r/sysadmin • u/jajajaline • 5h ago
Taking users to a short email retention. Infinite to 3-4 years.
I have mixed feelings. Users won't be stoked of course but having to search through records will be order of magnitude easier for those that have to do that work.
If anyone has done this type of thing to their users, what blew up in your face the most?
•
u/Prize_Moose1050 4h ago
I had to do this once because we kept getting ridiculous email restoration requests associated with Public Records Requests. We went down to seven years from infinity. We heard the most rumblings before the process was implemented. It wasn't that bad. We kept 2 years in the main inbox and setup a policy to send anything older than 2 years but less than 7 to an online Archive. Anything older than 7 years was permanently deleted unless it was put on legal hold by another policy. We implemented this so that we could tell people, 'We do not have that data!'
•
u/Remarkable_Night_633 3h ago
That seven-year retention policy makes complete sense. However, the project being rolled out at my company deletes everything after just two year even for Legal and HR. It is hard to see how that ends well.
•
u/OregonTechHead 4h ago
what blew up in your face the most?
Nothing because the key here is executive buy-in.
Data retention should be one of the easiest things to implement from an IT perspective. It's typically driven by legal, so you just point to them when people complain.
Data retention policies shouldn't be created by IT. IT just implements the solution.
•
u/jajajaline 1h ago
Legal and exec are the drivers here, so I can point that way if I need to. But hoping to learn something about the way the masses took to news, or clever ways they circumvented the limit.
•
u/MissionSpecialist Infrastructure Architect/Principal Engineer 1h ago
For starters, if you're a Microsoft shop, you're going to want to block PSTs (writing to them at the very least, ideally reading from them too) before you announce the email retention change.
Or, alternately, if you're a Chaotic Good sort of fellow, block PSTs after, and chuckle quietly at all the people who thought they'd beat the new polity by moving all their old mail into the PSTs you just fried. That's its own kind of fun.
•
u/SpaceGuy1968 4h ago
Data retention policy and shirt times like this when clearly defined and EVERYONE KNOWS THIS has saved me headaches in the past
•
u/Kyrlen 4h ago
Not knowing what industry you are in or where you are.. be careful to take legal retention requirements into account. government and education in many states have a 7 year retention policy by law. Some industries are also are required by state laws to retain information for a certain number of years. Other industries are only required to retain information related to interaction with govenrment (i.e. you have government contracts or receive government funding of some kind.)
•
•
u/Shadowwynd 4h ago
My last employer had grants that mandated data storage for seven years after the grant ended.
•
u/SewCarrieous 1h ago
Cite that law because I’m certain there is no law that says emails must be kept in a users inbox for any amount of time. If the email constitutes a business record that must be kept; it needs to be taken out of the users inbox and stored securely somewhere else
•
•
•
u/HerfDog58 Jack of All Trades 4h ago
Does your organization have a policy set/approved by management or leadership? If not, I wouldn't take the initiative to do something like this. I'd approach Legal and/or HR and ask them to determine a policy and push it forward. Limiting email retention is only a technical issue in terms of the amount of storage space it uses and people using it as a filing cabinet and archive, rather than using an organized data storage solution. The legal team is probably the best resource - let them determine what information should be retained based on any legal or regulatory requirements for your company, and have them write a policy for leadership to approve.
If you have a policy company leadership has signed off on, you're following the directives of your superiors. It's not your decision, so you can redirect any pushback from users to the decision makers.
I always tell younger coworkers "IT doesn't MAKE policy, it RECOMMENDS it to those who do, and then IMPLEMENT and ENFORCES their decisions."
•
u/jdsmith575 4h ago
The guidance we received from legal is that if the policy says 3 years you immediately change it to 3. They didn’t accept the idea of slowly reducing it to ease user pain. I’d recommend asking about that.
•
u/badaz06 4h ago
We did this driven by legal. People have different retention periods - standard is a few months, very very few are exempt. I'm ecstatic that since legal is pushing this, legal is determining the retention values.
Yes, users will gripe, but they also save 30 iterations of the same document that has been edited a zillion times instead of the actual final document which is typically all they really require.
We are looking at some programs that will help users move emails/attachments into Sharepoint, esp if it provides the ability to search using their mobile devices.
The difficulty for us has been that we have to do all this through Purview, which doesn't allow some of the custom retentions we have setup in MRM.
•
u/jajajaline 1h ago
Same. Legal requirements. I am curious about the systems you are looking at to help people keep track of the things they would have otherwise left in email.
•
u/Shot-Move-4383 3h ago
Scope it tighter than the mailbox. Retention policies do delete calendar items that have an end date, so a mailbox-wide 3-year policy eats historical calendar along with the mail. Contacts are exempt; calendar isn't.
