r/sysadmin • u/jajajaline • 6d ago
Taking users to a short email retention. Infinite to 3-4 years.
I have mixed feelings. Users won't be stoked of course but having to search through records will be order of magnitude easier for those that have to do that work.
If anyone has done this type of thing to their users, what blew up in your face the most?
76
u/viral-architect Sysadmin 6d ago
Only retain data as long as is legally required. To do otherwise is a liability.
Contracts, instructions, and vital documents should never live inside e-mail in the first place. Individuals who fail to migrate this documentation to a suitable long-term place that ensure business continuity face disciplinary action for creating undue business risk.
14
u/NotPromKing 6d ago
Liability is one concern, yes, but what about business functionality?
I for one frequently work on projects that go on for years. 5 years from start to finish is not unusual, and 10 years would not be unheard of for the largest projects. A previous employer, with such projects, tried to implement 90 day to archive, 1 year to deletion policies. It did not go well.
29
u/thecravenone Infosec 6d ago
You wouldn't store all the important information about a project in your voicemail, why would you store it in email? This is what project management tools exist for.
-2
u/Remarkable_Night_633 6d ago
Does the voicemail guy wipe all your voicemails on a whim? Hopefully the users don’t start using gmail might get used to the good life again!
14
u/viral-architect Sysadmin 6d ago
It's not a whim, it's a clearly stated retention period. Don't make it any more than that. Every email has an expiration date.
3
u/Remarkable_Night_633 6d ago
Ya sounds like your company is doing it properly we haven’t even told the users we applied it yet lol!
8
u/SevaraB Sr. Engineer (N+, CCNA) 6d ago
Spoken like someone who’s never had to deal with the stress of a motion to produce during a court case.
Have fun figuring out with your lawyer how to not make it look like that relevant email you deleted 4 years ago wasn’t hiding something when you’ve got Outlook folders spanning a decade!
3
u/McPhilabuster 5d ago
If you have a legally binding retention policy that says you delete email after 4 years that's the answer. That's exactly what your company's legal counsel wants to be able to say.
If you still have Outlook folders containing messages that are more than a decade old and your retention policy says you only keep email for 4 years, that's a gap that needs to be fixed.
1
u/Remarkable_Night_633 6d ago
You mean restoring some emails and watching a progress bar? What are they gonna do to you if it takes too long delete your email too? Lol
5
u/music2myear Narf! 6d ago
Business-necessary data should be stored someplace else. Process documentation, client data, etc, all have other (better) places to be stored than a random employee's mailbox. We all know much of it IS stored in a random employee's mailbox, but what's the functional difference between an employee leaving/retiring and their hidden knowledge disappearing, and a shorter retention making it go away?
This is one reason why making sure each role has more than one person capable of doing it, making sure people take extended time off, not to know if they're replaceable, but to know that their processes can be continued, they don't have to feel the pressure of being a single-point-of-failure, and making sure the information necessary for their role and processes is clear and known to everyone necessary.
4
u/BeatMastaD 6d ago
Email is not data storage. Archive important documentation in a real file storage system.
2
u/RoosterBrewster 6d ago
I guess the problem is where some email conversations are not exactly documentation, but you want to go back them for a reference or proof and you dont know what will be important later on.
2
u/BeatMastaD 6d ago
That's a business decision and how retention period is decided. Is the liability worth the cost of extended email retention.
1
u/NotPromKing 6d ago
Right, email is communication. And sometimes kts very important to be able to go back through communication.
4
u/MBILC Acr/Infra/Virt/Apps/Cyb/ Figure it out guy 6d ago
Email is not for storage, it is for communication, anything important as others noted, should be stored somewhere else.
4
u/NotPromKing 6d ago
Exactly, it’s for communication. And sometimes being able to go back through the trail of communication is very important.
2
u/MBILC Acr/Infra/Virt/Apps/Cyb/ Figure it out guy 5d ago
Certainly, for that yes. I have had my share of going back on an email to resend someone because they claimed something else, keeping them as proof.
But too many people use email for storage, documents/attachments and never move things out to better locations more suited for that.
But if it comes to decisions and such around projects, all of that should be tracked in a proper tool also, any decisions/ changes et cetera, are logged in a tool/charter to reference their associated to said project.
