Google
Search WWW Search msexchangetips.blogspot.com

Wednesday, August 23, 2006

Exchange: Query Mailbox Creation Timestamp

Summary:

Unlike user creation timestamp which could be queried in ADSIEDIT, mailbox creation time is not stored in AD. To query mailbox creation time you need to query the MAPI properties of the Mailbox. In the MAPI property of the Mailbox, you will see a property "PR_Creation_Time" This property shows the date the mailbox was created. However, if the mailbox was moved, this time will not reflect the original creation time but rather the last mailbox move. This is because a mailbox move essentially creates a new mailbox. There is a method to get the original mailbox timestamp by looking at PR_NTSDModificationTime property the root of the IPM_Subtree in your mailbox. This property is the last modification time of the security descriptor. This timestamp does not change because it is at the root and the user will not see this folder. However, if you were able to view this property say for your inbox, the time may not be the same depending on whether or not you chagned permissions on your inbox such as giving another user rights or delegation to that folder.


This information can be useful in instances where you need to restore a mailbox from backup to determine if the user resided in the server where you need to restore the tape to. This article will go over how to manually view these properties using MFCMAPI and secondly how using a script to query this out for all users on an Exchange server. I would like to thanks Glen Scales (Exchange MVP Developer) for helping to creating this script.

Download all scritps from:
ftp://ftp.smtp25.org/


Manually Checking the Mailbox Creation Date.


1. Download MFCMAPI, also known as MAPI Editor. http://www.microsoft.com/downloads/details.aspx?FamilyID=55FDFFD7-1878-4637-9808-1E21ABB3AE37&displaylang=en

2. Launch MFCMAPI application. Click OK at the Microsoft Exchange Server MAPI Editor window. Click Session, and select Logon and Display Store Table.

3. You will now be prompted to create a profile. Note, you must be logged in with an account and mailbox profile that has full rights to your Exchange server, otherwise you will receive the following error message below when we open the temp table.

Error:
Code: MAPI_E_FAILONEPROVIDER === 0x8004011D
Function
File f:\df7830\extest\src\mfmapi\mapistorefunctions.cpp

4. Once logged in, go to MDB menu, Open Other User's Mailbox. Select the Mailbox you wish to open from the GAL and click ok and click ok at the prompt.

5. You will see a new dialog box with your mailbox name at the top. Highlight the root container. On the right pane, look for the following property

Property: 0x3FD60040

This is your orginal mailbox creation date.



Now to get last mailbox creation time such as when the mailbox was last moved to another store.


6. Highlight TOP of Information Store. On the right pane locate the following property:


PR_Creation_Time

----------------------------------------------------------------------------------

Now to script the original mailbox creation time by querying the PR_NTSDModificationTime at the root of the IPM_Subtree copy and paste the contents below into a text file and name that text file mborigtime.vbs. Save to C: drive.


servername = wscript.arguments(0)
PR_NTSDModificationTime = &H3FD60040
Set fso = CreateObject("Scripting.FileSystemObject")
set wfile = fso.opentextfile("c:\admin\mbCreationTime.csv",2,true)
wfile.writeline("Mailbox,CreationTime")
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("configurationNamingContext")
strDefaultNamingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
svcQuery = "Com.ActiveConnection = Conn
Com.CommandText = svcQuery
Set Rs = Com.Execute
while not rs.eof
GALQueryFilter = "(&(&(&(& (mailnickname=*)(!msExchHideFromAddressLists=TRUE)( (&(objectCategory=person)(objectClass=user)(msExchHomeServerName=" & rs.fields("legacyExchangeDN") & ")) )))))"
strQuery = " com.Properties("Page Size") = 100
Com.CommandText = strQuery
Set Rs1 = Com.Execute
while not Rs1.eof
call procmailboxes(servername,rs1.fields("mail"))
wscript.echo rs1.fields("mail")
rs1.movenext
wend
rs.movenext
wend
rs.close
wfile.close
set fso = nothing
set conn = nothing
set com = nothing
wscript.echo "Done"




sub procmailboxes(servername,MailboxAlias)

Set msMapiSession = CreateObject("MAPI.Session")
on error Resume next
msMapiSession.Logon "","",False,True,True,True,Servername & vbLF & MailboxAlias
if err.number = 0 then
on error goto 0
Set objInbox = msMapiSession.Inbox
Set objInfostore = msMapiSession.GetInfoStore(objInbox.StoreID)
Set objRootFolder = objInfostore.Rootfolder
Set Non_IPM_rootFolder = msMapiSession.GetFolder(objRootfolder.fields.item(&h0E090102),objInfoStore.ID)

