into service. For example, only two appliances could be used, so long as all purposes are being met. Your company s encryption key is generated during the configuration of your first MessageLabs Appliance. All other appliances must be configured with the same encryption key. 11

12 2.6.3 Multiple Exchange servers and MessageLabs Appliances at a single location You are not restricted to just one journaling mailbox (or Exchange server) when configuring MessageLabs Appliances. The following figures are representative of cases where there are multiple appliances and multiple journaling mailboxes. To simplify the diagrams, only two appliances and two Exchange servers (each with one journaling mailbox) appear, but in practice there could be more of each. Also, the single MessageLabs Appliances shown in the figures could easily be expanded to multiple appliances with specific purposes, as was shown earlier. In this case, each MessageLabs Appliance archives messages from a single journaling mailbox, and stubs attachments from a single Exchange server. This arrangement is satisfactory when both Exchange servers are equally busy, and relatively little fluctuation in their loading occurs. Figure: Two MessageLabs Appliances connected to two Exchange Servers at a single location When issues of load balancing arise, another configuration (shown on the left) is possible. Load balancing can be achieved by connecting both MessageLabs Appliances to the journaling mailboxes on both servers. In this scenario, both appliances can also be configured to stub attachments in both Exchange servers. Figure: Two MessageLabs Appliances connected to both Exchange Servers at a single location 12

13 2.6.4 Multiple Locations If you have multiple office locations (sites), each with their own Exchange environment, you will need multiple appliances. Figure: Multiple locations Each location can be modeled on any of the foregoing scenarios. All locations store messages in a single MessageLabs Archive, providing unified enterprise searching for legal discovery purposes. You can balance loads by adjusting the number of MessageLabs Appliances at each location and assigning specific purposes to them. You must ensure that the appliances at each location provide complete coverage for the MessageLabs Appliance purposes: archiving, UI, stubbing, and export. 2.7 External access configuration scenarios The MessageLabs Archiving service supports external access for users wanting to search the archive and/or retrieve stubbed attachments. For security reasons, the MessageLabs Appliance should never be placed outside your firewall, so this access is handled through an HTTP proxy (strictly speaking, this is a reverse proxy ). This proxy allows external users to search the archive and/or to retrieve stubbed attachments using the Outlook user interface. This section describes several alternative configurations for external access, using either the proxy provided by MessageLabs (the recommended approach) or your own proxy. Using the MessageLabs Archiving proxy offers several advantages: It installs on your Exchange server, allowing it to use the same DNS entry and digital certificate as that server. It can load balance requests between any number of MessageLabs Appliances at a location. MessageLabs will monitor the proxy to ensure that it is configured properly. For stubbing, the proxy provides the publicly available URL that allows original attachments to be retrieved, via a MessageLabs Appliance, from the MessageLabs Archive where they exist. When users access the MessageLabs Archiving Interface from an external location, the search interface and stubbed attachments both retrieve information from the MessageLabs Appliance. This interaction is handled through the proxy. 13

14 Standard Configuration: Single Exchange Server In the configuration illustrated below, a single Exchange Server is in use. Users access the archiving service in Outlook by connecting directly to the Exchange Server, which is where the MessageLabs Archiving proxy will be installed. Figure: Single Exchange server 14

15 Standard Configuration: Front End Exchange Server In the configuration illustrated below, two Exchange servers are used. A front end Exchange server, residing between two firewalls, is used for external access. A back end Exchange server, behind a firewall, is used for internal access. Typically the front end Exchange server acts as the SMTP mail gateway and does not hold any mailbox databases: these are on the back end Exchange server, which is also where journaling takes place. The MessageLabs Archiving proxy is installed on the front end Exchange Server. This configuration provides greater security. Figure: Front End Exchange Server If your environment contains more than one Exchange server, the proxy needs to be installed on each of those servers. 15

16 Advanced Configuration: Custom Proxy If you choose not to use the proxy provided by MessageLabs, you will need to ensure that the proxy you use has all the necessary certificates and security authentications. You will also need to configure the proxy to connect to the appropriate MessageLabs Appliance at the location. You will also need to create a DNS entry that points to your proxy that is available for resolution internally, externally and when connected over VPN (as appropriate). The illustration below shows a possible configuration: please consult MessageLabs for assistance before proceeding with this option. Figure: Custom proxy 16

