Exchange: Query Mailbox Creation Timestamp

Summary:

Unlike user creation timestamp which could be queried in ADSIEDIT, mailbox creation time is not stored in AD. To query mailbox creation time you need to query the MAPI properties of the Mailbox. In the MAPI property of the Mailbox, you will see a property "PR_Creation_Time" This property shows the date the mailbox was created. However, if the mailbox was moved, this time will not reflect the original creation time but rather the last mailbox move. This is because a mailbox move essentially creates a new mailbox. There is a method to get the original mailbox timestamp by looking at PR_NTSDModificationTime property the root of the IPM_Subtree in your mailbox. This property is the last modification time of the security descriptor. This timestamp does not change because it is at the root and the user will not see this folder. However, if you were able to view this property say for your inbox, the time may not be the same depending on whether or not you chagned permissions on your inbox such as giving another user rights or delegation to that folder.


This information can be useful in instances where you need to restore a mailbox from backup to determine if the user resided in the server where you need to restore the tape to. This article will go over how to manually view these properties using MFCMAPI and secondly how using a script to query this out for all users on an Exchange server. I would like to thanks Glen Scales (Exchange MVP Developer) for helping to creating this script.

Download all scritps from:
ftp://ftp.smtp25.org/


Manually Checking the Mailbox Creation Date.


1. Download MFCMAPI, also known as MAPI Editor. http://www.microsoft.com/downloads/details.aspx?FamilyID=55FDFFD7-1878-4637-9808-1E21ABB3AE37&displaylang=en

2. Launch MFCMAPI application. Click OK at the Microsoft Exchange Server MAPI Editor window. Click Session, and select Logon and Display Store Table.

3. You will now be prompted to create a profile. Note, you must be logged in with an account and mailbox profile that has full rights to your Exchange server, otherwise you will receive the following error message below when we open the temp table.

Error:
Code: MAPI_E_FAILONEPROVIDER === 0x8004011D
Function
File f:\df7830\extest\src\mfmapi\mapistorefunctions.cpp

4. Once logged in, go to MDB menu, Open Other User's Mailbox. Select the Mailbox you wish to open from the GAL and click ok and click ok at the prompt.

5. You will see a new dialog box with your mailbox name at the top. Highlight the root container. On the right pane, look for the following property

Property: 0x3FD60040

This is your orginal mailbox creation date.



Now to get last mailbox creation time such as when the mailbox was last moved to another store.


6. Highlight TOP of Information Store. On the right pane locate the following property:


PR_Creation_Time

----------------------------------------------------------------------------------

Now to script the original mailbox creation time by querying the PR_NTSDModificationTime at the root of the IPM_Subtree copy and paste the contents below into a text file and name that text file mborigtime.vbs. Save to C: drive.


servername = wscript.arguments(0)
PR_NTSDModificationTime = &H3FD60040
Set fso = CreateObject("Scripting.FileSystemObject")
set wfile = fso.opentextfile("c:\admin\mbCreationTime.csv",2,true)
wfile.writeline("Mailbox,CreationTime")
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("configurationNamingContext")
strDefaultNamingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
svcQuery = "Com.ActiveConnection = Conn
Com.CommandText = svcQuery
Set Rs = Com.Execute
while not rs.eof
GALQueryFilter = "(&(&(&(& (mailnickname=*)(!msExchHideFromAddressLists=TRUE)( (&(objectCategory=person)(objectClass=user)(msExchHomeServerName=" & rs.fields("legacyExchangeDN") & ")) )))))"
strQuery = " com.Properties("Page Size") = 100
Com.CommandText = strQuery
Set Rs1 = Com.Execute
while not Rs1.eof
call procmailboxes(servername,rs1.fields("mail"))
wscript.echo rs1.fields("mail")
rs1.movenext
wend
rs.movenext
wend
rs.close
wfile.close
set fso = nothing
set conn = nothing
set com = nothing
wscript.echo "Done"




sub procmailboxes(servername,MailboxAlias)

