MS-Exchange 2007 restore error

[mohammad_yaseen]

Kindly note we are trying to restore MS-exchange 2007 deleted mail account the needed data is from 2013 to 2015, our mail exhcange admin have re-created the account and we've tried to run the restore and we got many errors please check sample of the errors below:

WRN - MBOX:OpenCurMbox can't find e-mail addr firstname.lastname [firstname.lastname]
ERR - unable to create object for restore: Microsoft Exchange Mailboxes:\firstname.lastname [firstname.lastname]\Top of Information Store\Inbox\new.xls <00000000A3DCB1CA8CC61D4097548AE07B537F2E07005CEAD6DD0F890C42830BBB0EFD5553E100000008105D000081B3B76965A3C8419BC71A554F6E7190000CFC4BBBB60000> (BEDS 0xE0008488: Access is denied.)

[manatee]

when you say "our mail exhcange admin have recredted the account" what exactly was done?

[Thiago_Ribeiro]

Hi @mohammad_yaseen,

Other question, is this restore already worked before? If yes what changed in your environment?

If not, did you follow all the requirements for this restore? From what I understand, is a GRT restore right?

Thiago

[mohammad_yaseen]

Hello rino19ny:

What I mean that this account was deleted from the exchange after employee resegnation, and we needed his email data later on, so our exchange admin has re-created the mail account on exchange server, in order to restore the mails to this account, I hope I made myself clear

[mohammad_yaseen]

Dear Thiago

Please note this the first time we do the restore on this account, but it was done before successfully on other accounts, but the difference is these accounts have not been deleted before, and No the GRT is not enabled

thanks

[mohammad_yaseen]

Please check the screenshots of mail backup policy

[Marianne]

In what state is the recreated mailbox account?

I am not an Exchange expert, but on Google I find references to inactive, hidden, disabled, enabled, etc.

[mohammad_yaseen]

Hello @Marianne

Kindly note it's a new account with enabled state

Thanks

[Thiago_Ribeiro]

Hi,

OK, thanks for clarify. This "new" account have the same permissions that other accounts that were deleted?

[mohammad_yaseen]

Hi @Thiago_Ribeiro

Yes it does have the same permissions, noting that we've tried to send mail to the newly created account and it was delivered

[Marianne]

Any possibility that the original mailbox was on a different Information Store / database?

It might be a good idea to follow the steps for a redirected restore.
https://www.veritas.com/content/support/en_US/doc/123726044-127283846-0/id-SF930531851-127283846

Have you tried that?

[Thiago_Ribeiro]

Hi,

@mohammad_yaseen you said in a previous post that is not GRT restore, but I understood that is....Because of that message error that you posted before..

@Marianne Is this your understanding?

There is a privileges on local machine, did you check?

Requirements for any Exchange granular clients that are mailbox servers

Each Exchange granular client that is a mailbox server requires configuration of
the following:

■ The NFS client is installed. It also must have an unassigned drive letter for NetBackup to use to mount an NFS view of the backup image.

■ An account for NetBackup Exchange operations (unique mailbox for NetBackup). This account must have the right to “Replace a process level token.”

■ The Exchange credentials in the Exchange client host properties. Use the credentials of the account for NetBackup Exchange operations. Alternatively for Exchange 2013 and 2016, you can add “Exchange Servers” to
the “View-Only Organization Management” role group.

■ (Exchange 2010 and 2007) If you configure the NetBackup Client Service with a logon account and configure the Exchange credentials in the Exchange client host properties, you must configure the “Replace a process level token” for both users.

About Exchange backups and Granular Recovery Technology (GRT)

■ Mapping of Exchange hosts.
For virtual environments you need to create a map of the virtual names and physical names of the systems in the Exchange configuration. The Distributed Application Restore Mapping includes any NetBackup client that performs a
backup, mounts the backup image, or initiates a restore operation. This configuration is included in the master server host properties. If you use a proxy server and it is not a media or a master server, you also need
to add the proxy server to this list.

■ The client(s) must have the same version of Windows as the client from which the backup is made.

■ If you use an Exchange granular proxy server, the mailbox servers and the proxy host must also meet the following additional requirements:
■ Have the same NetBackup version
■ Use the same NetBackup master server
■ Both use a Windows version that is supported for that version of Exchange

For example, for Exchange 2010, the granular proxy host must be installed on Windows 2008 SP2 or R2 or on Windows 2012. See the Application/Database Agent Compatibility List for more information.
Requirements for a granular client that is an off-host client An off-host client requires configuration of the following:

■ The off-host client must have the NFS client installed. It also must have an unassigned drive letter for NetBackup to use to mount an NFS view of the backup
image.

■ Mapping of the primary client name and the off-host computer name. Perform this configuration in the Distributed Application Restore Mapping in the master server host properties.

■ The NetBackup client that performs the restore must have the same version of Windows as the off-host client from which the backup is made.

Thiago

[Marianne]

Hi @Thiago_Ribeiro 
The way that backups are configured in this case is old-fashioned MAPI method and is explained in NBU for Exchange manual under this topic:

Configuring MAPI mailbox and public folder operations (Exchange 2007)

This type of configuration needs 2 separate policies - one for Information Store(s) and another for Mailboxes.
No idea why this method is still being used since Exch2007 also supports GRT.

[Lowell_Palecek · Accepted solution]

Look in the NetBackup\logs\BEDS folder on the client (Exchange server) for a log with nbremsrv or similar in its name. The module nbremsrv.exe is a 32-bit app that NetBackup uses to make MAPI calls.

When you find this log, do the logons succeed? There are two levels of logon. Nbremsrv intializes MAPI as the account under which it's running. Then it logs onto the account of the target user.

You can test this connectivity outside of NetBackup, with tools from Microsoft, such as Test-MAPIConnectivity and MFCMAPI.

Possible reasons for the logon to fail:

- The NetBackup account lacks permission.
- The NetBackup account doesn't have an associated mailbox.
- The Exchange configuration of the target account blocks it.
- It's true that the target account doesn't exist.
- CDO MAPI is not installed on the Exchange server.
- Outlook (or other mail program that preempts CDO MAPI) is installed on the Exchange server.

Other readers note: the foregoing applies only to Exchange 2007. NetBackup does not use MAPI with later versions of Exchange. Also, Outlook does not interfere with NetBackup GRT for later versions of Exchange.

What version of NetBackup are you running?

[manatee · Accepted solution]

ok. i only did this once, a long time ago, and one thing you should've have done is create a fresh AD account for the deleted user. because doing so it would use a new SID number. your admins should've first restored the deleted AD account, then restored the mailbox (inplace or redirected restore).

[mohammad_yaseen]

Dear All,

Thanks a lot for your support

The restore's done successsfully as below:

1. After creating the mail account, we provide it with old pemissions of the old account, besidetge infostore and SID

2. We gave the domain user (Windows user) that is used to take backup full permissions on newly created mail account

3. We ran the restore process normally

[mohammad_yaseen]

One more thing

Before the restore finished successfully, it was failed with a strange behaviour, in the logs we found that the old backup domain user (Windows user) appeared in the logs giving the message "domain user must be unique with at least 6 characters", so in order to finish the restore we've removed the old account and the restore finished successfully, honestly we don't now why we got this message, noting that this account is too old and we didn't use it, below you can find and example of our accounts

old backup user: user123

new backup user:user1234

[Lowell_Palecek]

The need for the user name to be unique and not part of another name is documented in the NetBackup for Exchange admin guide as an Exchange 2007 requirement.