Sunbelt Exchange Archiver Best Practices Guide - Sunbelt Software
Sunbelt Exchange Archiver Best Practices Guide - Sunbelt Software
Sunbelt Exchange Archiver Best Practices Guide - Sunbelt Software
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> <strong>Best</strong> <strong>Practices</strong>......................................................................... 3<br />
Backup ................................................................................................................................4<br />
Setting up Alerters .......................................................................................................... 4<br />
Archiving ............................................................................................................................ 6<br />
Retention Periods............................................................................................................ 6<br />
Example archive retention process ............................................................................. 6<br />
Retention Periods – Important Notes.......................................................................... 7<br />
Archive Web ................................................................................................................... 7<br />
Permission to Search Other Users’ Mailboxes ........................................................... 8<br />
Searching..................................................................................................................... 9<br />
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> Searches ....................................................................... 10<br />
Search templates ....................................................................................................... 10<br />
Legal hold – lock documents .................................................................................... 12<br />
Exporting items to a PST .......................................................................................... 12<br />
Compliance Recommendations ........................................................................................ 14<br />
SEC ........................................................................................................................... 14<br />
Gramm-Leach Bliley Act –....................................................................................... 15<br />
HIPAA ...................................................................................................................... 15<br />
FDA 21 CFT Part 11................................................................................................. 17<br />
Maintenance...................................................................................................................... 18<br />
Server Reboots.............................................................................................................. 18<br />
Limiting Threads........................................................................................................... 18<br />
SQL Maintenance ......................................................................................................... 19<br />
Setup Fulltext Searching............................................................................................... 19<br />
How fulltext bookmarks work ...................................................................................... 20<br />
SEA Plugin for Outlook................................................................................................ 21<br />
Avoid changing permissions on your SQL Server, the SEA Admin Active Directory<br />
Account, or the SEA File Structure .............................................................................. 22<br />
AV Exclusions .............................................................................................................. 22<br />
Performance ...................................................................................................................... 23<br />
Firewall ......................................................................................................................... 23<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 2 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> <strong>Best</strong> <strong>Practices</strong><br />
The purpose of this document is to familiarize you with the best practices for operating a<br />
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> server in conjunction with your current <strong>Exchange</strong><br />
Environment. By reading this document, you’ll familiarize yourself with <strong>Sunbelt</strong>’s best<br />
recommended practices, as well as some useful tips on using your <strong>Exchange</strong> <strong>Archiver</strong>.<br />
This guide is broken down into several sections:<br />
• Backup<br />
• Archiving<br />
• Compliance Recommendations<br />
• Server Maintenance<br />
• Performance<br />
Each of these sections will give detailed information on how to optimize that particular<br />
part of your Archive Infrastructure.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 3 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Backup<br />
Regular backups of your <strong>Exchange</strong> <strong>Archiver</strong> should be part of any established operating<br />
