Voice Mail and Discoverability with Exchange 2007 Unified Messaging


Exchange 2007 was the first release of Exchange to include Unified Messaging (UM) and this was the first time many of our customers started considering replacing their existing voice mail systems with UM. As with any new technology, many have sent in questions or concerns regarding the legal implications of UM, and how to control the voice mail messages once they’re inside Exchange.

If you aren’t familiar with Exchange UM and the benefits it provides to both end-users and IT professions, please check out more information here: http://www.microsoft.com/exchange/evaluation/unifiedmessaging/default.mspx .

However, some companies have been hesitant to store voice mail and e-mail in the same system, fearing that it will create increased legal risk by making voice mails more “discoverable” or somehow less manageable. We got this initial feedback during our TAP and beta trials of Exchange, so we worked with the law firm of Covington & Burling LLP. They studied this problem and created a white paper to summarize their findings.

If you read through the white paper, you’ll notice two things. First, the white paper concludes “.that no aspect of Exchange alters, by increasing or decreasing, the record retention obligations of these organizations in the U.S. or E.U. .” That is, if a company is obligated to retain voice mail messages, it doesn’t matter if they’re stored in Exchange 2007 UM or somewhere else – they still need to be retained. Likewise, if voice mail messages have been deleted in the normal course of business prior to an obligation to retain them, the fact they were in Exchange 2007 UM doesn’t create a new obligation to retain where no obligation existed before.

Secondly, the white paper notes that Exchange 2007 Unified Messaging offers significant advantages for a company that may need to retain and produce voice mails. Features that were considered especially helpful included being able to visit a single system to access, query, and produce both voice mail and e-mail; and having a single repository (rather than multiple repositories) to apply retention policies.

The complete white paper is available here if you’re interested: http://www.microsoft.com/exchange/evaluation/unifiedmessaging/dataretentionwp.mspx

There are additional benefits that Exchange 2007 Unified Messaging provides for companies seeking to reduce cost and increase flexibility in addressing e-discovery requirements. They fall into two categories:

  1. Ensuring that voice mails are not retained beyond policy during the normal course of business.
  2. Being able to quickly and easily retain voice mails to meet preservation obligations in the face of impending litigation.

For a good overview of our compliance features if you’re not already familiar with them, check out the Exchanger Server 2007 Compliance Tour here: http://www.microsoft.com/exchange/evaluation/compliance/compliance-tour.mspx

Ensuring that voice mails are not retained beyond policy during the normal course of business:

To meet this first category of requirements, you can implement a transport rule and modify some settings to easily control how you retain voice mail.

  1. Use a Managed Default Folders setting to automatically expire voice mails after X days. Also note that these policies can be applied differently at the user- or group-level, as well as for the entire organization.
  2. Use Transport Rules to prevent voice mail being from being forwarded outside the organization, based on attributes Exchange automatically adds to a voice mail message:

  1. Use Journaling settings to ensure that voice mail is not journaled to any external system. Additionally, in case you didn’t know, Exchange does not journal voice mail by default. To change this setting or verify your existing settings, an administrators can use Set-TransportConfig or Get-TransportConfig cmdlets described here: http://technet.microsoft.com/en-us/library/bb201690(EXCHG.80).aspx
  2. Use Exchange ActiveSync settings to prevent voice mails from being forwarded to Mobile devices. This policy is somewhat draconian, as it prevents all attachments from being forwarded to mobile devices, not just .wma files.
  3. Customize the voice mail message template to remind users of the company policy about voice mail retention. Administrators can create a message of up to 512 characters that appears on every voice mail message using Set-UMMailboxpolicy -VoiceMailText, described here: http://technet.microsoft.com/en-us/library/bb124903(EXCHG.80).aspx

Ensuring that voicemails are retained to meet preservation obligations in the face of impending litigation:

Once you have Exchange retaining voice mail to be consistent with organizational policies, you may need to change that based on impending litigation.