17 3 System setup This section provides an overview of the setup process as well as step-by-step procedures for setting up the network, and for configuring Exchange and Active Directory. It also contains instructions on configuring and changing the configuration of MessageLabs Appliances. These steps must be performed before MessageLabs Archiving can be enabled for use. 3.1 System requirements Exchange requirements MessageLabs Archiving is designed to work with the following versions of Microsoft Exchange: Microsoft Exchange 2000 with Service Pack 3 installed Microsoft Exchange 2003 with Service Pack 1 installed Microsoft Exchange Network requirements The MessageLabs Appliance requires outbound Internet Connectivity with a static IP address that is accessible internally. The appliance needs to connect to the Internet, but the MessageLabs Archiving infrastructure does not need to connect to the appliance User access requirements To work with the MessageLabs Archiving interface, users must use Internet Explorer version 5.5 or higher on a Windows PC. Internet Explorer must be configured to allow JavaScript and popups. 3.2 Setup overview This guide contains the information needed to set up the MessageLabs Archiving service. In general, this is a two-step process. Step 1 involves setting up a single MessageLabs Appliance and giving a single user access so that you can confirm everything is working correctly before adding more users. To do this, you: Plan the configuration see Introducing the MessageLabs Archiving service in section 2) Configure your network to allow the MessageLabs Appliances to communicate with the MessageLabs Network see Network configuration in section 3.3 Configure journaling in Exchange see Configuring Exchange 2000/2003 in section 3.4 or Configuring Exchange 2007 in section 3.5 Configure Active Directory and set up a single user for testing purposes see Active Directory configuration in section 3.6 Install the first MessageLabs Appliance see Installing the MessageLabs Appliance in section 3.8 Configure the first MessageLabs Appliance see Configuring the first MessageLabs Appliance in section Confirm that archiving is operating properly by logging on to the MessageLabs Archiving user interface and searching for messages explained in the MessageLabs Archiving User Guide. 17

18 Step 2 involves expanding your configuration to include more MessageLabs Appliances (if required) and more users. To do this, you: If using multiple MessageLabs Appliances, install and configure them see Installing the MessageLabs Appliance in section 3.8 and Configuring additional MessageLabs Appliances in section Configure the MessageLabs Stubbing module see Configuring Exchange for stubbing in section 3.11 If providing remote access, plan the configuration and set up remote access see External access configuration scenarios in section 2.7 Give users access to MessageLabs Archiving functions see Setting up user access rights starting in section 5. Set up user groups see Setting up user groups starting in section 6. Create your electronic messaging policy see Setting up your electronic communications policy, starting in section 9. Configure MessageLabs Supervision review see Setting up supervision review, starting in section

19 3.3 Network configuration Connectivity options The MessageLabs Appliance talks to the MessageLabs Archiving infrastructure through one of several connectivity options. These options include: HTTPS port 443 HTTPS port 443 with a router or firewall-based access control list (see below) HTTPS port 443 over a Virtual Private Network Connection (contact MessageLabs for details) For more information on these options, contact MessageLabs Router or firewall configuration (optional) For maximum security, MessageLabs highly recommends that you configure your router or firewall with access control lists that prevent the MessageLabs Appliance from communicating with anything other than the MessageLabs Archiving infrastructure. See the documentation for your router or firewall for instructions on setting up access control lists. Your rules should be configured as follows: For MessageLabs Appliances located in the US Source IP address of the MessageLabs Appliance Destination Port 443 For MessageLabs Appliances located in the UK and Europe Source IP address of the MessageLabs Appliance Destination Port

20 3.4 Configuring Exchange 2000/ Updating Exchange installation Apply service packs as necessary Creating a new user account and journaling mailbox A new user account and mailbox that will become the Journaling Mailbox is required for archiving. Depending upon whether you want to configure journaling to feed data between Exchange servers, you may need a separate user account/mailbox per storage group and/or Exchange server. To create a new user account and journaling mailbox: 1. On your primary Exchange Server, open the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, and connect to the domain in which you want to create the user. 2. Right-click the organizational unit in which you want to create the user. 3. Click New, then User from the menu. 4. Enter a full name and a user login name for example, messagelabs_archive or, in the case of multiple journaling mailboxes, messagelabs_archive_nn, where nn is a sequence number for the journaling mailbox. 5. Click Next. 6. Enter a value for password (and verify password). Set the username must change password, user cannot change password and password never expires options in accordance with your company s policies. Record the login name and password; you will need them when you configure the MessageLabs Appliance. Note: If you allow the password to expire, you must change it manually and reconfigure the appliance each time it changes. 7. Click Next. 8. Ensure that the Create an Exchange address check box is checked. 9. Click Next. 10. Click Finish. The user account and mailbox will be created. 11. Right-click on the new user and choose Properties. 12. On the Exchange General tab, click Delivery Restrictions. 13. Under Message Restrictions, select Only from. 14. Click Add. 15. Enter the name of the new user. The journaling mailbox must be configured to only receive mail from itself. 16. Click Check Names, then OK, then OK. Note: The journal account should not have any size restrictions applied to it. In addition, no Exchange Server rules should be applied to the account, especially rules that might move or delete messages from the account Exchange journaling configuration MessageLabs uses the BCC journaling feature in Exchange to copy all the messages to the journaling mailbox (as set up above). Journaling should be enabled about one or two days before the MessageLabs Appliance is installed so a small number of messages are ready for archiving Enabling standard journaling Before you enable BCC journaling, you must enable standard journaling on each mailbox store in your organization for which you want BCC journaling enabled. Enable journaling only on those mailbox stores that you want to archive. To enable standard journaling: 1. On the Exchange server that has the mailboxes that you want to archive, open Exchange System Manager. 2. Expand Servers, expand <your Exchange server>, expand <storage group> 3. Right-click the mailbox store and choose Properties. 4. On the General tab, select Archive all messages sent or received by mailboxes on this store, and then click Browse to specify a mailbox as the journaling mailbox. 5. Select the journaling mailbox (as set up above, for example messagelabs_archive@yourdomainname.com). All journaled messages for senders on this mailbox store will now be sent to the specified mailbox. 20

