((MXECHO))

I have stopped adding new content to this site. Please see www.msexchangeteam.com for new Exchange information.

It is rather common for people to experience problems after their mailbox has been moved between Exchange Servers. This is usually due to something else playing a part in the move, for example maybe Anti_Virus on the server has not been configured properly (http://support.microsoft.com/kb/823166 and http://www.msexchange.org/articles/Properly-Configure-file-system-antivirus-Exchange.html) or maybe something else is hooked into the mailbox when trying to move, 3rd party archiver or indexer…whatever. What can you do to help verify that your mailbox moves will go as planned? Well of course you can test on a small subset prior to your whole org, but you can also turn up diagnostic logging on the Exchange Server to get more information about the mailbox moves during the move, so should something go wrong you can go back and review.

In Exchange 2003 – Navigate in Exchange System Manager to the Exchange Server, right-click and choose Properties, open the Diagnostic Logging tab and choose MSExchangeIS\System\Move Mailbox – turn this up to Maximum. This will generate a lot of events in the application log on your server (so be mindful of space) but will also give you much more information about how the procedure went and if there were any errors in the process.

In Exchange 2007 you will use the Management Shell

set-eventloglevel –id “MSExchangeIS\9002 System\Move Mailbox” –level expert

and to turn it back down

set-eventloglevel –id “MSExchangeIS\9002 System\Move Mailbox” –level lowest

Hope this helps in troubleshooting Move Mailbox operations.

If you ever find your self in a position where you need to run a hard repair against an Exchange database, it is important you understand the entire procedure. First I should say that running the /p against your database should never be your first choice, it is always your last resort. You have no backup, and no other options.

So here is your procedure

1. eseutil /p <path to edb>
   1. this process will take a long time, usually deleting the unicode table takes the longest and you should be careful not to click in the black command prompt window, this can pause eseutil. If you do pause, you can resume by clicking the top cmd promt title bar and pressing F5. This procedure will take a while.
   2. this process deletes data that is corrupt or incomplete so the database can be brought back to a consistent state.
2. eseutil /d <path to edb>
   1. this process will defrag the repaired database and must be run after the /p.
   2. you must have at least 110% free space, relative to the database size in order to run this command. You can redirect to another temp location using the /t switch (eseutil /d <full path to edb> /tX:\tempdfg.edb)
   3. again do not click the command prompt screen, it may pause eseutil
3. isinteg –fix <servername> –test alltests
   1. Before you can run isinteg –fix you will have to mount and dismount the database. To do this,
      1. move all logs from the original storage group location, stop smtp so no new mail is delivered to the database, mount the DB and then dismount, you can then restart SMTP.
   2. isinteg will create a log file named isinteg.pri, check this log when finished, at the bottom of the log you will see how many errors and fixes were encountered. Run this test until you see 0 errors and 0 fixes. You may need to run this 2 or 3 times.

Once you have run EACH of the steps above you can then mount your Database and allow your clients to connect. Each is very important to the stability of your database in the future. It is even recommended that you eventually move all your mailboxes from this database to a new database in the future.

The process of using eseutil /p can get you out of a bad situation but it is never something you want to use unless you are out of options. This will take a LONG time and you will lose data from your DB.

recap – process is

eseutil /p

eseutil /d

mount / dismount

isinteg –fix –s <servername> –test alltests

I ran across a situation the other day that I thought could use some additional explanation. In this case when users would open a Public Folder for the first time through Outlook the Outlook client would lock up or become unresponsive. If the user closed (end task) Outlook and went back into the same Public Folder then it opened quickly. If they waited (not ending task) then the Outlook client would “hang” for 40 seconds to 2 or 3 minutes – depending on how many items were in the Public Folder, but the folder would eventually open. The more items, the longer the wait time. As testing the Admin, created new profiles, and even restarted the computer several times to test. The issue ONLY occurs the first time they open the folder, after the first long pause, the folder opens fast each and every time. These clients were online clients. To clarify, this was for each folder in the Public Folder hierarchy. 

When we open a Public Folder in Outlook online mode the server creates the view for your client based on the view requested by the client. On most clients the view is standard, meaning they have not added any additional columns or modifications. In this standard scenario, the server has the general view already created as a table and can provide this view to the client quickly. However if your client is requesting a different view, then the server must create this view as a table in the store in order to present the view to the client. Once the view is created it is kept for a given amount of time (varies depending on Exchange version, but at least days) and is reused the next time it is requested. This is why the users would see the data quickly after the initial delay.

Do you have any control over these views or workarounds for the initial delay? There are two attributes on the public folder store that can control how many cached views are held and how long they are held for, msexchmaxcachedviews and msexchagingkeeptime. The biggest impact you can have on this initial delay is lowering the item count for the folders you are trying to access. The more items in the folder, the longer it will take to present the new view to your client. The other option you have is to reset your clients views back to default. You may  not even realize that you are using a view that is not common. The Outlook switch /cleanviews will reset your clients views back to default. This will NOT clear any views from the server, just the settings on the client.

This same type of behavior can be seen in mail folders as well, not just Public Folders. In fact many people may see this after a mailbox move as the views associated with the mailbox will needs to be recreated. Once the view is created, as long as it is accessed frequently enough the view will not be deleted from the server and the clients performance will remain quick. If the user goes on vacation….and doesn’t access their custom view for a given amount of time, then when they return they will also more than likely see some initial delays while those views are being created.