  1. Instantly implement a retention hold on an effected user’s mailbox, using either the Set-Mailbox cmdlet or the EMC. The retention hold can be indefinite, or have a set start and end date. This command can also be combined with the Get-Mailbox cmdlet, allowing you to easily select an OU, etc.
  2. Easily transcribe voice mails, by providing a text field right next to the “play” controls on the voice mail message where the end user can make notes. These transcribed notes are searchable with Exchange’s full-text search engine, allowing the message to be quickly retrieved later.
  3. Assist users in the process of identifying relevant information by providing a litigation-specific Managed Custom Folder. This could automatically create a folder in the end user’s Mailbox, with a name like “Contoso Litigation” and a descriptive label, such as “Please store any and all email, voice mail, and faxes related to Contoso Litigation in this folder”
  4. Easily export voice mails to another mailbox for review using the Export-Mailbox cmdlet with the -Subject “Voice Mail” parameter. This allows Exchange administrators to create separate accounts for the purpose of reviewing voice mails, while leaving the original messages in place.

In Summary: Exchange 2007 Unified Messaging does not change a company’s obligation to retain voice mail. However, by using Exchange UM, organizations will find it easier to control voice mail. It will also be easier to implement a retention policy that applies to e-mail, voice mail, and fax messages. Should it become necessary to prepare for litigation, Exchange 2007 Unified Messaging reduces the cost of accessing, querying, and producing voice mail.

– Chris Chalmers
  TECHNOLOGY SPECIALIST


Share this post :

Comments (8)
  1. Benjamin Wright says:

    The Securities and Exchange Commission has issued authoritative rules on record retention, and they normally exclude the retention of voice mail.  However, a organization may desire to retain voice mail for purposes of contract enforcement or the preservation of other interests.  –Ben http://hack-igations.blogspot.com/2008/06/voicemail-other-audio-legal-records.html

  2. pesos says:

    SBS2008 RTM’d today.  Does that mean you guys will be blogging about the backup solution asap?  :-)

  3. Gandolf says:

    I’m particularly interested in the Transport rule to prevent unauthorized forwarding of Voice mails outside the organization. What if the user changes the subject and changes the file extension? will it bypass the Transport rule?

  4. Regarding Gandolf’s post, in Exchange 2007 there are now different *types* of messages, voicemail and email. The Journaling feature is aware of this: it won’t journal voicemail by default. However, the Transport rules are not aware of this difference, there isn’t an explicit "voicemail" checkbox in the Transport rules. Therefore, the transport rule needs to key in on some other attribute of the message, like subject name or attachment file name (or both). So Gandolf is correct, if the user changed the file extension and subject, he could bypass the transport rule.  Perhaps I could write a more complex transport rule that keyed off information less accessible to the user, but ultimately the end user will probably win this "arms race." They can play the message on a speakerphone and record it, just as users can use cellphone cameras to take pictures of rights-managed documents.  We’ve raised the bar high enough to prevent "accidental" forwarding of voicemail outside the organization, but a motivated and intentional user can get a voicemail outside the system if they try hard enough.

  5. Lee Owens says:

    Chris, first let me thank you for the post – very helpful information as we are considering implementing UM.  But, just for clarification, you say that "Exchange does not journal voice mail by default", yet the TechNet doc you link to says "By default, in Exchange 2007, when you create a journal rule to journal e-mail messages sent to or from recipients or senders in an Exchange organization, voice mail and missed call notifications that are generated by Unified Messaging servers are included".  I checked my transport config setting for this, which hasn’t been altered, and found that the VoicemailJournalingEnabled setting is set to True, apparently by default.  Are you referring to this setting, or to something else in Exchange that would be preventing the journaling of voicemail by default?  Thanks again.

  6. Regarding Lee Owens’ post, "Good catch!" You are correct, the journaling *does* capture Voicemail by default, and can be configured so it *does not* capture voicemail if you use the Set-TransportConfig cmdlet. My mistake – I was so excited to discover that journaling was "voicemail-aware," that I missed the fact the default setting is TRUE instead of FALSE. And to your second point, Yes, that was the setting I was referring to: there is not something else in Exchange that would prevent the journaling of voicemail by default. Thanks again for the catch.

  7. Hemal says:

    Chris,

    I want to create policy where voicemail should be permnanetly deleted after 30 days which I believe I can acheive through managed folder content settings. But How can I exclude users if they are on vacation for more than 30 days and haven’t heard their voicemail.

    In short any policy i can create which distinguish between read voicemail and unread voicemail on UM ?

    Thanks

    Hemal Doshi

  8. Ojas says:

    What about text messages (SMS)?  I know that’s not part of the UM discussion in the white paper Chris has attached, but is there any case law on SMS discoverability?  Has anyone on this board had to deal with that issue?  thanks.

Comments are closed.