As a result of political details I won't get in to, and related to a current e-mail migration project from four different legacy mail systems to a new hosted environment, where no user data is being migrated and users are being actively prevented from sending mail into the new environment from the old environment, the following request has come up.
Once the new system is production, we would like to facilitate user access to the legacy environments. This will allow continuity of information contained in e-mail (e. g. day one on new system, users can send a new message as a reply to a message visible in the old system). We would like to do this in a read-only fashion, to ensure that no changes are occurring as a result of user actions in the legacy environment. (This "lock" of the old environment is related to e-discovery concerns from the legal department.)
For the purposes of this question, the legacy environment of interest is an Exchange 2003 environment, with Outlook and OWA access available. Users have Outlook 2003 profiles today that work against the legacy environment.
We have thought of some hack answers - like scripting out changing permissions on every user mail folder to prevent changes - but don't think there's a "good" answer to this problem. Specifically, we're worried about changing one's own information (e. g. deleting e-mails), and about intraorganization e-mail (e. g. user in Exchange organization e-mails to another user in the organization, despite being told not to do that).
The environment is approximately 15 TB at the moment, so the idea of exporting everything to PSTs and giving users access to those was discussed but discarded as unfeasible.
Is there a "good" way to do this that we haven't thought of? I'm aware that the basic underlying question is akin to asking, "how do we stop this mail system from doing any mail traffic?" I'm not saying this is a reasonable request. I'm just doing due diligence to find out if it's possible in a sane way.
p.s. just to forestall questions on this, we don't expect 100% prevention of user information forwarding as there are too many ways for it to happen - we're just preventing as best as we can and stating as policy that they can't do it other ways. Not my decision - just following orders. The proposed migration plan is not a discussion point at this juncture - it's just finding out if one piece of it is at all reasonably doable.
p.p.s. the legacy systems include Notes as well so I'm going to ask the same question again with Notes as the source. It didn't feel right to make those two into one question.
Edit: Just to be 100%, preventing send/receive is part of this, but so is maintaining the integrity of the existing data, e. g. preventing deletion of an existing item.
Second edit: to the point about "you can't, let them do whatever, just tell them not to" line of thinking, I'm wondering if we could just up the dumpster window to the window where they have access to legacy, then know everything exists SOMEWHERE even if they do it and then delete it. Part of the pushback coming from the legal side is that they don't want to have to search a whole ton of backups. (No, there's no archive in the old system, and yes, the new system has archiving, and yes, that means some of this is a stupid line of thinking, but as I said, I'm forced to ask the questions. I'm just looking to make sure no one on here says "oh, here's an easy way - blah blah blah" and the technical implementation team doesn't get burned. Due diligence and somewhat CYA.)
Edit 3: OK, so I just spoke with my boss and there was an interesting idea brought up. If we do as discussed below in one of the answers and grab a presnapshot, then prevent all mail flow, we don't care about deletes, because the snapshot has everything in it of value. There's no way to "add" something discoverable because of broken mail flow. So maybe that's close enough. If we disable the MTA service, will that stop intradatabase mail flow? Is that a reasonable plan of attack for getting to a "known good" discovery state while still allowing data access?