21 3.4.5 Enabling BCC journaling BCC journaling is standard journaling with the added ability to capture BCC recipients. When BCC journaling is enabled, Exchange captures all recipients (including BCC recipients) that are known at the originating server. In order to enable BCC journaling, you must set a registry key. Note: Failure to enable BCC journaling will mean that messages will be archived without the BCC recipient information. To enable BCC journaling: 1. On the Exchange server that has the mailboxes that you want to archive, open Regedit 2. Add the Parameters key (if it doesn t already exist) on the Exchange server in the following location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeTransport\Parameters 3. Add the following registry value within the Parameters key: a. Value name: JournalBCC b. Data type: Dword c. Data value: 1 Figure: Registry entry for enabling BCC journaling Note: The above information about setting the registry key is contained in the Microsoft Knowledge Base article , "XADM: BCC Information Is Lost for Journaled Messages in Exchange 2000." 3. Once the additional registry key and value are added, restart the Simple Mail Transfer Protocol (SMTP) service and the Microsoft Exchange Information Store service so that the changes will be recognized. Note: For more information on the journaling feature, see the following Microsoft reference article Configuring Exchange Overview Configuring Exchange 2007 for journaling requires that you: Create a journal account/mailbox. Configure your mailbox databases to point to this journaling mailbox. or Create a journaling rule to send messages from the Hub Transport Server to this journaling mailbox. 21

22 3.5.2 Creating a New User Account and Journaling Mailbox A new user account/mailbox needs to be created for journaling activities. To create a new user account and journaling mailbox: 1. On your primary Exchange server, open the Exchange Management Console. 2. In the tree, expand Recipient Configuration. 3. Right-click on Mailbox and choose New Mailbox. 4. Select User Mailbox. 5. Click Next. 6. Select New User. 7. Click Next. 8. Choose the Organizational Unit in which you want to create the account. 9. Enter the full user name and a user login name. For example, messagelabs_archive. 10. Enter a value for password (and verify password). Set the username must change password, user cannot change password and password never expires options in accordance with your company s policies. Record the login name and password: you will need them when you configure the MessageLabs Appliance. Note: If you allow the password to expire, you must change it manually and reconfigure the appliance each time it changes. 11. Click Next. 12. For Mailbox Settings, leave the Alias at its default, ensure the correct Server, Storage Group and Mailbox database are selected. 13. Click Next. 14. Confirm the configuration summary settings are correct. 15. Click New. Exchange System Manager will attempt to create the user account and mailbox. 16. Once the wizard has completed successfully, click Finish. 17. In the tree, click Mailbox. A list of mailboxes will be displayed. 18. Right click on the mailbox and choose Properties. 19. On the Mail Flow Settings tab, select Message Delivery Restrictions. 20. Click Properties. 21. For Accept message from, select Only senders in the following list and click Add. 22. Select the mailbox created earlier. 23. For Reject message from, ensure No senders is selected. 24. Click OK. 25. Click OK Enabling Journaling for Individual Mailbox Databases Enabling journaling for individual mailbox databases requires you to configure the mailbox databases to point to the corresponding journaling mailbox. To configure journaling for individual mailbox databases: 1. In the Exchange Management Console, expand Server Configuration, then click on Mailbox. 2. Right click on the mailbox database and choose Properties. The Mailbox Database Properties screen appears. 3. On the General tab, enable the Journal Recipient checkbox. 4. Click Browse and choose the mailbox created in the previous procedure (see Creating a New User Account and Journaling Mailbox in section 3.4.2), then click OK. All journaled messages for senders in this mailbox database will now be sent to the specified mailbox. Repeat these steps for each mailbox database to be journaled Enabling Journaling for the Entire Enterprise Enabling journaling for the entire enterprise requires you to set up a journaling rule that will determine which messages get journaled. Note: You can set up rules to only journal messages for specific mailboxes, if desired. Hub Transport-level journaling is only supported in the Enterprise version of Exchange

23 To configure journaling for the entire enterprise: 1. In the Exchange Management Console, expand Organization Configuration, then click on Hub Transport. 2. In the Toolbox Actions pane, click New Journaling Rule. The New Journaling Rule screen appears. 3. Enter a name for the journaling rule in the Rule name field. 4. Click Browse in the Journal address area and choose the mailbox created in the previous procedure (see Creating a new user account and journaling mailbox in section 3.4.2). 5. Click OK. 6. Make sure the Global option (in the Scope area) is enabled. 7. Click New. The Completion screen appears. 8. Click Finish. 3.6 Active Directory configuration Setting Up Accounts for the MessageLabs Appliances The MessageLabs Appliance needs an account that can access a local Domain Controller. In most cases, this will be one of the user accounts associated with a journaling mailbox. This account must have read access to the configuration naming context. To set up an account with access to the configuration naming context: 1. On the root Domain controller, start the ADSI editor (adsiedit.msc in Microsoft Support Tools). 2. In the tree, expand Configuration. 3. Right click on the configuration entry in the tree and choose Properties. Note: This item looks like: (CN=Configuration, DC=...). 4. On the Security tab, click Add and enter the user name and click OK. 5. Click Advanced. 6. Double-click on the user name, and set Apply onto to This object and all child objects. 7. In the permissions, check List Contents and Read All Properties. 8. Click OK Setting up the MessageLabs Archiving security groups in Active Directory Users log in to the MessageLabs Archiving interface using their standard Windows user name and password. During the authentication process, the MessageLabs Appliance checks to see if the user is a member of one or more of the predefined Active Directory security groups. A user can be a member of one or more of these groups, allowing for complete flexibility in permission and access control. If the user is not a member of at least one of the MessageLabs Active Directory security groups, they cannot log in to the MessageLabs Archiving user interface. 23

