Restore Exchange 2013 Accidentally Deleted Mail Box

Good news Exchange 2013 doesn’t delete a mailbox right away.  Exchange 2013 has a retention period.  It can be restored rather quickly, just not as quickly as it took to delete it.  This covers the restore of an accidentally deleted Exchange mailbox.

  • You can attempt to restore the Active Directory Object that was deleted if you are on Windows Server 2008 R2 or newer.
  • Import-Module ActiveDirectory
    
    Get-ADObject -Filter {displayName -eq "John Doe"} -IncludeDeletedObjects | Restore-ADObject
  • Alternatively, you can try to restore the AD Object via ldp.exe https://technet.microsoft.com/en-us/library/dd379509(v=ws.10).aspx
  • If you can’t restore the AD-Object. Recreate the Active Directory user account that was deleted with the same username. (If the mailbox was deleted then the AD User object was deleted and needs to be recreated)
  • After you have restored or recreated the user account:
    • Make sure the home directory for the user account is correct in Active Directory.
    • Double check the folder security is correct for the new user account.
    • Set a default password for the user account in Active Directory.
    • Set the password to reset on next login.
    • Review and fix the Active Directory groups for the user account etc.
  • Get a list of all mail boxes and output the list to a text file in Exchange Powershell.
    • Get-MailboxDatabase | Get-MailboxStatistics | Format-List DisplayName, MailboxGuid, Database, DisconnectReason, DisconnectDate > mailboxes.txt
    • Find the mailbox guid for the user with the deleted mail box in the text file “mailboxes.txt”.
  • Make the recently deleted mailbox show up in the disconnected mailbox list
    • To run the powershell below you will need the Exchange database name and guid for the deleted mailbox.
    • Exchange Database Name can be looked up via Exchange Admin Center -> Servers -> Pencil (Edit) -> then cancel once noted or copied.
    • Enter in the mailbox database name and mailbox guid you retrieved earlier into the powershell script below.  Run the script in Exchange Powershell to get the disconnected/deleted mailbox to show up in EAC.
    • Update-StoreMailboxState -Database “Exchange Database Name” -Identity “Mailbox Guid”
  • Connect the deleted mailbox to the AD account you recreated and mark the mailbox as no longer deleted.
    • In “Exchange Admin Center” -> Recipients -> … -> Connect a Mailbox
    • EAC View Disconnected Mailboxes

      EAC View Disconnected Mailboxes

    • Click on the desired mailbox and then click on the Connect button.
    • EAC Connect Mailbox to AD Account

      EAC Connect Mailbox to AD Account

    • Wait for Active Directory to Sync (take a coffee break.)

 

  • In “Exchange Admin Center” -> Recipients -> find user that was restored
    • Edit the recipient and fix the alias to be the correct email address for the user.
    • Click on email addresses and remove any bad SMTP addresses.
  • If you recreated their account, then notify the user via phone or in person the default password for the user account and the password reset minimum requirements.

 

How to restore an Office 365 Mailbox:

https://community.spiceworks.com/how_to/137752-restore-exchange-online-soft-deleted-mailbox-to-a-shared-mailbox

Restore deleted Exchange Online mailbox in Office 365 environment | Prefix | Part 01#23

https://technet.microsoft.com/en-us/library/dn186233(v=exchg.150).aspx

 

Resources:

http://www.msexchange.org/kbase/ExchangeServerTips/ExchangeServer2013/ManagementAdministration/clean-mailboxdatabase-exchange-2013.html

https://technet.microsoft.com/en-us/library/dd379509(v=ws.10).aspx

http://www.dell.com/support/article/us/en/19/SLN156497/en

How to restore Exchange 2010 Mailbox
https://www.apticallc.com/how-to-recover-deleted-mailboxes-in-exchange-2010/

3 thoughts on “Restore Exchange 2013 Accidentally Deleted Mail Box

  1. Robert

    You saved my day!! Thanks a lot
    I used it for a shared mailbox recovery and it worked like a charm

Leave a Reply

%d bloggers like this: