Configure Office 365 Litigation Hold in Custom Command

Question

Hey Support,

Were in the process of just spinning up Adaxes 2014.1 in our environment, and I'm working on build the employee off boarding custom command and can get everything to work but setting the mailbox on litigation hold for the account. We currently do this via powershell using the following command

Set-Mailbox "%displayName%" -LitigationHoldEnabled $true –Itemholdperiod 365

I'll be the first to admit I'm not great at powershell, but when I perform this command and can get it to work successfully I have to establish a remote powershell session. I wish this was that easy (just add that line of pshell to my custom command) but it says the Set-Mailbox is not a recognized cmdlet. This makes sense since I don't have the exchange tools installed on our Adaxes server.

I wanted to you guys what you suggest prior to moving forward. Should I try and come up with a custom script that can do that via a remote session? If thats the case I may need some help. Any other suggestions?

This would be a huge win for me (and im sure others) as if anyone has tried to place a mailbox on litigation hold through Outlook 365's web portal it's so slow. Thanks!

Comments

Hello Ben,

Hmm. maybe you meant In-Place Hold? As stated by Microsoft:

Whereas In-Place Hold provides granular hold capability based on query parameters, hold period, and the ability to place multiple holds, litigation hold only allows you to place all items on hold indefinitely or until hold is removed.

http://technet.microsoft.com/en-us/libr ... 50%29.aspx

So, there is no hold period for a litigation hold. Also, there is no such parameter for Set-Mailbox as –Itemholdperiod.

Also, are you doing this in a federated environment or not? Do you have Exchange installed on-premises?

---

Support,

This is my mistake, the command we use is "Set-Mailbox "Display Name" -LitigationHoldEnabled $true -LitigationHoldDuration 365". This enables litigation hold on the mailbox for 365 days.

http://help.outlook.com/en-us/140/ms.ex ... x#duration

I believe we do run in a federated environment (our team does not serve as the exchange administrators), and we to NOT have an exchange server on premise.

You can log into the Office 365 web console and and perform the same task (without the duration configured) also but we would like to implement this into one command from adaxes. It would be nice to have this all setup into one offboarding task or command.

Thank you!

Answer 1

Hello Ben,

Adaxes allows putting Exchange mailboxes on litigation hold, however currently you cannot specify the hold duration using the built-in functionality. We'll add the possibility to specify a hold duration in the future.

Nevertheless, you can still use a script for this purpose. The following script puts a mailbox on litigation hold for $litigationHoldDuration days:

$litigationHoldDuration = 365 # TODO: modify me

# Get credentials of the Office 365 tenant associated with the user
$o365Credential = $Context.GetOffice365Credential()

# Create a remote PowerShell session to Exchange Online
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $o365Credential -Authentication Basic -AllowRedirection
Import-PSSession $session -AllowClobber -DisableNameChecking

# Enable litigation hold
Set-Mailbox "%sAMAccountName%" -LitigationHoldEnabled $true -LitigationHoldDuration $litigationHoldDuration

# Close the remote session and free up resources
Remove-PSSession $session

To put mailboxes on hold automatically once a user gets deprovisioned, you can add the script to the Custom Command that you use for the off-boarding process. To do this:

1. Launch Adaxes Administration Console.
2. In the Console Tree, expand the service node that represents your Adaxes service.
3. Navigate to and select the Custom Command that you use for the off-boarding process. The actions and conditions of the Custom Command will be displayed in the Result Pane (located to the right).
4. Click the Add action to a new set link.
   
5. Select the Run a program or PowerShell script action.
6. Paste the above script in the Script field.
   
7. Enter a short description for the script and click OK.
8. Double-click Always.
9. Select the If has an Exchange mailbox condition.
10. Select has.
    
11. Click OK and save the Custom Command.

Comments

Hey Guys,

Waaayyy back when you helped me out with creating this script to check on legal holds. It's been working for some time until recently...and now it appears to be a problem with the way the script calls the actors user credentials.

Are we unable to use what I have below anymore? I'll attach an image also of the error i'm receiving.

# Get credentials of the Office 365 tenant associated with the user
$adminName = $Context.RunAs.UserName
$adminPassword = ConvertTo-SecureString -AsPlainText -String $Context.RunAs.Password -Force

---

Attaching error...

---

Hello Ben,

What version of Adaxes are you using?

What radio-button did you select in the Run as section of the Run a program or PowerShell script action? You can check that as follows:

1. Launch Adaxes Administration Console.
2. Navigate to the Custom Command and select it.
3. Double-click the Run a program or PowerShell script action.
4. Check the Run as section.
   

---

Support,

From a Admin console we are using version Version 3.7.13430.0 (64 bit). We also upgraded to the most recent release (2016) about two months ago. When we run this as the "Default Service Administrator" account which is a Global Administrator in Office 365.

Thanks,

---

Hello Ben,

In the latest version of Adaxes you can achieve what you need using If PowerShell script returns true condition and Modify Exchange Properties action. The script will check if Exchange mailbox is put on Litigation hold and return True if it is not. If the script returns true the action will put the mailbox on Litigation hold for 365 days. To do this:

1. Launch Adaxes Administration Console.

2. In the Console Tree, expand the service node that represents your Adaxes service.

3. Navigate to and select the Custom Command that you use for the off-boarding process. The actions and conditions of the Custom Command will be displayed in the Result Pane (located to the right).

4. Double-click the Run a program or PowerShell script action you have for the old script.

5. Select Modify Exchange Properties and click Exchange properties.
   

6. Activate Mailbox Features tab.

7. Select both checkboxes in front of Litigation Hold .
   

8. Select Litigation hold duration (days) and enter the number of days.
   

9. Click OK three times.

10. Right-click the set in the right view pane and click Add condition.

11. Select If PowerShell script returns true, enter a short description and paste the script into the Script field.

     $mailboxParams = $Context.TargetObject.GetMailParameters()
    
     # Get properties of Litigation Hold
     $litigationHold = $mailboxParams.MailboxFeatures.GetItemByType(
         "ADM_EXCHANGE_MAILBOXFEATURETYPE_LITIGATIONHOLD")
    
     $Context.ConditionIsMet = -not($litigationHold.Enabled)
    

    

12. Click OK and save the changes.

Finally you will have a set like the following: