Missing Exchange arbitration mailboxes: the errors they cause and how to recreate them

Exchange's hidden arbitration mailboxes run migration batches, message approval, offline address book (OAB) generation and more. When one goes missing or points at a deleted database, the error shows up somewhere else: a migration that won't start, moderated mail that never reaches a moderator, or a cumulative update that stops halfway. Here's how to match the symptom to the mailbox, find what's broken and recreate it the supported way.

Symptoms#

In the Exchange Management Shell, listing the arbitration mailboxes warns that an object is corrupted and in an inconsistent state, followed by this validation error:

Database is mandatory on UserMailbox.

The same error stops Exchange setup, and ExchangeSetup.log records it as [ERROR] Database is mandatory on UserMailbox. If the account has been deleted or is no longer a mailbox, cmdlets that target it by name fail with the usual not-found error:

The operation couldn't be performed because object 'Migration.8f3e7716-2011-43e4-96b1-aba62d229136' couldn't be found on 'DC01.contoso.com'.

Feature symptoms depend on which mailbox is affected:

Why it happens#

Exchange 2016 CU8 and later, Exchange 2019 and Exchange Server SE all use these seven mailboxes. Setup /PrepareAD creates their accounts as disabled users in the Users container, and the first Mailbox server you install turns them into mailboxes. They usually break in one of three ways:

• The database was removed while they were still in it. A plain Get-Mailbox -Database doesn't list arbitration mailboxes, so they're easy to forget when you retire a database. The account survives, but its database link (the homeMDB attribute) is now blank. That's what "Database is mandatory on UserMailbox" means.
• The account was deleted. Stale-account cleanup scripts often delete disabled users with odd names, and these accounts are disabled by design.
• A server was removed with ADSI Edit instead of being uninstalled, and its database objects went with it. Microsoft names an incorrectly deleted mailbox server as a typical cause of the blank database link.

How to fix it#

1. Find out what's missing or broken#

Set-ADServerSettings -ViewEntireForest $true
Get-Mailbox -Arbitration | Format-Table Name, DisplayName, Database -AutoSize
Get-MailboxDatabase | Format-Table Name, Server -AutoSize

# Every system account in AD, with its recipient type
Get-User -ResultSize Unlimited | Where-Object {
  $_.Name -like 'SystemMailbox{*' -or $_.Name -like 'Migration.*' -or $_.Name -like 'FederatedEmail.*'
} | Format-Table Name, RecipientTypeDetails -AutoSize

In a healthy organization all seven appear as ArbitrationMailbox, each in a database that Get-MailboxDatabase still lists (extra organization mailboxes are fine if you added them for OAB generation). An empty or unknown database means the mailbox is broken, and a name that's absent from both lists is missing. An account that Get-User shows with a different type only needs step 4.

2. Recreate missing accounts with PrepareAD#

If an account no longer exists in Active Directory, run PrepareAD again from the ISO of the newest Exchange build in your organization, as a member of Enterprise Admins:

E:\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD

PrepareAD recreates the missing accounts, but it doesn't turn them into mailboxes. You do that in step 4, after Active Directory replication has finished.

3. Re-home mailboxes whose database is gone#

You can't move a mailbox out of a database that no longer exists, and its old contents are gone anyway. There's no need to delete the account: Microsoft's documented fix is to point it at a database that exists. Run the SetupAssist script from Microsoft's CSS-Exchange project (aka.ms/ExSetupAssist) to list the mailboxes with a blank homeMDB, then set a database for each one using the distinguished name the script reports, and answer Yes to the confirmation prompts. Arbitration mailboxes also need the -Arbitration switch.

Get-MailboxDatabase | Format-Table Name, Server -AutoSize
Set-Mailbox 'CN=SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c},CN=Users,DC=contoso,DC=com' -Arbitration -Database DB01

The AD account keeps its attributes, so a re-homed mailbox usually needs nothing from step 4; the checks under "Verify the fix" show whether its capabilities are intact.

4. Turn the accounts into mailboxes and restore their capabilities#

Run only the blocks you need. -Database is optional, but I prefer to pick a healthy, replicated database. The capability settings follow Microsoft's procedure, and Set-ADUser needs the Active Directory module.

