Question

How do I configure FTK Central to collect from on-premise Microsoft Exchange?

 

Prerequisites

  • Install Outlook 2016 (not 365) 32-bit Professional Plus on the FTK Central server (used for building PSTs when collecting email)
  • Exchange Server 2010 SP1, 2013, or 2016 with Exchange Web Services (EWS) enabled

 

Answer

  1. On the Exchange server, open Powershell as Administrator
  2. Run the following command to grant Receive As and View Information Store Status permissions over all mailboxes to the desired collection account (replace with the desired collection account username)
    Get-MailboxDatabase | Add-ADPermission -User <collectionAccountAddress> -ExtendedRights Receive-As,ms-Exch-Store-Visible -InheritanceType All
  3. Run the following command to list the permissions for the collection account, to confirm the permissions were applied (replace with the desired collection account username)
    get-mailboxdatabase | get-adpermission -user <collectionAccountAddress> | format-list *
  4. Log in to FTK Central and click Data Sources
    https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009875486/original/2021-06-08_12_59_14-Window__1___1_.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T163748Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=8fc2fde5adb668d0c958431cbf6e8965ac46d1dc92b2bd52e36d1e5307c64c45
  5. Click Exchange
    https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009875487/original/2021-06-23_11_26_09-mRemoteNG_-_confCons.xml_-_ftkc-app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T163748Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=0fc0e7debca4c144a1e5510bd1f09838d4ec7f93c35490e772f0f6957452af3e
  6. Click Add Exchange
    https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009875488/original/2021-06-23_11_27_00-mRemoteNG_-_confCons.xml_-_ftkc-app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T163748Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=1a30d8e5bc8299ccec0288b0be66013d5a86a7587330e01a3d283472ae10a180
  7. From the Version drop-down, select the correct version of Exchange
    https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009875489/original/2021-07-06_11_05_17-mRemoteNG_-_confCons.xml_-_ftkc-app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T163748Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=a28063a0497809894ad72c0a16f3316fb37f5abe8277c4e11ecce3a06cfc9f3e
  8. Do the following:
      1. Provide a Name for the connector
      2. Enter the Exchange Server Address
      3. Enter the collection account Username
      4. Enter the collection account Password
      5. Check whether or not Exchange Server-side Mail Box Indexing is enabled
      6. Choose whether or not to associate the connector to all custodians
      7. Click Save
        https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009875490/original/2021-07-06_11_08_25-mRemoteNG_-_confCons.xml_-_ftkc-app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T163748Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=efedc4385746c40e35aec7e8cda20eeb096513c0ed1b02094082c2835959edb7

Notes

  • FTK Central cannot collect from hidden mailboxes.
  • Explicit "deny" permissions set on any mailboxes will override the collection account's permissions.

  • If Exchange has any throttling policies that could constrain the service account, they could prevent FTK Central from collecting successfully.  To avoid this, you may need to create a throttling policy that sets at least the below settings to "Unlimited", and attach the collection account to that policy (Descriptions of these settings and additional information about Exchange throttling policies can be found on Microsoft's Set-ThrottlingPolicy).

    RCAMaxConcurrency
EWSMaxConcurrency
EWSMaxSubscriptions
CPAMaxConcurrency
EwsCutoffBalance
EwsMaxBurst
EwsRechargeRate