Exchange 2003 Mailbox Recovery
Today I recovered a single mailbox from backup tapes on an Exchange 2003 server. The user had been deleted from Active Directory. The mailbox had passed the retention time on the server and been purged from the Exchange database.
I found very very minimal documentation on how to do this, it was so sketchy that I was almost afraid to try this.
We only have a single Exchange 2003 Standard server, and I believe that its a little bit simpler if you have Enterprise or more Exchange servers. So, for those of you in the same boat, here’s how to do it.
First, and I cannot stress this enough, make sure that your Mailbox Store is such that “This database can be overwritten by a restore” is NOT checked. You should probably make sure that your Public Folder Store is set the same. Just in case.
Now, right click on the server and select New -> Recovery Storage Group. Create the logs and system paths in locations that have sufficient space to hold the .edb and .stm files for your restore.
Right click on the Recovery Storage Group (RSG) and select “Add Database to Recover”. Select the Mailbox store.
Make sure that this store is not mounted (not your live store - you can leave that running), and that it is set to allow overwrites by restores. I believe this is the default.
Now, on your Backup software (we use Veritas BackupExec), browse to the Information Store and select only the mailbox store to be recovered, not the Public Folder Store. Make sure that in your options you select that this is the last backup to restore and not to mount the store when finished. Run the restore. For me this was the scary bit. The documentation was lacking the phrase “Don’t worry, Exchange knows to make sure the restore will go to the Recovery Storage Group, NOT the live Mailbox Store”
Once the restore is complete, mount the store in the RSG. If Exchange thinks that there are still further restores to occur, you can use eseutil /cc <Path to Restore.env directory> to finalise the store and allow it to be mounted.
Now you can use exmerge to dump out the mailbox(es) from the RSG to a PST file. Unless the useraccount has been removed from AD.
If the user account has been removed, then you have to recreate the account. Before you do that, check the exmerge.log file as it will tell you the GUID of the mailboxes that it can’t find accounts for. You have to go through to the point of selecting mailboxes to action for that information to be written.
The lines in Exmerge.log will appear something like this:
[11:39:13] Error! Cannot identify the user with the msExchMailboxGuid \C1\A7\98\CE\B8\CF5J\99\E1\B1\28\8C\7D\EFj. The legacyExchangeDN is /O=COMPANY/OU=EXCHANGE ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=AUSER.
Note the almost but not quite hex pattern listed. This is the important bit.
Each mailbox has a hex guid. Each mail enabled user has a property which gives their mailbox guid. You need to convert this to proper hex.
\C1\A7\98\CE\B8\CF5J\99\E1\B1\28\8C\7D\EFj
First, break out the couplets from each group
C1 A7 98 CE B8 CF 5 J 99 E1 B1 28 8C 7D EF j
Only the first two characters in any grouping are Hex, any following characters should be treated individually (Note that the 5 and J (case IS important) have been split.)
Now, take any non-hex characters and get the hex value for that ASCII character from http://www.asciitable.com/ :
C1 A7 98 CE B8 CF 5 J 99 E1 B1 28 8C 7D EF j C1 A7 98 CE B8 CF 35 4A 99 E1 B1 28 8C 7D EF 6A
UPDATE: If the leading \ is missing, treat the first group as individual ascii characters!
UPDATE2: I’ve written a tool to do this for you!
Now you need to use a tool such as ADSIEdit.msc to change the msExchMailboxGuid property on the recreated user account. Synchronise your domain controllers and run ExMerge again, this time the mailbox should be available to dump out, complete with the items from the Dumpster (if the user killed everything in their mailbox before leaving the company).
I'm a big fan of my beers and ales. If you find this article useful, consider buying me a beer!
September 8th, 2006 at 10:37 pm
You saved my butt! Thank You so much for putting this on the web. You must have some idea of how happy you made me since you went through this before.
September 9th, 2006 at 6:05 pm
Heh
I mainly did it as an exercise to make sure we could do it, thankfully it wasn’t business critical! This time!
Took me hours and hours to track down the info and piece it all together, so I wrote an internal procedure. Realised it was probably something a lot more people are having issues with so decided to write it up here too.
Judging by the number of referrals I’m getting from Google, I’d say there are quite a few people having the same problems!
October 2nd, 2006 at 11:13 am
Hi,
I’m having some trouble converting CT\ADn\A3\BF\8EC\BC\A9\F9r\EAT\B4C to a correct hex pattern:S
any chance you could help ?