$db = 'DB01'
Enable-Mailbox -Identity 'FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042' -Arbitration -Database $db

Enable-Mailbox -Identity 'Migration.8f3e7716-2011-43e4-96b1-aba62d229136' -Arbitration -Database $db
Set-Mailbox -Identity 'Migration.8f3e7716-2011-43e4-96b1-aba62d229136' -Arbitration -Management $true -Force

Get-User -ResultSize Unlimited | Where-Object { $_.Name -like 'SystemMailbox{1f05a927*' } |
  Enable-Mailbox -Arbitration -Database $db

$oabName = 'SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}'
Enable-Mailbox -Identity $oabName -Arbitration -Database $db
Get-Mailbox $oabName -Arbitration | Set-Mailbox -Arbitration -UMGrammar $true -OABGen $true -GMGen $true `
  -ClientExtensions $true -MessageTracking $true -PstProvider $true -MaxSendSize 1GB -Force
$oab = Get-Mailbox $oabName -Arbitration
Set-ADUser $oab.SamAccountName -Add @{"msExchCapabilityIdentifiers"="40","42","43","44","47","51","52","46"}

Enable-Mailbox -Identity 'SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}' -Arbitration -Database $db
Set-Mailbox -Identity 'SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}' -Arbitration -UMDataStorage $true -Force

Enable-Mailbox -Identity 'SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}' -Arbitration -Database $db

$shardName = 'SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA}'
Enable-Mailbox -Identity $shardName -Arbitration -Database $db
Set-Mailbox -Identity $shardName -Arbitration -DisplayName 'Microsoft Exchange' -RequireSenderAuthenticationEnabled $false `
  -UseDatabaseQuotaDefaults $false -SCLDeleteEnabled $false -SCLJunkEnabled $false -SCLQuarantineEnabled $false `
  -SCLRejectEnabled $false -HiddenFromAddressListsEnabled $true -Force
$shard = Get-Mailbox -Identity $shardName -Arbitration
Set-ADUser $shard.SamAccountName -Add @{ msExchCapabilityIdentifiers = 66 }

5. Re-point anything that referenced a deleted account#

If an account was deleted and PrepareAD re-created it, check what referenced the old object. Where an OAB's GeneratingMailbox or a moderated group's ArbitrationMailbox still points to a deleted object, update it with Set-OfflineAddressBook -GeneratingMailbox or Set-DistributionGroup -ArbitrationMailbox.

Get-OfflineAddressBook | Format-List Name, GeneratingMailbox
Get-DistributionGroup -ResultSize Unlimited | Where-Object { $_.ModerationEnabled } |
  Format-Table Name, ArbitrationMailbox -AutoSize

Verify the fix#

Set-ADServerSettings -ViewEntireForest $true
Get-Mailbox -Arbitration | Format-Table Name, DisplayName, Database -AutoSize
Get-Mailbox -Arbitration | Format-List Name, PersistedCapabilities
Get-OfflineAddressBook | Update-OfflineAddressBook

Good looks like this: all seven arbitration mailboxes, each in an existing database, with no warnings and the capabilities you set listed under PersistedCapabilities. Then retest what was failing: a small local migration batch under Recipients › Migration in the Exchange admin center, a message to a moderated test group (the moderator should get the approval request), or the setup run that stopped earlier.

Prevent it next time#

• Before you remove any database, move its system mailboxes: Get-Mailbox -Database DB01 -Arbitration | New-MoveRequest -TargetDatabase DB02. Do the same with -AuditLog and -PublicFolder.
• Exclude the SystemMailbox, Migration and FederatedEmail accounts from disabled-account cleanup.
• Keep them in a database with several DAG copies, and remove servers with Exchange setup, not ADSI Edit.
• Add Get-Mailbox -Arbitration to your pre-update checks (see installing Exchange Server security updates).

References#

• Re-create missing arbitration mailboxes (Microsoft Learn)
• "Database is mandatory on UserMailbox" error in Exchange Server Setup (Microsoft Learn)
• Exchange Server supportability matrix (Microsoft Learn)