Requirements
- Archive all incoming / outgoing e-mail exchanges
- Install on Workstations (Windows XP)
Sounds as if your target machines may be mobile, requiring the host based solution?
Archiving Email
Any mail server should be able to solve your archiving requirements (i.e. at least allow direction of carbon copy of email to some other internal mailbox.) For a Windows LAN there's plenty of Freeish Mail Servers and something like hMailserver might be able to server your needs. Bill Weiss has pointed out Postfix.
For a smallish network of 3 ~ 5 users (where you may not have control of your mail server) using a hosted service such as Gmail / Google Apps for business will give you your archiving requirements, with the flexibility that people can be connecting from anywhere. But it does come with a cost. Postini has a minimum of 100 users.
on Workstations
As pointed out by Avery Pain this is normally a 'feature' of your mail client (MTA.) For freeish clients, such as Mozilla Thunderbird this can be done with something like:
- Blind Carbon Copy (in Account Settings | Copies & Folders);
- Filter Rule to copy all incoming message to above bcc folder
But you know that users can change this. You could have a 'service' to checks the above settings and reverts to appropriate setting if changed ?
Encrypted Mail Traffic
If any of your workers use their Windows XP Pro machines outside the office, you should require that their mail be encrypted between the mail client and mail server. If you don't host your own mail server on your premises, you should at minimum require mail traffic be encrypted. Hosted services such as Gmail do this by default (both pop and smtp.)
Encrypted Mail Traffic definitely makes the 'listen in/monitor' concept a lot more challenging. Just watching traffic/dumping it to a file and reading it later (such as tcpdump) will result in beautifully encrypted data in your archives.
Value Proposition
Depending on how much/difficult it is to install a mail server on the premises (i.e. will it require a new machine, licenses etc.) it may be the most cost effective solution is to go for a hosted service which can be something like USD$10.00/month (Google) or USD$20 ~$50 /a year (pobox.com) an account. That's an annual cost as low as USD$200.00 a year to get all your archiving requirements!!
If you are providing the archiving service as part of a service/regulatory compliance then you may need to review the SLA with the hosting provider on privacy et. al.