October 2nd, 2006 at 11:15 am
sorry… the value was CT\ADn\A3\BF\8EC\BC\A9\F9r\EAT\B4C
October 2nd, 2006 at 11:16 am
ok … i try again … last time “CT\ADn\A3\BF\8EC\BC\A9\F9r\EAT\B4C”
October 2nd, 2006 at 11:59 am
Assuming the case is all correct…
CT\ADn\A3\BF\8EC\BC\A9\F9r\EAT\B4C
Splitting it gives:
C T AD n A3 BF 8E C BC A9 F9 r EA T B4 C
Gives:
43 54 AD 6E A3 BF 8E 43 BC A9 F9 72 EA 54 B4 43
Try that…
October 2nd, 2006 at 12:00 pm
Hmm.. that was all nicely formatted, but the spaces have been stripped
November 10th, 2006 at 11:05 am
Hey, thanks for the post. I knew i needed to change the GUID in ADSI but i never taught of looking in the exmerge log for the
backup user guid. Could you help with this:
To transform to hex:
u\A5y\11kBFG\9C\2D\18\FE\FA\DD6\B5
I worked it out to 75 A5 79 11 6B 0B 46 47 9C 2D 18 FE FA DD 36 B5 but it doesnt seem to be picking up the account in exmerge.
Any help would be appreciated,
Colm
November 10th, 2006 at 2:20 pm
I split it like this:
u A5 y 11 k B F G 9C 2D 18 FE FA DD 6 B5
Which gives:
75 A5 79 11 6B 42 46 47 9C 2D 18 FE FA DD 36 B5
I think you treated the B as 0B instead of an ascii character which gives 42. See if that helps.
This is all hideously undocumented, so I could be way off
December 6th, 2006 at 8:51 am
This is a great article - helped me recover a mailbox I’d been working for three days to recover. Here’s a pointer that will help with figuring out the
mailbox guid. Just dump the information about the RSG using the following script. The msExchMailboxGuid can be more easily derived from the output.
'******************************
'CHANGE FOR YOUR ENVIRONMENT
cComputerName = "victexevsizn1"
'******************************
On Error Resume Next
Dim cComputerName
Const cWMINameSpace = "root/MicrosoftExchangeV2"
Const cWMIInstance = "Exchange_Mailbox"
Dim strWinMgmts ' Connection string for WMI
Dim objWMIExchange ' Exchange Namespace WMI object
Dim listExchange_Mailboxs ' ExchangeLogons collection
Dim objExchange_Mailbox ' A single ExchangeLogon WMI object
' Create the object string, indicating WMI (winmgmts), using the
' current user credentials (impersonationLevel=impersonate),
' on the computer specified in the constant cComputerName, and
' using the CIM namespace for the Exchange provider.
strWinMgmts = "winmgmts:{impersonationLevel=impersonate}!//"& _
cComputerName&"/"&cWMINameSpace
Set objWMIExchange = GetObject(strWinMgmts)
' Verify we were able to correctly set the object.
If Err.Number <> 0 Then
WScript.Echo "ERROR: Unable to connect to the WMI namespace."
Else
'
' The Resources that currently exist appear as a list of
' Exchange_Mailbox instances in the Exchange namespace.
Set listExchange_Mailboxs = objWMIExchange.InstancesOf(cWMIInstance)
'
' Were any Exchange_Mailbox Instances returned?
If (listExchange_Mailboxs.count > 0) Then
' If yes, do the following:
' Iterate through the list of Exchange_Mailbox objects.
For Each objExchange_Mailbox in listExchange_Mailboxs
wscript.echo objExchange_Mailbox.LegacyDN & vbtab &_
objExchange_Mailbox.DateDiscoveredAbsentInDS & vbtab &_
objExchange_Mailbox.DeletedMessageSizeExtended & vbtab &_
objExchange_Mailbox.LastLoggedOnUserAccount & vbtab &_
objExchange_Mailbox.LastLogoffTime & vbtab &_
objExchange_Mailbox.LastLogonTime & vbtab &_
objExchange_Mailbox.MailboxDisplayName & vbtab &_
objExchange_Mailbox.MailboxGUID & vbtab &_
objExchange_Mailbox.ServerName & vbtab &_
objExchange_Mailbox.Size & vbtab &_
objExchange_Mailbox.StorageGroupName & vbtab &_
objExchange_Mailbox.StorageLimitInfo & vbtab &_
objExchange_Mailbox.StoreName & vbtab &_
objExchange_Mailbox.TotalItems
Next
Else
' If no Exchange_Mailbox instances were returned,
' display that.
WScript.Echo "WARNING: No Exchange_Mailbox instances were returned."
End If
End If
December 6th, 2006 at 9:38 am
Thats pretty neat - thanks for that!
December 8th, 2006 at 12:20 pm
\CCa6\9Ey\A5\99O\9E\251\AA\9B\7C\AA\2C
CC 61 36 9E 59 A5 99 4F 9E 25 31 AA 9B 7C AA 2C
is this correct?
December 19th, 2006 at 3:23 pm
Thank you very much,
Note: I had only problem to transform 2\97\86\9AG\EB\84M\A1\CF84\A1P\C5\16 to HEX. It took a couple of tests to
.. 02 97 86 9A G EB 84 M A1 CF 8 04 A1 P C5 16
devide it corectly into couples
Michal
December 19th, 2006 at 3:54 pm
@Rene - looks good to me!
@Michael - Yes, only the first 2 characters in each segment are actual Hex, each subsequent character should be treated individually and converted to the ASCII Hex value.