24 To set up MessageLabs Archiving-specific Active Directory groups 1. Open the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. 2. Connect to the domain in which you want to create the group. 3. Right-click on the domain and choose New, then Group. 4. In the Group Name field, enter the group name (see list of required group names below). 5. If your company has multiple domains, set the Group Scope to Universal, otherwise set the Group Scope to Global. 6. Set the Group Type to Security. 7. Click Next. 8. Ensure that Create an Exchange Address box is not selected. 9. Click Next, then Finish. 10. Repeat steps 1-9 for each Active Directory security group required. Create Active Directory security groups using the following names; all must be created: MessageLabs Policy Managers MessageLabs Archive Export Users MessageLabs User Managers MessageLabs Archive Report Users MessageLabs Archive Search Users MessageLabs Archive Discovery Users MessageLabs Archive Disposition Users MessageLabs Supervision Reviewers MessageLabs Supervision Senior Reviewers MessageLabs Supervision Report Users Adding a user to the MessageLabs security groups For testing purposes, set up a user who is a member of each of the MessageLabs security groups. To add a user to a MessageLabs Archiving Active Directory Group: 1. Open the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. The Microsoft Management Console opens for configuration of Active Directory Users. 2. On the Action menu, click Find. The Find Users, Contacts and Groups screen appears. 3. In the Name field, enter the user name. The User Properties screen appears. 4. Click the Member Of tab, then click Add. The Select Groups screen appears. 5. Click on the name of the appropriate MessageLabs Archiving Active Directory security group and then click Add. The group name is added to the list. 6. Repeat Step 5 to add additional MessageLabs Archiving Active Directory security groups. 7. Click OK, twice. The user account is updated. 24

25 3.7 Preparing for MessageLabs Appliance configuration You may find it convenient to complete this table so that you have the required information at hand during the configuration of the MessageLabs Appliance. If you have multiple MessageLabs Appliances, you will need this data for each appliance. MessageLabs Appliance Network Connection You will need information used to configure the MessageLabs Appliance to connect to the network. IP Address Subnet Mask Default Gateway Preferred DNS Server Alternate DNS Server Customer ID You will need your customer ID, which is assigned to you by MessageLabs Customer ID Name and Location of the MessageLabs Appliance The Location is assigned in consultation with MessageLabs. The serial number is on the sticker on the back of the appliance. Location MessageLabs Appliance Name MessageLabs Appliance Serial Number Active Directory Configuration You will need the IP address or host name of the local domain controller and an account that the MessageLabs Appliance can use to connect to it. Domain Controller Address Domain User Name Password Exchange Journaling Mailbox Configuration You will need information for the user that owns the journaling mailbox. These values are required for each journaling mailbox Exchange Server Address Journaling Mailbox Domain Journaling Mailbox Name Journaling Mailbox Password 25

26 3.8 Installing the MessageLabs Appliance Installing the MessageLabs Appliance involves providing electrical power and connecting it to your network. During installation, you will need to connect a monitor (with a resolution of 1024 x 768), a keyboard and a mouse to the MessageLabs Appliance. These can be removed when installation and configuration is complete. To power up the MessageLabs Appliance: 1. Connect the power cord. 2. Attach the MessageLabs Appliance to an active network jack. The network cable plugs into the LAN 1 port on the rear of the appliance. 3. Connect a monitor to the monitor connector. 4. Connect a keyboard to the keyboard connector (or to a USB port). 5. Connect a mouse to the mouse connector (or to a USB port). 6. Ensure that the MessageLabs Appliance is powered on and is showing the logon window. After it is installed, you configure the MessageLabs Appliance by following the procedures in the next section. 3.9 Configuring a MessageLabs Appliance Configuring the first MessageLabs Appliance To configure the first MessageLabs Appliance: 1. Log on to the MessageLabs Appliance, entering config as the user name and P@ssw0rd as the password. The configuration interface appears on the screen with the End User License Agreement panel. 2. Click I Agree to continue. This constitutes acceptance of the conditions in the license agreement. The Networking screen appears. 3. Configure network connection settings: enter the IP Address, Subnet mask, DNS and Default gateway address you wish to assign to the MessageLabs Appliance. Note: The static IP address locates the MessageLabs Appliance on the local area network. The Obtain IP Address Automatically option is not recommended. 4. Click Next. The appliance attempts to connect to the MessageLabs Archiving infrastructure, and displays a warning if a problem is detected. 5. Enter your customer ID in the field. This unique identifier is provided by MessageLabs. Note: This field may be pre-populated when you receive your appliance, but you should confirm that it is correct. 6. Click Next. The Appliance Name screen appears, prompting for a location and name for the MessageLabs Appliance as well as time zone and regional settings. 7. Enter location information: a. Choose a location from the Location dropdown list. Your company s account is configured with a list of locations. b. Enter a name in the Appliance Name field. You are free to assign any name you choose. c. Enter the serial number for the MessageLabs Appliance in the Serial Number field. The serial number is on the sticker on the back of the appliance. d. Select the appropriate time zone for the MessageLabs Appliances in the Time Zone dropdown. e. Select the appropriate date settings option in the Date Settings dropdown. The date settings impact date/time formatting within the web user interface. 8. Click Next. You are prompted to generate the encryption key. 9. Click Next. The encryption key is generated. 10. Enter Active Directory information: a. Select Single Domain or Multiple Domain from the Active Directory Environment dropdown. b. In the Domain Address Controller field, enter the IP address or DNS name for the local Domain Controller. c. In the Connect As group, fill in the Domain, Name and Password. 11. Click Next. 26

