2.1.6 Ensure 'Do not permanently delete items until the database has been backed up' is set to 'True'

Information

This policy setting can prohibit items from being permanently deleted until the database has been backed up.

Rationale:

To ensure that accidentally deleted items can be recovered, they should not be permanently deleted until the database is backed up.

Impact:

Additional storage space will be required until any pending items are permanently deleted.

If using a 3rd party backup solution that does not set the backup parameters on the Mailbox database as it is backed up then this setting should be skipped. Native backup solutions will update the database bits properly, allowing for the RetainDeletedItemsUntilBackup parameter work as intended.

Failure to evaluate the organization's backup solution in conjunction with this setting will result in increased database growth. To see the backup parameters mentioned above run Get-MailboxDatabase | fl *backup*

Solution

To implement the recommended state, execute the following PowerShell cmdlet:

Set-MailboxDatabase 'Mailbox Database' -RetainDeletedItemsUntilBackup $true

OR

Perform the following actions:

Launch the EAC (Exchange Administrative Center).

Go to 'Servers' on the left and click on the 'Databases' tab.

Double-click the database and go to the 'Limits' settings.

Ensure the Don't permanently delete items until the database is backed up box is checked and click Save.

Default Value:

False

See Also

https://workbench.cisecurity.org/benchmarks/12442

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-11, 800-53|SI-12

Plugin: Windows

Control ID: 4e3c7e85334495542d40ca42d5f1fc40b8abecb5786a8f77cf75914ce4aa7cc4