December 21st, 2006 at 2:40 am
I ran across your article because this is exactly what we’re trying to do, recover a purged mailbox. Everything goes fine, but I’m having trouble converting the GUID portion. Is there some other references to help on this?
I took
\98N\D2\81M47G\A7\E81s\7Fd\91\E3
And got
98 N D2 81 M 04 07 G A7 E8 01 s 7F d 91 E3
Then
98 4E D2 81 4D 04 07 47 A7 E8 01 73 7F 64 91 E3
But it doesn’t seem to be right.
December 21st, 2006 at 9:36 am
@Doug:
98 4E D2 81 4D 34 37 47 A7 E8 31 73 7F 64 91 E3
You need to treat everything after the first two chars as individual ascii characters.
If there was some reference to help on this I wouldn’t have had to write the article after lots of digging round on Google and Usenet!
January 7th, 2007 at 9:44 pm
Thanks a lot man!
I was looking for hours trying to restore a database but i couldnt get the mail from the database because of this problem:( If i didnt make it before monday i might have lost the client.
So thanks again, you’re a lifesaver!!
grtz
Bram
January 11th, 2007 at 11:46 pm
I ended up having to do this same thing. Figuring out the hex encoding bit was a pain… wish I’d found this website first.
For those still scratching their heads on how to split up the octets correctly,k the key insight is that a \XX sequence (backslash followed by two hex digits) encodes a single charactuer. (Octet.) Any other character should be converted into its ascii code and then THAT is used as the octet. Example:
i\FC\EE1\EA\CE\AFM…
“i” is 0×69
then 0xFC
then 0xEE
then “1″ is 0×31
then 0xEA
then 0xCE
then 0xAF
then “M” is 0×4D… etc
does that help?
January 24th, 2007 at 4:32 pm
Great page! Been having real problems until I found this.
I used the vbscript Ratdog posted (thanks) but you have to remember reorder the GUID output as follows when inputting in adsiedit:
script order: 12345678-1234-1234-1234-123456789ABC
Adsiedit order: 78563412-3412-3412-1234-123456789ABC (input like AC EF 53 etc…)
Thanks again!
January 30th, 2007 at 5:26 pm
When you mount the store in the RSG…will this cause any problems for the production stores that are running? And how come you don’t just let the Veritas product do it by itself?
January 30th, 2007 at 5:33 pm
The RSG is referenced totally seperately from the main store - a user will still connect to their mbox on the main store.
For speed reasons (several hours worth…) we no longer back up to individual mailbox level. We only backup the store as a whole. Veritas will restore this to the RSG, but you can’t restore individual mailboxes out of veritas unless you back them up at that level.
We will be looking at some form of email archiving solution later this year to hive off attachments to a NAS/SAN or something and bring the total size of the store down dramatically, but until then…
February 4th, 2007 at 9:49 pm
Hi, indeed very useful.
Can someone verify this one:
\FE\18\A5\D2\FF9\BBK\91\80\F22\AC\E7\2A\8F
FE 18 A5 D2 FF 39 BB 4B 91 80 F2 32 AC E7 2A 8F
Thx…
February 5th, 2007 at 11:14 am
\FE\18\A5\D2\FF9\BBK\91\80\F22\AC\E7\2A\8F
FE 12 A5 D2 FF 9 BB K 91 80 F2 2 E7 2A 8F
FE 12 A5 D2 FF 39 BB 4B 91 80 F2 32 E7 2A 8F
Yeah, looks ok. If its not working you have to remember that the exact case of any “extra” letters on each hex couplet is important when checking its ASCII value.
February 12th, 2007 at 9:13 pm
*HIGH FIVE* fizzgig!
I spent several DAYS trying to work through this whole process and wouldn’t you know I stumble on your site AFTER I’ve already figured 90% of it out. Nevertheless, this blog is exactly what I needed because I probably would have spent MORE days trying to find the old guid for the mailbox that needed restored and EVEN MORE days trying to parse it to an actual guid. Your post is very significant and I sincerely appreciate your effort!
For the record, I spent most of a day walking through a process from TechNet (article 997796). As you mention at the beginning of your post, the “trick” they use doesn’t work with Exchange STANDARD edition. For anyone who’s read this far down in Fizzgig’s post, Exchange STANDARD is only allowed ONE production mailbox and in the trick from TechNet you will need two (not including the Recovery Storage Group). I just wanted to clarify that …again, that took me almost an entire day to discover.
Thanks again!
March 12th, 2007 at 10:20 pm
Thanks for publishing this. It works perfectly well. I needed to restore a August 2006 backup from a Backup Exec 10 Exchange backup into a Recovery Storage Group. However, the user account got deleted a while ago. After re-creating the AD user and changing the GUID I actually got an exmerged pst-file of the entire mailbox. Kudos!
March 13th, 2007 at 9:29 pm
This article has helped me enormously but I’m struggling with the msExchMailboxGuid property on the recreated user account - I hope someone can help. It’s a single server domain with Exchange on the DC. I’ve re-created the user, restored into the RSG and I’m using RatBoy’s script to enumerate the mailboxes. I take my recovered guid and reorder the couplets and use ADSIEdit.msc to set msExchMailboxGuid property. However, when I re-enumerate the mailboxes, the change hasn’t taken effect. Do I need to force the changes to propagate from the Active Directory to Exchange?
