Export (0) Print
Expand All

Create or remove an In-Place Hold

 

Applies to: Exchange Online, Exchange Server 2013

Topic Last Modified: 2015-07-17

An In-Place Hold and Litigation Hold preserves all mailbox content, including deleted items and original versions of modified items. All such mailbox items are returned in an In-Place eDiscovery search. When you place an In-Place Hold on a user's mailbox on, the contents in the corresponding archive mailbox (if it's enabled) are also placed on hold, and returned in a eDiscovery search.

NoteNote:
Depending on your Active Directory topology and replication latency, it may take up to an hour for an In-Place Hold to take effect.

  • Estimated time to complete: 5 minutes

  • You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "In-Place Hold" entry in the Messaging policy and compliance permissions topic.

  • To place an Exchange Online mailbox on In-Place Hold, it must be assigned an Exchange Online (Plan 2) license. If a mailbox is assigned an Exchange Online (Plan 1) license, you would have to assign it a separate Exchange Online Archiving license to place it on hold.

  • In Exchange Online, the quota for the Recoverable Items folder is automatically increased to 100 GB when you place an In-Place Hold on a mailbox. The default size of the Recoverable Items folder is 30 GB.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

TipTip:
Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection.

Use the EAC to create an In-Place Hold

  1. Navigate to Compliance management > In-place eDiscovery & hold.

  2. Click New Add Icon.

  3. In In-Place eDiscovery & Hold, on the Name and description page, type a name for the search and an optional description, and then click Next.

  4. On the Mailboxes page, click Specify mailboxes to search, click Add Add Icon, select the mailboxes you want to place on hold, and then click Next.

    ImportantImportant:
    You can use the Search all mailboxes option for In-Place eDiscovery searches. You can’t select this option to place all mailboxes on hold. To create an In-Place Hold, you must select the specific mailboxes you want to be placed on hold.
  5. On the Search query page, complete the following fields, and then click Next:

    • Include all user mailbox content   Click this button to place all content in selected mailboxes on hold.

      NoteNote:
      To get the same results as litigation hold in Exchange 2010, you can use this option and select Hold indefinitely on the next page (In-Place Hold settings).
    • Filter based on criteria   Click this button to specify search criteria, including keywords, start and end dates, sender and recipient addresses, and message types.

      ImportantImportant:
      If a mailbox is placed on more than five query-based holds, the query parameters are ignored and all mailbox content is placed on hold.
  6. On the In-Place Hold settings page, select the Place content matching the search query in selected mailboxes on hold check box and then select one of the following options:

    • Hold indefinitely   Click this button to place items returned by the search on an indefinite hold. Items on hold will be preserved until you remove the mailbox from the search or remove the search.

    • Specify number of days to hold items relative to their received date   Click this button to hold items for a specific period. For example, you can use this option if your organization requires that all messages be retained for at least seven years. You can use a time-based In-Place Hold along with a retention policy to make sure items are deleted in seven years. To learn more about retention polices, see Retention tags and retention policies.

Use the Shell to create an In-Place Hold

This example creates an In-Place Hold named Hold-CaseId012 and adds the mailbox joe@contoso.com to the hold.

ImportantImportant:
If you don’t specify additional search parameters for an In-Place Hold, all items in the specified source mailboxes are placed on hold. If you don’t specify the ItemHoldPeriod parameter, items are placed on hold indefinitely or until the mailbox is either removed from hold or the hold is deleted.
New-MailboxSearch "Hold-CaseId012�? -SourceMailboxes "joe@contoso.com�? -InPlaceHoldEnabled $true

For detailed syntax and parameter information, see New-MailboxSearch.

How do you know this worked?

To verify that you have successfully created the In-Place Hold, do one of the following:

  • Use the EAC to verify that the In-Place Hold is listed in the list view of the In-place eDiscovery & hold tab.

  • Use the Get-MailboxSearch cmdlet to retrieve the mailbox search and check the search parameters. For an example of how to retrieve a mailbox search, see the examples in Get-MailboxSearch.

ImportantImportant:
In Exchange 2013, mailbox searches can be used for an In-Place Hold and In-Place eDiscovery. You can’t remove a mailbox search that’s used for In-Place Hold. You must first disable the In-Place Hold by clearing the Place content matching the search query in selected mailboxes on hold check box on the In-Place Hold settings page or by setting the InPlaceHoldEnabled parameter to $false in the Shell. You can also remove a mailbox by using the SourceMailboxes parameter specified in the search.

Use the EAC to remove an In-Place Hold

  1. Navigate to Compliance management > In-Place eDiscovery & hold.

  2. In the list view, select the In-Place Hold you want to remove and then click Edit Edit icon.

  3. In In-Place eDiscovery & Hold properties, on the In-Place Hold page, clear the Place content matching the search query in selected mailboxes on hold, and then click Save.

  4. Select the In-Place Hold again from the list view, and then click Delete Delete icon.

  5. In warning, click Yes to remove the search.

Use the Shell to remove an In-Place Hold

This example first disables In-Place Hold named Hold-CaseId012 and then removes the mailbox search.

Set-MailboxSearch "Hold-CaseId012�? -InPlaceHoldEnabled $false
Remove-MailboxSearch "Hold-CaseId012�?

For detailed syntax and parameter information, see Set-MailboxSearch.

How do you know this worked?

To verify that you have successfully removed an In-Place Hold, do one of the following:

  • Use the EAC to verify that the In-Place Hold doesn’t appear in the list view of the In-place eDiscovery & hold tab.

  • Use the Get-MailboxSearch cmdlet to retrieve all mailbox searches and check that the search you removed is no longer listed. For an example of how to retrieve a mailbox search, see the examples in Get-MailboxSearch.

 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2015 Microsoft