Keyword Searches
Judging by the number of questions I see online, many administrators are looking for the best way to scan an information store for messages that contain specified keywords. This requirement usually arises because a manager wants to know who's been leaking confidential data or sending inappropriate email. Exchange doesn't offer keyword-search functionality, but if you need to look for instances of a particular text string, you're not totally out of luck.
First, if you need to search only a few mailboxes, don't disregard Exchange's built-in content indexing feature. If you turn on full-text indexing for the mailbox database, searching is quite fast, and the indexing schedule is adjustable. To enable indexing for a mailbox store, right-click the store, choose Create Full-Text Index from the context menu, then open the store's properties dialog box and use the Full-Text Indexing tab to control the indexing properties.
Searching all mailboxes on a store or server is a bit more complicated. The familiar Exmerge tool can scan for messages that have specified Subject lines or attachment filenames and move all messages it finds to a .pst file. However, this approach has a couple of drawbacks. One problem is that because Exmerge moves the messages that meet the criteria, the corresponding users will know you're monitoring their mail unless you run Exmerge against a copy of the mail database. (If you're using Exmerge to sanitize a message store by removing messages that you know are virus-infected or otherwise undesirable, this behavior won't be a problem.) The other problem is that Exmerge doesn't scan the body of the message or its attachments. If you need to look inside the message, you'll need to use a content management scanner such as GFI MailEssentials for Exchange/SMTP or Clearswift's MIMEsweeper. Other products, such as KVS's Enterprise Vault and IXOS SOFTWARE's IXOS-eCONserver, let you use indexed searches to find messages that contain inappropriate text or keywords.
On-the-Fly Content Scanning
Exchange administrators sometimes also need to scan all inbound or outbound content. You might already be using perimeter scanning to catch viruses, but perimeter scanning can also be a useful way to ensure that no one is sending out sensitive data, harassing email messages, and the like.
Exchange has no built-in content-scanning tools (unless you count the antivirus API—AVAPI, which is designed for virus scanning), but a wealth of third-party tools provide content scanning with or without virus scanning and keyword filtering. (To learn about some such tools, see Buyer's Guide, "Exchange Server Antivirus Software," February 2002, http://www.winnetmag.com, InstantDoc ID 23564.) These products range from standalone appliances such as the IronMail (see "CipherTrust's IronMail," March 2003, InstantDoc ID 37931) and freestanding products such as Trend Micro's InterScan VirusWall to products such as Power Tools for Exchange, which you install on your Exchange server. When you evaluate one of these products, consider what it lets you do with mail that matches your criteria, as well as what kinds of reporting features it includes. Some products let you define policies that control which kinds of mail can come and go; be sure that the product you select lets you adjust the keyword list easily and change policies on the fly. Download an evaluation version of the product you're interested in and test it on a server to make sure it behaves as advertised.
A Bit of Advice
Users tend to become testy if they find out their email is being monitored. I always recommend that mail-system administrators refuse to monitor or scan email unless they have a written request from a properly authorized supervisor or company officer. In addition, you probably shouldn't do the monitoring yourself. Set up the capability, then give access to whoever requested the monitoring. These actions help insulate you from knowledge of whatever the "bad" messages contain—a prudent posture in today's litigious climate. I'm not a lawyer, however, so consult your own, or your firm's, attorney for more detailed legal advice if you need it. Seeking legal advice is particularly important for international companies: Laws in different countries vary, so monitoring that's legal in Australia might not be legal in Austria or Argentina.
End of Article
Prev. page
1
[2]
next page -->