Any assistance would be greatly appreciated.
March 13th, 2007 at 10:04 pm
@Robin M: Did you create a mailbox for the recreated account before changing the msExchMailboxGuid property?
March 13th, 2007 at 10:29 pm
I’ve had some success now (I tried changing the guid both before and after creating the mailbox) - having left it alone for a while, it seems to have propagated to Exchange and I’m up and running with the data recovery. Thanks very much for all your help.
March 15th, 2007 at 1:41 am
I think I spoke too soon as I’m struggling again. The process is hit and miss. I recovered four mailboxes using SP1 Recover Mailbox. I used ‘merge’ for two and then ‘copy’ for two. Then I decided to try the first two again with ‘merge’ instead of ‘copy’ but failed this time around, and I can’t reproduce the successful results. Here’s what I’m doing:
1. Create user and mailbox with Active Directory new user wizard
2. Log on to new account with Outlook so that Exchange creates the mailbox
3. Change the msExchMailboxGuid using ADSIEdit.msc
I’ve left it to propagate as I did before but no luck. Is this the correct procedure?
March 15th, 2007 at 7:37 am
Hi,
I’m having the same problem trying to convert to hex.
Can someone please help me?
YE\FD\40F\FAFL\ABC\7F\9A\DF\A4J7
Thank you,
March 15th, 2007 at 7:40 am
Sorry, the right string is:
YE\FD\40F\FAFL\ABC\7F\9A\DF\A4J7
Thank you,
March 15th, 2007 at 7:46 am
wrong again….
i hope this one will be the right one:
YE\FD\40F\FAFL\ABC\7F\9A\DF\A4J7
March 15th, 2007 at 7:54 am
Ok , now I am really
It keeps changing the string when I submit my reply…
So:
You have to add slash and zero before the E
You have to add slash and zero after the 40
You have to add slash and zero before the C
Thank you,
March 15th, 2007 at 7:27 pm
Ok. After a lot of trial and error, I’ve got a procedure that works!
1. Create user and mailbox with Active Directory new user wizard
(don’t log on to new account with Outlook so that Exchange creates the mailbox)
2. Change the msExchMailboxGuid using ADSIEdit.msc
3. Wait for the change to propagate
4. Recover mailbox with SP1 Recover Mailbox
March 15th, 2007 at 10:55 pm
Thank you for posting this solution. It’s not often that you find something so useful and easy to use. This article saved my bacon. -Scott
March 19th, 2007 at 1:04 pm
I need help to convert this : \7E\E3B\2A7\131\40\8F\3C33\16\14\B3\F1 !!!
March 19th, 2007 at 1:25 pm
\7E\E3B\2A7\131\40\8F\3C33\16\14\B3\F1
Follow the guidelines above.
First break it into hex couplets and ascii characters
7E E3 B 2A 7 13 1 40 8F 3C 3 3 16 14 B3 F1
Then convert the ascii characters to their hex values.
7E E3 42 2A 37 13 31 40 8F 3C 33 33 16 14 B3 F1
March 21st, 2007 at 3:09 pm
Thanks for this information!! Worked like a charm.
March 24th, 2007 at 2:18 am
PLEASE!
First of all - incredible page. Only thing is that I am a hex retard with a hangover! Can someone please help me convert the following?
\86\DA\F6T\ED\179H\B0M\DD\202U\1C\40
Any help would be incredibly appreciated!!!! I have been stuck here all day with one of these because my help desk shit the bed!
April 4th, 2007 at 9:13 am
Have you guys heard of Ontrack PowerControls? This software lets you open the
edb file that stores your mailboxes and lets you import it into a newly created
mailbox or a pst file.
A little expensive though…
April 5th, 2007 at 1:11 pm
GEE thx man !! I’ve been trying out the new procedures on restoring a mailbox with this method for the past 3 hours a tryout. The best I could find was a veritas backupexec document that describes everything just as you did except indeed the missing KEY sentence that you mentioned. I’ve been spending the last hour browsing and hoping for a sign of a possible answer to my instictive question “won’t my live store be overwritten if I simply restore from within backupexec ???” You took away all doubt and saved the day ! Gonna go and press the start restore button now
April 19th, 2007 at 2:29 pm
Fantastic info, although I’ve never had to do this, I have been spending a bit of time reading up on how it’s done so that if I ever had to do this it wouldn’t be so tricky.
We use veritas too, and I’ve been shocked at the lack of info on how to actually use the software effectively, so far it’s been a case of trial an error with anything more advanced than a standard back up or restore.
May 16th, 2007 at 5:30 pm
This is a superb way of doing things. Even though Exmerge said the mailbox I was restoring had 0 KB in it it still extracted all the 450 MB to a PST file. Thanks for showing about the GUID change as that is exactly where I got stuck!
