Exchange 2010 Public Folder Data Recovery

As an Exchange administrator you likely work in an environment that has public folders.  Public folders allow users centralized access to tasks, email, calendars, contacts and more.  Over the years Microsoft has worked to move away from this technology, but was not able to due to customer dependence on this functionality.  In Exchange 2013, they have redesigned public folder technology and have introduced Modern public folders.  These are built on traditional mailbox technology which should streamline the backup and recovery process.  Despite this many organizations are still running Exchange 2010, so there is still a need to understand how to recover data from the public folder databases within your organization.

What kinds of things might need to be recovered and why? Well, you may have an end-user that cannot find their public folders calendar entries due to a mass deletion, some of their mail data went missing from a public folder or a legal investigation unexpectedly came up.

It is also important take a look back in time at what it took to restoring your public folder database.  Even if you were attempting to reclaim and individual item, it was not an easy task.  In older versions of Exchange in order to bring a public folder database online to extract data from it an isolated active directory domain and Exchange server required.  In time, Microsoft improved our ability to recover public folder data and this article will discuss several different levels of considerations for recovery options for your environment.

Recovery Option 1

With proper Exchange 2010 setup and disk space sizing you can allow your users or Exchange Administrators to be able to simply recover that missing email from within Deleted Item Retention for the mailbox in question.  This method is really the fastest way for a user to get that email message that they didn’t mean to delete. The user or Exchange administrator can do this right from Outlook, by going to Recover Deleted Items, selecting the message and choosing recover.

To verify your deleted item retention limit for public folders use the following steps:

1. Open the Exchange Management Console
2. Expand Organization Configuration
3. Click Mailbox
4. Choose the Data Management Tab
5. Right-click on your public folder database and choose properties
6. Under Deleted Settings, verify the number of days set to Keep deleted items

Recovery Option 2

There is a known bug with Exchange 2010 where a deleted public folder item loses track of its location, and both the user and the administrator are denied access to recover a public folder item through Recover Deleted Items. It is my understanding that this bug will not be resolved within Exchange 2010.  Therefore, users will need their Exchange administrators to attempt to recover the deleted item through ExFolders.

Recovery Option 3

If the item cannot be recovered with Recovery Option 1 or Recovery Option 2, then you will need to decide if the object recovery warrants a full database recovery. How to do this is explained in Recovery Option 3.

This public folder recovery option allows your Exchange administrator to restore your public folder database and extract the missing data to a pst file. This data can then be copied back into the public folder.  Please note that this process doesn’t come without risk. It involves restoring your mailbox data to a production/test Exchange server, while this is essentially isolated it is very important to follow every step or it could interfere with the replication and replicas of your production public folders.  Also not that part of this process involves and then moving public folder replicas from the restored public folder database which involves time and patience.  My personal opinion is that Option 3 should only be used for the extremely important exceptions.

Getting started Checklist

• Setup or locate a production/test Exchange server that is NOT used for anything but testing
• The production/test Exchange server will require a mailbox database
• Create a mailbox account that has been granted access to every public folder within your organization.  This account should be placed in the mailbox database on the production/test Exchange server

Replication Suspension

1. Logon to your production/test Exchange server  and open Exchange management shell
2. Type suspend-publicfolderreplication, type Y and press enter
3. Logon to the server that will be used to do the restore, in our case this should be the production/test server
4. Open Regedit and browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSExchangeIS\ServerName\Public-GUID
5. Create a ”DWORD (32-bit)Value” called Replication and make sure the value is 0 (zero). 

6. Type resume-publicfolderreplication, type Y and press enter

Restore the Public folder Database

1. On your production/test server open Exchange Powershell
2. New-PublicFolderDatabase DatabaseName -server servername -EdbFilePath "c:\pfrecovery\pfrecovery.edb" -LogFolderPath "c:\pfrecovery”

Note:  In this example our database name is PFDBDatabase

3. Get-PublicFolderDatabase –server servername to verify that the database has been setup

4. Open Regedit and browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSExchangeIS\Servername\Public-GUID to verify that the Replication DWord value that was set is still in place.

Note: If this is not in place repeat the steps under “Replication Suspension”

5. Open your backup product and do a redirected restore of your public folder data to the production/test server.

Note: You will likely need to fill in the name of the public folder database you created and “Allow the database to be overwritten” from within the backup solution.  Ultimately you may need to work with your backup vendor to make sure you put the right settings in place.

6. The restore time will vary depending on the size of the database and the restore vendor your organization uses

Mount the Database

1. Mount the database by typing Mount-Database DatabaseName
2. Logon to a server with ExFolders installed, connect to the new public folder database and make a note of the replicas

Note: You should see your local production test server and you will likely see one of your production databases. The registry key that is in place to stop replication is why this is ok the way it appears.

3. Open the Exchange Management Console
4. Right-click on the mailbox database on your production/test server and choose properties

5. Set the Public Folder database to the newly restored and mounted database

Extract the Data from Outlook

1. Use Outlook to open the mailbox that has been created for public folder recovery from your production/test server
2. Go to your public folders and choose the public folder that you are recovering data from
1. From the File Menu choose File, Import and Export..
2. Choose Export to a file and click Next

3. Select Personal Folder File (.pst) and click Next

4. Choose the Public Folder that you wish to recover data from and click Next

5. Choose a save location and then click Finish

6. Name the Folder and click OK

3. With Outlook, Open a mailbox that has access to the production public folder
4. Choose File, Open Outlook Data File
5. Select the pst file that was just created
6. Locate the item that needs to be recovered and copy it into the production public folder

Remove the Restored Public Folder Database

1. Open the Exchange Management Console
2. Right-click on the mailbox database on your production/test Exchange server and choose properties

3. Set the Public Folder database to production database that this was originally set with

4. Use ExFolders to check public folder replicas on your production public folder server(s) and your production test public folder server.  If anything on your production/test Exchange server production then we need to move to step 5
5. Open Exchange Management Shell and go to the scripts folder [PS] C:\Program Files\Microsoft\Exchange Server\v14\scripts>
6. Then run the following powershell command  .\MoveAllReplicas.ps1 -Server productiontestservername  -NewServer productionpublicfolderdatabaseservername

Note:  Walk away and wait at least a few hours or even wait until the next business day before running the following command.  If you run this command prematurely; especially in an environment with 1000’s of public folders, you will be littered with public folder conflict messages in your mailbox.

7. Open Exchange Management Shell and go to the scripts folder [PS] C:\Program Files\Microsoft\Exchange Server\v14\scripts>
8. Then run the following command Get-PublicFolderStatistics

Note: If any public folders are listed when this command is run then you will need to wait to move on to the next step.

9. Use Exfolders to check your replicas, if you see the replicas that you expect in the list on your production public folder database then step 10 can be skipped.
10. [PS] C:\Program Files\Microsoft\Exchange Server\v14\scripts>.\AddReplicaToPFRecursive.ps1 -server servername-TopPublicFolder "\" –ServerToAdd servername

Remove the Public Folder Database

11. When the data is no longer required, remove the recovery database.  It is a best practice to remove this database within a day or two of the restore.
12. Open Exchange Powershell
13. Remove-PublicFolderDatabase -Identity DatabaseName and type Y and then press enter
14. Verify that it has completed removing from within the Exchange Management Console and by using Exchange Powershell command Get-MailboxDatabase
15. Browse to the C: drive of your production/test Exchange server and delete the c:\pfrecovery folder and its contents