practices. With <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong>, there are two important areas which need to<br />
be backed up:<br />
1) Your archive (the HSM folder)<br />
2) Your databases and log files (SQL, SQL logs)<br />
To properly back both of these up, you should follow these steps:<br />
1) Ensure that the backup is performed during the “Backup Window” in the SEA<br />
console.<br />
2) Backup the databases<br />
a. If using SQL Express:<br />
i. Stop all MS SQL Database services<br />
ii. Copy these files to a backup folder:<br />
1. exchangeDB<br />
2. exchangeDB_log<br />
3. hsmDB<br />
4. hsmDB_log<br />
5. ftsDB (3.X versions only)<br />
6. ftsDB_log (3.X versions only)<br />
b. If using SQL Standard/Enterprise/Datacenter<br />
i. Use the SQL Backup Agent to setup a backup plan of the<br />
exchangeDB, hsmDB, and ftsDB (if applicable) databases to copy<br />
to a backup folder.<br />
3) Navigate to the HSM folder on your SEA server. If you do not know where this<br />
is, check the PamStoreAdministrator tool to see where it is located.<br />
4) Copy the HSM to a backup folder location, or use third party backup software to<br />
copy the HSM.<br />
5) Once these steps have been completed, your SEA server will be backed up.<br />
Setting up Alerters<br />
Alerters are designed to notify users, preferably administrators, about circumstances<br />
leading to critical situations. Depending on the type of confidence level, alert messages<br />
(notification) will be sent to recipients added onto the Alerter tab.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 4 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
You can specify which user will be sending notification by right-clicking the Alerter<br />
Settings node and selecting Alerter settings. You can find this menu underneath<br />
manager, then the settings tab. This will bring up the Alerter Registry Properties<br />
submenu. Here, you will need to enter your <strong>Exchange</strong> User Alias, <strong>Exchange</strong> Server<br />
name, and Sender e-mail address. This will be the SEA admin account by default.<br />
Note: There is also an option to send mail priority and set retry attempts. We recommend leaving<br />
these to the default settings unless the exchange server you’re operating with has known<br />
limitations, in which case you can customize these for poorer performance.<br />
When completed entering this information, you can push Apply and then OK.<br />
Once you’ve done this, you can setup your alerter. There are five types of alerter<br />
notifications:<br />
• Scheduler notifications – sent when scheduling errors are encountered;<br />
• Restorer notifications – sent when errors while restoring are encountered;<br />
• <strong>Archiver</strong> notifications – sent when errors while archiving are encountered;<br />
• QuotaExceed notifications – sent when quota-exceeded related errors are<br />
encountered.<br />
• QuotaWarning notifications – sent when a certain percentage of the limit in the<br />
HSM store has been used up. This setting (percentage) can be configured on the<br />
server side.<br />
You will be enrolled with each upon adding a recipient. To add a user as an alerter<br />
recipient, right click in the open white space in the pane to the right of the alerter settings<br />
button and choose Add recipient.<br />
Click the browse button next to recipient name and choose an appropriate recipient. The<br />
<strong>Exchange</strong> Server and email address will auto-fill. In the confidence level box, enter<br />
“admin.” This email address will now receive alerts.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 5 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Archiving<br />
This section of the <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> deals with the process of archiving and<br />
archiving best practices. Here, we will discuss retention periods, archive web, legal holds,<br />
and PST exports.<br />
Retention Periods<br />
The exact length of time an email should be archived greatly varies upon legal<br />
requirements outlined by the regulations to which your company is required to comply. A<br />
partial list of these requirements is available through Microsoft at<br />
http://technet.microsoft.com/en-us/library/aa998649.aspx, but your exact compliance<br />
regulations are defined by your industry and the laws of the nation in which you reside.<br />
Note that <strong>Sunbelt</strong> <strong>Software</strong> does not provide any legal advice regarding retention periods<br />
whatsoever – this is the responsibility of your legal department.<br />
With SEA, retention periods take place after an email has been archived according to the<br />
group settings associated with a job. You can think of the process of applying a retention<br />
category like this:<br />
1) In SEA, A job is created to schedule when they archiving will occur.<br />
2) A SEA group is created based on the users in your organization and their<br />
compliance requirements. Within each group, the group settings will determine<br />
the minimum size and age of the message to be archived.<br />
3) The SEA group is assigned a retention category that will determine how long<br />
email it is kept in your archive.<br />
