A better way to recover a mailbox


Update 06/11/2015: We have now disabled the old method of recovering a mailbox (which involved using Get-RemovedMailbox and New-Mailbox –RemovedMailbox) and we no longer support the recovery of hard deleted mailboxes.

The process of recovering deleted users or mailboxes in a hybrid or cloud-only organization can be frustrating. When dealing with these scenarios, customers would sometimes end up with multiple mailboxes for a single user, find that some emails are missing, or even lose data associated with other services. Often, they would find those situations difficult to troubleshoot and they would call Microsoft support for help.

For a long time now, Exchange Online has had a capability called "soft delete" that allows a user to recover a mailbox with very little effort. Let’s take a look at how a mailbox recovery should be approached.

Scenario: User Is Accidentally Deleted Along with Their Mailbox

First, you need to know if the deleted user was managed on-premises or in the cloud.

If the user was managed in the cloud:

If the source of authority for the user is in the cloud (meaning they are not sync’d from on-premises Active Directory), you can restore the user from the Admin Portal at http://portal.office.com. Navigate to Users, and select Deleted Users. There you will see the option to restore the user.

image

If user was synchronized from on-premises AD:

If the user account was being synchronized from on-premises you should restore the user on-premises. The mailbox will automatically reconnect.

IMPORTANT NOTE: Recreating the user on-premises will not have the same effect because the Globally Unique Identifier (GUID) used in the recovery process would be different.

The proper way to restore a deleted user is documented at http://support.microsoft.com/kb/2619308. That’s it! There is no need to take any additional actions.

What If These Actions Do Not Work?

There could still be times when "soft recovery" actions will not fix the user's account. For instance, the user may have a corrupt account or the account may have been permanently deleted. Another possibility is that the user is no longer with the company, but the mailbox is used as a job-related mailbox and needs to be available to a new user. 

For these scenarios we have the New-MailboxRestoreRequest cmdlet. This allows you to merge the data from one user or archive mailbox to another user, or you can archive the active mailbox. Unlike the recovery process above (which is the best approach), New-MailboxRestoreRequest allows you to merge the data from a soft-deleted mailbox into an alternate active mailbox or archive mailbox.

Why Is This a Benefit?

Previously, if you could not recover both the user and the mailbox, you would have to perform an unsupported process of hard-deleting a mailbox. This process was unreliable and sometimes caused a ripple effect on other services such as SharePoint and Lync. If the process failed, you were left with very limited options, and ultimately had to call support.

What Do I Need To Do To Take Advantage of This New Option?

All you need to do is create a new user with a mailbox and merge the data. The way you create the user with a new mailbox will depend on if you use DirSync or the Microsoft Online Portal to create users.

1. Create the user and Mailbox.

Using DirSync:

  • Create the user and remote mailbox from the on-premises Exchange management tools.
  • Force a directory synchronization.

Not Using DirSync:

2. Run the cmdlet to merge the accounts. This is done from PowerShell connected to Exchange Online.

A) Connect PowerShell to Exchange Online. To do this, see http://technet.microsoft.com/en-us/library/jj984289(v=exchg.150).aspx

B) Run the following Command and retrieve the GUID for the soft-deleted mailbox that you want to restore: Get-Mailbox -SoftDeletedMailbox

C) Run a cmdlet similar to the following to restore the mailbox: New-MailboxRestoreRequest -SourceMailbox <GUID from Step 2B> -TargetMailbox <GUID from Step 1>

NOTE 1:  If the mailbox source and/or target is an archive, use the following switches (-SourceIsArchive and/or -TargetIsArchive)

NOTE 2: The value in Step 2C calls for the account GUIDs, but they can take other values such as an SMTP address or a UPN. The reason we recommend using GUIDs is to reduce the chances that there will be any confusion or conflict between the source and destination.

Are there limitations?

This merge capability does have some limitations. For instance, you cannot merge data from a source mailbox that is active. Let’s say you have a user (Jane) who is still licensed and using her mail. You would be unable to merge her data into Tom’s mailbox with this new approach. This new process is not meant to be used for backup and duplication purposes; this is a recovery tool only.

Another time when this tool will not work is when the mailbox is hard-deleted. If you manually remove a user account in Office 365, and then remove the user from the Recycle Bin, the mailbox would be hard-deleted. This is the potentially damaging scenario that was briefly discussed above. Again, this merge approach is for recovering soft-deleted mailboxes when the normal recovery options are not available to you.

NOTE: Unless you place the mailbox on litigation or in-place hold prior to hard-deleting the user account, there is no recovery method available to you from Exchange Online to restore the mailbox or its contents.  If you place the mailbox on hold first, it will be flagged as an inactive mailbox and the New-MailboxRestoreRequest CMDlet will be available to you.  For more information on inactive mailboxes see: Manage inactive mailboxes in Exchange Online.

Timothy Heeney

Comments (24)
  1. Anonymous says:

    Good stuff, Tim.

    What happens to the soft deleted mailbox after the New-MailboxRestoreRequest cmdlet is run? Is it empty? Could it be merged again to another mailbox?

  2. Anonymous says:

    Great article. Any additional notes you can provide around restore options for "inactive mailboxes" (mailboxes on litigation hold or IPH where the user has since been deleted)?

  3. Anonymous says:

    @jpalarchio – The approach documented in this blog will work for inactive mailboxes as well. Inactive Mailboxes should show up in a similar way that soft deleted mailboxes do.

