Exchange Server 2007: Using Journaling Rules

[LEFT][CODE]http://www.msexchange.org/tutorials/Exchange-Server-2007-Using-Journaling-Rules.html[/CODE]

[B]Overview[/B]

The upcoming release of Exchange Server, Exchange Server 2007, has many changes at the architectural level. These changes maximize the features available, one of them being journaling.
As a reminder, journaling is the ability to record all messages flowing in and out of an organization.
It is a very useful feature because there are many legal and regulatory requirements, such as the Sarbanes Oxley Act, SEC Rule 17A-4 and many more, that need a journaling solution.
The journaling method used in Exchange Server 2003 can be used in Exchange Server 2007, but now journaling can be used at the Hub Transport Server role. Due to the characteristic of any message exchanged between users passing through the Hub Transport Server role, new functionality such as journaling mail-enabled contacts, mail-enabled groups, recording user messages with a single journal rule without setting the changes in each mailbox database is provided.
[B]Journaling: The traditional way...[/B]

In Exchange Server 2003, journaling took place directly in the mailbox store because there was no hub transport role.
In Exchange Server 2007 we can choose either to have the same option (allowing a Journal mailbox to receive all message traffic from a mailbox database) or to support a number of Mailbox databases. We can also create a separate mailbox database to store the mailbox which will receive the journaling.
In the following example, we are going to configure a mailbox database in Exchange Server 2007 to record all user messages that have been sent and received within the same database to be redirected to a specific mailbox.
To configure Journaling for a specific mailbox database, follow these steps:

[LIST=1][*]Open the [B]Exchange Management Console.[/B][*]Expand [B]Server Configuration[/B], and then click on [B]Mailbox Database[/B].[*]In the [B]Toolbox Actions of selected Mailbox Database[/B] click on [B]Properties[/B] (Figure 01).[/LIST]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image002a1159366682671.JPG[/IMG]
[B]Figure 01:[/B] Exchange Management Console – Requesting Properties of Mailbox Database[/INDENT]
[LIST=1][*]In the [B]Mailbox Database Properties [/B]page, go to the [B]General[/B] tab and then select the [B]Journal Recipient[/B] checkbox (Figure 02).[/LIST]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0041159366682750.jpg[/IMG]
[B]Figure 02:[/B] Mailbox Database Properties Page[/INDENT]
[LIST=1][*]Before checking [B]Journal Recipient[/B], click on [B]Browse[/B] and choose which mailbox will get all messages from the mailbox database. For the purposes of this article, this user is called [B]Journal[/B] (Figure 03), click [B]OK [/B]to finish.[/LIST]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0061159366682890.jpg[/IMG]
[B]Figure 03:[/B] Selecting the user who will receive all messages of selected Mailbox Database[/INDENT]
[LIST=1][*]This is the final screen of journaling settings at mailbox database level; now, all the messages by existing users in the mailbox database, will be copied to the mailbox called [B]Journal[/B] (Figure 04).[/LIST]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0081159366889609.jpg[/IMG]
[B]Figure 04:[/B] Mailbox Database with Journal Recipient enabled and set to Journal recipient[/INDENT]From now on, all the messages from all users that have mailboxes in this mailbox database will be recorded in the mailbox named [B]Journal[/B].
[B]Testing the traditional way of Journaling[/B]

To check which users will be affected by our configuration, we should run a cmdlet. To do this, go to the MSH console and type the following:
[I]Get-Mailbox | Group-Object database | fl[/I]
The output of this command will be a list of all mailbox databases with the respective users as shown in Figure 05.
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0101159366890015.jpg[/IMG]
[B]Figure 05:[/B] Viewing users by Mailbox Database[/INDENT]Now, we will test this feature by sending a message from the user [I]Anderson Patricio[/I] to [I]Jose Rodas[/I].
Once this message is sent, we will have to check the Journal mailbox and analyze if the message was recorded. We can see all the recipient information and the real message will appear as an attachment.
[INDENT] [IMG]http://www.msexchange.org/img/upl/Figure06-new1159437881593.JPG[/IMG]
[B]Figure 06:[/B] Viewing the message sent by User Anderson Patricio in the Journal Mailbox[/INDENT][B]Overview of the Exchange Server 2007 Journal Rule [/B]

Exchange Server 2007 uses Hub Transport to journal messages, so it is valid for the whole organization because all the information on Hub transport server is kept and replicated on Active Directory. The process of message journaling has three main components:

[LIST][*][B]Journal agent:[/B] This is an agent that can be configured to journal e-mail messages that are sent or received by recipients in an Exchange 2007 organization.[*][B]Journaling Mailboxes:[/B] This is a mailbox that is only used for collecting journal reports (messages).[*][B]Journal Reports[/B]: This is the message that Microsoft Exchange generates when a message matches an existent journal rule and then is submitted to the journaling mailbox.[/LIST]
The journaling process is very simple. All the messages that pass through the Hub transport are inspected, and if they match the defined criteria that was configured in the journal rule, a journal report will be created and delivered to the Journaling Mailbox as shown in Figure 07.
[INDENT] [IMG]http://www.msexchange.org/img/upl/Figure07-new1159437881593.JPG[/IMG]
[B]Figure 07:[/B] Process of journaling in Exchange Server 2007[/INDENT][B]Now... Using the new Exchange Server 2007 feature[/B]

In this section, we will start using the new Exchange Server 2007 feature: the Journaling Rules. Consider the following scenario: we will record all messages sent and received from user [B]Jose Rodas[/B] in the mailbox [B]Journal[/B].
To create a journal rule, follow these steps:

[LIST=1][*]Open the [B]Exchange Management Console[/B], expand [B]Organization Configuration[/B], click [B]Hub Transport[/B], and select [B]New Journaling Rule[/B] on the Toolbox [B]Actions[/B] (Figure 08).[/LIST]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image016a1159367162265.JPG[/IMG]
[B]Figure 08:[/B] Creating the new journaling rule[/INDENT]
[LIST=1][*]On the [B]New Journaling Rule[/B] page, type a name on the [B]Rule name[/B] field. This name can have up to 245 characters.[*]In the [B]Journal e-mail address[/B] field, select the recipient that will get all the message traffic for this rule.[*]In [B]Scope[/B] we can choose one of these options:
[LIST][*][B]Global[/B]: All messages (Internal and External)[*][B]External[/B]: Only external messages[*][B]Internal[/B]: Only internal messages[/LIST]
[*]In the [B]Journal e-mail for recipient[/B] field select the user who you want a record of his/her messages. For the purpose of our example, we have made a journal rule for all messages sent and received for the user [email]jose@apex07.beta[/email].[/LIST]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0181159367163125.jpg[/IMG]
[B]Figure 09:[/B] Creating the journal rule[/INDENT]
[LIST=1][*]On the [B]Completion[/B] page, the result of the rule creation will appear on the screen with the cmdlet used to create the rule. Click [B]Finish[/B] to exit (Figure 09).[/LIST]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0201159367456218.jpg[/IMG]
[B]Figure 10:[/B] Finishing the rule creation[/INDENT][B]Testing the Journaling Rule…[/B]

We will send a test message from the user [I]Anderson Patricio[/I]to the user[I] Jose Rodas. [/I]The expected result is to get the message in our recently configured Journal Mailbox (Figure 11).
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0221159367456625.gif[/IMG]
[B]Figure 11:[/B] User Anderson Patricio sends a test message to Jose Rodas to test a recently created Journaling Rule[/INDENT]Now, we can access the Journal mailbox and check if the journal rule is working correctly (Figure 12).
[INDENT] [IMG]http://www.msexchange.org/img/upl/Figure12-new1159437881609.JPG[/IMG]
[B]Figure 12: [/B]Viewing the message recorded in Microsoft Outlook Web Access[/INDENT]At this point, we see that the journaling rule is working as expected. It was completed with just a rule in the Hub Transport role at Organizational level.
[B]How can I make a journaling rule for the whole organization?[/B]

In many cases, the journaling feature is required for all the members of an organization because of legal requirements, as we described in the beginning of this article. Using Journaling Rules makes this process easier, storing all the users' messages in the same, or another, mailbox database than the one that actually stores the mailboxes by just creating a rule.
The creation process is just the same, the only difference is that we do not need to choose anything on [I]Journal e-mail for recipient[/I] so all the organization's mail traffic will be stored in the Journal mailbox (Figure 13).
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0261159367668171.jpg[/IMG]
[B]Figure 13: [/B]Creating a Journaling Rule for all users[/INDENT][B]Problem Resolution: Journaling vs. Transport Rules[/B]

In some cases, we could get a conflict between Transport Rules and Journal Rules.
In order to better understand this difference, we will use the following example. There is a transport rule that blocks all the messages between users Anderson Patricio and Jose Rodas (Ethical Wall), but the administrator is required to record all the messages before they are dropped.
By default, the Transport Agent rules are executed first then Journaling Rules. So, in this situation, it will not be possible to journal when you have a transport rule that deletes some messages. The order of agent transport in Exchange 2007 is shown in the figure below (Figure 14).
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0281159367669734.gif[/IMG]
[B]Figure 14:[/B] Some of Hub Transport Architecture. The full version can be found [URL="http://download.microsoft.com/download/f/f/b/ffb96cba-fc3e-476a-a27a-50d63d36d720/Exchange2007_HubTransportRoleArchitecture.pdf"]here[/URL] (image courtesy of Microsoft)[/INDENT]So, as discussed earlier, the default order does not let us record blocked messages on Transport Rules, so let’s check the order through a cmdlet called [B]Get-TransportAgent[/B] in the Exchange Management Shell (Figure 15).
To check the orders that are assigned, type the following in an MSH Console:
[I]Get-TransportAgent[/I]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0301159367670406.jpg[/IMG]
[B]Figure 15: [/B]Checking the TransportAgent order priority[/INDENT]In this example, our scenario will not work as expected, in other words, the blocked message will not be recorded in the mailbox Journal.
To solve this, we will have to change the transport agents order with the Set-TransportAgent cmdlet.
The full syntax to solve this is:
[I]Set-TransportAgent <Transport-Agent-Name> -Priority:<Number> (Figure 16).[/I]
[INDENT] [IMG]http://www.msexchange.org/img/upl/image0321159367940296.jpg[/IMG]
[B]Figure 16: [/B]Changing Agents priority and visualizing them after changes[/INDENT]With this change, our scenario works as expected. The Journaling Agent has a higher priority than the Transport Rule Agent. So even blocked messages will be recorded in the Journal mailbox.
[B]Conclusion[/B]

In the article we have discussed how to use journaling using two different methods:

[LIST][*]The first being similar to Exchange Server 2003 (mailbox database).[*]The second, using journaling rules, which is a feature that will be available in Exchange Server 2007.[/LIST]
We have also seen that this new method of journaling is easier and more advanced than the method used in previous versions of Exchange Server.
We also learned how to manage TransportAgent orders in the Hub Transport Role of Exchange Server 2007 using cmdlets in the Exchange Management Console.
[B]Note:
[/B]This article was written using an Exchange Server 2007 Beta 2 version. The final release (RTM) may have different screens than the ones described in this article.



[/LEFT]