Reading Mailbox Move History


Initial problem – In the ticket that sparked this Post  consisted of customer complaining about seeing the popup in outlook “Microsoft Exchange administrator has made a change that requires you quit and restart Outlook

Outlook pops this error for a few reasons, primarily when a Named Property mapping GUID changes on the mailbox. Which can happen when a mailbox is moved cross forest, or when it is moved and we tell it to not preserve the GUID

First Lesson learned in this investigation Exchange has a thing called Signature Preservation built into mailbox moves to prevent GUIDS from changing when  mailboxes are moved.  Exchange also have a setting on move mailbox -DoNotPreserveMailboxSignature  we can set to preserve or not preserve these GUIDS.

Next I learned Everything you’ve ever wanted to know about the history of mailboxes moves can be found with get-mailboxstatistics -IncludeMoveReport -IncludeMoveHistory

Some powershell

The following is some PowerShell I used to look  up what we were doing to a user we will call Greg with Mailbox Preservation causing him to see  the popup “Microsoft Exchange administrator has made a change that requires you quit and restart Outlook

Start by shoving get-mailboxstatistics for Greg into a variable to obtain all of the data – I use $bob was my defaultvariable for everything.

$bob = Get-MailboxStatistics greg@happymillfam.com -IncludeMoveReport -IncludeMoveHistory

Next I look in the variable to see how many moves we have for Greg. Then pick one to check out – $bob.MoveHistory | ft Finalsync*,Source*,Target*

Greg1.PNG

I figure caring about the most recent move is going to be useful, it’s the Top of the list based on time stamp, so let’s grab [0] and look at the top of the list. Why [0] because lists start at zero and not 1 to make it harder for you count= ]  – $bob.MoveHistory[0] | clip – The output can be log so I like to shove it into the clipboard and read it with notepad ++ . What you end up with looks like below well mostly I truncated a bunch of it.

Greg2.PNG

Some the stuff you might want to care about here is did it complete, where it came from and went too, how much was moved, failures, ETC –The Property you really want to care about is Report. – in Report is a bunch of great data. For my case I cared about the last line in Report.Entries in the above datablog, which clearly says we did not preserve signature and users will need to restart outlook. – Bingo. Now why did we set that?

In the Above blob of data, you see Report and I bet you’re thinking it’s an array with log entries over time. You’re not wrong, but you are not right either. If we shove the output
into get-member we see there is more in there then what we see. What you see Above lives under report.Entries property

Greg3.PNG

The data with the most meaning to my issue was in the DebugEntries property. Which get-member says is filled with even more properties. In DebugEntries what I am after is the LocalizedString property.  Which clearly shows who ever started this move ran it with -DoNotPreserveMailboxSignature set to $false Which answered my Why did the Greg get prompted to restart out.  Damit Greg, stop complaining and deal with the outlook popup “Microsoft Exchange administrator has made a change that requires you quit and restart Outlook

Greg4.PNG

Leave a Reply