27 12. Enter Journaling Mailbox information: a. In the Exchange Server Address field, enter the IP address or the DNS name for the Exchange Server that contains the journaling mailbox. b. In the Journaling Mailbox group, specify the Domain, Name and Password for the journaling mailbox. 13. Click Next. The MessageLabs Appliance performs validation of the appliance configuration and the Active Directory and Exchange settings. 14. In the Send Validation Results To field, enter an address to which a status report should be sent. Several validations are performed and a summary of the results is sent to the specified address. 15. Confirm search functionality and export the encryption key by following the procedure below To confirm search functionality and export encryption key: 1. Log on to the MessageLabs Archiving user interface (see Logging In to the MessageLabs Archiving user interface in section 4.2.1). 2. Perform a basic search. See the MessageLabs Archiving User Guide for details. Note: You will have to wait until some messages have been archived to be able to search for them. To log in, ensure that your account was added to the MessageLabs Archiving Search Users or MessageLabs Archiving Discovery Users group. 3. Click Setup, then Key Export/Validation The Key Export/Validation screen appears. 4. Click Export Key and choose a destination. An encryption key was generated during the configuration of the first appliance. Copy the key to a safe place where it will be backed up. 5. To validate the exported encryption key, ensuring it is correct, click Browse and select your key file, then click Validate. If validation does not work, export the key again and repeat the validation. If validation continues to fail, contact the MessageLabs Global Client Support Centre (GCSC) immediately contact information is on the last page of this guide. 6. If you plan to add additional MessageLabs Appliances, copy the encryption key to a removable device (such as a USB key) to use when configuring the additional appliances Configuring Additional MessageLabs Appliances To configure an additional MessageLabs Appliance: 1. Log on to the MessageLabs Appliance, entering config as the user name and P@ssw0rd as the password. The MessageLabs Archiving configuration interface appears on the screen with the End User License Agreement panel. 2. Click I Agree to continue. This constitutes acceptance of the conditions in the license agreement. The Networking screen appears. 3. Configure network connection settings: enter the IP Address, Subnet mask, DNS and Default gateway address you wish to assign to the MessageLabs Appliance. Note: The static IP address locates the MessageLabs Appliance on the local area network. The Obtain IP Address Automatically option is not recommended. 4. Click Next. The appliance attempts to connect to the MessageLabs Archiving infrastructure, and displays a warning if a problem is detected. 5. Enter your customer ID in the field. Use the same ID as for the first appliance. 6. Click Next. The Appliance Name screen appears, prompting for a location and a name for the MessageLabs Appliance. 7. Enter location information: a. Choose a location from the Location dropdown list. Your company s account is configured with a list of locations. b. Enter a name in the Appliance Name field. You are free to assign any name you choose. c. Enter the serial number for the MessageLabs Appliance in the Serial Number field. The serial number is on the sticker on the back of the appliance. d. Select the appropriate time zone for the MessageLabs Appliances in the Time Zone dropdown. e. Select the appropriate date settings option in the Date Settings dropdown. The date settings impact date/time formatting within the web user interface. 8. Click Next. You are prompted for the location of the encryption key that was exported from the first MessageLabs Appliance. All appliances for your company share the same key. 9. Click Next. 27

