Check disabled status of multiple mailboxes (and then Delete them)

[RabbieBurns]

Ive just finished auditing our exchange server, and there are a whole load of old mailboxes from staff who no longer work here.

 

The user accounts are still in AD but they are all disabled. If I just delete the accounts, Im assuming this will delete the mailboxes as well?

 

Ive exported a list of all the mailboxes in the Exchange Server.. is there an automated way I can cross reference this with AD, and get a list of the mailboxes whose correspoding AD account is disabled?

 

Cheers

Edited August 26, 2011 by RabbieBurns

[Arthur]

get a list of the mailboxes whose correspoding AD account is disabled?

No need to cross-reference as you can simply list disabled AD accounts that are mailbox-enabled...

 

Get-User -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Where-Object { $_.UserAccountControl -match 'AccountDisabled' }

[RabbieBurns]

I just tried running that but it didnt return any results:

 

[PS] H:\>Get-User -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Where-Object { $_.UserAccountControl -match 'AccountDisabled' }
[PS] H:\>

[Arthur]

Works fine for me...

 

[PS] D:\>[color="#FF0000"]Get-User -ResultSize Unlimited -RecipientTypeDetails UserMailbox[/color] | Where-Object { $_.UserAccountControl -match 'AccountDisabled' }

Name                                                        RecipientType
----                                                        -------------
ABC                                                         UserMailbox
DEF                                                         UserMailbox

 

What happens if you run the command shown in red above? Does it list all of your users in AD who are mailbox-enabled?

Edited August 26, 2011 by Arthur

[sukh]

1. If you just delete the accounts it wont just delete the mailboxes. What you should do is remove the user from the EMC which will delete the account and mailbox, or if you disable the the mailbox it will just mark the mailbox for deletion and leave the user account alone. Perform these actions via the EMC. Although you can do it via AD, it;s cleaner via EMC.

2.

[RabbieBurns]

Works fine for me...

 

[PS] D:\>[color="#FF0000"]Get-User -ResultSize Unlimited -RecipientTypeDetails UserMailbox[/color] | Where-Object { $_.UserAccountControl -match 'AccountDisabled' }

Name                                                        RecipientType
----                                                        -------------
ABC                                                         UserMailbox
DEF                                                         UserMailbox

 

What happens if you run the command shown in red above? Does it list all of your users in AD who are mailbox-enabled?

 

red command works... full command doesnt...

 

@sukh, cheers for the advice of how best to delete... any suggestion on how to determine active / inactive (enabled/disabled Ad accounts) simply?

[RabbieBurns]

this is 2007 exch not 2010, im not sure if ive put 2010 in my posts by accident anwyere

[sukh]

Which AD version you on?

[RabbieBurns]

2008, but could raise to 2008r2 if needed as all our dc are now 2008r2

[sukh]

1. You can do something like this in AD - do a custom search -

 

(&(UserAccountControl:1.2.840.113556.1.4.803:=2)(msExchHomeServerName=*)(objectClass=User))

 

2. Or simply just do a common queries, and select disabled account, then on the results, go to the view and add in the exch server columns

 

3. Or if you want to use powershell, quest have some simple and nice add-ins

[Arthur]

this is 2007 exch not 2010, I'm not sure if I've put 2010 in my posts by accident anywhere

I'm using Exchange Server 2010 SP1. Perhaps that's why it works for me?

Edited August 26, 2011 by Arthur

[sukh]

I'm using Exchange Server 2010 SP1. Perhaps that's why it works for me?

 

If you do get-user "username" | fl

 

does the attribute UserAccountControl get returned in the results? If does then that why, diff exch veriosns

[Arthur]

3. Or if you want to use powershell, quest have some simple and nice add-ins

Get-QADUser -Disabled

 

I know it's not quite the same, but another option might be to use the Get-Mailbox cmdlet to find mailboxes which haven't been accessed within the last 90 days.

 

$mailboxes = Get-Mailbox -ResultSize Unlimited
$mailboxes | Where-Object {
 (Get-MailboxStatistics $_).LastLogonTime -and `
 (Get-MailboxStatistics $_).LastLogonTime -le `
 (Get-Date).AddDays(-90)
}

[Arthur]

does the attribute UserAccountControl get returned in the results?

Yes.

[RabbieBurns]

Get-QADUser -Disabled

 

I know it's not quite the same, but another option might be to use the Get-Mailbox cmdlet to find mailboxes which haven't been accessed within the last 90 days.

