SolutionBase: Recovering mailboxes on an Exchange Server

E-mail is one of the most important functions on a network. If your Exchange Server crashes, you'll need a strategy to recover it. These tips will help.

Several years ago, I had a job supporting several Exchange Servers for the military. One afternoon, I received a phone call from someone saying that one of the generals had accidentally deleted all of his messages from his Exchange mailbox. Normally, you can just drag the messages from Outlook's Deleted Items folder back to the Inbox. The general, however, had been out of the country for several months, and the retention time for the deleted items had expired.

At that point in my career, I was still learning my way around Exchange Server and had never restored an Exchange mailbox before. When they told me that I'd have to set up a dedicated server, restore the databases, export the general's messages to a PST file, and then import them into the private information store, I thought they were joking. As it turns out, though, I learned a hard lesson that day. Restoring individual mailboxes in Exchange is a real pain.

At the time of the incident, the current version of Exchange was 4.0. A lot of years have passed since then, and a few versions of Exchange have come and gone. Now Microsoft has made it a lot easier to recover individual mailboxes. Exchange Server 2003 contains two mechanisms designed to help you recover individual mailboxes without needing a separate server: the Mailbox Recovery Center and the Recovery Storage Group. In this article, I'll show you how both of these new features work.

The Mailbox Recovery Center

You can use the Mailbox Recovery Center when a mailbox is accidentally deleted or when a mailbox becomes disassociated with a user account. For instance, when an employee leaves a company, his or her mailbox is usually deleted. The employee's replacement, however, may need a copy of the messages that were in that mailbox. In the past, this would mean performing a very time-consuming restore process. But if you're running Exchange Server 2003, you can use the Mailbox Recovery Center to recover the deleted mailbox.

When a mailbox is deleted, it's not actually removed from the server. Instead, the mailbox is retained in a special location for 30 days. If the mailbox needs to be restored during that period, you can simply link the deleted mailbox to the user account of your choice. You must keep in mind that each user account can be linked to only a single Exchange mailbox.

To see how the Mailbox Recovery Center works, go into the Active Directory Users and Computers console and create a user account and a corresponding Exchange mailbox. While you're waiting for the next replication cycle to complete, go ahead and send several test messages to the mailbox you just created. This step is important, because a glitch in Exchange sometimes causes new mailboxes to not be displayed in the System Manager until those mailboxes receive at least one message.

When you can verify that the new account has been replicated to all of the other domain controllers in the domain, it's time to delete the mailbox. You could delete the entire account, but for demonstration purposes, we'll just delete the mailbox. Right-click on the account in Active Directory Users and Computers, and select the Exchange Tasks command from the resulting shortcut menu. The Exchange Tasks Wizard will then appear. If Exchange Tasks is not an option on your domain controller, it's because you haven't installed the Exchange System Manager onto that server.

In the Exchange Tasks Wizard, click Next, select the Delete Mailbox command, and click Next again. You'll now see a warning message indicating that the mailbox and its contents are about to be deleted. Click Next and say goodbye to the mailbox. Click Finish to complete the deletion.

Now you need to make sure that the Exchange System Manager recognizes that the mailbox has been deleted. Open the Exchange System Manager and navigate through the console tree to Administrative Groups | your administrative group | Servers | your server | First Storage Group | Mailbox Store | Mailboxes. Right-click on the Mailboxes container, and select the Run Cleanup Agent command from the resulting shortcut menu. You should see a red circle with an X in it next to the deleted mailbox, as shown in Figure A.

Figure A

User8's mailbox has been deleted, as indicated by the red X.

The fact that the red X icon is displayed next to the mailbox indicates that the mailbox is not actually gone. If the mailbox had actually been deleted, it simply would not appear on the mailbox list at all.

Now imagine that a week has passed and someone tells you that you need to restore the mailbox from backup. Actually, you don't have to restore the mailbox from backup because it hasn't been deleted yet. Instead, all you have to do is connect the mailbox to a user account. If this were a real-life situation, the easiest thing to do would be to right-click the mailbox and select the Reconnect command from the resulting shortcut menu. Doing so would launch a wizard that walked you through the task of connecting the mailbox to a user account.

For the purposes of this article, however, I want to show you how to reconnect the mailbox by using the Mailbox Recovery Center. Reconnecting a mailbox in the way I just described is easy if you're reconnecting a single mailbox. However, if you have multiple mailboxes to reconnect, using the Mailbox Recovery Center is better because it can do a bulk reconnect.

To reconnect mailboxes, navigate through the System Manager to Tools | Mailbox Recovery Center. Right-click on the Mailbox Recovery Center container, and select the Add Mailbox Store command from the resulting shortcut menu. You'll now see a list of every mailbox store in your entire Exchange organization. Select the mailbox store that contains the deleted mailboxes and click Add, followed by OK. In the right pane, System Manager will display the deleted mailboxes within the store, as shown in Figure B.

Figure B

The deleted mailboxes in the store are displayed in the Mailbox Recovery Center.