28 10. Update Active Directory information (if required): a. Select Single Domain or Multiple Domain from the Active Directory Environment dropdown. b. In the Domain Address Controller field, enter the IP address or DNS name for the local Domain Controller. c. In the Connect As group, fill in the Domain, Name and Password. 11. Click Next. You are prompted to choose the purpose of this appliance. Note: The first MessageLabs Appliance is automatically configured to perform all purposes, so additional appliances can be configured to perform just some purposes, as explained in Appliance configuration scenarios in section If you chose the archiving purposes, you can select one of the existing journaling mailboxes or check Other. 13. If you chose Other, you are prompted to add a Journaling Mailbox. a. In the Exchange Server Address field, enter the IP address or the DNS name for the Exchange Server that contains the journaling mailbox. b. In the Journaling Mailbox group, specify the Domain, Name and Password for the journaling mailbox. c. Click Save. 14. Click Next. The MessageLabs Appliance performs validation of the appliance configuration and the Active Directory and Exchange settings. 15. In the Send validation Results to field, enter an address to which a status report should be sent. Several validations are performed and a summary of the results is sent to the specified address. 16. If this MessageLabs Appliance was configured to perform purposes that you do not want the first MessageLabs Appliance to perform, change the configuration of the first appliance accordingly. See section 3.10 for instructions Changing the MessageLabs Appliance configuration Once a MessageLabs Appliance has been configured, you can change its settings. Generally speaking, you only need to do this if you are going to use MessageLabs Stubbing or if you are configuring multiple MessageLabs Appliances for different purposes. For implementations assigning different purposes to different appliances, you may need to change the configuration of the first appliance, which was automatically configured to perform all purposes. Unlike initial configuration (done with a wizard), changing the configuration involves choosing from the menu in the MessageLabs Appliance s interface. When updating password information for journaling mailbox, stubbing account or active directory access, any other references to that account will automatically be updated. To modify the MessageLabs Appliance s network settings: 1. Click Network Settings in the menu. The screen contains the same fields as in the Network Settings screen of the wizard, showing the information entered in that wizard. 2. Edit any field you wish. Unedited fields will not be changed when the screen is closed. 3. Click Save to confirm the new settings or click Cancel to keep the previous settings. To change the MessageLabs Appliance name: 1. Click Appliance Name in the menu. 2. Edit any field you wish. The Appliance Name, Serial Number, Time Zone and Date Settings fields may be edited, but the Location field is disabled. If you need to change the appliance s location you must reset the appliance and re-enter the complete setup information. 3. Click Save to confirm the new settings or click Cancel to keep the previous settings. To change the purpose of the MessageLabs Appliance: 1. Click Appliance Purpose in the menu. 2. Check the checkboxes next to the purposes you want to assign to the appliance. 3. If you choose the archiving purpose, a list of the Exchange journaling mailboxes configured for this location appears. Check the mailboxes that this appliance is to archive or check Other and follow the instructions in the procedure below. 4. If you choose the stubbing purpose, a list of Exchange Servers in this location that are configured for stubbing appears. Check those that are to be assigned to the appliance or click Add and follow the instructions in the procedure on the following page. 5. Click Save to confirm the new settings or click Cancel to keep the previous settings. 28

29 To add additional journaling mailboxes to the MessageLabs Appliance: This procedure is valid only for appliances configured to perform the archiving purpose. 1. Click Journaling Mailboxes in the menu. A list of the journaling mailboxes currently configured for this location appears. 2. Click Add New Journaling Mailbox. A new screen appears. 3. In the Exchange Server field, enter the IP address or the DNS name for the Exchange Server that contains the journaling mailbox. 4. In the Journaling Mailbox group, specify the Domain, Name and Password for the journaling mailbox. A list of appliances appears. 5. Check the appliances that should process messages from this mailbox. 6. Click Save to confirm the new settings. To configure stubbing: This procedure is valid only for MessageLabs Appliances configured to perform the stubbing purpose. 1. Click Stubbing Settings in the menu. A list of the Exchange Servers in this location that are configured for stubbing appears. 2. To have this appliance stub attachments from an Exchange Server in this list, click the Exchange Server. A new screen appears, showing a list of the MessageLabs Appliances that process mail for the selected Exchange Server. Note: If necessary, you can add an Exchange Server by clicking Add new Exchange Server and then entering the name and domain of the Exchange Server and the name and password of the user account created for stubbing purposes (see section ). 3. Choose the appropriate appliance and click Schedule. A screen appears, showing in visual form all the possible hours in a working week. Click to enable or disable stubbing during specific hours. Note: Set your stubbing time window to avoid overlapping with automated backup procedures. 4. Click Save to confirm the new settings or click Cancel to keep the previous settings. To change the directory settings for the MessageLabs Appliance: 1. Click Directory Settings in the menu. The screen contains the same fields as in the Directory Settings screen in the wizard, with the information entered in that wizard. 2. Edit any field you wish. Unedited fields will not be changed when the screen is closed 3. Click Save to confirm the new settings or click Cancel to keep the previous settings. To temporarily suspend archiving from a journaling mailbox: Suspending archiving can be useful when upgrading your MessageLabs Archiving installation. It prevents MessageLabs Archiving from accessing the journaling mailbox until you remove the suspension. The journaling mailbox continues to receive messages. Any messages currently being processed will be archived, but no additional messages will be retrieved from the journaling mailbox. 1. Click Journaling Mailboxes in the menu. A list of the journaling mailboxes currently configured for this appliance appears. 2. Select a journaling mailbox and click Pause. To reset the MessageLabs Appliance to its default configuration: 1. Click Reset in the menu. 2. Choose Reset the appliance. The configuration reverts to what it was when you first installed the MessageLabs Appliance. 29

