Applies to: Exchange Server 2013, Exchange Online

Topic Last Modified: 2012-10-13

If your organization is involved in a legal action, you may have to take steps to preserve relevant data, such as email messages, that may be used as evidence. In situations like this, you can use litigation hold to retain all email sent and received by specific people or retain all email sent and received in your organization for a specific time period. For more information about what happens when a mailbox is on litigation hold and how to enable and disable it, see the “Mailbox Features” section in Manage User Mailboxes.

Use the litigation hold report to keep track of the following types of changes made to a mailbox in a given time period:

For each of these change types, the report includes the user who made the change and the time and date the change was made.

What do you need to know before you begin?

Tip:
Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection.

Use the EAC to run a litigation hold report

  1. In the EAC, navigate to Compliance Management > Auditing.

  2. Click Run a per-mailbox litigation hold report.

    Microsoft Exchange runs the report for litigation hold changes made to any mailbox in the past two weeks.

  3. To view the changes for a specific mailbox, in the search results pane, select the mailbox. View the search results in the details pane.

Tip:
Want to narrow the search results? Select the start date, end date, or both, and select specific mailboxes to search. Click Search to re-run the report.

How do you know this worked?

To verify that you’ve successfully run a litigation hold report, mailboxes that had litigation hold changes within the date range are displayed in the search results pane. If there are no results, then no changes to litigation hold have taken place within the date range or recent changes haven’t taken effect yet.

Note:
When a mailbox is put on litigation hold, it can take up to 60 minutes for the hold to take effect.