Recovering ‘Deleted Mailbox’ with NMM
This article covers the scenario of recovering a ‘deleted’ mailbox from NMM. The procedure documented in this article applies both to NMM 8 and NMM 9. Exchange server 2010 is used in this demo.
Before I cover this procedure in NMM, below is background on how the need for this restore may arise.
In Exchange 2010 a user mailbox can either be ‘Removed’ or ‘Disabled’.
Difference between ‘Remove’ and Disable’ mailbox choice in EMC:
Disable: Will remove the Exchange attributes from the user account but will leave the user account in Active Directory. The mailbox for the user will still exists on the mailbox database and it gets purged when the retention time elapses (default of 30 days)
Remove: Remove will remove both the user mailbox and user account from Active directory. The mailbox will still be there on the mailbox database till the retention time has elapses.
If the mailbox was either ‘deleted’ or ‘removed’ (for some reason, like employee leaving a company), there may be a need to restore this mailbox in future. If the deleted mailbox retention time has not expired, it could be recovered as below:
- If the mailbox was ‘Disabled’. This mailbox will show in the ‘Exchange Management Console’ under ‘Disconnected Mailbox’ as shown below:
a.
b. To recover this mailbox, Right click the mailbox and select ‘Connect…’
c. Select ‘User Mailbox’ , then ‘Next’
d. Click ‘Browse’ Under ‘matching user’ and then select the user to connect this mailbox to
e. Provide the ‘Alias’, then select ‘next’
f. Review Summary and select ‘Connect’
g. Review and select ‘Finish’. This will ‘reconnect’ the disconnected mailbox to the user in Active directory.
2. If the mailbox was ‘removed’ and is still within the retention period, create a new ‘user’ in Active Directory with the same name as the original user and then follow the above steps to ‘connect’ the user to the mailbox on the database.
The following exchange shell command is useful to get a list of ‘Disabled’ or ‘Removed’ mailbox users that are still within the retention period:
Get-MailboxDatabase | Get-MailboxStatistics | where {$_.DisconnectReason -ne $null} | ft displayname,database,disconnectreason,*guid*,*server* -auto
DisplayName Database DisconnectReason MailboxGuid ServerName OriginatingServer
———– ——– —————- ———– ———- —————–
charlu carydb3 Disabled 3f91bda9-453c-4752-8b88-423d2f4ccc53 APPHOST1 apphost1.spring.local
Once the retention period expires and the mailbox is purged from the database, it will not show up in the above output.
Once the mailbox data is purged from the mailbox database, if a restore is required after the retention period, then you would need to depend on your backups for restore.
Restoring a deleted mailbox using NMM:
I have used NMM 8.2.4 to demo this procedure. It likely will work as is, with NMM 8.2.3 or NMM 8.2.2. Also the same procedure applies to NMM 9. The first step in performing mailbox restore of mailbox (deleted or otherwise) is to perform GLR or restore to RDB. Refer to the post https://community.emc.com/people/fpinto/blog/2018/05/14/recovering-exchange-data-with-nmm-8
- Once the initial phase of GLR or RDB restore is complete, the mailboxes can be browsed from NMM GUI:
2. When you click the ‘deleted’ mailbox it generates this error message (shown below). Note, because there is no user associated with this mailbox or the associated user has its mailbox properties removed, MAPI is not able to show the contents of this mailbox. You can only recover the ‘Entire’ mailbox and not individual folders or mail items within it.
3. Acknowledge the message window by click ‘ok’. When you switch to the ‘Monitor’ tab, you will notice the same message there:
Selecting Exchange RDB view
Mailbox SystemMailbox{18d1f726-3cd7-48cd-8983-12ec40779e8b} is a ArbitrationMailbox and is not browsable nor can it be recovered.
Error getting item list: Error browsing folders — Failed to fetch mailbox items. Please see libmapibrowse.raw for more information. [exch_get_mbx_list].
Error browsing folders — Failed to fetch mailbox items. Please see libmapibrowse.raw for more information. [exch_get_mbx_list].
4. Select the mailbox for ‘restore’. Once you select the mailbox for restore, there are 2 types of restores that can be done:
- Restore the mailbox to itself
If you want to restore the mailbox to itself, create the mailbox with the same name (you would do this before you do the restore with NMM. You can do this with Exchange Management Console or Exchange powershell and then come back to the NMM GUI and select ‘Recover..’ as shown below:
(Note: If you have disabled the mailbox, connect the mailbox shown under ‘Disconnected Mailbox in EMC to the original user. If the mailbox was removed, then connect, under ‘Disconnected mailbox’ to a new mailbox and a new AD user with the same name. If the mailbox was deleted from the database, due expiry of retention time or the mailbox was manually deleted from the database, using the ‘remove-storemailbox’, then create a new user and new mailbox with the same name and proceed with the restore. In all variations of deletions, the mailbox can be restored to the original mailbox name)
b. Restore the mailbox to another mailbox. (Alternate mailbox)
To restore this mailbox to another mailbox, you would choose ‘Advance Recover..’. Then in the ‘Select Alternate Mailbox User’ box, specify the user to which you want to restore to and click ‘Search’ to locate the user. Then select this user and click ‘Next’
Here we are performing the restore to an alternate mailbox ‘Andy’ and ‘Start Restore’
5. When the restore is complete, switch to the ‘Monitor’ tab to check on the progress.
6. Verify the restore by logging into the mailbox of the target user, in our case ‘Andy’ :
Restore using Exchange PowerShell:
This mailbox restore can also be done using Exchange Powershell:
- First get the GLR database name:
Get-mailboxdatabase
b. Issue the new-mailboxrestorerequest command:
new-mailboxrestorerequest -sourcedatabase GLR20180516163434 -sourcestoremailbox “charlu” -targetmailbox “Andy” -TargetRootFolder Restore201805161717 –AllowLegacyDNMismatch
Summary:
This article covered the procedure involved in restoring a deleted mailbox from NMM 8.2.4 backups. The procedure also applies to NMM 9. Key point to remember is that the deleted mailbox cannot be browsed for individual mail items recovery from the NMM GUI. The entire mailbox can be recovered from NMM GUI or using powershell. Powershell command can be further refined to recover individual folders within the mailbox if desired.