Case Example: If you have two departments, sales and marketing, who each have<br />
security groups that contain all sales persons and marketers, you could add both<br />
of these groups into an SEA group called “Sales and Marketing” that could<br />
receive a retention period (next bullet point) that would be based upon legal<br />
compliance regulations requested by your legal department.<br />
4) The job is associated with your SEA group.<br />
5) The job is run based on a schedule you set earlier (Point 1). It reads through the<br />
received by and size fields based in the job criteria and sends the message to the<br />
archive.<br />
6) The message is held in the archive for the period set in your retention category.<br />
Example archive retention process<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 6 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
SEA Group – All users from Sales and Marketing security groups<br />
Job – All messages older than 10 days, larger than 0 bytes.<br />
Retention – 120 calendar months<br />
Today’s date – 1/11/10<br />
Email Received By Date – 1/1/10<br />
Email Received By – A marketing user<br />
In this case, the following would happen:<br />
1) The SEA job runs.<br />
2) The job checks the emails of the mailboxes associated with the group assigned to<br />
that job.<br />
3) SEA determines that the message is older than 10 days by viewing the received by<br />
date.<br />
4) SEA determines that the message is larger than 0 bytes.<br />
5) SEA archives the message and assigns the retention category of 120 calendar<br />
months.<br />
6) Ten years pass.<br />
7) The message is deleted on 1/11/20 – ten years from the day the message was<br />
archived, not received.<br />
Retention Periods – Important Notes<br />
• Retention periods are retained based upon the date when the message is<br />
ARCHIVED, not the date in which the message is received. For a full<br />
explanation, see the last bullet points in the section above.<br />
• Before reviewing retention categories, you should know that once a message has<br />
been archived a retention category CANNOT BE CHANGED. This is done to<br />
achieve legal compliance.<br />
Archive Web<br />
Archive Web is a web based interface that directly connects into the <strong>Sunbelt</strong> <strong>Exchange</strong><br />
<strong>Archiver</strong>’s backend and allows you to search and administer your archive from an easy to<br />
use web interface. Through archive web, you can completely access your entire <strong>Exchange</strong><br />
archive, including individual mailboxes, messages, and flagged items for legal purposes,<br />
such as holds. In this section of the best practices guide, we’re going to go over some<br />
simple but important practices with archive web. This way, you’ll be prepared to<br />
administer some of the most common tasks with <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong>, without<br />
having the need to load the console and occupy valuable time on your server.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 7 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Permission to Search Other Users’ Mailboxes<br />
In order to search another user’s mailbox, you will need to navigate to the SEA console<br />
and login with FullAccess rights. Once inside the SEA console, perform the following<br />
steps:<br />
1) From the menu, select Tools -> Mailbox rights manager.<br />
2) From the mailbox rights manager, select the mailbox that you would like to be<br />
able to search and double-click it.<br />
3) This will bring up the Mailbox Rights for that particular mailbox.<br />
4) To allow a user to search this mailbox, select Add…<br />
5) Either type the name of the user or scroll and select the user account, then press<br />
OK.<br />
6) Press Apply.<br />
As you can see from the screenshot below, in this case, Steve Johnson has the rights to<br />
search Brian Johnston’s mailbox.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 8 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Searching<br />
Selecting the Search Tab in archive web will open the search menu that will show access<br />
to both <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> and <strong>Sunbelt</strong> File <strong>Archiver</strong> (if you have it installed).<br />
The Search menu contains the following nodes:<br />
Common search – allows you to search in all archived emails and files (accessible only<br />
when both products – <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> and <strong>Sunbelt</strong> File <strong>Archiver</strong> – are<br />
installed)<br />
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> – allows you to search in archived emails<br />
<strong>Sunbelt</strong> File <strong>Archiver</strong> – allows you to search in archived files (accessible if <strong>Sunbelt</strong> File<br />
<strong>Archiver</strong> is installed in the environment)<br />
Search templates – contains saves search templates and search results<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 9 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> Searches<br />
Under the <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> node you can search in archived emails with<br />
