Solved

exchange 2007, possible to recover mailbox in this specific case?

Posted on 2010-08-19
29
528 Views
Last Modified: 2012-06-27
exchange 2k7 fully updated, on server 2008 R2 fully updated

problem:  deleted a user and his mailbox by clicking too fast.  before we realized this was done, we recreated a new user with the same username and a new mailbox

i don't see the old mailbox listed in "disconnected mailboxes"

i'm not working in ex2k7 EMC or CLI - and i never had to recover a mailbox on 2007 yet.

i have PST backups up until july 26th of this year.  so, he's missing about 20 days of mail now.

so...  do i have any choices at all to recover the missing data for this  user?
0
Comment
Question by:B H
  • 10
  • 8
  • 5
  • +4
29 Comments
 
LVL 11

Expert Comment

by:MichaelVH
ID: 33479531
have you got a backup of the database?
0
 
LVL 2

Expert Comment

by:ctpmn1
ID: 33479540
You can restore from a backup to a live server then export to a pst then import the new pst.
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 33479592
Every 24 hours the maintenance interval will run, once this runs the original mailbox should appear in disconnected mailboxes unless you have told Exchange not to keep mailboxes when they are deleted, by default it will keep them for 30 days.

If this is the case, delete the new mailbox (after exporting all the existing mail to PST) then re-connect the user to the original mailbox.  Once done you can re-import the mail from the PST file
0
Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

 
LVL 74

Expert Comment

by:Glen Knight
ID: 33479602
Sorry Byron, didn't realise it was you :)

Presumably you have already tried all of the above?
0
 
LVL 3

Expert Comment

by:tomex07
ID: 33479683
You can't see the mailbox in "disconnected mailboxes" because a full Exchange backup has been run on the server.

From Technet:
After a mailbox has been removed from the dumpster, the only way to recover the mailbox is with a restore of the database that the mailbox was in from a point in time when the mailbox was still in the database.

For information about recovering a deleted mailbox that is no longer in the dumpster, follow the procedure:
http://technet.microsoft.com/en-us/library/aa997694(EXCHG.80).aspx
0
 
LVL 24

Author Comment

by:B H
ID: 33479941
> have you got a backup of the database?
that would be great, right?

> You can restore from a backup
the only backup was pst's, that stopped in late july

> Every 24 hours the maintenance interval will run, once this runs the original mailbox should appear in disconnected mailboxes
OH! - so i won't see it until the maint runs??  this is good news i think.
 - can i force the maint to run right now?

> Sorry Byron, didn't realise it was you :)
yep it's me, asking on behalf of a client who has an "administrator" working on their server.  don't currently have time to research, so i came here :)

> You can't see the mailbox in "disconnected mailboxes" because a full Exchange backup has been run on the server.
i wish a full backup ran - we wouldn't even be here.  fact is, the user got deleted around 5 hours ago, and no backups were in effect

> After a mailbox has been removed from the dumpster
is the dumpster in 2007 the same as disconnected mailboxes, which i won't see until after the maint runs?


0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 33480012
just simply refreshing on the disconnected mailboxes container should re-scan for disconnected mailboxes (appologies it doesnt require the maintenance to run - I just checked it and it happened straight away after a refresh)

Under Server Configuration > Mailbox right click on Mailbox Database and select properties, under the limits tab what does it say under "Keep deleted mailboxes for"
0
 
LVL 3

Accepted Solution

by:
tedoff earned 250 total points
ID: 33480120
Run this in Exchange Management Shell:
clean-mailboxdatabase -database [databasename]

That should make the database appear in the Disconnected Mailboxes node.
In the very rare case it doesn't try running this:
Get-MailboxStatistics -database [databasename]
You will get a list of all the mailboxes in the database, connected or disconnected.  If you put the new mailbox on the same database you should see two entries for the user's DisplayName, one is for the new mailbox, one is the disconnected one.  You might be able to identify the disconnected one by the ItemCount value.
If you're able to find the old mailbox you can run the Get-MailboxStatistics command a different way:
Get-MailboxStatistics -database [databasename] | ft DisplayName,ItemCount,MailboxGuid
Find the MailboxGuid value for the disconnected mailbox, then use it in a Connect-Mailbox command.  You can either connect it to a new AD-user, or disable the new mailbox you created and reconnect the existing user account to the old mailbox:
Connect-Mailbox -Identity [MailboxGuid] -database [databasename] -user [Domain\Username]
0
 
