Encrypting with LDT in an Exchange DAG Environment

Prerequisites

Before you can start the LDT data encryption process, you need to:

• Create or identify the CTE policy you want to use for data encryption. LDT uses a single Live Data Transformation policy for both initial encryption and subsequent rekeys, so the policy you use should have all the access control rules you want to use for your data when it is in production. For details, see CTE Policies for Exchange DAG.

• Set your Quality of Service (QoS) settings. QoS enables administrators to manage and control LDT impact to application workloads by monitoring and controlling the use of host system resources, such as memory or I/O utilization, during data transformation.

For details about using LDT, see CTE-Live Data Transformation with Data Security Manager or CTE-Live Data Transformation with CipherTrust Manager for the version of CTE that you are using.

Procedure

1. In the Exchange Admin Center, make Exchange node 1 the primary node.

   Make node 1 the active node and move all of the databases to that node.

2. Make all of the databases active on node 1.

3. Suspend all databases on node 2. Wait for 2-3 minutes for the database to finish with replication so the database will be suspended.

   

   Warning

   Make sure that all of the Exchange services in node 2 are down and not accessing the Exchange databases. All Exchange Services must be stopped, all databases must be suspended, and all data replication between the nodes must be stopped. Any file access on the node during the encryption process could cause data corruption.

4. When you are certain that all Exchange DAG services have been suspended on node 2, create the GuardPoints you want to use on node 2 with the appropriate Live Data Transformation policy. When you create the GuardPoints:

   • Make sure you are guarding each host individually. Do not assign the GuardPoints using a Host or Client Group because you only want these GuardPoints to exist on node 2 at this point.

   • Imporant: When you specify the guard path, only guard the Mailbox Database. Do not guard at a higher or lower directory. For example:

     • Correct: C:\Program Files\Microsoft\Exchange Server\V15\Mailbox\Mailbox Database 1088388171\

     • Incorrect: C:\Program Files\Microsoft\Exchange Server\V15\Mailbox\Mailbox Database 1088388171\Inbox\ — This is not correct because it's below the mailbox database directory.

   • Make sure that Secure Start is on for the GuardPoints.

   The following example shows two correctly-specified GuardPoints in CipherTrust Manager:

   

   Live data transformation on node 2 begins as soon as the GuardPoints become active on node 2.

5. Wait until LDT has finished transforming the data in all GuardPoints on node 2.

6. In the Exchange Admin Center, go to the Exchange Database tab and Resume all Passive database copy on node 2.

7. Wait for the server to move to the healthy state. If it does not, wait for some more time for the Content Index state to change to Healthy.

   

   Warning

   It may take a few minutes for the Exchange Service to resync. Monitor the Exchange logs on the system and make sure that replication is working. Make sure that database replication finishes and databases are in a healthy state before proceeding.

8. In the Exchange Admin Center, move all of the databases from node 1 to node 2.

   Now the databases on node 1 are mounted as passive. All databases on node 2 are mounted as active.

9. Create the same GuardPoints on node 1 that you created on node 2.

Warning

• Make sure that all GuardPoints on node 1 are identical to those on node 2.

• You must guard the same databases with the same Live Data Transformation Policy and the same encryption key on both nodes.