search criteria specific for email archive. To start a search, click on the <strong>Sunbelt</strong> <strong>Exchange</strong><br />
<strong>Archiver</strong> node in the left-pane. The Search pane gets displayed in the right pane of the<br />
window. In the Fulltext text box, enter the desired word, phrase, or combination of words<br />
with logical operators (AND, OR), then click on the Search button.<br />
Note: You can find more information on search patterns and queries which can be used in<br />
the Fulltext text box by clicking the Information icon ( ) next to the text box. Please<br />
note that the fulltext search is enabled only if SEA search was installed and the post<br />
processing plugin was configured in the <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> Manager.<br />
You can also specify your search criteria in further detail by using the Subject, From,<br />
and To text boxes. You do not need to enter the whole name in the From or To text<br />
boxes. If you click the Resolve button, all senders‘ names containing the specified string<br />
will be displayed and you can choose which sender(s) which you would like to search.<br />
The More choices tab:<br />
Search in versions - Each email version satisfying search criteria will be listed<br />
separately in search results list<br />
Search in deleted documents – items marked for deletion will be searched. Checking<br />
the “only in deleted documents” will search only deleted items, not items marked for<br />
deletion.<br />
Search templates<br />
Search templates are designed to organize search queries that will be frequently used in<br />
your enterprise. When you unfold the Search templates node, you will see a list of search<br />
templates that have been saved so far. The search results saved under the respective<br />
template are accessible as well. Simply choose the appropriate template to search for<br />
items with its predefined search criteria, or unfold the template’s node to display its saved<br />
search results.<br />
The color of the template icon indicates the search type for which the template was<br />
created:<br />
Blue icon ( ) - Common search template<br />
Pink icon ( ) - <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> search template<br />
Green icon ( ) - <strong>Sunbelt</strong> File <strong>Archiver</strong> search template<br />
Click on the plus sign next to the template to unfold the template node. Respective search<br />
results are saved with the date and time when they were saved.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 10 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Selected results will be displayed in the main pane. Hold the cursor over the Actions<br />
button on the upper bar and the down-drop menu opens.<br />
Using the down-drop menu you can perform the following tasks:<br />
• Unlock all documents<br />
• Lock all documents<br />
• Lock selected document(s)<br />
• Unlock selected document(s)<br />
o Note: For locked documents see the chapter “Legal hold – lock<br />
documents”.<br />
• Search again with the same search settings<br />
• Delete saved results<br />
• Export results to mailbox – only accessible for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> search<br />
templates (see the section “Exporting search results”)<br />
• Export results to PST file – only accessible for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> search<br />
templates (see the section “Exporting search results”)<br />
Note: Items which are marked for deletion in the archive are highlighted in red in the<br />
search results list.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 11 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Templates handling<br />
When you click on any template node under the Search templates, its search settings will<br />
open in the main pane of the window. You can click the Search button to execute the<br />
search with the search settings specified in this template. You can also modify the<br />
template. Should you alter the template, click Update to save the changes for the given<br />
template.<br />
Additionally, you can click the Delete button to delete the template. All associated results<br />
saved under that template will be deleted as well. If you modify the template, the results<br />
of the previously executed search saved under this template will be displayed red,<br />
indicating that they were searched for with that template before its modification.<br />
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> search templates (with pink icon) and <strong>Sunbelt</strong> File <strong>Archiver</strong><br />
search templates (with green icon) can be shared with other ArchiveWeb users, i.e. other<br />
users will be able to see the respective template under their Search templates node and<br />
will be able to use it. To do so, just click the Share to link. Then, in the pop-up dialog,<br />
check the users who you want to share the template with.<br />
Legal hold – lock documents<br />
For auditing purposes, found documents and emails can be locked by a user to prevent<br />
modification of the item. Specifically, when an item is locked, it remains in the state in<br />
which it was locked. This means it cannot be deleted, edited, or modified. Simply put: it<br />
cannot be changed in the system.<br />
To lock found items, follow this procedure:<br />
