Configuring registry settings for Exchange Server journal filtering

Configuring the registry settings described in this section will enable custom filtering for all the Exchange Journaling tasks hosted on the server.

By creating a named ruleset file you can limit filtering to particular journal mailboxes.

See About custom filtering ruleset files.

Note:

If the Compliance Accelerator Journaling Connector is being used to capture a required percentage of all journaled messages, do not configure a custom filter that deletes selected messages; this will compromise the accuracy of the Compliance Accelerator monitoring policy, because any deleted messages are not available for capture by the Journaling Connector.

To configure the registry settings to enable custom filtering for Exchange Journaling tasks

  1. On the computer that hosts the Enterprise Vault Exchange Journaling task, log on as the Vault Service account.

  2. Start Regedit.

  3. Navigate to the following location:

    HKEY_LOCAL_MACHINE
\Software
 \KVS
  \Enterprise Vault
   \External Filtering
	\Journaling

    If the External Filtering key does not exist, create it by performing the following steps in the order listed:

    • Right-click Enterprise Vault and select New > Key.

    • Name the key External Filtering.

    Similarly, if the Journaling key does not exist, create it as follows:

    • Right-click External Filtering and select New > Key

    • Name the key Journaling.

  4. If the Journaling key does exist, any existing filters will be listed under it. Filter names will be an unbroken numbered sequence starting at 1.

    If the Compliance Accelerator Journaling Connector is installed (KVS.Accelerator.PlugIn.Filter), it must be the last in the sequence, so you will need to rename it before creating the new custom filtering setting. For example, if the Journaling Connector is currently named 1, rename this setting as 2 and create the new custom filtering setting with the name 1.

    To rename the Journaling Connector setting, do as follows:

    • Right-click the setting name and select Rename.

    • Enter the new name, for example, 2.

  5. Create a new string value for the new custom filtering setting. The name of this setting must fit into the existing number sequence. If no other journaling filters exist, set the name to 1. Give it the value EnterpriseVault.CustomFilter.

  6. If an entry called Override exists and has a non-zero value, set its value to 0.

    If custom filtering is implemented and a rule action has marked messages as "Do not archive", setting Override to 0 (zero) prevents the Exchange Journaling task from re-examining the messages each time it processes the journal mailbox.

    If you later change the rule action, you can temporarily set Override to 1 to force the Exchange Journaling task to reprocess any messages in the journal mailbox.

  7. If it does not exist, create a DWORD value called MoveOnFilterFailure and set its value to 1.

    This entry controls whether the Exchange Journaling task moves messages to the folder Failed External Filter when an unhandled error occurs in the external filter. This folder is automatically created when required in the journal mailbox.

  8. Close Regedit.

  9. After you have configured the required XML filter rules, restart the Journaling tasks.

    See About custom filtering ruleset files.