Third-Party Products in an Exchange DCAR Solution

Exchange provides some of the basic requirements for a discovery, compliance, archiving, and retention (DCAR) solution. However, to complete your DCAR solution, you'll probably need additional capabilities—such as PST management, policy-based archiving, and access control and auditing—that third-party products provide. Let's look at these capabilities in more detail.

PST Management
On an individual level, personal folder files (PSTs) are extremely convenient. But the price of that convenience is loss of control. PSTs give users a great way to collect and store information; they also provide a great way for users to accidentally (or intentionally) violate archiving and retention policies and leak protected information past access control and audit mechanisms.

Whether you completely prohibit PSTs or permit their use only under certain conditions, you must have some technical means to keep control. Many administrators I've talked to consider PST management to be one of the hardest technical concerns they face during their DCAR implementations. If you don't agree, think about how you'd answer these questions:

• How do I index the contents of PSTs that are defined in users' Outlook profiles?
• How do I discover PSTs that are on users' hard drives but not part of their profiles?
• How do I discover PSTs that are on file servers, including those stored in roaming user profiles?
• Can I detect PSTs if a user renames the PST and changes the extension?
• How do I enforce proper access and audit ACLs on PSTs?
• How do I enforce proper access and audit ACLs on PSTs stored on FAT partitions?
• Do I need to use Group Policy Objects (GPOs) to prevent my Outlook users from creating or opening PSTs?
• How do I mimic the functionality of GPOs for users and machines (e.g., home users, laptops) that aren't domain-joined or that spend most of their time not connected to the corporate network?
• Which other mail clients are in use that can create PSTs?
• If I prohibit PSTs, what alternative functionality do users have to perform some of the same functions in an approved and manageable fashion?

The PST management component of your DCAR solution must be able to address these concerns. . . .