1) Unfold the Search templates node. A list of saved search templates will be<br />
displayed.<br />
2) Unfold the desired template and select the search results with the items that you<br />
want to lock. Hold the cursor over the Actions button on the upper bar to unfold<br />
the Actions menu.<br />
3) Form the down-drop menu, select Lock all documents or Lock selected<br />
document(s) according to your intention. Locked documents will be displayed<br />
with a yellow lock icon ( ).<br />
Note: You can unlock documents by selecting Unlock all documents or Unlock<br />
selected document(s) on the down-drop menu.<br />
Exporting items to a PST<br />
With Archive web, you can easily export items found through searches to a .PST file that<br />
you can manage for your own purposes. To do so:<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 12 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
1) Unfold the Search templates node. A list of saved search templates will be<br />
displayed.<br />
2) Unfold the <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> search template (with pink icon ) and<br />
select the search results that you want to export. Hold the cursor over the Actions<br />
button on the upper bar.<br />
3) The Actions menu will open. Select Export result to PST file.<br />
4) The PST file will be created on the SEA server where ArchiveWeb is located.<br />
Once the PST file was created, it can be downloaded. Simply click DOWNLOAD<br />
next to the desired PST file.<br />
5) If you click CLOSE located next to the given record, the record will be deleted;<br />
otherwise it will remain displayed in the list.<br />
Note: Every export task is listed also in the <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> Enterprise<br />
Manager under Tools / Export tasks.<br />
Note: Sometimes when exporting the results to a predefined mailbox a red flag might be<br />
displayed next to the report. This means that errors have occurred while exporting.<br />
Information on how many documents were exported successfully or failed at exporting<br />
can be found under the Info column.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 13 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Compliance Recommendations<br />
Depending on the industry in which you work, different requirements are set forth<br />
regarding email archiving and archive requirements. Some extreme cases, such as data<br />
involving trading information for the Securities and <strong>Exchange</strong> Commission, have such<br />
stringent requirements that they mandate that all emails be archived permanently. On the<br />
other hand, some loose requirements mandate that only a “best effort” must be<br />
maintained for email compliance.<br />
In order to aid you in your quest of becoming compliant, <strong>Sunbelt</strong> <strong>Software</strong> has prepared a<br />
list of compliance resources that will outline some of the most common standardizations<br />
used throughout the industry. Keep in mind, <strong>Sunbelt</strong> <strong>Software</strong> is merely a software<br />
company and not a legal firm.<br />
Any information contained in this document should not be considered<br />
legal advice in any way. If you wish to ensure archiving compliance in<br />
your organization, consult an attorney.<br />
SEC<br />
The SEC maintains very strict standards that require adherence to email standards that are<br />
more rigid than any other compliance laws. Some of the regulations with the SEC<br />
include:<br />
• Having messages time/date stamped [17A-4(f)(2)]<br />
• Ensuring supervisors have the ability to review outgoing email for noncompliant<br />
language [17A-4 Section 3010]<br />
• Maintaining a searchable Archive [17A-4(f)(3)]<br />
• Keeping offsite storage in tamper-proof media [SEC 17A-4(f)(3)]<br />
Additionally, for brokers, members, and dealers:<br />
• Retention periods of at least 6 years<br />
To achieve this, <strong>Sunbelt</strong> <strong>Software</strong> makes the following recommendations<br />
1) Implement <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong>.<br />
2) Create user accounts for your supervisors and give them the ability to search their<br />
subordinates in ArchiveWeb.<br />
3) Create a retention policy of 1200 months.<br />
4) Apply this retention policy to all users.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 14 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
5) Implement a second HSM by completing the following steps:<br />
1. Navigate to the PamMediaStoreAdministration tool.<br />
2. Stop your HSM by choosing Start, Stop, or Delete an existing<br />
MediaStore, then choosing Stop.<br />
3. Close, then open Administrate an existing MediaStore.<br />
4. Click Next, then choose your HSM from the dropdown.<br />
5. Click Next.<br />
6. Leave the checkbox selected on the next screen, and choose Next.<br />
7. At the next screen, choose the Activate multiple saving checkbox, then<br />
select a location where you would like to backup a second copy of your<br />
HSM (which contains your archive data).<br />
8. Click Next seven times, then click Finish.<br />
6) Setup a backup plan using software such as DoubleTake.<br />
(http://www.sunbeltsoftware.com/Business/Double-Take/) to backup from your<br />
