How to restore a mailbox without needing the users password

VMware specific discussions

How to restore a mailbox without needing the users password

Veeam Logoby ShawnKPERS » Mon May 02, 2011 8:04 pm

I am currently testing using U-Air in V-Power to restore an email from our exchange 2010 backup into the users email mailbox. With a little bit of mucking around I got it to work, but the one part I found that may be a deal breaker is the fact that I need the uses AD login password to access the account from the backup. I would like to have it allow me to use administrator credentials to restore from any mailbox. Is this possible? And if so do I have to do something like give the administrator account full access to all mailboxes?
ShawnKPERS
Enthusiast
 
Posts: 49
Liked: 4 times
Joined: Fri Apr 29, 2011 3:55 pm
Full Name: Shawn Nix

Re: How to restore a mailbox without needing the users passw

Veeam Logoby Gostev » Mon May 02, 2011 8:45 pm

Hi Shawn, sure this is possible, but you need to grant administrator account permissions to access user mailboxes (this is disabled in Exchange by default, but can be easily enabled - you can look up how-tos on the internet, they vary depending on the Exchange version). In fact, most tools for granular Exchange recoveries require this change as a part of deployment process, in order to be able to restore data back into the user mailbox. Just remember to take new backup after you make the permission change. Thanks.
Gostev
Veeam Software
 
Posts: 21396
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: How to restore a mailbox without needing the users passw

Veeam Logoby aevenot » Tue May 03, 2011 10:18 am

Hi ShawnKPERS,

I'm searching for the same thing. I have add FullAccess for the Administrator to the user mailbox but it's not working.

Do you have find a way to make it work?
aevenot
Enthusiast
 
Posts: 31
Liked: 1 time
Joined: Tue Jul 07, 2009 9:14 am
Full Name: aevenot

Re: How to restore a mailbox without needing the users passw

Veeam Logoby Vitaliy S. » Tue May 03, 2011 10:44 am

Basically all you need to do is to grant FullAccess for the admin account as it is described in these articles:
Grant Full Mailbox Rights to an Administrator on Exchange 2000/2003
Exchange 2007 access to all mailboxes for Administrator
Grant Full Access to All Mailboxes in Exchange 2010

If you've done that and still have no luck, don't hesitate to contact our technical team for further troubleshooting steps.
Vitaliy S.
Veeam Software
 
Posts: 19564
Liked: 1104 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: How to restore a mailbox without needing the users passw

Veeam Logoby Gostev » Tue May 03, 2011 10:49 am

Be sure to perform and then use the NEW backup of Exchange VM once you have set this up.
Gostev
Veeam Software
 
Posts: 21396
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: How to restore a mailbox without needing the users passw

Veeam Logoby ShawnKPERS » Tue May 03, 2011 11:48 am

I already tried the method that Vitaliy was nice enough to post for 2010 with little luck, but in the script I used a group instead of a user to grant full access. I will give it another shot with a single user account and report back my findings.
ShawnKPERS
Enthusiast
 
Posts: 49
Liked: 4 times
Joined: Fri Apr 29, 2011 3:55 pm
Full Name: Shawn Nix

Re: How to restore a mailbox without needing the users passw

Veeam Logoby aevenot » Tue May 03, 2011 12:40 pm

I already tried the method also and it doesn't work. I already tried the command bellow with no luck too.

Get-MailboxDatabase -identity "Mailbox Database" | Add-ADPermission -user administrator -ExtendedRights Receive-As, Send-As
aevenot
Enthusiast
 
Posts: 31
Liked: 1 time
Joined: Tue Jul 07, 2009 9:14 am
Full Name: aevenot

Re: How to restore a mailbox without needing the users passw

Veeam Logoby aevenot » Tue May 03, 2011 12:43 pm

I have opened a case but the functionally is in beta version so I think it will be "best effort".
aevenot
Enthusiast
 
Posts: 31
Liked: 1 time
Joined: Tue Jul 07, 2009 9:14 am
Full Name: aevenot

Re: How to restore a mailbox without needing the users passw

Veeam Logoby tsightler » Tue May 03, 2011 2:22 pm 1 person likes this post

Is the account you're using a member of "Domain Admins", "Enterprise Admins", "Exchange Oragnizaion Admins" or "Administrators"? If so, you have to remove the explicit "Deny" permission for these groups as well. The "Deny" permission overrides all other rights so it has to be removed.

