Exchange 2003 Mailbox Recovery

Posted by on September 1, 2006

Today I recovered a single mailbox from backup tapes on an Exchange 2003 server. The user had been deleted from Active Directory. The mailbox had passed the retention time on the server and been purged from the Exchange database.

I found very very minimal documentation on how to do this, it was so sketchy that I was almost afraid to try this.
We only have a single Exchange 2003 Standard server, and I believe that its a little bit simpler if you have Enterprise or more Exchange servers. So, for those of you in the same boat, here’s how to do it.

First, and I cannot stress this enough, make sure that your Mailbox Store is such that “This database can be overwritten by a restore” is NOT checked. You should probably make sure that your Public Folder Store is set the same. Just in case.

Now, right click on the server and select New -> Recovery Storage Group. Create the logs and system paths in locations that have sufficient space to hold the .edb and .stm files for your restore.

Right click on the Recovery Storage Group (RSG) and select “Add Database to Recover”. Select the Mailbox store.
Make sure that this store is not mounted (not your live store – you can leave that running), and that it is set to allow overwrites by restores. I believe this is the default.

Now, on your Backup software (we use Veritas BackupExec), browse to the Information Store and select only the mailbox store to be recovered, not the Public Folder Store. Make sure that in your options you select that this is the last backup to restore and not to mount the store when finished. Run the restore. For me this was the scary bit. The documentation was lacking the phrase “Don’t worry, Exchange knows to make sure the restore will go to the Recovery Storage Group, NOT the live Mailbox Store”

Once the restore is complete, mount the store in the RSG. If Exchange thinks that there are still further restores to occur, you can use eseutil /cc to finalise the store and allow it to be mounted.

Now you can use exmerge to dump out the mailbox(es) from the RSG to a PST file. Unless the useraccount has been removed from AD.
If the user account has been removed, then you have to recreate the account. Before you do that, check the exmerge.log file as it will tell you the GUID of the mailboxes that it can’t find accounts for. You have to go through to the point of selecting mailboxes to action for that information to be written.

The lines in Exmerge.log will appear something like this:
[11:39:13] Error! Cannot identify the user with the msExchMailboxGuid \C1\A7\98\CE\B8\CF5J\99\E1\B1\28\8C\7D\EFj. The legacyExchangeDN is /O=COMPANY/OU=EXCHANGE ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=AUSER.

Note the almost but not quite hex pattern listed. This is the important bit.
Each mailbox has a hex guid. Each mail enabled user has a property which gives their mailbox guid. You need to convert this to proper hex.

 \\C1\\A7\\98\\CE\\B8\\CF5J\\99\\E1\\B1\\28\\8C\\7D\\EFj

First, break out the couplets from each group

 C1 A7 98 CE B8 CF  5  J 99 E1 B1 28 8C 7D EF  j

Only the first two characters in any grouping are Hex, any following characters should be treated individually (Note that the 5 and J (case IS important) have been split.)
Now, take any non-hex characters and get the hex value for that ASCII character from http://www.asciitable.com/ :

 C1 A7 98 CE B8 CF  5  J 99 E1 B1 28 8C 7D EF  j
 C1 A7 98 CE B8 CF 35 4A 99 E1 B1 28 8C 7D EF 6A

UPDATE: If the leading \ is missing, treat the first group as individual ascii characters!
UPDATE2: I’ve written a tool to do this for you!

Now you need to use a tool such as ADSIEdit.msc to change the msExchMailboxGuid property on the recreated user account. Synchronise your domain controllers and run ExMerge again, this time the mailbox should be available to dump out, complete with the items from the Dumpster (if the user killed everything in their mailbox before leaving the company).

Tags: , , , , , , ,

Incoming links

Comments (131)

  • This workded great for outputing the mailbox to a pst. Is there a way to make it work within exchange again? The recover mailbox option in exchange can copy and merge the mailbox but outlook cannot access it.

  • You can exmerge the mailbox out and then use exmerge again to import the created .pst files back into your Exchange.