secondary HSM to another media system.<br />
7) Back the other media system to tape completely.<br />
Gramm-Leach Bliley Act –<br />
The Gramm-Leach Bliley act was enacted to secure access to sensitive financial records.<br />
Concerning email compliance, the following regulations pertain:<br />
• Email must be secured [Section 6801]<br />
• Customer records must be controlled to prevent harm<br />
• Strong access control and passwords<br />
Accordingly, <strong>Sunbelt</strong> <strong>Software</strong> recommends you implement the following solution to<br />
ensure your archive’s safety:<br />
1) Implement <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong>.<br />
2) Only allow one necessary administrator to access mailboxes in ArchiveWeb.<br />
3) Ensure that the SEA_Admin account has a password with at least:<br />
a. 2 numbers<br />
b. 3 special characters (*$%^)<br />
c. 16 total digits<br />
4) Set a retention period to 84 months.<br />
HIPAA<br />
Health Insurance Portability and Accountability Act is designed to maintain the safety<br />
and confidentiality of health records from any other source than the individual and their<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 15 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
health care provider. Concerning emails from health related institutions, there are many<br />
regulations that come into play:<br />
• Email Confidentiality required [Section 164.312]<br />
• Archives must utilize Encryption [Section 164.312]<br />
• Archive must always be accessible [Section 164.312]<br />
• Organization must have an email archive disaster recovery plan [Section 164.308]<br />
• An auditing record must be maintained for when email is sent, received, modified,<br />
accessed, and deleted from <strong>Exchange</strong> Store [Section 164.312(b)]<br />
Because of the nature of sensitive medical information, <strong>Sunbelt</strong> recommends that HIPAA<br />
clients maintain a security level equal to that of the Securities and <strong>Exchange</strong><br />
Commission. Additionally, we require that HIPAA clients be running SEA version 4.1 or<br />
later.<br />
To achieve this, do the following:<br />
1) Implement <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong>.<br />
2) Create user accounts for your supervisors and give them the ability to search their<br />
subordinates in ArchiveWeb.<br />
3) Create a retention policy of 1200 months.<br />
4) Apply this retention policy to all users.<br />
5) Implement a second HSM by completing the following steps:<br />
1. Navigate to the PamMediaStoreAdministration tool<br />
2. Stop your HSM by choosing Start, Stop, or Delete an existing MediaStore,<br />
then choosing Stop<br />
3. Close, then open Administrate an existing MediaStore<br />
4. Click Next, then choose your HSM from the dropdown<br />
5. Click Next<br />
6. Leave the checkbox selected on the next screen, and choose Next.<br />
7. At the next screen, choose the Activate multiple saving checkbox, then select<br />
a location where you would like to backup a second copy of your HSM<br />
(which contains your archive data).<br />
8. Click Next seven times, then click Finish.<br />
6) Setup a backup plan using backup software, such as DoubleTake.<br />
(http://www.sunbeltsoftware.com/Business/Double-Take/) to backup from your<br />
secondary HSM to another media system.<br />
7) Back the other media system to tape completely.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 16 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
FDA 21 CFT Part 11<br />
FDA 21 CFT Part 11 specifically maintains auditing requirements regarding exactly<br />
when email was sent, why it was sent, who it was sent to, where it was sent, and why it<br />
was sent. Additionally, the requirements of it say that this report must be generated by a<br />
computer. Accordingly, <strong>Sunbelt</strong> <strong>Software</strong> makes the following recommendation:<br />
1) Implement <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.1 or later to enable auditing.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 17 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Maintenance<br />
The process of keeping your server up, running, and operating efficiently can be a very<br />
daunting task. In this section of the best practices guide, we cover the best methods you<br />
can implement to keep your Archive server running as smoothly as possible.<br />
Server Reboots<br />
<strong>Sunbelt</strong> <strong>Software</strong> highly recommends that SEA servers occasionally be rebooted in order<br />
to ensure that all services are occasionally refreshed and properly operating. When<br />
rebooting a SEA server, you should follow these steps:<br />
1) Stop all services by running the Stop.bat file from the SEA 4.X start menu.<br />
2) Reboot your server by running the restart option from your start menu.<br />
3) Once your server has restarted, run the Stop.bat and Start.bat files from the start<br />
menu.<br />
If a server is unresponsive upon reboot, open the SEA Management Console. If the<br />
options are grayed out, run the stop and start batch file an additional time. Once this is<br />
done, navigate to the Session menu and choose Connect. The options should now be<br />
black. If it is not, check to make sure that your SQL services are running.<br />