Wscript.echo Non_IPM_rootFolder.fields.item(PR_NTSDModificationTime)
wfile.writeline(mailboxAlias & "," & Non_IPM_rootFolder.fields.item(PR_NTSDModificationTime))


else
wscript.echo = "Error Opening Mailbox"
wfile.writeline(mailboxAlias & "," & "Error Opening Mailbox")
end if
Set msMapiSession = Nothing
Set mrMailboxRules = Nothing

End Sub


7. Now open a command prompt. Go to:

C:\>mborigtime.vbs exservername

This will query all the orginal mailbox creation time for your exchange server and put the results to

C:\admin\mbCreationTime.csv


----------------------------------------------------------------------------------

Now to script the last time the mailbox was moved to another store by querying the PR_Creation_Time at the root of the IPM_Subtree copy and paste the contents below into a text file and name that text file lastmborigtime.vbs. Save to C: drive.


servername = wscript.arguments(0)
PR_Creation_Time = &H30070040
Set fso = CreateObject("Scripting.FileSystemObject")
set wfile = fso.opentextfile("c:\admin\lastmbCreationTime.csv",2,true)
wfile.writeline("Mailbox,CreationTime")
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("configurationNamingContext")
strDefaultNamingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
svcQuery = "Com.ActiveConnection = Conn
Com.CommandText = svcQuery
Set Rs = Com.Execute
while not rs.eof
GALQueryFilter = "(&(&(&(& (mailnickname=*)(!msExchHideFromAddressLists=TRUE)( (&(objectCategory=person)(objectClass=user)(msExchHomeServerName=" & rs.fields("legacyExchangeDN") & ")) )))))"
strQuery = " com.Properties("Page Size") = 100
Com.CommandText = strQuery
Set Rs1 = Com.Execute
while not Rs1.eof
call procmailboxes(servername,rs1.fields("mail"))
wscript.echo rs1.fields("mail")
rs1.movenext
wend
rs.movenext
wend
rs.close
wfile.close
set fso = nothing
set conn = nothing
set com = nothing
wscript.echo "Done"




sub procmailboxes(servername,MailboxAlias)

Set msMapiSession = CreateObject("MAPI.Session")
on error Resume next
msMapiSession.Logon "","",False,True,True,True,Servername & vbLF & MailboxAlias
if err.number = 0 then
on error goto 0
Set objInbox = msMapiSession.Inbox
Set objInfostore = msMapiSession.GetInfoStore(objInbox.StoreID)
Set objRootFolder = objInfostore.Rootfolder
Set Non_IPM_rootFolder = msMapiSession.GetFolder(objRootfolder.fields.item(&h0E090102),objInfoStore.ID)

Wscript.echo Non_IPM_rootFolder.fields.item(PR_Creation_Time)
wfile.writeline(mailboxAlias & "," & Non_IPM_rootFolder.fields.item(PR_Creation_Time))


else
wscript.echo = "Error Opening Mailbox"
wfile.writeline(mailboxAlias & "," & "Error Opening Mailbox")
end if
Set msMapiSession = Nothing
Set mrMailboxRules = Nothing

End Sub


Now open a command prompt. Go to:

C:\>lastmbcreationtime.vbs exservername

This will query all the orginal mailbox creation time for your exchange server and put the results to

C:\admin\lastmbCreationTime.csv




James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com

How useful was this article? Want to see a tip not listed? Please leave a comment.

18 Comments:

Anonymous Anonymous said...

Thanks very much for these scripts.
Our customer wants to send an e-mail with e-mail regulations to newly created users. But because there is a possibility that the user was created first, and the mailbox was created a few days later, I could not use the ADSI value of 'whenCreated'.
This script will do the trick.

4:10 AM  
Anonymous Ben Christian said...

Nice work, thanks.

11:15 PM  
Anonymous Anonymous said...

for some reason i can't seem to connect (via ftp) to ftp.smtp25.org can enyone else?

4:41 AM  
Anonymous Anonymous said...

Having trouble excecuting the script when copied and pasted from the page. anyone else?

8:34 AM  
Blogger SW said...