LVL 3

Expert Comment

by:tedoff
ID: 33480161
Sorry, correction, clean-mailboxdatabase should make the MAILBOX appear in the Disconnected Mailboxes node, not the database!
0
 
LVL 24

Author Comment

by:B H
ID: 33480788
> just simply refreshing
nothing listed :/

> Keep deleted mailboxes for
30 days

for the CLI database stuff, there might be a bigger issue going on, all kinds of IIS errors, access denied, stores not mounted anymore - someone may be doing something on another server so i'll check that out and then run those
0
 
LVL 24

Author Comment

by:B H
ID: 33480830
wow here's one for my wall of shame.

i was doing it on the 32bit server because i was so used to pst crap... and it wasn't attached to the real exchange server in the gui.

back on the real server - there were 4 mailboxes in the disconnected state... not the one i want though.

running:
clean-mailboxdatabase -database "mailbox database"
errors out so i figured it must be this:
clean-mailboxdatabase "mailbox database"
that took about 45 seconds, then put me back at the cmd prompt

refreshing the gui, my user is there!

now - how do i get his mail out of that, in this case:
1. the user was already recreated in active directory
2. same exchange alias for the user object
3. ???

:)

0
 
LVL 24

Author Comment

by:B H
ID: 33480866
more detailed question than what i posted above:

we'd like to reattach this "new" form of the user, to the old mailbox.

but first, we'd like to:

1. exmerge out the last 2 days of stuff
2. exmerge out the entire mailbox to a different pst
3. then make the mailbox swap,
4. then push the last 2 days from the smaller pst into the "old" (now alive) box
5. shelf the full pst

bonus points for something i can just copy and paste :)

- "mailbox database" is the name
- "balazs" is the user alias
- "rhcexch" is the servername if it matters
- a 32bit server with outlook is available already
- the user mailbox is a grand total of 400mb


0
 
LVL 24

Author Comment

by:B H
ID: 33481643
oh no where'd you guys go
0
 
LVL 74

Assisted Solution

by:Glen Knight
Glen Knight earned 250 total points
ID: 33482313
I went to bed :)

Easiest thing to do is to export the mailbox to PST using the import/export function in outlook.  Make sure you highlight the "Mailbox - User" and then goto File > Import/Export follow the wizard through.

Then delete the new mailbox.

Then under disconnected mailboxes right click the one you want and select reconnect and find your user.

Then use the outlook import/export to re-import the PST file.

If your not familiar with the Exchange Management Shell don't use it.
0
 
LVL 10

Expert Comment

by:dhruvarajp
ID: 33483354
there really is a way .. a little complex.
if you know what time you deleted the mailbox.. note this time
restore the database to the recovery storage group
while doing eseutil /cc
do it this way

paste the logfiles in the log directory  to the .env file location(all logs exactly before the noted time )

then run
eseutil /cc  with switch  /t

there you go

you should have the latest data.. and this is the max recoverability

Dhruv

0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 33483361
surely http:#33482313 is a much easier way then that!?
0
 
LVL 3

Expert Comment

by:tedoff
ID: 33484698
Running Clean-MailboxDatabase is what got you past the sticking point.

You have several options at this point.  This would be my preferred option however:

Create a new AD account
Then right-click on the mailbox in the Disconnected Mailbox node and select Connect
The Connect-Mailbox wizard will appear, take the default User Mailbox option and click Next.
Select Existing user and click Browse.  Choose the new AD account you just created and click OK.
Make sure the Alias field is populated, then click Next, then Connect.

You now can set up an Outlook profile to log in to the new user's mailbox, which contains the data you'd like to recover.
Once logged in use the Import and Export feature in Outlook to create a PST.  Then use that PST to import the data to the new mailbox created for the production user.
0
 
LVL 3

Expert Comment

by:tedoff
ID: 33484767
Also, here's my opinion on this statement: "If your not familiar with the Exchange Management Shell don't use it."

I'd say it this way . . . If you're not familiar with EMS, then LEARN it.  It's a game changer, it takes administration of Exchange to a new level, and if you don't learn it you'll continue to get stuck on simple stuff like finding a disconnected mailbox if you don't know your way around EMS.  There is no equivalent in the console for clean-mailboxdatabase.  There are many other examples of things you can only do in the shell, and not in the console.  And there are things you can do in the shell with filtering and command piping that you could only dream of with the old E2K3 ESM tools.  LEARN it.
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 33484825
Tedoff, I think that's a bit harsh, I work with exchange A LOT! And I would say I use the EMS about 10% of the time.