For additional information on this behavior see this TechNet article http://technet.microsoft.com/en-us/library/cc535025.aspx

Exchange 2007 mailbox databases have content indexing enabled by default. This is new to Exchange 2007. The search process and indexing process is much faster and much improved over previous versions. Several posts could be made regarding Exchange Search, however this post will just discuss how attachments can affect your indexing and search results.

Filters are used to extract the text from specific types of documents, html, doc, xml, xls, pdf, and so on. In the registry under HKLM\Software\Microsoft\Exchange\MSSearch\Filters there will be a list of filters that the server is able to use; see picture below.

Registry view of IFilters

Now here is what you need to understand, if a filter exists for a file type Exchange Search will attempt to index the attachment. If the server does not have a filter installed for a file type, Exchange Search will skip the attachment. Yeah OK, so that makes sense, but why is that important? Well if the Exchange Server has a filter installed for a file type that Exchange can not access, then the entire message will fail to get indexed. For example, lets say you have an xls file with DRM or is password protected, Exchange Search will not be able to read that attachment, and will not index the message either. Now let’s say that same example, but this time you DO NOT have an xls filter, then Exchange Search will NOT try to read the attachment and WILL index the message.

So, Message will fail to be indexed if Exchange fails to index an attachment that Exchange HAS a filter installed for.

Message will succeed indexing process if Exchange does NOT have a filter installed.

All of this only matters in situations where Exchange can not read the attachment. If a normal xls attachment is sent and can be opened and read normally then both the attachment and the email message will be indexed (as long as there is an xls IFilter). This all works great, the problem is where there are issues with the attachments.

There is one other interesting piece to this, in situations where the file type is not a true file type. For example, let’s say some random NON-Microsoft application spits out automated spreadsheet’s or documents and gives them an xls or .doc  file extension. This file was not created in Microsoft Excel so the attachment will not be read correctly, meaning again both the attachment and message will fail indexing. In the same sense that you can not rename a .pdf to .doc and expect Word to open it correctly, you can not expect an IFilter to be able to read a file type that was not truly created by that file types application.

When troubleshooting Exchange Search cases where you are seeing missing items in your search results, check the attachments can you find anything that sets them apart. If they were created by another application or process what are your options?

1. Open each attachment and resave with the appropriate application. Example: 3rd party app creates .xls files, they open with Excel fine but were not created with Excel – Indexing will fail to index this file. Open each attachment in Excel and re-save, they attachment and message should now be added to the content index catalog.

2. Remove the associated Filter. Example: delete the xls IFilter from the registry, Exchange will now skip attempting to read xls attachments and the actual message will now succeed, of course this means none of your xls attachments will be indexed.

3. Disable Content Indexing for the mailbox database in question. By disabling Content Indexing for this database you will force Exchange to use Store Search when clients query for items. Store Search does not index attachments and would not be affected by the behavior explained above. Store Search is much slower and has some limitations but it would work around your issue.

Side Note:Exchange 2007 does not have IFilters for Office 2007 by default you need to install these - http://support.microsoft.com/kb/944516

If you have ever wanted to have a look at the Performance of your Exchange Server, any version, then this is the post for you

Using PerfWiz you can easily configure a Performance Monitor counter to take a snapshot of your server over a given period of time, the best part is it uses a wizard to capture the counters that mean the most to a Windows Server/Exchange Server so you do not have to be a PerfMon genius. Then using the PAL tool you can analyze the .blg file that the PefWiz counter creates and get a nice report with graphs to review and diagnose or build baselines of your Exchange Server. The report even explains what the counters mean and what you should be looking for. You install the PerfWiz on your Exchange Server (quick and easy install, no reboot required) and PAL on any workstation, there are some pre-reqs for the PAL tool so make sure to read through them on the site below.

Keeping an eye on performance trends can be invaluable when trying to justify hardware upgrades or for better tuning of your servers. I am sure you will find this tool combination useful.

PerfWiz - http://www.microsoft.com/downloads/details.aspx?FamilyID=31FCCD98-C3A1-4644-9622-FAA046D69214&displaylang=en

PerfWiz - (Exchange 2007) - http://blogs.technet.com/mikelag/archive/2008/05/02/perfwiz-replacement-for-exchange-2007.aspx

PAL - http://pal.codeplex.com/

Recently I ran across a scenario where a company had migrated from Exchange 2003 to Exchange 2007 and noticed that their Search functionality was behaving differently. They, like most, used their email as a major component of their business. Work orders would come into their mailboxes and they would use Search to find and manage the flood of inbound emails. Each email would have a subject pattern that was somewhat predictable based on their work ordering numbering scheme. When they would search they would search for their portion of the code. This portion was not always the first portion of the string of characters. When using Exchange 2003 this worked great. Once they moved to Exchange 2007, they got inconsistent results. Why? Answer

Search in Exchange 2007 (Exchange Search) is completely different from earlier versions of Exchange. Improvements were made to performance, Content Indexing, and Search. New items are indexed almost immediately after their arrival into a mailbox giving end users a fast, reliable, and more stable search function. In Exchange 2000 and Exchange 2003, indexing was not enabled by default.

(note: there are other possible fixes to this error

Before I explain the difference before the clean and dirty states of an Exchange database we should explain how