Set msMapiSession = CreateObject("MAPI.Session")
on error Resume next
msMapiSession.Logon "","",False,True,True,True,Servername & vbLF & MailboxAlias
if err.number = 0 then
on error goto 0
Set objInbox = msMapiSession.Inbox
Set objInfostore = msMapiSession.GetInfoStore(objInbox.StoreID)
Set objRootFolder = objInfostore.Rootfolder
Set Non_IPM_rootFolder = msMapiSession.GetFolder(objRootfolder.fields.item(&h0E090102),objInfoStore.ID)

Wscript.echo Non_IPM_rootFolder.fields.item(PR_NTSDModificationTime)
wfile.writeline(mailboxAlias & "," & Non_IPM_rootFolder.fields.item(PR_NTSDModificationTime))


else
wscript.echo = "Error Opening Mailbox"
wfile.writeline(mailboxAlias & "," & "Error Opening Mailbox")
end if
Set msMapiSession = Nothing
Set mrMailboxRules = Nothing

End Sub


7. Now open a command prompt. Go to:

C:\>mborigtime.vbs exservername

This will query all the orginal mailbox creation time for your exchange server and put the results to

C:\admin\mbCreationTime.csv


----------------------------------------------------------------------------------

Now to script the last time the mailbox was moved to another store by querying the PR_Creation_Time at the root of the IPM_Subtree copy and paste the contents below into a text file and name that text file lastmborigtime.vbs. Save to C: drive.


servername = wscript.arguments(0)
PR_Creation_Time = &H30070040
Set fso = CreateObject("Scripting.FileSystemObject")
set wfile = fso.opentextfile("c:\admin\lastmbCreationTime.csv",2,true)
wfile.writeline("Mailbox,CreationTime")
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("configurationNamingContext")
strDefaultNamingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
svcQuery = "Com.ActiveConnection = Conn
Com.CommandText = svcQuery
Set Rs = Com.Execute
while not rs.eof
GALQueryFilter = "(&(&(&(& (mailnickname=*)(!msExchHideFromAddressLists=TRUE)( (&(objectCategory=person)(objectClass=user)(msExchHomeServerName=" & rs.fields("legacyExchangeDN") & ")) )))))"
strQuery = " com.Properties("Page Size") = 100
Com.CommandText = strQuery
Set Rs1 = Com.Execute
while not Rs1.eof
call procmailboxes(servername,rs1.fields("mail"))
wscript.echo rs1.fields("mail")
rs1.movenext
wend
rs.movenext
wend
rs.close
wfile.close
set fso = nothing
set conn = nothing
set com = nothing
wscript.echo "Done"




sub procmailboxes(servername,MailboxAlias)

Set msMapiSession = CreateObject("MAPI.Session")
on error Resume next
msMapiSession.Logon "","",False,True,True,True,Servername & vbLF & MailboxAlias
if err.number = 0 then
on error goto 0
Set objInbox = msMapiSession.Inbox
Set objInfostore = msMapiSession.GetInfoStore(objInbox.StoreID)
Set objRootFolder = objInfostore.Rootfolder
Set Non_IPM_rootFolder = msMapiSession.GetFolder(objRootfolder.fields.item(&h0E090102),objInfoStore.ID)

Wscript.echo Non_IPM_rootFolder.fields.item(PR_Creation_Time)
wfile.writeline(mailboxAlias & "," & Non_IPM_rootFolder.fields.item(PR_Creation_Time))


else
wscript.echo = "Error Opening Mailbox"
wfile.writeline(mailboxAlias & "," & "Error Opening Mailbox")
end if
Set msMapiSession = Nothing
Set mrMailboxRules = Nothing

End Sub


Now open a command prompt. Go to:

C:\>lastmbcreationtime.vbs exservername

This will query all the orginal mailbox creation time for your exchange server and put the results to

C:\admin\lastmbCreationTime.csv




James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com

How useful was this article? Want to see a tip not listed? Please leave a comment.