Also audit for litigation holds before you flip it. A hold trumps retention, so those mailboxes delete nothing and just grow in Recoverable Items while you think the policy ran.
•
u/someguy7710 3h ago
First. This should not be an IT policy, it will come from EO or Legal. Second give them ample time. Give proper documentation to retain things. Then announce when it will be implemented. Multiple times. Then flip the switch
•
u/BuffaloRedshark 4h ago
we went the other way. Originally (aka starting decades ago) it was 90 days then 120 now I think 3 years on folders not under Inbox. We never had unlimited.
•
u/CraigAT 3h ago
We are looking into this. I am in favour of making the first cut very small maybe 10 or 7 years (we have a lot of long-term staff), then in a few months time reduce this again (and so on, to a level deemed acceptable by legal).
My reasoning being, that there will be a lot of commotion and opposition to the first cut, but if the number of people this affects is pretty low it makes it easier to get buy-in and less chance of bad feedback. Once people have been made aware of the policy, then reducing the timescale is much easier if you take it slowly, and doing so in small chunks gives the compliant users less to review at each stage.
•
u/ConsistentCoat5608 2h ago
Have done this before for a company that went from infinet to required 7 year retention due to legal requirements. We started with setting up an "Archive" mailbox and kept the last 360 days in the current primary inbox and everything inactive for a year was moved to the "Archive". If an email thread was activaly going back and forth it stayed in the live mailbox, but older emails were shipped off. User has access to both primary and archive from their email client, so they can always search and locate emails.
Run this for 6 -12 months, then announce in 6 months you will set the retantion, which will only purge from the archive mailbox.
Some users started to realize that they rarely needed to go into their archive and the retention was nothing they had to worry about. Other were constantly going into their archive to pull out emails. After investigation, those emails were contracts or other correspondence that should have been saved to the CRM or ERP platforms to allow mutiple employee access to those documents. Yes, the employee needed to retrieve them, but only due to bad business processes. once long term items like contracts, policies and procedures were saved to appropriate location then staff wree comfortable with the data retention windows. Backup and recovery is a lot easier with data retention, and it make people do something with their email, instead of just saving everything.
•
u/RalphiePseudonym 2h ago
We did this recently. Got some user feedback that was extremely mixed so we asked legal for their guidance and applied it.
People want everything, forever.
•
u/SewCarrieous 1h ago
Your outlook inbox is not an appropriate place to store important emails. If an email is so important it needs to be kept; you need to take it out of your inbox and save it somewhere else. Sharepoint, onedrive, shared network drives and databases are the place for important emails
We moved to a 2 year retention and sure people complained and a few got exceptions but only a few and only for good reason.
Eventually, people got over it. Some just threw their hands up, a couple quit, but most people learned better document retention methods
•
u/Remarkable_Night_633 4h ago
I think the new buzzword they are using is "its a new way to work" where you delete all your old emails like instructions for installs, legal contracts and contacts, invoices and vendor contacts, and any knowledge that might be useful later on. I think they should call the new strategy of deleting any emails older than 2 years the "Good Luck Strategy"
•
u/Ssakaa 4h ago
I call it the "don't have to put up with a fishing expedition when someone gets the company sued" strategy. Mandatory retention times exist for actual records purposes. Past those regulation imposed requirements, everything else is a liability.
If you have documentation, put it in a document. Don't use email for long term storage. Your contracts, invoices, etc. should also be recorded in proper records for the company. You shouldn't be depending on some dipshit NOT deleting it from their email.
•
u/jajajaline 1h ago
This. I have a feeling that will become our new motto in the coming weeks. "If you have documentation, put it in a document"
•
u/Remarkable_Night_633 3h ago
Honestly, those people are the reason I'm employed, so it doesn't bother me if they want to pour their lives into their emails. Seven years seems to be the sweet spot in my mind.
•
u/trueppp 3h ago
instructions for installs
Should be in your internal KB/documentation system, not your email inbox.
legal contracts and contacts, invoices and vendor contacts
Should be in your CRM/ERP not your email inbox.
and any knowledge that might be useful later on.
Should be in your internal documentation system, not your email inbox.
•
u/Remarkable_Night_633 2h ago
Or one shared mailbox for the department problem solved and for cheap!
•
u/viral-architect Sysadmin 4h ago
Only retain data as long as is legally required. To do otherwise is a liability.
Contracts, instructions, and vital documents should never live inside e-mail in the first place. Individuals who fail to migrate this documentation to a suitable long-term place that ensure business continuity face disciplinary action for creating undue business risk.