A lot of people still prefer the GUI interface and have no reason to learn it the EMS
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 33484845
I also disagree with: Running Clean-MailboxDatabase is what got you past the sticking point.

A simple refresh would have done the job and I confirmed this in my lab and on a couple of live servers.
0
 
LVL 3

Expert Comment

by:tedoff
ID: 33484897
Bryon already stated refreshing didn't help, quoting:

> just simply refreshing
nothing listed :/
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 33484947
That was when on the non-Exchange server.

It is not a requirement to run the command.
0
 
LVL 24

Author Comment

by:B H
ID: 33486502
right, on the other server (not connected to the live one) all of that was futile of course

but i did refresh on the new server and he wasn't there, the command brought him back - not sure why the refresh didnt, but demazter you're other comments were valuable too

i am pretty familiar with the cli, i just don't have all the commands/syntax memorized yet, i prefer to stay out of the gui

i was hoping for 5-6 lines of code i could just paste into the command line and save time going to look them up... like:

get-mailbox something | export-mailbox somePSTpath
disconnect mailbox livebox user something
reconnect mailbox newbox user something
get-mailbox something | import-mailbox somePSTpath
0
 
LVL 24

Author Comment

by:B H
ID: 33486514
or actually this:

get-mailbox something | export-mailbox dates-last-5-days somePSTpath
get-mailbox something | export-mailbox complete-dump someOtherPSTpath
disconnect mailbox livebox user something
reconnect mailbox newbox user something
get-mailbox something | import-mailbox theFirstPSTpath(smaller one)

0
 
LVL 10

Expert Comment

by:dhruvarajp
ID: 33486566
this process will give you data from
the data you created new mialbox till date..

what about  from 26 th till new mailbox creation ?

that data is in the logs, for that you might want to do what i said earlier

actutlly
what i said+ yours will have the all data for user
0
 
LVL 24

Author Comment

by:B H
ID: 33486714
Yah but eseutil needs a dismounted database right?  

Can you (or demazter) give me clear compact steps - basically if I stop what I'm doing and go deal with this client from remote, I want to be in and out having it done, I can't get sidetracked too much today trying to figure out the exact commands or gui process... I don't need a lot of detail, but some numbered list of do this, then do this, etc. Right now they're kinda split among a few posts up there
0
 
LVL 10

Expert Comment

by:dhruvarajp
ID: 33486922
ok sure
you do not need dismount the running database

you create a rsg
and restore 26 th backup to the database in the rsg
and do the procedures as commented earlier  do the  eseuitl /cc with /t  
merge the rgs database mialbox .. olny for that specific user

..later you alos import what you exported

Dhruv
0
 
LVL 24

Author Comment

by:B H
ID: 33487526
ok so what i basically ended up doing was this:

(code snippet)


in the gui that would have been,
outlook export stuff to pst
right click the user, disable
right-click the disconnected mailbox, connect, to a user, balazs
outlook import stuff from pst

didn't have time to go messing with recovery storage groups on a 100gb database with live users in it :/


export-Mailbox -identity balazs -PSTFolderPath C:\jbfullexport\
export-Mailbox -identity balazs -startdate "07/01/2010" -PSTFolderPath C:\jbtempexport\
Disable-Mailbox balazs@domain.com
Connect-Mailbox -Identity '1944e14d-881e-4907-b52e-14489bd416f5' -Database 'RHCEXCH.domain.com\First Storage Group\Mailbox Database' -User 'domain\balazs' -Alias 'balazs'
import-mailbox -identity balazs -allowduplicates 0 -pstfolderpath c:\jbtempexport\

Open in new window

0
 
LVL 24

Author Closing Comment

by:B H
ID: 33487573
the combination of the two selected comments got this back up.

the clean command made it visible, the outlook process got the guy back online

didn't have time to go messing with eseutil or RSG's, the old box was right there so i didnt see the need to spend the time.

for anyone looking for a command-line way to do it, see my second last comment, and one of the accepted ones to get the guid of the disconnected box

thanks a lot guys!
0

Featured Post

Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question