Google
Search WWW Search msexchangetips.blogspot.com

Wednesday, August 23, 2006

Exchange: Query Mailbox Creation Timestamp

Summary:

Unlike user creation timestamp which could be queried in ADSIEDIT, mailbox creation time is not stored in AD. To query mailbox creation time you need to query the MAPI properties of the Mailbox. In the MAPI property of the Mailbox, you will see a property "PR_Creation_Time" This property shows the date the mailbox was created. However, if the mailbox was moved, this time will not reflect the original creation time but rather the last mailbox move. This is because a mailbox move essentially creates a new mailbox. There is a method to get the original mailbox timestamp by looking at PR_NTSDModificationTime property the root of the IPM_Subtree in your mailbox. This property is the last modification time of the security descriptor. This timestamp does not change because it is at the root and the user will not see this folder. However, if you were able to view this property say for your inbox, the time may not be the same depending on whether or not you chagned permissions on your inbox such as giving another user rights or delegation to that folder.


This information can be useful in instances where you need to restore a mailbox from backup to determine if the user resided in the server where you need to restore the tape to. This article will go over how to manually view these properties using MFCMAPI and secondly how using a script to query this out for all users on an Exchange server. I would like to thanks Glen Scales (Exchange MVP Developer) for helping to creating this script.

Download all scritps from:
ftp://ftp.smtp25.org/


Manually Checking the Mailbox Creation Date.


1. Download MFCMAPI, also known as MAPI Editor. http://www.microsoft.com/downloads/details.aspx?FamilyID=55FDFFD7-1878-4637-9808-1E21ABB3AE37&displaylang=en

2. Launch MFCMAPI application. Click OK at the Microsoft Exchange Server MAPI Editor window. Click Session, and select Logon and Display Store Table.

3. You will now be prompted to create a profile. Note, you must be logged in with an account and mailbox profile that has full rights to your Exchange server, otherwise you will receive the following error message below when we open the temp table.

Error:
Code: MAPI_E_FAILONEPROVIDER === 0x8004011D
Function
File f:\df7830\extest\src\mfmapi\mapistorefunctions.cpp

4. Once logged in, go to MDB menu, Open Other User's Mailbox. Select the Mailbox you wish to open from the GAL and click ok and click ok at the prompt.

5. You will see a new dialog box with your mailbox name at the top. Highlight the root container. On the right pane, look for the following property

Property: 0x3FD60040

This is your orginal mailbox creation date.



Now to get last mailbox creation time such as when the mailbox was last moved to another store.


6. Highlight TOP of Information Store. On the right pane locate the following property:


PR_Creation_Time

----------------------------------------------------------------------------------

Now to script the original mailbox creation time by querying the PR_NTSDModificationTime at the root of the IPM_Subtree copy and paste the contents below into a text file and name that text file mborigtime.vbs. Save to C: drive.


servername = wscript.arguments(0)
PR_NTSDModificationTime = &H3FD60040
Set fso = CreateObject("Scripting.FileSystemObject")
set wfile = fso.opentextfile("c:\admin\mbCreationTime.csv",2,true)
wfile.writeline("Mailbox,CreationTime")
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("configurationNamingContext")
strDefaultNamingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
svcQuery = "Com.ActiveConnection = Conn
Com.CommandText = svcQuery
Set Rs = Com.Execute
while not rs.eof
GALQueryFilter = "(&(&(&(& (mailnickname=*)(!msExchHideFromAddressLists=TRUE)( (&(objectCategory=person)(objectClass=user)(msExchHomeServerName=" & rs.fields("legacyExchangeDN") & ")) )))))"
strQuery = " com.Properties("Page Size") = 100
Com.CommandText = strQuery
Set Rs1 = Com.Execute
while not Rs1.eof
call procmailboxes(servername,rs1.fields("mail"))
wscript.echo rs1.fields("mail")
rs1.movenext
wend
rs.movenext
wend
rs.close
wfile.close
set fso = nothing
set conn = nothing
set com = nothing
wscript.echo "Done"




sub procmailboxes(servername,MailboxAlias)

Set msMapiSession = CreateObject("MAPI.Session")
on error Resume next
msMapiSession.Logon "","",False,True,True,True,Servername & vbLF & MailboxAlias
if err.number = 0 then
on error goto 0
Set objInbox = msMapiSession.Inbox
Set objInfostore = msMapiSession.GetInfoStore(objInbox.StoreID)
Set objRootFolder = objInfostore.Rootfolder
Set Non_IPM_rootFolder = msMapiSession.GetFolder(objRootfolder.fields.item(&h0E090102),objInfoStore.ID)

