• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

MS Exchange Mailbox Problem...

o0_Enigma_0o

OSNN Junior Addict
#1
Hi Guys...

We have had a guy leave our office and I have tried to remove there account...

I firstly disabled the account so he could not log on remotely and I could check his emails and then extract any important emails.

When I tried to connect via my Outlook client I was told I did not have enough permissions... After checking the mailbox permissions it turns out I have full permissions on everything (I am the admin).
Anyway... I cut my losses and decided to delete the account... I got the dialog box "delete mailbox?" it was greyed out and ticked so I clicked ok...

The user account is now gone... but under my System Manager the mailbox is still there... but it says last logged on by S-1-5-21-3201456927-15689...
It is also showing as 564Kb and 150 Items. Also my back up server is now throwing a major wobbly saying that the directory is invalid or corrupt..

Is there anyway I can get the emails from this mailbox... or can I just delete this properly?

Cheers Guys

Kirk
 

o0_Enigma_0o

OSNN Junior Addict
#2
Hi Guys...

Bit of an update...

I have created a new user called "Test" and attached the broken mailbox to it... It seems to be ok now... however...

I have now found LOADS of strange stuff around my server...

everything file or folder i look at under the permissions bit seems to have a strange unknown user "S-1-5-21-3201456927-15689..." Its the same number that has access to this broken mailbox...

Is this normal??

Or am I stupid and have we been hacked?

Cheers
 

fitz

Woah.. I'm still here?
Staff member
Political User
#3
what version of exchange? what version of AD? what version of Windows is this running on? Was this an upgrade/migration from a previous version of Exch? What is the SID of your backup account?

edit:
What is the last 3 digits of this:
S-1-5-21-3201456927-15689...
 
Last edited:

o0_Enigma_0o

OSNN Junior Addict
#4
Hi mate,
Thanks for the reply...
Windows Server 2003 SMS runnign Exchange version 6.5 And AD - Version 5
as for the last numbers -> 1156

the back up system seems to be using the administrators account...
is it safe to post the SID here?
 

fitz

Woah.. I'm still here?
Staff member
Political User
#6
Hi mate,
Thanks for the reply...
Windows Server 2003 SMS runnign Exchange version 6.5 And AD - Version 5
as for the last numbers -> 1156

the back up system seems to be using the administrators account...
is it safe to post the SID here?
You shouldnt need the rest of the SID.. the middle parts are all domain specific anyway.. the 1-5-21 implies a domain account, the last numbers (1156) implies it is a non-default account or group (ie: not the built-in domain admins/domain users/etc)

Try using this utility to convert the SID to and readable format..

By guess off the top of my head would be the backup service account is the one hitting the mailboxes. Are you doing brick level backups?

It almost sounds like you have a bad tombstoned object.. but I don't know if that is should be happening on an SBS server.
 

o0_Enigma_0o

OSNN Junior Addict
#7
Hi Guys,

The guy that left was a normal user.
I will have ago with that util and let you know what I find.

Not sure about the Brick level backups... We have Veritas Backup Exec... if that helps :)

Cheers
 

fitz

Woah.. I'm still here?
Staff member
Political User
#8
Hi Guys,

The guy that left was a normal user.
I will have ago with that util and let you know what I find.

Not sure about the Brick level backups... We have Veritas Backup Exec... if that helps :)

Cheers
Are you backing up individual mailboxes or just the information store as a whole?
 

o0_Enigma_0o

OSNN Junior Addict
#9
Erm...
Both... I think
We have a Job that backs up everything on the server including the info store... then it backs up the database of mailbox's... so I think it will do the mailboxes individually
 

Members online

No members online now.

Latest posts

Latest profile posts

Hello, is there anybody in there? Just nod if you can hear me ...
Xie
What a long strange trip it's been. =)

Forum statistics

Threads
61,961
Messages
673,239
Members
89,014
Latest member
sanoravies