Export Exchange mailbox and delete account

Question

Hello Remco,

Yes, this can be done. You can use a PowerShell script that exports a mailbox to a PST file and add it to the Deprovision Custom Command with the help of the Run a program or PowerShell script action. However, there is one issue with such a solution. The thing is that exporting a PST can take quite long, and the script will 'hang' Adaxes until the mailbox is exported or until the 10-minute limit set for executing scripts in Adaxes gets expired. So, there is a possibility that if a mailbox is quite large, it will exceed the 10-minute limit.

To workaround the issue, we suggest the following approach: the Deprovision Custom Command will only start the mailbox export and then exit if the script doesn't complete in, let's say, 9 minutes. Also, a certain property of the user account will be modified to a certain value. The property will simply serve as a flag that the user's mailbox is being exported. For this purpose, you can use one of Adaxes virtual properties that can store boolean (true/False) values, for example, CustomAttributeBoolen1. Virtual properties are not stored in AD, but they can be used the same as any other properties of AD objects.

Also, you'll need to create a Scheduled Task that checks mailbox export requests for all users who have the flag set. As soon as mailbox export is complete, it will delete the user's account.

Will such a solution suit you? By the way, what do you mean by "the account should be deleted"? Does it mean that the user's account should be deleted from AD or that the mailbox associated with the user should be deleted from Exchange?

commented Jan 10, 2014 by Support (216k points)

1 Answer

Best answer

Hello Remco,

Thank you for your good words, we really appreciate it.

The script is ready. As mentioned before in this topic, you will need to modify the Custom Command that you use for user deprovisioning and create a Scheduled task that will check the mailbox export status periodically and delete the account. To do this:

Modify the Custom Command for User Deprovisioning:
First of all, you need to extend the Custom Command for user deprovisioning with an action that initiates export of the user's mailbox to a file. Also, it will set a certain property to a certain predefined value. The property will serve as a flag to determine that the user's mailbox is being exported. Also, it will store the initiator's e-mail to be able to send the report in case mailbox export fails. For the flag and storing the initiator's email, we suggest using Adaxes virtual properties. They are not stored in Active Directory, but can be used as any other property of AD objects. The scripts below use the CustomAttributeBoolean1 property as a flag and the CustomAttributeText1 property for storing the initiator's e-mail. To modify the Custom Command:

Launch Adaxes Administration Console.
Expand the service node that represents your Adaxes Service.
Navigate to and select the Custom Command that you use for deprovisioning users.
Click the Add action to a new set link.
Select the Run a program or PowerShell script action.

Paste the following script to the Script field. It will initiate mailbox export to a PST file, set a flag indicating that the user's mailbox is being exported and store the initiator's e-mail.

 $exchangeServer =  "exchangeserver.example.com" # TODO: modify me
 $filePath = "\\server\ExportedMailboxes\%username%.pst" # TODO: modify me
 $defaultEmail = "recipient@mail.com" # TODO: Modify me
 $waitTime = 540000 # TODO: modify me. Time in milliseconds

 # Script block to initiate mailbox export
 $scriptBlockToExecute = @"
 & {
     `$session = New-PSSession -configurationname Microsoft.Exchange -connectionURI 'http://$exchangeServer/PowerShell'

     Import-PSSession `$session -DisableNameChecking

     Get-MailboxExportRequest -Name "%username%" | Remove-MailboxExportRequest -Confirm:`$False
     try
     {
         New-MailboxExportRequest "%username%" -FilePath '$filePath' -Name "%username%" -ErrorAction Stop
     }
     catch
     {
         `$_.Exception.Message
     }
     Remove-PSSession `$session
     }
 "@

 # Start Windows PowerShell as a separate process and run the script block in that process
 $arguments = @("-noninteractive", "-noprofile", "-executionpolicy bypass", "-Command $scriptBlockToExecute")
 $powershellPath = "$env:windir\syswow64\windowspowershell\v1.0\powershell.exe"   
 $starProcessInfo = New-Object System.Diagnostics.ProcessStartInfo
 $starProcessInfo.FileName = $powershellPath
 $starProcessInfo.Arguments = $arguments
 $starProcessInfo.WindowStyle = "Hidden"
 $starProcessInfo.CreateNoWindow = $True
 $starProcessInfo.UseShellExecute = $False
 $starProcessInfo.RedirectStandardError = $True
 $process = [System.Diagnostics.Process]::Start($starProcessInfo)
 $result = $process.StandardError.ReadToEnd()
 $process.WaitForExit($waitTime)

 # If $result is not empty, an error occurred while creating a mailbox export request
 # Give error and exit
 if (-not([System.String]::IsNullOrEmpty($result)))
 {
     $Context.LogMessage($result, "Error")
     return
 }

 # Set a flag indicating that the user's mailbox is being exported
 # and store the initiator's email address
 if ([System.String]::IsNullOrEmpty("%adm-InitiatorEmail%"))
 {
     # The initiator doesn't have an email address. Notifications will be sent to the default address
     $Context.TargetObject.Put("adm-CustomAttributeText1", $defaultEmail)
 }
 {
     $Context.TargetObject.Put("adm-CustomAttributeText1", "%adm-InitiatorEmail%")
 }