Wscript.echo Non_IPM_rootFolder.fields.item(PR_NTSDModificationTime)
wfile.writeline(mailboxAlias & "," & Non_IPM_rootFolder.fields.item(PR_NTSDModificationTime))


else
wscript.echo = "Error Opening Mailbox"
wfile.writeline(mailboxAlias & "," & "Error Opening Mailbox")
end if
Set msMapiSession = Nothing
Set mrMailboxRules = Nothing

End Sub


7. Now open a command prompt. Go to:

C:\>mborigtime.vbs exservername

This will query all the orginal mailbox creation time for your exchange server and put the results to

C:\admin\mbCreationTime.csv


----------------------------------------------------------------------------------

Now to script the last time the mailbox was moved to another store by querying the PR_Creation_Time at the root of the IPM_Subtree copy and paste the contents below into a text file and name that text file lastmborigtime.vbs. Save to C: drive.


servername = wscript.arguments(0)
PR_Creation_Time = &H30070040
Set fso = CreateObject("Scripting.FileSystemObject")
set wfile = fso.opentextfile("c:\admin\lastmbCreationTime.csv",2,true)
wfile.writeline("Mailbox,CreationTime")
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("configurationNamingContext")
strDefaultNamingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
svcQuery = "Com.ActiveConnection = Conn
Com.CommandText = svcQuery
Set Rs = Com.Execute
while not rs.eof
GALQueryFilter = "(&(&(&(& (mailnickname=*)(!msExchHideFromAddressLists=TRUE)( (&(objectCategory=person)(objectClass=user)(msExchHomeServerName=" & rs.fields("legacyExchangeDN") & ")) )))))"
strQuery = " com.Properties("Page Size") = 100
Com.CommandText = strQuery
Set Rs1 = Com.Execute
while not Rs1.eof
call procmailboxes(servername,rs1.fields("mail"))
wscript.echo rs1.fields("mail")
rs1.movenext
wend
rs.movenext
wend
rs.close
wfile.close
set fso = nothing
set conn = nothing
set com = nothing
wscript.echo "Done"




sub procmailboxes(servername,MailboxAlias)

Set msMapiSession = CreateObject("MAPI.Session")
on error Resume next
msMapiSession.Logon "","",False,True,True,True,Servername & vbLF & MailboxAlias
if err.number = 0 then
on error goto 0
Set objInbox = msMapiSession.Inbox
Set objInfostore = msMapiSession.GetInfoStore(objInbox.StoreID)
Set objRootFolder = objInfostore.Rootfolder
Set Non_IPM_rootFolder = msMapiSession.GetFolder(objRootfolder.fields.item(&h0E090102),objInfoStore.ID)

Wscript.echo Non_IPM_rootFolder.fields.item(PR_Creation_Time)
wfile.writeline(mailboxAlias & "," & Non_IPM_rootFolder.fields.item(PR_Creation_Time))


else
wscript.echo = "Error Opening Mailbox"
wfile.writeline(mailboxAlias & "," & "Error Opening Mailbox")
end if
Set msMapiSession = Nothing
Set mrMailboxRules = Nothing

End Sub


Now open a command prompt. Go to:

C:\>lastmbcreationtime.vbs exservername

This will query all the orginal mailbox creation time for your exchange server and put the results to

C:\admin\lastmbCreationTime.csv




James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com

How useful was this article? Want to see a tip not listed? Please leave a comment.

20 Comments:

Anonymous Anonymous said...

Thanks very much for these scripts.
Our customer wants to send an e-mail with e-mail regulations to newly created users. But because there is a possibility that the user was created first, and the mailbox was created a few days later, I could not use the ADSI value of 'whenCreated'.
This script will do the trick.

4:10 AM  
Anonymous Anonymous said...

Nice work, thanks.

11:15 PM  
Anonymous Anonymous said...

for some reason i can't seem to connect (via ftp) to ftp.smtp25.org can enyone else?

4:41 AM  
Anonymous Anonymous said...

Having trouble excecuting the script when copied and pasted from the page. anyone else?

8:34 AM  
Blogger Unknown said...

For the life of me I could not get this script to work. Can anyone post an update if they have one? I am trying to utilize this on an Exchange 2003 environment. The first error I was getting is this
mborigtime.vbs(13,40) Microsoft VBScript compilation error: Unterminated string constant
I had made some changes and had quite a few other errors but the last one was:
mborigtime.vbs(15, 1) ADODB.Command: The connection cannot be used to perform this operation. It is either closed or invalid in this context.

Thoughts?

2:36 PM  
Anonymous Anonymous said...

I couldn't get the scripts to work either. After fixing a few unterminated strings (probably got farked up when the script was published in HTML), I got errors about the command text not being set. Sure enough, svcQuery = "".