May 18th, 2007 at 5:22 pm
HELP !! I am in the same shoes as many above and I tried but no dice,
My line was:
53yn\E5DFD\85\8C\EC\F8\1B\BCgQ
Which I read as:
5 03 y n E5 0D 0F D 85 8C EC F8 1B BC g Q
And converted to:
35 03 79 6E E5 0D 0F 44 85 8C EC F8 1B BC 67 71
But the task wizard says NO Good, Help !!
May 18th, 2007 at 5:23 pm
Whoa, the correct line is : 53yn\E5DFD\85\8C\EC\F8\1B\BCgQ
It didnt post right the first time.
May 18th, 2007 at 5:26 pm
why does it keep doing that, the correct post one last time is : 53yn\E5DFD\85\8C\EC\F8\1B\BCgq
May 18th, 2007 at 5:27 pm
Forget it, it keeps changing the format when I post. The article was very helpful though.
May 18th, 2007 at 6:12 pm
No no no.
The first two characters in any grouping are hex, anything after that should be treated as a single (case sensitive) ascii character and converted to its hex value:
53yn\E5DFD\85\8C\EC\F8\1B\BCgQ
53 y n E5 D F D 85 8C Ec F8 1B BC g Q
June 5th, 2007 at 7:21 pm
Thanks for this info! It saved the day!
June 8th, 2007 at 12:08 pm
Thanks for your post, it has saved my day!
June 18th, 2007 at 4:58 pm
This workded great for outputing the mailbox to a pst. Is there a way to make it work within exchange again? The recover mailbox option in exchange can copy and merge the mailbox but outlook cannot access it.
June 23rd, 2007 at 12:21 pm
You can exmerge the mailbox out and then use exmerge again to import the created .pst files back into your Exchange.
July 9th, 2007 at 12:06 pm
I need to convert :
6T\24\1FJurE\87u\AD\1E\1C\12\ED\60
can you help me?
July 9th, 2007 at 3:41 pm
I try to convert but adsi not apply, i need help to convert-.
6T\24\1FJurE\87u\AD\1E\1C\12\ED\60
6 T \24\ 1F J u r E\ 8 7 u\ A D\ 1E \1C \12\E D \ 6 0
6 54 24 1F 4A 75 72 45 38 37 75 41 44 1E 1C 12 45 44 36 30
July 9th, 2007 at 3:47 pm
6T\24\1FJurE\87u\AD\1E\1C\12\ED\60
The first two characters are ALWAYS hex:
6T 24 1H J u r E 87 u AD 1E 1C 12 ED 60
6T 24 1H 4A 75 72 45 87 75 AD 1E 1C 12 ED 60
July 9th, 2007 at 3:59 pm
Hi Fizzgig, thanks for your help.
In ADSI edit console, poperties of user and msExchMailboxGuid , set the value to
6T 24 1H 4A 75 72 45 87 75 AD 1E 1C 12 ED 60 but i get error message:
A value for the atribute was not in the acceptable range of values
July 10th, 2007 at 9:53 am
Hi,
I converted the string into:
06 54 24 1H 4A 75 72 45 87 75 AD 1E 1C 12 ED 60 and adsi edit console accept but the exmerge cause same error in exmerge.log becaus don’t recognize the user mailboxguid:
6T\24\1FJurE\87u\AD\1E\1C\12\ED\60
July 10th, 2007 at 9:56 am
My bad. Should be 1F not 1H
July 12th, 2007 at 3:05 pm
Hi Fizzgig, thanks a lot.
The adsi console only accept with “06 54 24 1F 4A 75 72 45 87 75 AD 1E 1C 12 ED 60″ but exmerge find same errors.
I think correct string are 6T 24 1F 4A 75 72 45 87 75 AD 1E 1C 12 ED 60 but i have errors in adsi edit console with them…
regards,
July 14th, 2007 at 6:38 pm
Trying to convert 949\8B\BF\814ON\8B\E6Bp7Ik\B3 ?
Thanks
August 13th, 2007 at 7:02 pm
You save my job!!!!!
The procedure works fine!!!
Thankssss
August 17th, 2007 at 4:30 pm
Hi All
I am having some issues converting one of my user guids to hex as well. What happens is I only come up with 15 octets. I’ve gone thru the process a bunch of times and can’t see the forest thru the trees:
Error! Cannot identify the user with the msExchMailboxGuid 02b\94B\26zF\80\95\E3\9B\CE\B5\B92. The legacyExchangeDN is ect….
02b 94B 26zF 80 95 E3 9B CE B5 B9 02
02 b 94 B 26 z F 80 95 E3 9B CE B5 B9 02
02 62 94 42 26 7A 46 80 95 E3 9B CE b5 B9 02
Bu that only comes up to 15 octets, of course this is the user I need and all the other GUID are coming up correctly with 16 octets but I need to get this one restored. Does some see something I am doing wrong here?
Thanks a bunch
August 17th, 2007 at 4:33 pm
Darn it that did not paste well, guid is
02b\94B\26zF\80\95\E3\9B\CE\B5\B92
Again all I can see to convert this to is 15 octets and need 16 in order to replace in adsiedit.