For the life of me I could not get this script to work. Can anyone post an update if they have one? I am trying to utilize this on an Exchange 2003 environment. The first error I was getting is this
mborigtime.vbs(13,40) Microsoft VBScript compilation error: Unterminated string constant
I had made some changes and had quite a few other errors but the last one was:
mborigtime.vbs(15, 1) ADODB.Command: The connection cannot be used to perform this operation. It is either closed or invalid in this context.

Thoughts?

2:36 PM  
Anonymous Anonymous said...

I couldn't get the scripts to work either. After fixing a few unterminated strings (probably got farked up when the script was published in HTML), I got errors about the command text not being set. Sure enough, svcQuery = "".

Bummer.

Also, I was unable to log into the FTP site to download the scripts.

It's a shame, because these scripts are just what I need right now. Has anyone gotten them to work?

1:56 PM  
Anonymous Anonymous said...

Yes - I've gotten it to work. Go over to http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.exchange.development&mid=9b997efd-d3b3-4d18-a1a7-e3cfcbbf9d78 for the script and instructions.

UCG

8:14 AM  
Blogger longge said...

replica handbags began designing luggage for the wealthy that traveled. His first invention was to design lv that was flat and therefore easy to stack in railway carriages. It gained popularity at lightening speed. It didn't take long before his competition was copying his design. In 1854 the replica louis vuitton business came to be, as luggage began to be replaced with replica bags ideas for handbags.
co

6:38 PM  
Blogger Simple Luxury said...

Burberry Outlet Store Online
Handbags Outlet Store Online


www.burberry-outlets.org
www.prada-outlet.org

9:10 AM  
Blogger dong dong said...

2015624dongdong
christian louboutin
oakley sunglasses cheap
christian louboutin outlet
hollister clothing store
ray ban outlet
louis vuitton outlet stores
christian louboutin sale
michael kors bag
cheap lululemon
michael kors outlet online sale
true religion outlet
coco chanel
michael kors handbags
www.louisvuitton.com
ray ban glasses
red christian louboutin
louis vuitton handbags
michael kors outlet online
coach outlet store online
rolex watches outlet
celine outlet
ray ban sunglasses
cheap jordans
coach factory outlet
jordan 13
hollister clothing
tory burch outlet online
oakley vault
jordan shoes
mont blanc
toms outlet
nfl jerseys

12:46 AM  
Blogger oakleyses said...

louis vuitton outlet, oakley sunglasses, michael kors handbags, cheap jordans, prada handbags, uggs outlet, michael kors outlet, oakley sunglasses, uggs on sale, ray ban sunglasses, burberry outlet, tiffany jewelry, uggs on sale, kate spade, gucci handbags, ray ban sunglasses, prada outlet, longchamp outlet, louboutin uk, burberry factory outlet, tory burch outlet, nike air max, tiffany jewelry, christian louboutin, louboutin shoes, oakley sunglasses, cheap oakley sunglasses, chanel handbags, michael kors outlet store, louis vuitton outlet, nike outlet, ralph lauren polo, louis vuitton, christian louboutin, michael kors outlet online, longchamp outlet, uggs outlet, michael kors outlet online, nike air max, longchamp bags, replica watches, ralph lauren outlet, oakley sunglasses, ray ban sunglasses, louis vuitton outlet online, nike free, michael kors

6:30 PM  
Blogger oakleyses said...

burberry pas cher, lunette oakley pas cher, coach outlet, kate spade outlet, true religion jeans, converse, coach outlet, longchamp soldes, north face uk, michael kors, louboutin pas cher, new balance, lululemon outlet, coach purses, nike air max, hermes pas cher, nike tn pas cher, vans pas cher, coach outlet store online, mulberry uk, lunette ray ban pas cher, nike air max uk, sac guess pas cher, nike air force, nike roshe run pas cher, longchamp pas cher, north face pas cher, nike air max pas cher, ray ban uk, true religion outlet, abercrombie and fitch, polo lacoste pas cher, true religion outlet, michael kors, jordan pas cher, nike free, polo ralph lauren uk, vanessa bruno pas cher, true religion outlet, hogan sito ufficiale, ralph lauren pas cher, michael kors outlet online, nike free pas cher, nike roshe uk, abercrombie and fitch UK, nike blazer pas cher, hollister uk

6:31 PM  
Blogger oakleyses said...

