Restoring Microsoft Exchange Items via Powershell without "Application Aware Backup"

[Thomson]

Hey Guys

I currently have the following problem:
A customer has a compromised Exchange Server. This Exchange Server (VM) is no longer active and therefore offline - The whole VM is off. But since the VM still contains important data we would like to restore about 100 mailboxes.

Unfortunately there is no backup before the compromise...Please don't ask why

So we have created a new full backup for the VM. The VM was of course offline during the backup for security reasons. So it was not possible to perform an application aware backup.

Using the VEEAM GUI it is no problem to restore the mailboxes. We only have to manually enter the Exchange DB and the log folder because no Application Aware backup was made.
--> Select VM Restore Point \ Application Items \ Start Exchange Mailbox Item Restore \ In Exchange Explorer select "Add Store" and mount the correct mailbox DB

Since we don't want to restore the 100 mailboxes manually via the GUI, we can use the Powershell. But unfortunately no restore session can be started with Start-VBRExchangeItemRestoreSession, because the restore point for VEEAM was not backed up "Application Aware".

I also can't find a Powershell command to manually mount the mailbox in the GUI.

Information about the Restore Point:

Code: Select all

Info                : Veeam.Backup.Model.COibInfo
Id                  : d35e147e-f357-4c15-8184-d0acb3740351
Uid                 : d35e147ef3574c158184d0acb3740351
LinkIdNullable      : 
OriginalOibId       : d35e147e-f357-4c15-8184-d0acb3740351
LinkId              : 00000000-0000-0000-0000-000000000000
CreationTime        : 11.03.2022 17:40:17
CreationTimeUtc     : 11.03.2022 16:40:17
Type                : Full
Algorithm           : Full
PointId             : 12e269d3-ea73-4944-9996-f2d3d75573d3
ObjectId            : 43f57f9e-4de5-4ccb-bf65-9b332673a929
StorageId           : b63ac425-e227-4dd9-8387-fa7602be6b99
InsideDir           : 8d39d838-cd49-4ef6-863e-9e911e0b1e4e (vm-13094)
IsCorrupted         : False
IsRecheckCorrupted  : False
IsLicensed          : True
CreationUsn         : 46667114
IsConsistent        : True
ApproxSize          : 448827228160
VmName              : EX01
Name                : EX01
State               : Nothing
EffectiveMemoryMb   : 16384
GuestInfo           : Veeam.Backup.Model.CGuestInfo
AuxData             : Veeam.Backup.Core.CViOibAuxData
ParentId            : 00000000-0000-0000-0000-000000000000
ParentOriginalOibId : 00000000-0000-0000-0000-000000000000
DisplayName         : EX01
HvAuxData           : 
HasIndex            : False
HasExchange         : False
HasVeeamArchiver    : False
HasSharePoint       : False
HasSql              : False
HasAd               : False
HasOracle           : False
Fqdn                : 
BackupId            : 051f7986-87e3-4fa9-b1ee-1130f6150610
LinkableType        : Oib
IsFull              : True
MountToFull         : False

Try to start the restore session with the restore point

Code: Select all

PS U:\> Start-VBRExchangeItemRestoreSession -RestorePoint $vbrrestore[0] -Verbos
Start-VBRExchangeItemRestoreSession : Der Parameter "RestorePoint" kann nicht gebunden werden. Der Wert "Veeam.Backup.Core.COib" vom Typ "Veeam.Backup.Core.COib" kann nicht in den Typ 
"Veeam.Backup.Interaction.Explorer.PowerShell.IVBRApplicationRestorePoint" konvertiert werden.
In Zeile:1 Zeichen:51
+ Start-VBRExchangeItemRestoreSession -RestorePoint $vbrrestore[0] -Verbos
+                                                   ~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Start-VBRExchangeItemRestoreSession], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Veeam.Exchange.PowerShell.Cmdlets.RestoreSession.StartVBRExchangeItemRestoreSession

Translated into english:
Start-VBRExchangeItemRestoreSession : The "RestorePoint" parameter cannot be bound. The value "Veeam.Backup.Core.COib" of type "Veeam.Backup.Core.COib" cannot be converted to type
"Veeam.Backup.Interaction.Explorer.PowerShell.IVBRApplicationRestorePoint" type.

Is there a Powershell command or a workaround so that I can start the restore as an Application Item restore or include the DB mailbox like in the GUI?
I have also already opened the restore session via the GUI including binding the mailbox db. But Veeam does not allow the powershell exchange restore commands because it is not an application item restore.

Thank you in advance for your support. I hope you understand what my problem is

Thomas

[Mildur]

Hi Thomson

If you had to rebuild your exchange server, why don‘t you try microsoft dial tone recovery?

It‘s much easier to take the old edb file for a dial tone recovery.
You can use veeam to restore the database (from your new backup) and microsofts guide for dial tone recovery to finish the process on the exchange server.
https://docs.microsoft.com/en-us/exchan ... erver-2019

Or another method would be to simply install a new exchange server with the same hostname and reuse the old databases.
https://docs.microsoft.com/en-us/exchan ... erver-2019

[david.domask]

@Thomson

Unfortunately I don't think you can manually pass an FLR session to the VEX (Veeam Exchange Explorer) session like you can from the UI: https://helpcenter.veeam.com/docs/backu ... ml?ver=110

The cmdlet expects to have the necessary object to know what to load.

But, can't you just do the multiple mailbox restore from UI?

https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Is there a reason this is not ideal?