Thanks,
Brent
August 17th, 2007 at 4:39 pm
still did not paste well all right then:
02b\94B\26zF\80\95\E3\9B\CE\B5\B92
without slashes
02 b 94 B 26 z F 80 95 E3 9B CE B5 B9 02
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
I cant seem to get 16 octets anyone see what i am missing?
August 17th, 2007 at 4:45 pm
You’re forgetting that EVERY SINGLE CHARACTER AFTER THE FIRST TWO SHOULD BE TRANSLATED TO ASCII!!!
the last 2 is not a 2 its the ASCII hex value of “2″ - 0×32
August 17th, 2007 at 5:28 pm
msExchMailboxGuid 02b\94B\26zF\80\95\E3\9B\CE\B5\B92. The legacyExchangeDN
Here is the GUID straight from the log: For some reason whenever I pasted this before the B9/02 converts to B92 which is not what show in the log:
So I see this as
02 b 94 B 26 z F 80 95 E3 9B CE B5 B9 02
Which would convert to:
02 62 94 42 26 7A 46 80 95 E3 9B CE B5 B9 02
Am I still missing something there?
Obviously missing something or it would work.
Thanks
August 17th, 2007 at 5:34 pm
This really saved my butt. Problem is that about 1/4 of the mailboxguids shown on the exmerge log are missing the leading \ on some of these it doesn’t seem to matter, but I can’t get this one to work out to 16 groups after translation.
SC\81E\5E\AD8o\B2\A9\E3W\FA\29Ki
Any help would be appreciated.
Bill
August 17th, 2007 at 5:54 pm
@Bill
Hmm. Not come across that before. Although, given “SC” isn’t valid Hex I would try splitting it to S and C and converting them to ascii, then convert the other segments as usual.
August 17th, 2007 at 6:08 pm
That was it, thanks for the quick reply and the help
August 17th, 2007 at 6:22 pm
Excellent!!!
That may actually be the fix for anybody else posting a msExchMailboxGuid missing a leading \ -treat the first segment as individual ascii characters to be converted to Hex.
You have to wonder who decided that this would be a handy format to report the Guids in!
August 20th, 2007 at 1:21 pm
Treating the first segment as individual ascii characters allowed me to reconnect to the mailbox. I was also missing the leading \ and whenever I converted to hex I was only coming up with 15 groups. After treating the 1st segment as 2 ASCII characters my problem was solved. Thank you all so much for your help, cost of recovering mailbox 1hr, this thread priceless.
August 28th, 2007 at 7:30 pm
This thread save me a lot of time I had the same issue with the missing leading \…I was pulling my hair out trying to figure out why I could not get 16 groups when all of the other were. This explained why…….Very nice!
September 10th, 2007 at 2:02 pm
Hi,
Can you help me please ?
\E1\AC\26\8Bt\EB\10B\97\F1\EA\83\1E\81\84D goes to
E1\AC\26\8B\74\EB\10\42\97\F1\EA\83\1E\81\84\44
is this correct ?
Thank you
September 17th, 2007 at 9:56 pm
Canyou convert this Please? Thank you
\A187\F2\C2E\F6F\B6fM\3C\D69\E33
September 17th, 2007 at 10:02 pm
Sorry, I meant
\A187\F2\C2E\F6F\B6fM\3C\D69\E33
September 18th, 2007 at 2:17 am
Try the tool I’ve just finished writing (new post up) and see if that helps
September 18th, 2007 at 10:07 am
Hi,
I have SBS 2003 and I deleted an user dan with his mailbox that I purged.I wanted to recover the mails from a backup.
Everything worked smooth till the last step.
I created a “new” user dan with a new mailbox.
I edited with ADSI Edit the msExchMailboxGuid I want to change.After the changed takes place I have a disconnected mailbox.If I want to reconnect it to the same user
I can’t because the user isn’t listed in “Select a new user for this mailbox” window.
So I wanted to reconnect and then to proceed with the restore of the mailbox.
Can you help me please ?
September 18th, 2007 at 11:00 am
If I try to reconnect to an other user that I find in “Select a new user for this mailbox” list I receive:
………………….
This legacyExchangeDN value is already being used by CN=dan,OU=SBSUsers,OU=Users…..
Id no:c1034ad7
Exchange System Manager
Thank you.
September 18th, 2007 at 11:58 am
Hi Dan,
You use exmerge to recover the email from the Recovery Storage Group.
You can then use exmerge again to import the email from the PST file back into an actual mailbox if required.
September 18th, 2007 at 12:28 pm
OK
Everything is ok now. Only next time I log on, the new mailbox will be recreated with the new guid.
Thank’s anyway.
October 8th, 2007 at 6:36 pm
My user has been migrated to 2007 and needs something restored from before the migration. I use RSG and can restore by exmerge wont work because the original mailbox is gone. I have even got far enough to move the edb and stm file to another storage group and have it mounted. I cant reconnect because it says that it already connected. I think I need to change the GUID on the mailbox to another user. Any ideas?