30 3.11 Configuring Exchange for stubbing About configuring MessageLabs Archiving stubbing Since stubbing requires that message have already been archived, and typically is not configured to act on messages until a specific number of days have passed, it does not need to be configured immediately on system setup. Configuring stubbing involves: Creating the necessary Exchange accounts (see below). Installing the Outlook form (see below). Change the configuration of a MessageLabs Appliance to handle stubbing (see Changing the MessageLabs Appliance Configuration in section 3.10) Setting up new accounts for stubbing purposes Create an account that has permissions to read and modify the mailboxes that will be associated with a stubbing policy. If you have more than one Exchange server each server must have a separate account that exists on the corresponding Exchange server. To create a new user account for stubbing on Exchange 2000/2003: 1. On your primary Exchange Server, open the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in 2. Connect to the domain in which you want to create the account. 3. Right-click the organizational unit in which you want to create the account and choose New, then User. 4. Enter a full name and a user login name. 5. Click Next. 6. Enter a value for password (and verify password). Set the username must change password, user cannot change password and password never expires options in accordance with your company s policies. Record the login name and password: you will need them when you configure the MessageLabs Appliance. Note: If you allow the password to expire, you must change it manually and reconfigure the appliance each time it changes. 7. Click Next. 8. Ensure that the Create an Exchange address check box is checked. 9. Click Next. 10. Click Finish. The stubbing account will be created. 11. Open the Exchange System Manager on the Exchange server that the stubbing account was created on. 12. Right-click on the server. 13. Click Delegate control The Delegate Control wizard will appear. 14. Click Add. 15. Enter the user name of the stubbing account and click OK. 16. Select Exchange Administrator from the roles dropdown. 17. Click OK. To create a new user account for stubbing on Exchange 2007: 1. On your primary Exchange server, open the Exchange Management Console. 2. In the tree, expand Recipient Configuration. 3. Right-click on Mailbox and choose New Mailbox. 4. Select User Mailbox. 5. Click Next. 6. Select New User. 7. Click Next. 8. Choose the Organizational Unit in which you want to create the account. 9. Enter the full user name and a user login name. For example, MessageLabs_Stubbing_<ExchServerName>. 30

31 10. Enter a value for password (and verify password). Set the username must change password, user cannot change password and password never expires options in accordance with your company s policies. Record the login name and password: you will need them when you configure the MessageLabs Appliance. Note: If you allow the password to expire, you must change it manually and reconfigure the appliance each time it changes. 11. Click Next. 12. For Mailbox Settings, leave the Alias at its default, ensure the correct Server, Storage Group and Mailbox database are selected. 13. Click Next. 14. Confirm the configuration summary settings are correct. 15. Click New. Exchange System Manager will attempt to create the user account and mailbox. 16. Once the wizard has completed successfully, click Finish. 17. In the tree, right click Organization and choose Add Exchange Administrator. 18. Browse to select the account created above. 19. Select Exchange Organization Role. 20. Click Add Installing the MessageLabs Archiving Outlook Form An Outlook form needs to be installed on each Exchange Server where stubbing will be performed. This form is used to handle forwarding of stubbed attachments from Outlook. To simplify the process, you can create an organizational forms library on one Exchange Server and then replicate that library to all other relevant Exchange Servers. To create a public organizational forms library in Exchange 2000/2003: Note: If you already have a Public Organizational Forms library in place, go to the next procedure. 1. In the Exchange System Manager, expand Administrative Groups. 2. Expand the node for the administrative group with mailboxes you plan to stub, then expand Folders. 3. Right-click Public Folders and choose View System Folders. The system folders for the administrative group appear in the left pane. 4. Right-click EFORMS REGISTRY and choose New, then Organizational Form. The General tab of the Properties screen appears 5. In the Name field, enter a name for the forms library. 6. From the E-forms language drop-down list, choose English. 7. Click OK. 8. Verify the permissions that have been set for the forms library so that client computers have permission to access the forms: a. Right-click the new library (listed under EFORMS REGISTRY) and choose Properties from the context menu. The Properties screen for the forms library appears. b. On the Permissions tab, click Client permissions. The Client Permissions screen appears. c. Verify that Default has a Reviewer Role, that the Read items option is selected in the Permissions area, and that Edit items and Delete items are set to None. d. Click Add on the Client Permissions screen. The Add Users screen appears. e. Choose your account from the list and then click Add. f. Click OK to return to the Client Permissions screen. g. Choose your account from the list and then choose Owner from the Roles drop-down list. h. Click OK to return to the Permissions tab of the Properties screen. 9. On the Replication tab of the Properties screen, configure the forms library to replicate to any remaining Exchange servers on which you plan to perform stubbing. For instructions refer to the Microsoft Exchange documentation. 10. Click OK to close the Properties screen. 31