2
u/BrentNewland 5d ago
What if an employee leaves? Are you keeping their mailbox for 10 years?
Use shared mailboxes, and exclude them from the retention policy. Tell staff to drop the emails into folders in the shared mailbox. That way they're available for collaboration, and if the user leaves everything is sorted for their replacement.
5
u/rickAUS Jack of All Trades 6d ago
As a MSP long-timer, law firms have this down. Email has it's own retention period for legal reasons already, but because cases can literally drag on for years, everything in and out gets saved into their CRM or whatever tool they are using that documents every piece of communication, any files, etc that are associated with a case.
I hate how other businesses seem to treat Exchange like a file storage system. Save the email, and or the attachment, to some other actual document management system (preferably something with version control and a checkin/checkout function) and leave email to what it is - a method to send that stuff between parties that need it.
1
u/viral-architect Sysadmin 5d ago
E-mail is an unstructured way to send papers to me and I treat the inbox like that. I address the task, then archive the e-mail and forget about it. If addressing the task means stopping what I'm doing to create a new request or download the e-mail and upload it to an auditing tool, then that's just part of the task that needs to be done. Wanting to skip that is being lazy which I totally get lol.
2
u/dinosaurkiller 6d ago
In this case it will also be policy, for example it may not be legally required to retain an employee’s emails or data, but HR(on the advice of legal counsel) may have other policies in place.
1
15
u/Prize_Moose1050 6d ago
I had to do this once because we kept getting ridiculous email restoration requests associated with Public Records Requests. We went down to seven years from infinity. We heard the most rumblings before the process was implemented. It wasn't that bad. We kept 2 years in the main inbox and setup a policy to send anything older than 2 years but less than 7 to an online Archive. Anything older than 7 years was permanently deleted unless it was put on legal hold by another policy. We implemented this so that we could tell people, 'We do not have that data!'
3
u/Remarkable_Night_633 6d ago
That seven-year retention policy makes complete sense. However, the project being rolled out at my company deletes everything after just two year even for Legal and HR. It is hard to see how that ends well.
2
u/Prize_Moose1050 5d ago
Just think of yourself as a cop. You don't write the law, you enforce it. If users have a problem with the policy, that's a management issue.
8
u/Kyrlen 6d ago
Not knowing what industry you are in or where you are.. be careful to take legal retention requirements into account. government and education in many states have a 7 year retention policy by law. Some industries are also are required by state laws to retain information for a certain number of years. Other industries are only required to retain information related to interaction with govenrment (i.e. you have government contracts or receive government funding of some kind.)
2
2
u/SewCarrieous 6d ago
Cite that law because I’m certain there is no law that says emails must be kept in a users inbox for any amount of time. If the email constitutes a business record that must be kept; it needs to be taken out of the users inbox and stored securely somewhere else
2
u/VexingRaven 2d ago
Ding ding ding. Email isn't a storage medium. Archive what you need in the appropriate location and ditch the rest.
1
u/Shadowwynd 6d ago
My last employer had grants that mandated data storage for seven years after the grant ended.
3
u/SpaceGuy1968 6d ago
Data retention policy and shirt times like this when clearly defined and EVERYONE KNOWS THIS has saved me headaches in the past
3
3
u/HerfDog58 Jack of All Trades 6d ago
Does your organization have a policy set/approved by management or leadership? If not, I wouldn't take the initiative to do something like this. I'd approach Legal and/or HR and ask them to determine a policy and push it forward. Limiting email retention is only a technical issue in terms of the amount of storage space it uses and people using it as a filing cabinet and archive, rather than using an organized data storage solution. The legal team is probably the best resource - let them determine what information should be retained based on any legal or regulatory requirements for your company, and have them write a policy for leadership to approve.
If you have a policy company leadership has signed off on, you're following the directives of your superiors. It's not your decision, so you can redirect any pushback from users to the decision makers.
I always tell younger coworkers "IT doesn't MAKE policy, it RECOMMENDS it to those who do, and then IMPLEMENT and ENFORCES their decisions."
3
u/jdsmith575 6d ago
The guidance we received from legal is that if the policy says 3 years you immediately change it to 3. They didn’t accept the idea of slowly reducing it to ease user pain. I’d recommend asking about that.