  4. Anonymous says:

    I may be wrong on this but I’m pretty sure that having the AD Recycle Bin enabled stopped DirSync from being able to preform the sync – at least that was the impression i got when using OnRamp for my test environment

  5. Anonymous says:

    @Jeff – sorry for the delay I had to test it to verify, You can only perform the restore using the MailboxRstoreRequest cmdlet to one mailbox, subsequent restore request of the same soft deleted mailbox to other active mailboxes fail

  6. Anonymous says:

    The "new" Approach provides a much better/easier way to recover mailboxes. Thanks.

  7. Anonymous says:

    Exchange edb repair software is capable to instantly restore mailbox from corrupt exchange server database public folder. The software easily fix exchange server corruption issue and convert corrupt edb to pst format.
    http://www.edb2pst.net/

  8. Anonymous says:

    EDB recovery software is an advance and effective third party software, it can easily restore mailbox folders- Inbox, Outbox, Sent items, Journals, Notes, Task, Draft etc. The software can fix edb files error and database corruption issue.
    http://www.exchangeserver.recoveryfiles.org/

  9. Anonymous says:

    To repair inaccessible exchange server mailbox you can use Eseutil and Isinteg, It provide soft and hard database recovery, If you want to use third party software then try edb repair software.
    http://www.edbtoliveexchange.edbpst.net

  10. Anonymous says:

    Hi, nice write. Glad you are recommending this as I work exactly that way already :-) But maybe allow me to suggest a vital enhancement: In order to restore the deleted mailbox so that users won´t recognize that there is a new mailbox acting as the old
    one: Do not only takeover the SMTP address(es), also take over the "old" LegacyExchangeDN as X400 Alias address to the new mailbox (leave that LegacyDN as is). This will suppress NDR messages when other users who wrote to that deleted mailbox before and/or
    have that mailbox in their contacts folder.

  11. Anonymous says:

    Is this command available to all tenants in Office 365? I am global admin with Organization Management role however I could not run the command New-MailboxRestoreRequest : The term ‘New-MailboxRestoreRequest’ is not recognized as the name of a cmdlet,
    function

  12. Tairan Huang says:

    Thanks for the info, so what is the solution if the mailbox is hard-deleted AND the method involving "New-Mailbox –RemovedMailbox" is not available?

  13. Bob says:

    What if the source mailbox had LitigationHold or InPlace Hold enabled ?
    What about RMS protected messages ?

  14. @jpalarchio when you have an inactive mailbox it will essentially be in a soft deleted state meaning the steps similar to what is documented in this post will work for recovering the data

  15. Jesper Ståhle says:

    This is great! One issue that often occurs as part of accidental deletions is that NDRs start to surface because other users have the deleted users legacyExchangeDN address in their Outlook NK2 file, so sending with autocomplete attempts a delivery to
    the non-existing recipient. Would be great to see documented guidelines on that as well as part of this updated approach. Thanks!

  16. Devin L. Ganger says:

    Is this New-MailboxRestoreRequest going to perform the proper write-backs to the on-premises MailUser object and correctly tag it as a RemoteMailboxUser, or do we still need to run Enable-RemoteMailbox ourselves?

  17. Taylor says:

    Thanks for the information, but what is the solution when the mailbox is hard deleted and Get-RemovedMailbox is disabled?

  18. Robert Smith says:

    You can utilize inbuilt utility to repair Exchange EDB file. But inbuilt utility can only be work in minor corruption. If your Exchange EDB file is highly corrupted then you have to utilize a third party tool "Exchange EDB Repair Software" can easily repair
    your corrupted, damaged, deleted, inaccessible etc EDB files. Try its DEMO Version from here: –
    http://www.outlookemails.net/repair/edb/

  19. Moosa says:

    Kindly help me to get the Back up my Mail Data from Outlook.com because i unable to access my Domain/Admin page where we can ADD/DELETE the mail ID. Thanks in Advance for your kind assistance. Awaiting your reply soon. Thanks, Moosa

  20. Moosa says:

    Pls help to migrate my Mails from Outlook to Yahoo which are under single domain name.

  21. frvallet says:

    Thanks Tim, good article.
    My2cents
    – It didn’t failed when I have tried to merge the same soft deleted mailbox to another mailbox
    – You must add -AllowLegacyDNMismatch if you merge to a new account

  22. Tairan Huang says:

    Why is my question being filtered? Is that so scary for you to approve

  23. Vignesh says:

    Is this commandlet available to all the tenants in Office 365?
    New-MailboxRestoreRequest : The term ‘New-MailboxRestoreRequest’ is not recognized as the name of a cmdlet, function. I am a global admin with Organization Management permission.

  24. Joseph Crain says:

    Unfortunately this change stepped on a an important process for our Hybrid environment. We use Get-RemovedMailbox and New-Mailbox -RemovedMailbox in order to mimic the on-prem behavior of reattaching a disconnected mailbox to another user. We sometimes
    have identity provisioning conflicts and other issues arise where this function is invaluable. Having to merge mailboxes rather than just reattaching them is less desirable in these cases. Does the exchange online team have any plans to allow a soft deleted
    mailbox to just be ‘attached’ to another user rather than merged? Either that or return some similar functionality like Get-RemovedMailbox? How are we to deal with mailboxes that are removed after a Remove-MSOLUser -RemoveFromReycleBin?

Comments are closed.