converse shoes outlet, salvatore ferragamo, timberland boots, softball bats, herve leger, ray ban, hollister, louboutin, gucci, nike roshe run, iphone cases, beats by dre, mcm handbags, oakley, p90x workout, insanity workout, wedding dresses, abercrombie and fitch, abercrombie, nike air max, mac cosmetics, babyliss pro, valentino shoes, bottega veneta, mont blanc, converse, jimmy choo outlet, hollister clothing, nike air max, north face outlet, new balance shoes, north face outlet, instyler ionic styler, soccer shoes, lululemon outlet, asics running shoes, ghd hair, giuseppe zanotti, soccer jerseys, nfl jerseys, longchamp uk, reebok outlet, nike air huarache, chi flat iron, hermes handbags, vans outlet, polo ralph lauren, celine handbags, nike trainers uk, vans scarpe

6:33 PM  
Blogger oakleyses said...

toms shoes, supra shoes, montre pas cher, ugg uk, juicy couture outlet, moncler, lancel, michael kors outlet online, ugg pas cher, michael kors handbags, barbour, doke & gabbana, michael kors outlet, coach outlet, louis vuitton uk, canada goose jackets, pandora charms, moncler, ugg,ugg australia,ugg italia, links of london uk, moncler jackets, hollister, juicy couture outlet, canada goose outlet, swarovski uk, pandora jewelry, canada goose pas cher, canada goose outlet, marc jacobs, moncler pas cher, thomas sabo uk, swarovski jewelry, karen millen uk, louis vuitton, moncler, moncler uk, sac louis vuitton, canada goose, moncler outlet, louis vuitton, canada goose, wedding dresses uk, ugg,uggs,uggs canada, canada goose uk, sac louis vuitton, moncler, replica watches, barbour jackets uk, bottes ugg pas cher, canada goose jackets

6:34 PM  
Blogger Junda Xu said...

20151026 junda
michael kors outlet
louis vuitton outlet
nfl jerseys
cheap ugg boots
Coach Factory Outlet Online Sale
air max 95,nike golf,nike janoski,air max 1,nike canada,nike plus,nike shox,nike factory store
Louboutin Red Bottoms Shoes Outlet
oakley sunglasses
louis vuitton outlet
ralph lauren polo
michael kors outlet
michael kors outlet sale
ugg boots
Authentic Louis Vuitton Handbags Cheap Online
mont blanc
michael kors outlet
Gucci Outlet Online Sale
michael kors handbags
Authentic Louis Vuitton Belts Outlet Store
michael kors outlet
Coach Factory Outlet Private Sale
true religion jeans
tory burch outlet
Oakley Vault Outlet Store Online
hollister clothing store
nike trainers
Louis Vuitton Handbags Official Site
michael kors handbag
Louis Vuitton Handbags Factory Store
uggs australia

1:25 AM  
Blogger Minko Chen said...

kobe 9
nhl jerseys
nike air max
air max 90
mcm backpack
ugg outlet online
hermes belt for sale
ugg outlet store
ralph lauren outlet
louis vuitton outlet store
ralph lauren uk
juicy couture tracksuit
coach outlet
lacoste shirts
abercrombie and fitch
snow boots
true religion jeans
longchamp handbags
hermes outlet store
cheap nike shoes
1128MINKO

6:39 PM  
Blogger Jianxiang Huang said...

jianbin1217
fitflops shoes
fitflops sale
fitflops sale clearance
fitflops sale
fitflops shoes
michael kors outlet
michael kors outlet
michael kors outlet
tiffany and co
tiffany jewellery
beats by dr dre
beats by dre
oakley sunglasses
oakley sunglasses
ray-ban sunglasses
ray ban sunglasses
hollister uk
lululemon outlet
ugg outlet
ugg boots
ugg boots
rolex watches
mulberry handbags
mulberry bags
mulberry outlet
mulberry sale
mulberry handbags
mulberry handbags
louis vuitton handbags
louis vuitton handbags
toms shoes
omega watches
ferragamo shoes

10:27 PM  
Blogger Chen Jeje said...

true religion jeans
michael kors outlet
michael kors outlet store
tiffany jewelry
jordan retro
fitflops
jordan shoes on sale
http://www.outlettiffanyand.co
christian louboutin outlet
michael kors outlet
air huarache shoes
michael kors handbags outlet
nfl jerseys
fitflops clearance
cheap tiffanys
nike zoom kobe
michael kors handbags,michael kors handbags clearance,michael kors clearance
michael kors outlet
michael kors outlet store
michael kors handbags
fitflops clearance

7:28 PM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Query Mailbox Creation Timestamp