 

$mailboxes = Get-Mailbox -ResultSize Unlimited
$mailboxes | Where-Object {
 (Get-MailboxStatistics $_).LastLogonTime -and `
 (Get-MailboxStatistics $_).LastLogonTime -le `
 (Get-Date).AddDays(-90)
}

 

Nice idea with the logon time but it seems we have current staff who havent used the mailbox in a long time

 

Where would I find the quest script?

[Arthur]

Where would I find the quest script?

Quest's AD PowerShell snap-in can be download from here. See the cmdlet reference on the PowerGUI wiki for more info and examples.

 

Before you can use any of the Quest cmdlets you need to load the snap-in...

 

Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction SilentlyContinue

 

To save time you may want to add the line above to your PowerShell profile. Once the snap-in has been loaded you can run the command below to get a list of the QAD cmdlets.

 

Get-Command | Where { $_.name -match "QAD" }

Edited August 29, 2011 by Arthur

[RabbieBurns]

thanks arthur, got it downloaded will check it out tomorrow.

[sukh]

Yes.

 

This is why I suspect it doesnt work with 2007, 2007 doesnt return that attribute :-(

[RabbieBurns]

Right thanks for that Arthur, those pshell cmdlets look pretty useful.

 

Ive now got about 200 mailboxes Im about to delete

[RabbieBurns]

1. If you just delete the accounts it wont just delete the mailboxes. What you should do is remove the user from the EMC which will delete the account and mailbox, or if you disable the the mailbox it will just mark the mailbox for deletion and leave the user account alone. Perform these actions via the EMC. Although you can do it via AD, it;s cleaner via EMC.

2.

 

Hi @sukh,

 

After I disable the mailbox, how long does it take to purge from the database?

[RabbieBurns]

just found the setting... Will the deleted mailboxes still get backed up until the 30 days is over?

[Arthur]

Will the deleted mailboxes still get backed up until the 30 days is over?

They should be, because otherwise you wouldn't be able to reconnect the disconnected mailbox back to it's AD account.

 

Exchange allows us to disassociate a mailbox from an Active Directory user account, and later reconnect that mailbox to an Active Directory account. For some organizations, a mailbox database has a low deleted mailbox retention setting, and once a mailbox has been removed from a user, it is forgotten about and purged from the database once the retention period elapses. However, if you maintain your deleted mailboxes for any amount of time, having the ability to retrieve these mailboxes after they have been removed from a user can be very helpful at times.

 

By the way, if you ever need to restore a mailbox you may find this link useful... http://www.mikepfeiffer.net/2010/06/managing-disconnected-exchange-mailboxes-with-powershell/

 

The Disable-Mailbox cmdlet will strip the Exchange attributes from an Active Directory user and will disconnect the associated mailbox. By default, disconnected mailboxes are retained for 30 days. You can modify this setting on the database that holds the mailbox. In addition to this, you can also use the Remove-Mailbox cmdlet to delete both the Active Directory account and the mailbox at once:

 

Remove-Mailbox -Identity dave -Confirm:$false

 

After running this command, the mailbox will be purged once it exceeds the deleted mailbox retention setting on the database. One common mistake is when administrators use the Remove-Mailbox cmdlet when the Disable-Mailbox cmdlet should have been used. It's important to remember that the Remove-Mailbox cmdlet will delete the Active Directory user account. (Source)

[RabbieBurns]

They should be, because otherwise you wouldn't be able to reconnect the disconnected mailbox back to it's AD account.

 

 

 

By the way, if you ever need to restore a mailbox you may find this link useful... Managing Disconnected Exchange Mailboxes with PowerShell

 

cheers for that... I probably could have got away with using remove-mailbox as these are old accounts in AD and Ill end up deleting them anyway, but if this is best practice then thats fine.

 

Is there a way to purge them before the 30 days without changing the global setting? My backup is running at about 160gb just now and is taking a fair while, which is the motivation behind the cleanup really..

[sukh]

1. As you know you have rentension period for deleted mailbox, whatever you have set on your DB.

2. You will have to wait deleted items retension or you can change that setting to 0

[RabbieBurns]

Ok just to further update this thread with a bit of information. It seems that even after purging 200 mailboxes the mail database size didnt get any smaller.

 

From research I have to do an offline defrag now to sort out the mail database size.