Announcement

Collapse
No announcement yet.

Mailbox Managment Policy deleted 13GB and I need it back!

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Mailbox Managment Policy deleted 13GB and I need it back!

    I am a new IT Manager and I made a mistake today, a big mistake. Let me start at the beginning and excuse the long post, I want to be thorough so you can understand my plight.

    We run an Exchange 2003 SP2 on Windows Server 2003 SP2. We currently have around 200 Mailboxes. Our backup system is a Quantum Superloader 3 using Symantec Backupexec 11D. We do have the Exchange Agent for Backupexec. We do not have circular logging enabled.

    We have in the past not set any size limits for sending or receiving messages. We also never implemented quotas or limits on user mailboxes. As a result we have seen explosive growth on the server and reached the 75GB limit today. Of course the mailbox store dismounted automatically.

    I went into Exchange and turned the retention policy down from 30 days to 0 days and ran the Cleanup Agent. All of the mailboxes pending deletion were already backed up and it was an easy way to free up 2.5GB. Disaster was averted and the server was up and running with the store mounted. Now we needed a permanent solution and I knew the majority of our problem was not have any policies in place. Were we to control out mailbox management better we could last much longer on 75GB. Our largest ten mailboxes all topped 1.5GB each.

    I began to open the mailbox management policy and set it to report the space savings we would realize if we implemented a new management policy. I set it to report any message over 10MB and any deleted item over 7 days. Along with this I was planning on implementing a 10MB to 15MB send and receive limit. I would would want to seek management backing to help hedge user backlash and this report should seal the deal.

    Here is where the problem is: Somehow I accidentally selected Delete Immediately instead of Generate Report Only. When the report arrived there had been 13GB deleted. With retention still set to 0 days at the time the user can not recover their own messages through Outlook.

    The last full backup was Saturday August 25, 2007. I have an incremental backup from last night as well.

    I have no idea where to begin.

    Should I restore the entire Information Store? and then what?

    Should I inform the users and selectively restore?

    Should I contact Microsoft with a support incident for advice or would that not be of any help here?

    Is is possible for Symantec to help me automate the restore of these files?
    Last edited by Crewdawg; 29th August 2007, 02:11. Reason: Added details.

  • #2
    Re: Mailbox Managment Policy deleted 13GB and I need it back!

    I think you're going to have to resort to restoring the last Full backup (which is going to incur some downtime for email) and then restore any incremental backups you have (from oldest to newest starting with the 26th). You are probably going to experience some loss of emails from this week but hopefully it will be minimal. My suggestion for the future is to use the option in BackupExec 11D to allow the granular restore of items. This option can be set in the properties of your Exchange backup job. You can do a Full backup of the IS once a week and do a transaction log backup of the IS the remaining 6 days and have the ability to restore individual items from any mailbox from any day during the week. Also I would suggest setting your Deleted Items retention time to 7 days. That way it coincides with your weekly backups and in theory nothing will be deleted that hasn't already been backed up.

    Comment


    • #3
      Re: Mailbox Managment Policy deleted 13GB and I need it back!

      The Full and Incremental backups will restore me until Monday at 1800 hours. Is there any thing that can be done to keep or recreate the messages up until the delete happened. That would atleast get us down to only a few hours of lost e-mail.

      I do have the granular backup option enabled. We do a Full once a week and an incremental every other day of the week. I just do not know if there is a way to automate the restore. Is there a way to tell backup exec to only restore missing messages, or to tell it specific criteria to run on each box (i.e. bigger than 10meg or older than 7 days in the deleted items folder)?

      Comment


      • #4
        Re: Mailbox Managment Policy deleted 13GB and I need it back!

        This is what I have gathered here and in my research.

        1. Restore Information Store Backup to Recovery Store Group
        2. Restore Incremental Backups to Recovery Store Group
        3. EXMerge from Recovery Group to Storage Group

        From what I have read and others help (this is posted on other forums). The EXMerge is smart enough to know that messages already exist and won't duplicate them. So in theory this will find those missing message and put them back.

        Is there flaw in this logic?

        Comment


        • #5
          Re: Mailbox Managment Policy deleted 13GB and I need it back!