Note: SQL must be running BEFORE any SEA services are started.<br />
Limiting Threads<br />
In the Status menu of your SEA console, there is a section that allows you to set the<br />
active number of threads associated with SEA and your <strong>Exchange</strong> server. At a maximum,<br />
this number is set to 30. But by default, it is only set to one.<br />
The reason for this is that every thread initiated by <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> is a direct<br />
connection to exchange through MAPI. Accordingly, every MAPI call to <strong>Exchange</strong><br />
requires additional burden on your <strong>Exchange</strong> server, when it normally isn’t necessary.<br />
The only time SEA truly needs to speak with <strong>Exchange</strong> is during the process of<br />
archiving, which generally occurs only periodically, as it is defined in the SEA console.<br />
Otherwise, SEA communicates directly to Outlook clients. As a result, you should only<br />
increase the thread count if your network is extremely large and your archiving is unable<br />
to complete before the next job is queued. And as you do so, you should monitor the<br />
burden your <strong>Exchange</strong> server is taking because of it. If it is too dramatic, you should<br />
reduce your thread count. And if you’re unable to find a balance, you should contact<br />
<strong>Sunbelt</strong> <strong>Software</strong> support at support@sunbeltsoftware.com.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 18 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
SQL Maintenance<br />
In order for your <strong>Archiver</strong> to consistently operate as designed, you will need to setup a<br />
SQL maintenance plan to prevent excessively large SQL logs and other possible<br />
downfalls with a default installation of SQL. SQL maintenance is not specifically<br />
supported by <strong>Sunbelt</strong> <strong>Software</strong>; however, we do have two guides available for SQL 2000<br />
and SQL 2005 available for you to download here:<br />
SQL 2000:<br />
http://www.sunbeltsoftware.com/documents/sunbelt-exchange-archiver-sql-2000maintenance-plan.pdf<br />
SQL 2005:<br />
http://www.sunbeltsoftware.com/documents/sunbelt-exchange-archiver-sql-2005maintenance-plan.pdf<br />
Setup Fulltext Searching<br />
<strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> is capable of completely searching emails throughout an<br />
entire enterprise. With fulltext searching, administrators can search through any email<br />
field, including the “to” and “from” field. SEA accomplishes this through the use of the<br />
Java-based platform Lucene, which allows SEA to completely search every aspect of an<br />
email message.<br />
To setup fulltext searching, you should follow this procedure:<br />
1) Open SEA Manager and select View, then Manager.<br />
2) Select the Post Processing tab<br />
3) Click the Add… button on the bottom of the page<br />
4) From the dropdown box, select<br />
PostProcessPAMSearchIndex.SearchIndexPlugin.<br />
Note: If you have added this feature after SEA has already archived messages, you<br />
should follow these extra steps:<br />
1) From the same Post Processing tab, right click<br />
PostProcessPAMSearchIndex.SearchIndexPlugin and select Set Bookmark …<br />
2) From the bookmark dropdown, select a date before any archiving took place and<br />
press OK.<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 19 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Once you’ve setup fulltext searching, you can monitor the progress of your text searching<br />
by selecting the post processing tab from the SEA Manager, as you can see below.<br />
The post processing tab allows you to monitor plugins that have been installed in your<br />
archiver, including the fulltext search plugin. From within the Post Processing Tab, the<br />
plugin for FullText is called: PostProcessPAMSearchIndex.SearchIndexPlugin. To set<br />
this plugin to search all your mailboxes, you should double-click it. This will bring up the<br />
properties menu, allowing you to select the fulltext search plugin to index either some or<br />
all or your mailboxes. As a best practices recommendation, we recommend selecting<br />
“Apply for all mailboxes” and ensuring the Plugin is Active options are selected. This<br />
ensures that your entire organization is searchable.<br />
After you click OK, you can examine the properties area on the right. Notably, you will<br />
see a field called Bookmark Date. Bookmark date allows you to see the date of the latest<br />
email your server has index. This data is listed in European standard format<br />
(Day/Month/Year/Time). You can monitor it by occasionally clicking refresh.<br />
If you’ve previously archived emails within your organization, when you first install SEA<br />
fulltext, the fulltext post-processing plugin will begin to index your archives and slowly<br />
move the bookmark date up to the date of the most recently indexed archived email. Keep<br />
in mind, this process may take several hours or several days when first implemented,<br />
depending on the quantity of emails. Once it is complete, you can utilize the fulltext<br />
search option from archive web.<br />
How fulltext bookmarks work<br />
