Recover a deleted mailbox in Exchange Server: Connect-Mailbox and restore requests

Someone disabled the wrong mailbox, or deleted a leaver's account before the manager had copied what they needed. On Exchange Server that's usually recoverable without a backup, because the mailbox data stays in the database for a while after the account link is gone. In this post I'll show how to find the disconnected mailbox, choose between reconnecting and restoring, run either option and check the result.

How it works#

A mailbox is two things: the Exchange attributes on an Active Directory user, and the mailbox data in a database. A disconnected mailbox is mailbox data that no longer has a user attached. There are two kinds:

• Disconnected mailboxes stay in the database until the deleted mailbox retention period ends: 30 days by default, set per database with MailboxRetention. After that they're purged for good.
• Remove-Mailbox with -Permanent or -StoreMailboxIdentity deletes the mailbox data immediately. Then only a backup helps.
• Reconnecting (Connect-Mailbox) attaches the original mailbox to a user account. Restoring (New-MailboxRestoreRequest) copies its content into another mailbox through the Mailbox Replication Service.

Step-by-step#

1. Check the retention window#

Get-MailboxDatabase | Format-Table Name, MailboxRetention -AutoSize

Compare it with the date the mailbox was removed. If time is short, start the recovery now and investigate later.

2. Find the disconnected mailbox#

Get-MailboxDatabase | ForEach-Object { Get-MailboxStatistics -Database $_.DistinguishedName } |
    Where-Object { $_.DisconnectReason -in "Disabled","SoftDeleted" } |
    Format-Table DisplayName, Database, DisconnectReason, DisconnectDate, MailboxGuid -AutoSize

Note the MailboxGuid and the database. If several entries share a display name (common with soft-deleted copies after moves), the GUID and date tell them apart.

If a mailbox you removed a few minutes ago isn't listed as disconnected yet, the store hasn't caught up with Active Directory. Find its MailboxGuid in the unfiltered Get-MailboxStatistics -Database DB01 output, then use Update-StoreMailboxState to sync the store's view of that mailbox with Active Directory:

Update-StoreMailboxState -Database DB01 -Identity 1a2b3c4d-0000-4f00-a000-123456789abc

3a. Reconnect it to a user account#

Use this when the original user still exists (the mailbox was only disabled) or when a new or existing account without a mailbox should take it over:

Connect-Mailbox -Identity "Lina Haddad" -Database DB01 -User "contoso\lhaddad"

The target account must not have a mailbox already. In the Exchange admin center, the same action is under Recipients › Mailboxes, in the more options menu (…), as Connect a mailbox. Linked and resource mailboxes have their own parameters on Connect-Mailbox; check the cmdlet reference before you connect one of those.

3b. Or restore its content into an existing mailbox#

Use this when the AD account is gone and someone else needs the data, or for a soft-deleted mailbox:

New-MailboxRestoreRequest -SourceStoreMailbox 1a2b3c4d-0000-4f00-a000-123456789abc -SourceDatabase DB01 `
    -TargetMailbox manager@contoso.com -TargetRootFolder "Lina Haddad mailbox" -AllowLegacyDNMismatch

Get-MailboxRestoreRequest | Get-MailboxRestoreRequestStatistics |
    Format-Table Name, StatusDetail, PercentComplete, ItemsTransferred -AutoSize

-AllowLegacyDNMismatch is needed because, by default, the restore checks that the source mailbox's LegacyExchangeDN is present on the target (as its LegacyExchangeDN or an X500 address), which it won't be when the target is a different mailbox. -TargetRootFolder puts everything under one folder instead of merging it into the target's own Inbox and Sent Items. When the request shows Completed, remove it:

Get-MailboxRestoreRequest -Status Completed | Remove-MailboxRestoreRequest -Confirm:$false

4. Keep old replies and cached addresses working#

If the person's data now lives in a different mailbox, internal senders replying to old messages or using Outlook's cached entry can get IMCEAEX NDRs. Add the old LegacyExchangeDN as an X500 address on the mailbox that now receives their mail:

$old = Get-MailboxStatistics -Database DB01 | Where-Object { $_.MailboxGuid -eq "1a2b3c4d-0000-4f00-a000-123456789abc" }
Set-Mailbox manager@contoso.com -EmailAddresses @{Add = "X500:" + $old.LegacyDN}

Read the value before the mailbox is purged. My IMCEAEX and X500 guide explains the NDRs this prevents.

Verify#

• After a reconnect, Get-Mailbox "Lina Haddad" returns the mailbox, and Get-MailboxStatistics "Lina Haddad" | Format-List ItemCount, TotalItemSize, LastLogonTime shows the old item count, not an empty mailbox.
• Re-run the disconnected-mailbox search from step 2: the reconnected mailbox should no longer be listed.
• After a restore, the target mailbox shows the folder named in -TargetRootFolder, and Get-MailboxRestoreRequestStatistics reported Completed with no skipped items worth investigating.
• Send a test message to the old address and confirm it arrives in the right mailbox.

Tips & gotchas#

• Disable leavers' mailboxes rather than deleting their accounts on day one; reconnecting to the same user is the easiest recovery there is.
• A disconnected archive mailbox can only be reconnected to the user it belonged to, because it shares that user's LegacyExchangeDN.
• Remove-StoreMailbox purges a disconnected mailbox permanently, so check twice before using it to reclaim space.
• Past the retention period, or after a permanent delete, recover from backup with a recovery database: see Restoring mail with an Exchange Server recovery database.
• For cloud mailboxes, the process is different: see Restoring deleted mail and mailboxes in Exchange Online.

References#

• Disconnected mailboxes in Exchange Server (Microsoft Learn)
• Connect a disabled mailbox (Microsoft Learn)