If you have deleted a user then when we try to sync it will obviously fail. By default when we fail to sync a users archive 14 times in a row we will mark that mailbox as being deleted. We do this in the exchangemailboxentry table by changing the LegacyMbxDN field to Marked @ date/time.
So you could run a SQL script stating:-
select * from exchangemailboxentry where legacymbxDN LIKE '%marked%'
But you may have some whose user has been deleted but have not hit the 14 times failure so the mailbox will not be marked.
This default value can be changed but would not really recommend it as you may have some sync problems for whatever reason and mailboxes will start gettinbg marked as deleted if you set this too low.
The registry key that determines this is:-
|
Location
|
HKEY_LOCAL_MACHINE
\SOFTWARE
\KVS
\Enterprise Vault
\Agents
|
|
Content
|
DWORD
An integer value specifying a number of days.
|
|
Description
|
If a mailbox synchronize is unable to locate a mailbox that previously existed, it logs an entry in the event log. After 14 days of failing to find the mailbox it marks the mailbox as having been deleted.
MarkAsDeletedAfterXDays enables you to specify a length of time, other than 14 days, that must elapse before a mailbox is marked as having been deleted
|
The second way of doing this is if you are setting the billing account as if the user cannot be found that this field changes to the SID and states account unknown.
So in the VAC within the archives section you could sort on Bill usage to and then take a screenshot