  • I need to convert :
    6T\24\1FJurE\87u\AD\1E\1C\12\ED\60

    can you help me?

  • I try to convert but adsi not apply, i need help to convert-.

    6T\24\1FJurE\87u\AD\1E\1C\12\ED\60

    6 T \24\ 1F J u r E\ 8 7 u\ A D\ 1E \1C \12\E D \ 6 0

    6 54 24 1F 4A 75 72 45 38 37 75 41 44 1E 1C 12 45 44 36 30

  • 6T\24\1FJurE\87u\AD\1E\1C\12\ED\60

    The first two characters are ALWAYS hex:

    6T 24 1H J u r E 87 u AD 1E 1C 12 ED 60
    6T 24 1H 4A 75 72 45 87 75 AD 1E 1C 12 ED 60

  • Hi Fizzgig, thanks for your help.
    In ADSI edit console, poperties of user and msExchMailboxGuid , set the value to
    6T 24 1H 4A 75 72 45 87 75 AD 1E 1C 12 ED 60 but i get error message:
    A value for the atribute was not in the acceptable range of values

  • Hi,
    I converted the string into:
    06 54 24 1H 4A 75 72 45 87 75 AD 1E 1C 12 ED 60 and adsi edit console accept but the exmerge cause same error in exmerge.log becaus don’t recognize the user mailboxguid:
    6T\24\1FJurE\87u\AD\1E\1C\12\ED\60

  • My bad. Should be 1F not 1H 😉

  • Hi Fizzgig, thanks a lot.
    The adsi console only accept with “06 54 24 1F 4A 75 72 45 87 75 AD 1E 1C 12 ED 60” but exmerge find same errors.
    I think correct string are 6T 24 1F 4A 75 72 45 87 75 AD 1E 1C 12 ED 60 but i have errors in adsi edit console with them…

    regards,

  • Trying to convert 949\8B\BF\814ON\8B\E6Bp7Ik\B3 ?
    Thanks

  • You save my job!!!!!

    The procedure works fine!!!

    Thankssss

  • Hi All
    I am having some issues converting one of my user guids to hex as well. What happens is I only come up with 15 octets. I’ve gone thru the process a bunch of times and can’t see the forest thru the trees:
    Error! Cannot identify the user with the msExchMailboxGuid 02b\94B\26zF\80\95\E3\9B\CE\B5\B92. The legacyExchangeDN is ect….
    02b 94B 26zF 80 95 E3 9B CE B5 B9 02
    02 b 94 B 26 z F 80 95 E3 9B CE B5 B9 02
    02 62 94 42 26 7A 46 80 95 E3 9B CE b5 B9 02

    Bu that only comes up to 15 octets, of course this is the user I need and all the other GUID are coming up correctly with 16 octets but I need to get this one restored. Does some see something I am doing wrong here?
    Thanks a bunch

  • Darn it that did not paste well, guid is
    02b\94B\26zF\80\95\E3\9B\CE\B5\B92
    Again all I can see to convert this to is 15 octets and need 16 in order to replace in adsiedit.
    Thanks,
    Brent

  • still did not paste well all right then:
    02b\94B\26zF\80\95\E3\9B\CE\B5\B92
    without slashes
    02 b 94 B 26 z F 80 95 E3 9B CE B5 B9 02
    1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

    I cant seem to get 16 octets anyone see what i am missing?

  • You’re forgetting that EVERY SINGLE CHARACTER AFTER THE FIRST TWO SHOULD BE TRANSLATED TO ASCII!!!

    the last 2 is not a 2 its the ASCII hex value of “2” – 0x32

  • msExchMailboxGuid 02b\94B\26zF\80\95\E3\9B\CE\B5\B92. The legacyExchangeDN
    Here is the GUID straight from the log: For some reason whenever I pasted this before the B9/02 converts to B92 which is not what show in the log:
    So I see this as
    02 b 94 B 26 z F 80 95 E3 9B CE B5 B9 02
    Which would convert to:
    02 62 94 42 26 7A 46 80 95 E3 9B CE B5 B9 02
    Am I still missing something there?
    Obviously missing something or it would work.
    Thanks

  • This really saved my butt. Problem is that about 1/4 of the mailboxguids shown on the exmerge log are missing the leading \ on some of these it doesn’t seem to matter, but I can’t get this one to work out to 16 groups after translation.

    SC\81E\5E\AD8o\B2\A9\E3W\FA\29Ki

    Any help would be appreciated.

    Bill

  • @Bill

    Hmm. Not come across that before. Although, given “SC” isn’t valid Hex I would try splitting it to S and C and converting them to ascii, then convert the other segments as usual.

  • That was it, thanks for the quick reply and the help

  • Excellent!!!

    That may actually be the fix for anybody else posting a msExchMailboxGuid missing a leading \ -treat the first segment as individual ascii characters to be converted to Hex.

    You have to wonder who decided that this would be a handy format to report the Guids in!

  • Treating the first segment as individual ascii characters allowed me to reconnect to the mailbox. I was also missing the leading \ and whenever I converted to hex I was only coming up with 15 groups. After treating the 1st segment as 2 ASCII characters my problem was solved. Thank you all so much for your help, cost of recovering mailbox 1hr, this thread priceless.

  • This thread save me a lot of time I had the same issue with the missing leading \…I was pulling my hair out trying to figure out why I could not get 16 groups when all of the other were. This explained why…….Very nice!

  • Hi,

    Can you help me please ?

    \E1\AC\26\8Bt\EB\10B\97\F1\EA\83\1E\81\84D goes to

    E1\AC\26\8B\74\EB\10\42\97\F1\EA\83\1E\81\84\44

    is this correct ?

    Thank you

  • Canyou convert this Please? Thank you
    \A187\F2\C2E\F6F\B6fM\3C\D69\E33

  • Sorry, I meant

    \A187\F2\C2E\F6F\B6fM\3C\D69\E33

  • Try the tool I’ve just finished writing (new post up) and see if that helps 😉

  • Hi,
    I have SBS 2003 and I deleted an user dan with his mailbox that I purged.I wanted to recover the mails from a backup.
    Everything worked smooth till the last step.
    I created a “new” user dan with a new mailbox.
    I edited with ADSI Edit the msExchMailboxGuid I want to change.After the changed takes place I have a disconnected mailbox.If I want to reconnect it to the same user
    I can’t because the user isn’t listed in “Select a new user for this mailbox” window.
    So I wanted to reconnect and then to proceed with the restore of the mailbox.
    Can you help me please ?

  • If I try to reconnect to an other user that I find in “Select a new user for this mailbox” list I receive:
    ………………….
    This legacyExchangeDN value is already being used by CN=dan,OU=SBSUsers,OU=Users…..
    Id no:c1034ad7
    Exchange System Manager

    Thank you.

  • Hi Dan,

    You use exmerge to recover the email from the Recovery Storage Group.

    You can then use exmerge again to import the email from the PST file back into an actual mailbox if required.

  • OK
    Everything is ok now. Only next time I log on, the new mailbox will be recreated with the new guid.

    Thank’s anyway.

  • My user has been migrated to 2007 and needs something restored from before the migration. I use RSG and can restore by exmerge wont work because the original mailbox is gone. I have even got far enough to move the edb and stm file to another storage group and have it mounted. I cant reconnect because it says that it already connected. I think I need to change the GUID on the mailbox to another user. Any ideas?

  • No, you can’t edit the store. You have to create a new user and set the msExchMailboxGuid property to be the same as the mailbox you want to access, then exmerge displays that mailbox as belonging to the new user.

  • nevermind – I got it. I just remapped the GUID of the of the 2k3 storage group to the 2k7 group and now housed the active mailbox. Exmerge fired right up. I didnt think it would considering the version difference.