32 To install stubbing forms: 1. Using Outlook 2003 (English version) and the appropriate profile (account specified in the previous procedure), connect to the desired Exchange server to publish the appropriate Outlook form to the organizational forms folder. 2. In Outlook, choose Tools, then Forms, then Design a Form. 3. Select User Templates in File System in the Look in dropdown, and click on the Browse button to select ArchiveStub.Attachment.oft (Outlook form) file to publish. 4. Click Open The Outlook form opens. 5. Choose Tools, then Forms, then Publish Form As Choose the organizational forms folder (created in previous procedure) from the Look in dropdown and enter ArchiveStub.Attachment in the display name field, then click Publish. The form is published to the organizational folder and is ready to be used. To create a public folders database in Exchange 2007: Note: If you already have a Public Folder Database in place, go to the next procedure. 1. Start Exchange Management Console. 2. Under Server Configuration, select Mailbox. 3. Create new Storage group For example: Public Storage Group 4. Right click on the new storage group, and choose Create New Public Folder Database, and Name it 'Public Folder Database' To create a public folder: 1. Start Exchange Management Shell. 2. Run the follow command in the shell: New-PublicFolder -Path "\NON_IPM_SUBTREE\EFORMS REGISTRY" -Name "MessageLabs Archiving Stubbing Forms - ENGLISH" 3. Add the PR_EFORMS_LOCALE_ID property to set the language of the forms folder by doing the following steps: a. Download MfcMapi.exe, Microsoft Exchange Server MAPI Editor, from b. Install the tool on a workstation which has Outlook and a mail profile where the account belongs to the Exchange Administrators Group. c. Start the Microsoft Exchange Server MAPI Editor. d. Select the correct MAPI profile. e. On the Session menu, click Logon and Display Store Table. f. On the MDB menu, click Open public Folder Store, and then click OK. g. Expand Public Root, expand NON_IPM_SUBTREE, and then expand EFORMS REGISTRY. h. Click on the public folder created in step 2 (MessageLabs Archiving Stubbing Forms - ENGLISH). i. On the Property pane menu, click Modify Extra Properties. j. Click Add, and then click Select Property Tag. k. Click PR_EFORMS_LOCALE_ID in the list, then click OK. l. Click OK, then click OK again. m. Double click PR_EFORMS_LOCALE_ID, and in the Unsigned Decimal box, type 1033 for US English or 1036 for French. n. Select PR_PUBLISH_IN_ADDRESS_BOOK, right click and select Edit Property, clear Boolean and then click OK. o. Close the MAPI Editor. 32

33 To install stubbing forms to an Exchange 2007 public folder database: 1. Download PFDAVAdmin.EXE, Microsoft Exchange Server Public Folder DAV-based Administration tool and install it on the Exchange 2007 server Start the Microsoft Exchange Server Public Folder DAV-based Administration tool. 3. Under the File menu, choose Connect. 4. Enter the Exchange Server and Global Catalog server hostname/ip, along with the credentials for a user that belongs to the Exchange Administrator Group; under Connection select Public Folders, and click OK. 5. Expand System Folders, then expand EFORMS REGISTRY, then select the folder MessageLabs Archiving Stubbing Forms - ENGLISH. 6. Right click and select Folder Permissions. 7. Click Add and browse to select a user you wish to install the Outlook forms with, and Owner Permissions. 8. Under Permission, select Owner from the dropdown list, then click Commit Changes. 9. Close the Microsoft Exchange Server Public Folder DAV-based Administration tool. 10. Start Microsoft Outlook 2003, using the profile of the account with Owner Permission (from step 7) 11. In Outlook, choose Tools, then Forms, then Design a form. 12. In the Look in dropdown, select User Templates in File System, and click Browse to select ArchiveStub.Attachment.oft (Outlook form) file to publish. 13. Click Open. The Outlook form opens. 14. Choose Tools, then Forms, then Publish Form as From the Look In dropdown, choose the Organizational forms folder (created in earlier procedure) and enter ArchiveStub.Attachment in the Display name and Form name fields, then click Publish. The form is published to the organizational folder and is ready to be used Installing Proxy for External Access Configuring external access requires running an installation wizard on each Exchange server. The wizard the proxy server provided by MessageLabs. If you are using your own proxy, you do not need to run the wizard. 33

34 4 Accessing the Archiving interface This section describes the MessageLabs Archiving interface, and how to log in and out of the interface. 4.1 Introducing the MessageLabs Archiving interface Archiving interface areas Figure: MessageLabs Archiving interface Elements Home Page Title Bar Located along the top of the screen. This area contains the logout button. Menu Bar Located down the left of the screen. The MessageLabs Archiving interface menu provides central navigation. Workspace Rest of the screen. This area changes, based upon the item selected from the menu. In general, the workspace contains a list of items, and a toolbar to perform actions with those items. 34

35 4.1.2 Archiving interface areas search Figure: MessageLabs Archiving interface Elements - Search Screen Toolbar The toolbar provides buttons that you can click to perform actions on the items selected in the result list. Search Bar The search bar is where you enter search criteria or save a search. Result List This is the list of messages that match the search criteria. You can click a message to view it in the view pane, or Shift-click or Ctrl-click to select multiple messages for toolbar actions, such as copy to folder. View Pane This area displays the message content. If the message contains attachments, you can also download/view them by clicking on the links in this area. Note: The MessageLabs Archiving interface works with Internet Explorer 5.5 and higher on the PC. You must have JavaScript enabled to access the MessageLabs Archiving interface. 35