FullText searching in SEA is enabled through a post processing plugin that can be<br />
managed through the SEA manager. To enable it, you can follow the instructions in the<br />
Admin Manual, or just follow these summarized steps:<br />
1) Stop the <strong>Sunbelt</strong>PostProcessingSv service.<br />
2) Go to view –> Manager -> Post Processing Tab.<br />
3) Click Add…<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 20 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
4) Select PostProcessPAMSearchIndex.SearchIndexPlugin.<br />
5) Click Add.<br />
6) Right-click the plugin name and choose Edit Plugin…<br />
7) Select the Apply for all mailboxes plugin.<br />
8) Click OK.<br />
9) Right-click the plugin name and choose Set Bookmark…<br />
10) Set the bookmark to a date before archiving began.<br />
11) Click OK.<br />
12) Start the <strong>Sunbelt</strong>PostProcessingSv service.<br />
13) Navigate back to the Post Processing tab and occasionally hit refresh. The<br />
bookmark date should periodically updates.<br />
The big picture:<br />
SEA Plugin for Outlook<br />
The SEA plugin for outlook is an extremely powerful tool that authorized personnel can<br />
use to manager their own archived messages from Outlook, without the need to navigate<br />
to the SEA management console or Archiveweb. As a best practice, we strongly<br />
recommend giving this tool to administrators. However, we even more strongly<br />
encourage that you do not give this addin to all of your users. Allowing all users to utilize<br />
this add-in enables them to effectively control their own archive, which could potentially<br />
lead to compromises in your archive compliance. For example, a user could restore and<br />
then permanently delete a message from the archive.<br />
Additionally, you should make sure that all your users utilizing the Outlook Add-in make<br />
sure that they:<br />
• Are not running the firewall<br />
• Are not running an antivirus program that filters mail (Other than VIPRE<br />
Enterprise)<br />
• Are not running extra Outlook Add-ins that conflict with the SEA plugin<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 21 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Avoid changing permissions on your SQL Server, the SEA Admin Active<br />
Directory Account, or the SEA File Structure<br />
One of the most common problems we see with SEA is that administrators tend to try to<br />
apply their own custom settings and security groups with <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong>.<br />
Because of this, we feel the need to write this strongly worded warning:<br />
Under no circumstances whatsoever should you ever change the following aspects of<br />
SEA:<br />
• The SEA Admin account name in Active Directory<br />
• The SEA Admin account password<br />
• The SEA Admin account privileges<br />
• The SEA Admin account group membership<br />
Additionally, you should NEVER:<br />
• Hide the SEA Admin account from the Global Address List<br />
• Run Manual queries on the SEA SQL DB<br />
Also, the SEA Admin account should Never Expire.<br />
AV Exclusions<br />
As the provider of the leading antimalware platform VIPRE Enterprise, <strong>Sunbelt</strong> is keenly<br />
aware of the need to make proper exclusions on server based platforms to achieve<br />
maximum performance from your hardware. Accordingly, we recommend that you make<br />
the following exclusions on your SEA server to avoid conflicts with antimalware<br />
software that may cause undesired results:<br />
The HSM – Usually Located at \HSM, the HSM is the storage area<br />
where SEA contains messages and their respective attachments. Because of this, SEA<br />
writes and reads from this area very often and may “lock” with antimalware software,<br />
causing system freezes.<br />
SEA Program Directory – To ensure that SEA will always be able to be free from<br />
interference from other programs, you should exclude the SEA Program Files\<strong>Sunbelt</strong><br />
directory from any antimalware program’s scanning utility<br />
SQL – You should follow the Microsoft best recommended practices to exclude SQL<br />
from scans: http://support.microsoft.com/kb/309422<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 22 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com
Performance<br />
Firewall<br />
Because <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> user many different ports and protocols, you may<br />
wish to shut down the Windows Firewall. Doing this allows your SEA server to run<br />
without the worry of Windows Services interrupting its operations or somehow stopping<br />
the processes of archiving, retrieving, or administration through either the manager or<br />
archive web.<br />
To disable the Windows Firewall, please follow these Microsoft KB articles:<br />
Windows Server 2003: http://technet.microsoft.com/en-us/library/cc778563(WS.10).aspx<br />
Windows Server 2008: http://technet.microsoft.com/en-us/library/cc766337(WS.10).aspx<br />
<strong>Best</strong> <strong>Practices</strong> <strong>Guide</strong> for <strong>Sunbelt</strong> <strong>Exchange</strong> <strong>Archiver</strong> 4.X 23 sales@sunbeltsoftware.com<br />
Copyright© 2007-2010 <strong>Sunbelt</strong> <strong>Software</strong>, Inc. All rights reserved. support@sunbeltsoftware.com