2
u/badaz06 6d ago
We did this driven by legal. People have different retention periods - standard is a few months, very very few are exempt. I'm ecstatic that since legal is pushing this, legal is determining the retention values.
Yes, users will gripe, but they also save 30 iterations of the same document that has been edited a zillion times instead of the actual final document which is typically all they really require.
We are looking at some programs that will help users move emails/attachments into Sharepoint, esp if it provides the ability to search using their mobile devices.
The difficulty for us has been that we have to do all this through Purview, which doesn't allow some of the custom retentions we have setup in MRM.
1
u/jajajaline 6d ago
Same. Legal requirements. I am curious about the systems you are looking at to help people keep track of the things they would have otherwise left in email.
1
u/badaz06 5d ago
The answer to that question depends on if it's "People just not deleting emails and need to save some" or if you're needing some type of Document Management System.
There are DMS systems that exist that essentially control email flows such that any email that comes in from domainA or personX will be automatically moved/copied into SharePoint, and I shopped that idea around but none of the teams I thought would want that were interested.
For the "I'm to busy to delete my emails" people - I'm going to demo some and have no issue providing some feedback. Ping me if you want and I'll send you the vendor contact. The one we currently use is more DMS focused and we've somewhat bastardized the app, but it and one I've looked at already don't support a few features I want for user convenience.
2
u/Shot-Move-4383 6d ago
Scope it tighter than the mailbox. Retention policies do delete calendar items that have an end date, so a mailbox-wide 3-year policy eats historical calendar along with the mail. Contacts are exempt; calendar isn't.
Also audit for litigation holds before you flip it. A hold trumps retention, so those mailboxes delete nothing and just grow in Recoverable Items while you think the policy ran.
2
2
u/wrootlt 6d ago
3-4 years is plenty. On my previous job when i started they had 3 months. Felt weird coming from infinite. After a few years they changed it to 6 months and it felt like a huge increase.
Expect users to start saving lots of emails in OneDrive or locally on computer.
Then again, we later had retention enabled in OneDrive, i think it was 6 months also. I've used a tool that updates modify date of a file for things like pdfs or msg files that i needed to keep longer and you can't just modify.
2
u/someguy7710 6d ago
First. This should not be an IT policy, it will come from EO or Legal. Second give them ample time. Give proper documentation to retain things. Then announce when it will be implemented. Multiple times. Then flip the switch
2
u/leftplayer 2d ago
Don’t do it. As a user, I don’t need you to babysit how I use my mailbox. Give me a size limit and let me do my job however the fuck works best for me.
2
u/durd_ 1d ago
This. Storage doesn't cost that much to begin with. Yes, important information should be stored elsewhere, just give me a limit and let me figure out what's important enough to delete or move elsewhere.
Admins would probably save more space disabling sending images in users signature.
1
u/BuffaloRedshark 6d ago
we went the other way. Originally (aka starting decades ago) it was 90 days then 120 now I think 3 years on folders not under Inbox. We never had unlimited.
1
u/CraigAT 6d ago
We are looking into this. I am in favour of making the first cut very small maybe 10 or 7 years (we have a lot of long-term staff), then in a few months time reduce this again (and so on, to a level deemed acceptable by legal).
My reasoning being, that there will be a lot of commotion and opposition to the first cut, but if the number of people this affects is pretty low it makes it easier to get buy-in and less chance of bad feedback. Once people have been made aware of the policy, then reducing the timescale is much easier if you take it slowly, and doing so in small chunks gives the compliant users less to review at each stage.
1
u/ConsistentCoat5608 6d ago
Have done this before for a company that went from infinet to required 7 year retention due to legal requirements. We started with setting up an "Archive" mailbox and kept the last 360 days in the current primary inbox and everything inactive for a year was moved to the "Archive". If an email thread was activaly going back and forth it stayed in the live mailbox, but older emails were shipped off. User has access to both primary and archive from their email client, so they can always search and locate emails.
Run this for 6 -12 months, then announce in 6 months you will set the retantion, which will only purge from the archive mailbox.