          I'm not sure what state it will be in after the restore as far as how current it will be. It all depends on what Exchange does with the transaction logs. Here is a screenshot of the options you should use when doing the restore of your full backup. See how it looks after that and then make a determination on whether to restore the incremental backup or not. Also, I would recommend doing an incremental backup of the IS everyday. This will backup only the logs in case disk space is a concern. Also note that you can not do granular restores of your Public Folders.
          Last edited by joeqwerty; 7th July 2008, 13:40.

          Comment


          • #6
            Re: Mailbox Managment Policy deleted 13GB and I need it back!

            We do a Full backup every Saturday and an incremental every other day.

            Are you saying that there is a possibility that doing the Full Restore would only recover the missing items?

            Comment


            • #7
              Re: Mailbox Managment Policy deleted 13GB and I need it back!

              I am presented with three options for the Exchange restore.

              1. Retore all transaction logs; do not delete existing transaction logs (no loss restore)

              2. Restore all transaction logs until the point in time of; skip transactions after this time

              3. Purge esisiting data and restore only the database and transaction logs from the backup sets.

              I know #3 is out. The questions is what happens to already existing messages in the Information Store?

              Would not #1 just redo the deletion of all those files through the transaction logs?

              If that is the case #2 would be the best option and we would only lose any mail since the event, or would we?

              Comment


              • #8
                Re: Mailbox Managment Policy deleted 13GB and I need it back!

                No, I think number 1 is your best option. BackupExec will restore eveything from the Full backup and then Exchange will use the current transaction logs to roll everything forward in the database. Yes, I beleieve the Full restore will recover most of the deleted items. You may wind up with some email from this week missing but it is better than losing all of it. If you tell BackupExec to not restore over existing items it will only replace what's missing, everything else will be left alone.

                Comment


                • #9
                  Re: Mailbox Managment Policy deleted 13GB and I need it back!

                  I might also suggest that you run a Full backup of Exchange before you restore anything as a failsafe.

                  Comment


                  • #10
                    Re: Mailbox Managment Policy deleted 13GB and I need it back!

                    I now cannot get past a Event Id: 619 error. Eseutil will not work, or rather I don't know how to use it.
                    Last edited by Crewdawg; 30th August 2007, 01:23. Reason: Clarity

                    Comment


                    • #11
                      Re: Mailbox Managment Policy deleted 13GB and I need it back!

                      Take a look at the following links. Did you perform a Full backup before the restore? What options in BackupExec did you select?

                      http://support.microsoft.com/default...b;en-us;810199

                      http://support.microsoft.com/default...b;en-us;253931

                      Comment


                      • #12
                        Re: Mailbox Managment Policy deleted 13GB and I need it back!

                        This is what BackupExec should have done if you selected number 1 in the options:

                        Restore all transaction logs; do not delete existing transaction logs (no loss restore)

                        Select this option to preserve the existing transaction logs on the Exchange server. Transaction logs from the storage media are then restored and added to the existing set of transaction logs on the Exchange server. When the restore operation finishes, Exchange automatically updates its databases with the uncommitted transactions found in the existing and newly restored transaction logs. This option is selected by default.

                        If you are restoring individual databases into a storage group, you should select this option. If this option is not selected, uncommitted transactions for other databases in the storage group may be lost.

                        If continuous protection is enabled, select backup sets from the last full backup or recovery point to restore up to the latest full transaction log.

                        Comment


                        • #13
                          Re: Mailbox Managment Policy deleted 13GB and I need it back!

                          You can always try the restore again or restore from the Full backup you captured before the restore and be back at square one.

                          Comment


                          • #14
                            Re: Mailbox Managment Policy deleted 13GB and I need it back!

                            I am worried about doing a full restore over an existing Information Store

                            I am attempting to restore to a Recovery Storage Group

                            I will then merge the message stores.

                            While more complicated there is less chance of losing data.

                            Comment


                            • #15
                              Re: Mailbox Managment Policy deleted 13GB and I need it back!

                              Did you do a Full backup before the first restore? If so, you should be able to restore it without any problems and get back to square one. You can then try to come up with another game plan. Can you tell if BackupExec did the restore without any problems? Is the IS mountable at this point?

                              Comment

                              Working...
                              X