Right-click the mailbox you want to recover (you can select multiple mailboxes), and select the Find Match command from the resulting shortcut menu. Windows will launch the Exchange Mailbox Matching Wizard. Click Next to bypass the wizard's welcome screen. The wizard will now try to figure out which user account the mailbox belongs to. Usually, the wizard will find the match with no problem. However, if the account the mailbox belonged to has been deleted, or if multiple accounts are detected that the mailbox could potentially belong to, the matching process will fail.

For example, I'm trying to reconnect a mailbox named User8. I have accounts named User8 in multiple domains. Rather than picking a domain at random and linking the mailbox with it, System Manager will tell me that a conflict exists, as shown in Figure C. To get around this problem, right-click the mailbox and select the Resolve Conflicts command from the shortcut menu. This will launch the Exchange Mailbox Conflict Resolution Wizard, which you can use to specify the account the mailbox belongs to.

Figure C

System Manager has detected multiple user accounts that the mailbox could potentially belong to.

Now that you've matched the mailbox to a user, the only thing left to do is reconnect the mailbox. Simply right-click on the mailbox and select the Reconnect command from the menu. Windows will now launch the Exchange Mailbox Reconnect Wizard, which will reconnect the mailbox for you.

The Recovery Storage Group

Obviously, being able to reconnect a mailbox to a user account is a very handy feature. If it's been more than 30 days since the mailbox was deleted, however, the downside is that the mailbox is gone for good and must be restored from backup.

Previous versions of Exchange Server made it very difficult to restore an individual mailbox. You actually had to set up a recovery server and restore your entire information store to that server. You could then log on as the user whose mailbox was deleted, open Outlook, and export the contents of the mailbox to a PST file. You'd have to create a mailbox for the user on the main server and import the contents of the PST file into the user's mailbox. Depending on the size of the information store, this could be an all-day operation. You also needed a spare server and an extra Exchange Server license for the recovery server.

In Exchange Server 2003, the process of restoring a mailbox has improved considerably. You no longer need a spare server or an extra Exchange Server license. What you do need, however, is a lot of extra disk space on your Exchange Server.

As you may know, Exchange Server 2003 allows a server to contain multiple information stores. Restoring a single mailbox requires that you create a special type of information store called a Recovery Storage Group. You must then restore your backup of the information store to the Recovery Storage Group. From there, you can either copy the deleted mailbox from the Group to the information store, or you can merge the messages in the Group into the information store (for one or multiple mailboxes). The Recovery Storage Group is very similar to any other storage group except that it can't send or receive messages.

Before you attempt the following technique, I highly recommend installing Exchange Server 2003 Service Pack 1. This service pack lets you interact with the Recovery Storage Group through the System Manager. Prior to this service pack, the only way to interact with the Recovery Storage Group was through the ExMerge utility. You also must assign yourself Receive As permissions to the mailbox that you're restoring. Otherwise, the restoration will fail.

Now that you know the prerequisites, open the Exchange System Manager and navigate to Administrative Groups | your administrative group | Servers | your server. Right-click on the container for your server, and select the New | Recovery Storage Group commands from the resulting shortcut menus. You'll then see the Recovery Storage Group properties sheet.

As I explained earlier, you'll restore the entire information store to the Recovery Storage Group. This properties sheet gives you the chance to specify the system path location and the transaction log location. You can use any location you want, but make sure that it has enough free disk space to restore the information store and/or transaction logs. Click OK to create the Recovery Storage Group.

Right-click on the Recovery Storage Group and select the Add Database To Recover command from the resulting menu. When prompted, select the mailbox store that you plan on associating with the Recovery Storage Group and click OK. After a few moments, you'll see a properties sheet detailing how the selected store is now associated with the Recovery Storage Group. Click OK to return to the System Manager. The Recovery Storage Group will now contain a mailbox store. You should avoid mounting this store for the time being because doing so will create checkpoint files that will cause problems later on.

Now, use NTBackup (or any other Exchange-aware backup software) to restore your backup. You must restore only the mailboxes. Don't attempt to restore the log files or the public folders. If you're using NTBackup, make sure you specify the Last Restore Set option so that log file replay will occur after the restoration. When the restore operation completes, mount the mailbox store found within the Recovery Storage Group. When the restore operation runs, the restored information store will be redirected to the Recovery Storage Group, meaning that the restore will not affect the information store.

When the restore completes, mount the database in the Recovery Storage Group. Initially, the database will appear empty. Right-click on it and click Refresh. The Recovery Storage Group will be populated with the mailboxes that you've restored.

The last step in the process is to recover the desired mailbox. Locate it within the Recovery Storage Group's list of mailboxes. Right-click on the mailbox and select the Exchange Tasks option from the shortcut menu. When the Exchange Tasks Wizard starts, click Next, select the Recover Mailbox Data option, and click Next again.

Verify the destination mailbox store and click Next again. You must now decide whether you want to merge the restored data into the user's current mailbox or if you'd rather copy the contents of the restored mailbox on top of the user's existing mailbox. Make your selection and click Next. You'll now be prompted to enter a date and time for which you want to run the recovery operation. Click Next to restore the mailbox, and then click Finish to complete the operation.