 $Context.TargetObject.Put("adm-CustomAttributeBoolean1", $True)
 $Context.TargetObject.SetInfo()

In the script:
- $exchangeServer - specifies the Fully Qualified Name (FQDN) of the computer where your Exchange Server is installed,
- $filePath - specifies a template for the PST file path,
- $waitTime - is the time (in milliseconds) to wait for mailbox export to complete before the export process to be considered too long.
Modify the script to your requirements.
Enter a short description for the script and click OK.
Also, you need to add a condition for this action to be triggered only if the user has an Exchange mailbox. Right-click the action that you've just added and click Add Condition.
Select the If has an Exchange mailbox condition type.
Select has.
Click OK and save the modified Custom Command.

Create a Scheduled Task that deletes the user account after the export is complete
To create such a Scheduled Task:

Create a new Scheduled Task.
On the 3rd step of the Create Scheduled Task wizard, select the User object type.
On the 4th step, add the Delete the User action.
Click OK.
Now, you need to add a condition for this action to be triggered only if the flag for the user is set. Right-click the action that you've just added and click Add Condition.
Select If <property> <relation> <value> condition type.
Expand the <property> drop-down list.
Select the CustomAttributeBoolean1 property.
Select equals and True.
Click OK.
Also, you need to add a condition for this action to be triggered only if the mailbox export has been completed. Right-click the action and click Add Condition.
Select the If PowerShell script returns True condition type.

Paste the following script to the Script field. The script will return True only when mailbox export completes successfully.

 $exchangeServer = "exchangeserver.example.com" # TODO: modify me
 $to = "%adm-CustomAttributeText1%" # TODO: modify me
 $subject = "Mailbox export failed." # TODO: modify me
 $message = "Mailbox export request status: {0}. The user will not be deleted"

 $Context.ConditionIsMet = $False

 $session = New-PSSession -configurationname Microsoft.Exchange -connectionURI http://$exchangeServer/PowerShell
 Import-PSSession $session -DisableNameChecking

 # Get mailbox export status
 $result = Get-MailboxExportRequest -Name "%username%"

 Remove-PSSession $session

 if ($result -eq $NULL)
 {
     return
 }

 $requestStatus = $result.Status
 switch ($requestStatus)
 {
     "Failed"
     {
         $exportSuccessful = $False
     }
     "Suspended"
     {
         $exportSuccessful = $False
     }
     "Completed"
     {
         $exportSuccessful = $True
     }
     "CompletedWithWarning"
     {
         $exportSuccessful = $True
     }
     default
     {
         return
     }
 }

 # If export failed, send error, and exit
 if (-not($exportSuccessful))
 {
     $Context.SendMail($to, $subject, $message -f $requestStatus, $NULL)
     return
 }

 # If export successful, set $Context.ConditionIsMet to $True
 $Context.ConditionIsMet = $True

In the script:
- $exchangeServer - specifies the Fully Qualified Name (FQDN) of the computer where your Exchange Server is installed,
- $to - specifies the recipient of an e-mail message to be sent if mailbox export failed. By default, it is set to %adm-CustomAttributeText1% that will be substituted with the value of the CustomAttributeText1 property of the target user's account. As mentioned above, the Custom Command used for deprovisioning will store the initiator's e-mail address in this property.
- $subject - specifies the subject of the e-mail message,
- $message - specifies the text of the e-mail message.
Modify the script to your requirements.
Enter a short description for the script and click OK.
Finish creation of the Scheduled Task.

Thnx for the script!! However I'm running into the following problem when execute the export script:

The term 'Get-MailboxExportRequest' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At line:6 char:26 + Get-MailboxExportRequest <<<< -Name RSauer | Remove-MailboxExportRequest -C onfirm:$False + CategoryInfo : ObjectNotFound: (Get-MailboxExportRequest:String ) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException The term '.Exception.Message' is not recognized as the name of a cmdlet, functi on, script file, or operable program. Check the spelling of the name, or if a p ath was included, verify that the path is correct and try again. At line:13 char:20 + .Exception.Message <<<< + CategoryInfo : ObjectNotFound: (.Exception.Message:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException

I've changed $exchangeserver and $filepath to the correct values...

Remco

commented Jan 23, 2014 by RTiel (780 points)

Hello Remco,

The error means that the account that is used to connect to the Exchange Server does not have sufficient permissions to perform mailbox export in Exchange. When a script is run by a Custom Command, Business Rule or Scheduled Task, by default, the credentials of Adaxes default service administrator (the user account that you used when installing Adaxes) are used. To remedy the issue, you need to grant necessary permissions to the default service administrator by adding the administrator's user account to an appropriate Role Group in Exchange. For example, the Mailbox Import Export Role gives sufficient permissions. For more details, see the following article by Microsoft: http://technet.microsoft.com/en-us/libr ... 50%29.aspx.

commented Jan 23, 2014 by Support (216k points)

Export Exchange mailbox and delete account

Please log in or register to add a comment.

Please log in or register to answer this question.

1 Answer

Please log in or register to add a comment.

Related questions