  • thank you sooo much for spending the time in going through this, posting this and answering peoples questions.

    You rock!

  • You rock, my friend…I just restored back a long-ago-deleted mailbox with some important stuff in it for an exec. I am now viewed as a god around here. And if I’m a god, you are Zeus, King of Gods!! Thanks a ton…

  • I must be missing something obvious. In the fifth paragraph you say “Right click on the Recovery Storage Group (RSG) and select ‘Add Database to Recover’. Select the Mailbox store. Make sure that this store is not mounted (not your live store – you can leave that running)….” In my environment (SBS2003) there is only one mailbox store showing in the search results under “Select database to recover,” and the one that’s showing looks like it is my live store. And I don’t see any way of telling whether it’s mounted or not, unless the icon to the left of the store name is supposed to tell me that.

    Are you sure this step is supposed to come before recovering the store from backup? It would make more sense to me to restore the store first and then select it to add to the RSG.

  • Answered my own question. It’s OK to select the one and only mailbox store that is presented. Fizzgig, you should win some sort of award from the Bill and Melinda Gates foundation for this. And I LOVE the GUID converter tool.

  • I have a similar issue to David’s. I created the Recovery Storage Group as advised, but when I go to ‘Select Database To Recover’, I don’t see the store I need to recover. All of the other ones are there. Am I missing something?

  • Actually, nevermind. After rebooting the Exchange server and allowing it a good hour to sync up with the other Exchange servers in our organization, the option came up again. Thanks for posting this info, though!

  • To be honest I can’t remember much about mounting the store, I’ll try and remember and have a poke at our server next week, but its only running a single storage group with one mailbox store.

  • Thanks 4 this article, it really saved our ass 😉

    The GUID Converter Tool is very useful too!

  • Thank you very much for this excellent site which I had come accross a while ago and bookmarked, just saved my butt, thanks a million for all your great work. Everything is included for a full recovery from a totally ‘screwed’ and very ‘hosed’ state 🙂

  • The converter tool is not showing any results for me. I’m in a locked down environment so I’m guessing that is why.
    Could someone convert \CB\B4\84\FE\A4\A3XF\B3\B2\7Dn\DD\BCL\A8 for me and post the results? I’ve been trying to recover
    a mailbox for 4 days now.

  • Disregard my last comment. I attempted to convert it myself and I got it right the first time (pure luck I’m sure). Anyway, it worked like a charm and I got all the mail back. Thank you so much!!!

  • This information is unbelievably helpful. I’d been around the world trying to get a clean exmerge after an RSG dump from BE 11d. A lot of very, very smart MS guys missed this. On usenet my questions were basically ignored. “Call Symantec.” “Call Professional Services.” “It’s your legacyDN.” “Different SPs on Exchange.” “Different build of BE.” “Buy Ontrack.” I knew there was something up with the guid strings in the log files, but it never crossed my mind it was fixable. I thought it was corrupted from the way the backups had been done and I was stuck. So, THANK YOU so much for your work and for sharing it.

    The $10,000 question to me is: Why does this happen? What conditions have to be met for this specific problem to occur? From the paucity of docs on the issue, it evidently is very rare. Right?

  • I’ve no idea why exmerge logs guids in a format that isn’t directly compatible with AD user properties. Ok, so changing the msExchMailboxGuid property on a user account with ADSIedit probably isn’t really supported. That may be the reason its output in such an odd format.

    I’m surprised that there isn’t an option in exmerge to create dummy user accounts to match up unknown mailboxes to, that would be handy. Or even to just be able to dump orphaned mailboxes.

  • Why can’t Microsoft post something like this??? I really appreciate the effort and it resolved the problem. Kinda neat to do as well.

  • I’ll chime in here as well, very nice instructions, nice tool for converting the hex, etc. Good job.

  • You da Man! :o)

    Cheers Geeza.

Do you have anything to say?

Powered by Wordpress and Stripes Theme Entries (RSS) | Comments (RSS)