October 8th, 2007 at 7:43 pm
No, you can’t edit the store. You have to create a new user and set the msExchMailboxGuid property to be the same as the mailbox you want to access, then exmerge displays that mailbox as belonging to the new user.
October 8th, 2007 at 8:15 pm
nevermind - I got it. I just remapped the GUID of the of the 2k3 storage group to the 2k7 group and now housed the active mailbox. Exmerge fired right up. I didnt think it would considering the version difference.
October 30th, 2007 at 9:37 pm
thank you sooo much for spending the time in going through this, posting this and answering peoples questions.
You rock!
November 15th, 2007 at 7:19 pm
You rock, my friend…I just restored back a long-ago-deleted mailbox with some important stuff in it for an exec. I am now viewed as a god around here. And if I’m a god, you are Zeus, King of Gods!! Thanks a ton…
November 22nd, 2007 at 1:25 am
I must be missing something obvious. In the fifth paragraph you say “Right click on the Recovery Storage Group (RSG) and select ‘Add Database to Recover’. Select the Mailbox store. Make sure that this store is not mounted (not your live store - you can leave that running)….” In my environment (SBS2003) there is only one mailbox store showing in the search results under “Select database to recover,” and the one that’s showing looks like it is my live store. And I don’t see any way of telling whether it’s mounted or not, unless the icon to the left of the store name is supposed to tell me that.
Are you sure this step is supposed to come before recovering the store from backup? It would make more sense to me to restore the store first and then select it to add to the RSG.
November 22nd, 2007 at 2:29 am
Answered my own question. It’s OK to select the one and only mailbox store that is presented. Fizzgig, you should win some sort of award from the Bill and Melinda Gates foundation for this. And I LOVE the GUID converter tool.
December 11th, 2007 at 10:17 pm
Recovering data to deleted mailbox…
From…
January 11th, 2008 at 8:35 pm
I have a similar issue to David’s. I created the Recovery Storage Group as advised, but when I go to ‘Select Database To Recover’, I don’t see the store I need to recover. All of the other ones are there. Am I missing something?
January 12th, 2008 at 12:10 am
Actually, nevermind. After rebooting the Exchange server and allowing it a good hour to sync up with the other Exchange servers in our organization, the option came up again. Thanks for posting this info, though!
January 12th, 2008 at 12:11 am
To be honest I can’t remember much about mounting the store, I’ll try and remember and have a poke at our server next week, but its only running a single storage group with one mailbox store.
January 15th, 2008 at 12:04 pm
Thanks 4 this article, it really saved our ass
The GUID Converter Tool is very useful too!
January 21st, 2008 at 7:57 am
Thank you very much for this excellent site which I had come accross a while ago and bookmarked, just saved my butt, thanks a million for all your great work. Everything is included for a full recovery from a totally ’screwed’ and very ‘hosed’ state
January 22nd, 2008 at 8:09 pm
The converter tool is not showing any results for me. I’m in a locked down environment so I’m guessing that is why.
Could someone convert \CB\B4\84\FE\A4\A3XF\B3\B2\7Dn\DD\BCL\A8 for me and post the results? I’ve been trying to recover
a mailbox for 4 days now.
January 22nd, 2008 at 8:50 pm
Disregard my last comment. I attempted to convert it myself and I got it right the first time (pure luck I’m sure). Anyway, it worked like a charm and I got all the mail back. Thank you so much!!!
February 3rd, 2008 at 5:55 pm
This information is unbelievably helpful. I’d been around the world trying to get a clean exmerge after an RSG dump from BE 11d. A lot of very, very smart MS guys missed this. On usenet my questions were basically ignored. “Call Symantec.” “Call Professional Services.” “It’s your legacyDN.” “Different SPs on Exchange.” “Different build of BE.” “Buy Ontrack.” I knew there was something up with the guid strings in the log files, but it never crossed my mind it was fixable. I thought it was corrupted from the way the backups had been done and I was stuck. So, THANK YOU so much for your work and for sharing it.
The $10,000 question to me is: Why does this happen? What conditions have to be met for this specific problem to occur? From the paucity of docs on the issue, it evidently is very rare. Right?
February 3rd, 2008 at 7:10 pm
I’ve no idea why exmerge logs guids in a format that isn’t directly compatible with AD user properties. Ok, so changing the msExchMailboxGuid property on a user account with ADSIedit probably isn’t really supported. That may be the reason its output in such an odd format.
I’m surprised that there isn’t an option in exmerge to create dummy user accounts to match up unknown mailboxes to, that would be handy. Or even to just be able to dump orphaned mailboxes.
March 18th, 2008 at 4:50 am
Why can’t Microsoft post something like this??? I really appreciate the effort and it resolved the problem. Kinda neat to do as well.
April 8th, 2008 at 4:27 am
I’ll chime in here as well, very nice instructions, nice tool for converting the hex, etc. Good job.
May 2nd, 2008 at 4:58 pm
You da Man!
)
Cheers Geeza.
May 7th, 2008 at 6:32 pm
I’ve trying to convert this for 2 days. Can you help?