Bummer.

Also, I was unable to log into the FTP site to download the scripts.

It's a shame, because these scripts are just what I need right now. Has anyone gotten them to work?

1:56 PM  
Anonymous Anonymous said...

Yes - I've gotten it to work. Go over to http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.exchange.development&mid=9b997efd-d3b3-4d18-a1a7-e3cfcbbf9d78 for the script and instructions.

UCG

8:14 AM  
Blogger Unknown said...

replica handbags began designing luggage for the wealthy that traveled. His first invention was to design lv that was flat and therefore easy to stack in railway carriages. It gained popularity at lightening speed. It didn't take long before his competition was copying his design. In 1854 the replica louis vuitton business came to be, as luggage began to be replaced with replica bags ideas for handbags.
co

6:38 PM  
Blogger oakleyses said...

converse shoes outlet, salvatore ferragamo, timberland boots, softball bats, herve leger, ray ban, hollister, louboutin, gucci, nike roshe run, iphone cases, beats by dre, mcm handbags, oakley, p90x workout, insanity workout, wedding dresses, abercrombie and fitch, abercrombie, nike air max, mac cosmetics, babyliss pro, valentino shoes, bottega veneta, mont blanc, converse, jimmy choo outlet, hollister clothing, nike air max, north face outlet, new balance shoes, north face outlet, instyler ionic styler, soccer shoes, lululemon outlet, asics running shoes, ghd hair, giuseppe zanotti, soccer jerseys, nfl jerseys, longchamp uk, reebok outlet, nike air huarache, chi flat iron, hermes handbags, vans outlet, polo ralph lauren, celine handbags, nike trainers uk, vans scarpe

6:33 PM  
Anonymous Anonymous said...

true religion jeans
michael kors outlet
michael kors outlet store
tiffany jewelry
jordan retro
fitflops
jordan shoes on sale
http://www.outlettiffanyand.co
christian louboutin outlet
michael kors outlet
air huarache shoes
michael kors handbags outlet
nfl jerseys
fitflops clearance
cheap tiffanys
nike zoom kobe
michael kors handbags,michael kors handbags clearance,michael kors clearance
michael kors outlet
michael kors outlet store
michael kors handbags
fitflops clearance

7:28 PM  
Blogger raybanoutlet001 said...

bengals jersey
supra shoes sale
ugg boots
rolex watches
nike factory outlet
miami heat jersey
nike trainers uk
kate spade handbags
seahawks jersey
fitflops sale
2017.6.6

10:58 PM  
Blogger Unknown said...

ugg boots
gucci shoes
pandora outlet
nike air max 90
prada outlet
hermes belts
ralph lauren outlet
jordan 4
nike store
moncler jackets
20170823

11:54 PM  
Anonymous Cara Menghilangkan Batu Ginjal said...

Very nice information ;)

Pengobatan Untuk Mengatasi Perut Kembung
Obat Atasi Infeksi Usus
Pengobatan Kutil Kelamin
Pengobatan Ampuh Radang Sendi
Obat Kutu Air
Obat Menurunkan Demam

11:49 PM  
Blogger Unknown said...

nike outlet
pandora jewelry
true religion outlet
canada goose outlet
moncler online
jordan shoes
michael kors outlet online
christian louboutin shoes
kate spade outlet online
fitflops sale clearance
zzzzz2018.7.14

10:27 PM  
Blogger Unknown said...

www11.20



kate spade outlet
mbt shoes
christian louboutin
coach outlet online
michael kors outlet
true religion jeans outlet
champion sportswear
ralph lauren polo
pandora charms
off white outlet


11:09 PM  
Blogger jjjjjjjjjjjjj said...

fenty puma
kobe 9
michael kors
nike air max 2018
adidas yeezy
pureboost
off white shoes
nike air max
michael kors handbags
nike air max 2019

10:38 PM  
Blogger yanmaneee said...

golden goose sale
supreme clothing
kyrie 3 shoes
vapormax
birkin bag
hermes online
golden goose francy
supreme clothing
lebron 16
nike kd 12

12:49 AM  
Blogger Anita Frantz said...

I'm glad to be visiting your blog again after a long time. Nicely, this is the article I've been waiting for so long. I also recommended you check out the Kohi clicking test blog. Do visit this site and tell me what you think.

10:50 PM  
Anonymous Anonymous said...

9mobile data plans

Glo data plans

MTN data plans

Airtel 4g data plans

10:28 AM  
Anonymous Anonymous said...

Don't Miss These Websites to download free movies online.

11:39 PM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Query Mailbox Creation Timestamp