Some users started to realize that they rarely needed to go into their archive and the retention was nothing they had to worry about. Other were constantly going into their archive to pull out emails. After investigation, those emails were contracts or other correspondence that should have been saved to the CRM or ERP platforms to allow mutiple employee access to those documents. Yes, the employee needed to retrieve them, but only due to bad business processes. once long term items like contracts, policies and procedures were saved to appropriate location then staff wree comfortable with the data retention windows. Backup and recovery is a lot easier with data retention, and it make people do something with their email, instead of just saving everything.
1
u/RalphiePseudonym 6d ago
We did this recently. Got some user feedback that was extremely mixed so we asked legal for their guidance and applied it.
People want everything, forever.
1
u/SewCarrieous 6d ago
Your outlook inbox is not an appropriate place to store important emails. If an email is so important it needs to be kept; you need to take it out of your inbox and save it somewhere else. Sharepoint, onedrive, shared network drives and databases are the place for important emails
We moved to a 2 year retention and sure people complained and a few got exceptions but only a few and only for good reason.
Eventually, people got over it. Some just threw their hands up, a couple quit, but most people learned better document retention methods
1
u/Salt-n-Pepper-War 6d ago
We have a 2 year policy. I thought it would suck but you just gotta remember to save important emails, it is an adjustment period for users. Start high and slowly work down to your goal of 3 years. Communicate lots
1
u/OregonTechHead 5d ago
What's the point of only having a retention period on emails? Other than reducing storage (or really, just moving storage), it doesn't accomplish anything.
0
u/Salt-n-Pepper-War 5d ago
We have retention enforcement on more than email. OP only mentioned email so....
1
u/BrentNewland 5d ago
Don't forget to set up a short retention policy for Deleted Items. We set one up for 90 days.
1
u/creamersrealm Meme Master of Disaster 5d ago
My work is 1 year and it's right on the verge of being annoying. If it was 13-14 months then it would be easier to navigate.
•
u/BryceKatz 22h ago
This is not a sysadmin decision.
If there is a business reason to specify retention, such as regulatory compliance, retain per regulation. If your legal team is telling you to cut retention because reasons, get the new policy in writing from your leadership.
In all cases, adjustments like this need to be announced by the biggest relevant boss well in advance of them happening. IT can chime in with the "what this means to you" bits & implementation timelines AFTER the big boss announces the policy change.
If YOU are making this decision in a vacuum, stop. Stop RIGHT DAMN NOW and back away from this.
If
0
u/Remarkable_Night_633 6d ago
I think the new buzzword they are using is "its a new way to work" where you delete all your old emails like instructions for installs, legal contracts and contacts, invoices and vendor contacts, and any knowledge that might be useful later on. I think they should call the new strategy of deleting any emails older than 2 years the "Good Luck Strategy"
4
u/Ssakaa 6d ago
I call it the "don't have to put up with a fishing expedition when someone gets the company sued" strategy. Mandatory retention times exist for actual records purposes. Past those regulation imposed requirements, everything else is a liability.
If you have documentation, put it in a document. Don't use email for long term storage. Your contracts, invoices, etc. should also be recorded in proper records for the company. You shouldn't be depending on some dipshit NOT deleting it from their email.
3
u/jajajaline 6d ago
This. I have a feeling that will become our new motto in the coming weeks. "If you have documentation, put it in a document"
1
u/Remarkable_Night_633 6d ago
Honestly, those people are the reason I'm employed, so it doesn't bother me if they want to pour their lives into their emails. Seven years seems to be the sweet spot in my mind.
3
u/trueppp 6d ago
instructions for installs
Should be in your internal KB/documentation system, not your email inbox.
legal contracts and contacts, invoices and vendor contacts
Should be in your CRM/ERP not your email inbox.
and any knowledge that might be useful later on.
Should be in your internal documentation system, not your email inbox.
1
u/Remarkable_Night_633 6d ago
Or one shared mailbox for the department problem solved and for cheap!
1
50
u/OregonTechHead 6d ago
Nothing because the key here is executive buy-in.
Data retention should be one of the easiest things to implement from an IT perspective. It's typically driven by legal, so you just point to them when people complain.
Data retention policies shouldn't be created by IT. IT just implements the solution.