\B0\FAYA\3B\28\81F\85\EBE\81\D8bq\F3
May 14th, 2008 at 9:41 am
Thanks a lot man,
I got to the point where I read the guid from the exmerge log, but I was stuck with the format, it didn’t fit the pattern.
I really appreciate your guide on this, and your hex-tool is a welcome helping hand in a scenario like this!
Keep up the good work !!
July 30th, 2008 at 3:15 pm
Fantastic work…helped me immensely….was finding the steps to do this difficult to find anywhere else!!
July 31st, 2008 at 11:44 am
Thank you very much for this utility and the onfirmation on here. It has helped us trememndously when we had problems with our CEO’s mailbox.
Keep up the good work
October 3rd, 2008 at 10:23 am
YOU ROCK!!!! I CAN’T SAY IT ENOUGH! With an ill timed server upgrade to new hardware and then suddenly deciding to also change to VMWare ESXi and Server 2008/Exchange 2007, I have been basically down for about 2 weeks now. The catalyst to cause all of this was that my old server took a massive dump and would no longer let me log in. All I had was a backup of the RAW DB files. To make a long story hopefully shorter, it was looking like my only option was to spend hundreds of dollars to purchase software to convert the RAW DB files from 2003 to Exchange 2007 OR lose all my e-mails, contacts, hundreds of tasks, calendar appointments, etc.
Thanks for saving my @** with your article and this time saving tool! I owe you one big time.
October 10th, 2008 at 2:47 am
Excellent work!! I’ve been busting my a** to recover an old mailbox, this worked like a charm
October 15th, 2008 at 1:07 am
Great stuff.
Saved my arse when trying to restore some 20 odd mailboxes deleted 2 years previously which were needed for legal reasons.
Never listen to helpdesk when they say they export emails accounts to pst before deletion..
October 17th, 2008 at 12:25 pm
hi,
thanks!, I had to recover deleted AD accounts on a separate domain mounting backup as regular database and reconnecting mailbox to any user, then dumping with exmerge.
With this I can go faster, thanks!
December 16th, 2008 at 11:41 pm
Very nice work, helped me recover several boxes that were deleted months ago. I ran this several times without issue but all of a sudden I can’t do this anymore. I can get the user’s mailbox to show up in exmerge using the guid trick but when I try to export the data to a PST I get the following error:
“Error opening message store (MSEMS). Verify that the Microsoft Exchange Information Store service is running and that you have the correct permissions to log on. (0×8004011d)”
Any idea’s?
I checked all my permissions and that doesn’t seem to be an issue.
December 20th, 2008 at 8:02 pm
The RSG is referenced totally seperately from the main store - a user will still connect to their mbox on the main store.
Does this mean that when I edit the GUID using the AD editing tool, I’m only editing it *for the RSG* and not for the main store? I have a situation where a server had to be rebuilt from scratch and users have been using the new system for several weeks. I have a backup from before the crash (from the OLD server) and want to extract mail from it, but I don’t want to break the new server and the accounts on it (and I really don’t want to lose all their new email that has come in during the last few weeks). Can I do this? (Sorry to ask general help questions here, just hoping someone will stumble upon it as this is the best information I’ve found online about actually using exmerge!)
December 20th, 2008 at 9:48 pm
The msExchMailboxGuid that is attached to a user object is the same for the main store and the RSG. If you edit msExchMailboxGuid, then the user will become detached from their mailbox - IIRC Exchange will just create a new empty mailbox next time it should be accessed using the whatever msExchMailboxGuid is set to as a reference.
Restoring a store to the RSG will not overwrite the main store. Users will continue to access the main store. What I would suggest is that you take all the msExchMailboxGuid exmerge doesn’t recognise from the RSG and create dummy accounts so you can dump the mail out then re-import it to the actual accounts.
April 2nd, 2009 at 2:06 pm
You’re a legend, I want your baby.
April 24th, 2009 at 7:14 am
I had all this info from various websites and combined it for use myself, but it’s nice to see that someone has compiled into a web page for everyone’s use.
Good stuff you are a legend !!!!!
May 26th, 2009 at 10:48 am
I made the old Hex according to what is explained above, but the Hex var. that is now (the new account) active, is way much shorter then the one I get from converting the old one from the Recovery Storage Group. When I look it’s an Octet String.
Can this be right, I’m not sure. Can anybody help me out?
May 27th, 2009 at 1:21 pm
I had used your GUID trick 2 years ago but had forgotten about it until I saw those familiar backslashes in my exmerge log. Then it all came rushing back. Saved me AGAIN! This information is indeed priceless.
I love you man!
June 11th, 2009 at 11:15 am
Amazing! I could not find anything quite as helpful as this page! Thank you
I have been working non stop the past 48 hours (ok I slept 5 hours last night) as one of my client’s SBS servers died… Suffice to say, when I found out there was no system restore backup, I literally spat the dummy… It’s been screw around followed by screw around, and if it wasn’t for people like yourself, I would not have had the success I have had so far! Thankyou - and everyone else who has contributed here