Wednesday, 10 October 2012

Deleted Item Recovery and Deleted Mailbox Recovery

This article describes how to use the Deleted Item Retension and Deleted Mailbox Retension feature in Exchange 2000.

How to Minimize the Need to Restore

There are many reasons why you may need to restore your Exchange 2000 databases, however, restoring an Exchange 2000 database is not really the thing you want to be doing at 2pm on a Wednesday afternoon.
Two possible reasons for having to restore an Exchange 2000 database are:
  • A user deletes an important email
  • An administrator deletes the wrong mailbox
With a little bit of upfront planning there maybe no need to restore your Exchange database to resolve the two issues listed above. Exchange 2000 has the ability to keep both deleted mailbox items and deleted mailboxes for a set period of time. In this article we will look at how both of these features are implemented and how we can use them.

Deleted Item Recovery

The “Deleted Item Recovery” feature with Exchange 2000 enables your users to recover deleted items, even after they have removed them from the “Deleted Items” folder in Outlook.
“Deleted Item Recovery” is not enabled by default in Exchange, so the first thing we need to do is turn it on. “Deleted Item Recovery” is enabled at the Information Store level:
1. Open “Exchange System Manager”
2. Open the Properties for the Store that you would like to enable “Deleted Item Recovery” on.
3. Go to the Limits tab, and you will see the option “Keep deleted items for (days)”, we will enter the number of days that we want Exchange to retain deleted items in this box. Now, we need to consider the length of time we enter in this box, obviously the longer we keep deleted items the more space it’s going to use but we would have a better chance of recovering deleted items. The shorter we keep them the less space is used but we are limiting our ability to recover deleted items. This really is your call, for this example we are going to keep deleted items for a period of 35 days.
4. There is also a checkbox “Do not permanently delete mailboxes and items until the store has been backed up”. This option would override the 35 days, so if we don’t do a backup for 60 days, there would be 60 days worth of deleted items. When we perform the backup, anything older the 35 days will be purged.
In my experience it takes 10–15 minutes for the “Deleted Item Retention” settings to take effect (coffee break!).
So once we have enabled “Deleted Item Recovery”, our users can delete items which they will be able to recover if they need to.

Recovering Deleted Items


So, when the VP of your company calls you and say’s they deleted an important email yesterday and need to get it back for a meeting in 10 minutes, you do not have to run around the room screaming because you have “Deleted Item Recovery” enabled. The steps to recover the item are simple. This would need to be done by the user logged into Outlook.
1. Click on the “Deleted Items Folder”
2. Go to the Tools menu and select “Recover Deleted Item”

3. The “Recover Deleted Items From” dialogue box will now appear

4. Highlight the item(s) that you would like to recover and click on the “Recover Select Items” button .
The item will then be placed back into the “Deleted Items” folder and you can drag and drop it into another folder of your choice.
So, we have now looked at how we can enable “Deleted Item Retention” for a Store and how we can have a user recover a deleted item.
Now, one day a user calls you in a panic because they deleted an item from their mailbox by mistake. The user has to go into “Recover Deleted Items” but it does not show up. Upon further investigation you find out that they held down the SHIFT key whilst deleting the message. This will cause Outlook to bypass the “Deleted Items” folder and consequently it will not go into the “Deleted Item Recovery” folder. Therefore, what can be done now to recover the deleted item?
In the above scenario, there is not a lot you can do at this point apart from restore that user’s mailbox to a different server and use EXMERGE to extract the message they deleted. This is going to take a considerable amount of time and you will need a spare server to do the restore on.
Microsoft has a Knowledgebase article that explains how to set the DumpsterAlwaysOn attribute in the Registry. This will ensure that all items are placed into the “Deleted Item Recover Folder”. Here is the link to the Microsoft Knowledgebase article:;en-us;178630
Now, let’s move on and look at how we can recover deleted Mailboxes.
By default, Exchange 2000 retains deleted mailboxes for a period of 30 days, but you can increase or decrease it as you see fit. To modify the “Deleted Mailbox Retention” period:
1. Open the Properties for the Mailbox Store in “Exchange System Manager”
2. Go to the Limits tab and you will see the option “Keep deleted mailboxes for”. Here you can enter a suitable number of days in this box.