The way most brick level Exchange backup software works is to have you to create a relatively unprivileged account (in many cases simply "Domain Guest" or some other very limited account group), but give that account "Full Access" rights to the mailbox. We did this years ago with another backup solution, creating an account called "Postmaster". For the legacy tool this account performed the backup of the mailbox data, as well as restores, however, with Veeam we use this account only for restores and it works fine.

We use a simple web based password manager that supports automatic password changes for this account (changed daily) and we "share" this password out to admins who might need to perform restores. The tool audits any access to this password, emailing the team whenever the password is viewed. This provides us with many advantages, including the fact that admins don't have continuous, unaudited access to user mailboxes just so that they can perform occasional restores.
tsightler
Veeam Software
 
Posts: 4769
Liked: 1737 times
Joined: Fri Jun 05, 2009 12:57 pm
Full Name: Tom Sightler

Re: How to restore a mailbox without needing the users passw

Veeam Logoby aevenot » Tue May 03, 2011 3:09 pm

I have tried by using a standard account, not an admin account with no luck.
aevenot
Enthusiast
 
Posts: 31
Liked: 1 time
Joined: Tue Jul 07, 2009 9:14 am
Full Name: aevenot

Re: How to restore a mailbox without needing the users passw

Veeam Logoby ShawnKPERS » Wed May 04, 2011 11:36 am

Same here, I created a Joe Blow account that is only a member of the Domain Users group with no luck. What permission is Veeam looking for? I know the accounts that I have been testing with have full access to the mailboxes I am trying to recover, so there must be some additional right that is required. The only thing I can think of is the "send as" right since the backup exchange will need some way of sending the email to the production exchange.
ShawnKPERS
Enthusiast
 
Posts: 49
Liked: 4 times
Joined: Fri Apr 29, 2011 3:55 pm
Full Name: Shawn Nix

Re: How to restore a mailbox without needing the users passw

Veeam Logoby Gostev » Wed May 04, 2011 1:03 pm

ShawnKPERS wrote:the backup exchange will need some way of sending the email to the production exchange.

This does not actually happen when using Exchange AIR wizard. All restores are done through the public API (specific API depends on Exchange version).

Full Mailbox Access right should really be sufficient, if this does not work I think best would be to let our devs look at this via webex.
Gostev
Veeam Software
 
Posts: 21396
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

A

Veeam Logoby aevenot » Wed May 04, 2011 1:16 pm

FullAccess on the user mailbox works well with outlook or OWA but it doesn't with Veeam . U-AIR Exchange is still on beta version, so I think this will be fix on the final version.
aevenot
Enthusiast
 
Posts: 31
Liked: 1 time
Joined: Tue Jul 07, 2009 9:14 am
Full Name: aevenot

Re: How to restore a mailbox without needing the users passw

Veeam Logoby Gostev » Wed May 04, 2011 2:26 pm 1 person likes this post

Hi, it looks like in case of Exchange 2010, you additionally need to setup impersonation:
http://msdn.microsoft.com/en-us/library ... 40%29.aspx
Gostev
Veeam Software
 
Posts: 21396
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: How to restore a mailbox without needing the users passw

Veeam Logoby ShawnKPERS » Wed May 04, 2011 5:40 pm

Gostev,

You were right about the "Send As" permission, It was a shot in the dark but after testing I still got the same results. I will look into the site you posted about impersonation. Also I put in a support ticket this morning so if I get a good answer I will post it here.
ShawnKPERS
Enthusiast
 
Posts: 49
Liked: 4 times
Joined: Fri Apr 29, 2011 3:55 pm
Full Name: Shawn Nix

Next

Return to VMware vSphere



Who is online

Users browsing this forum: Bing [Bot] and 11 guests