We have been asked to delete a user account in “Active Directory” and also remove the users’ mailbox, so we complete the task as instructed. The user we deleted was Fred Smith! Three days later the HR department contact us and say that Fred was rehired and can he have all his old mail back? Here’s a little tip for you, don’t make this look too easy or they will wonder why your being paid “big bucks”!
1. Open the “Exchange System Manager”
2. Expand the Store that contained the Mailbox of the users’ account you had deleted
3. Click on the Mailbox container
4. In the right hand pane of the screen you will see a list of all the mailboxes in the Store

5. Notice that Fred’s account is still listed in the Mailbox Store. If we right click over Fred’s mailbox, you will notice two options on the menu (both grayed out at this point): Reconnect and Purge.

What we need to do is Reconnect Fred’s mailbox to a new “Active Directory Account”. Before we can do this, however, we have to run the “Exchange Cleanup Agent” and then recreate an “Active Directory Account”. To run the “Exchange Cleanup Agent”:
1. Right click over the Mailboxes container in the Store that the deleted mailbox exists in
2. Select Run Cleanup Agent from the menu.

Once the “Cleanup Agent” is complete, you will notice that the mailboxes with no corresponding “Active Directory” accounts will have a red X next to them. If you want to remove the mailbox completely you can right click over it and select Purge, this will remove the mailbox completely from your system and you will be unable to recover it.
We do not want to Purge the mailbox we want to Reconnect it, but before we can Reconnect the mailbox we need to create a new user account in “AD”. When you create the new account in “Active Directory Users and Computers” it is important to make sure you do not create a mailbox for the new account, so when prompted to create a mailbox ensure you clear the checkbox:

Now that we have created the new account, we can go ahead and reconnect the mailbox to the new account. It may take 10–15 minutes for the new account to register with your “Global Catalog” server so you might want to go and grab another coffee and then come back.
1. In “Exchange System Manager”, expand the Mailbox Store that contains the deleted mailbox
2. Click on the Mailbox container, and right click the deleted mailbox in the right-hand pain (the one with the red X)
3. Select Reconnect from the menu
4. In the “Select a new user for this mailbox” dialogue box, select the account that you want to associate with this mailbox and click OK

5. You should then get a dialog box informing you that the operation completed successfully, click OK
6. A second dialogue box may appear informing you that the object has not yet been replicated; you can click OK to this message
7. Give it 10–15 minutes (grab yet another coffee) and run the “Mailbox Cleanup Agent” again. Once the agent has completed, the red X next to the deleted mailbox should disappear, the mailbox has now been reconnected!

By implementing “Deleted Item Retention” and “Deleted Mailbox Retention” you should be able to save yourself the pain of having to do a restore from backup.
On a final note, you may want to keep checking your performance monitor from time to time to see how much information is being kept in the deleted items. Here’s how you can do it.
1. Open the “Windows 2000 Performance” monitor (Administrative tools > Performance)
2. On the Toolbar select the View Report button
3. Right click in the grey portion of the screen and select Add Counters from the menu
4. The “Add Counters” dialogue box will now be displayed. You can select the computer you would like to monitor and you can select the “Performance Object” you would like to add to your report
5. In the “Performance Object” drop down list select MSExchangeIS Mailbox
6. In the “Select Counters from list” you can select the “Total Size of Recoverable Items” and/or “Total Count of Recoverable Items”
7. If you only want to monitor these counters for a certain Mailbox Store you can use the “Instances” list to select the Store you are interested in. If you want the total for all the Stores leave it set to _Total.

Well, that’s about it folk’s until next time. I hope this article provides you with some useful information and saves you some time.