MS Exchange Mailbox Problem...

o0_Enigma_0o

OSNN Junior Addict
Joined
Jul 19, 2006
Messages
48
#1
Hi Guys...

We have had a guy leave our office and I have tried to remove there account...

I firstly disabled the account so he could not log on remotely and I could check his emails and then extract any important emails.

When I tried to connect via my Outlook client I was told I did not have enough permissions... After checking the mailbox permissions it turns out I have full permissions on everything (I am the admin).
Anyway... I cut my losses and decided to delete the account... I got the dialog box "delete mailbox?" it was greyed out and ticked so I clicked ok...

The user account is now gone... but under my System Manager the mailbox is still there... but it says last logged on by S-1-5-21-3201456927-15689...
It is also showing as 564Kb and 150 Items. Also my back up server is now throwing a major wobbly saying that the directory is invalid or corrupt..

Is there anyway I can get the emails from this mailbox... or can I just delete this properly?

Cheers Guys

Kirk
 

o0_Enigma_0o

OSNN Junior Addict
Joined
Jul 19, 2006
Messages
48
#2
Hi Guys...

Bit of an update...

I have created a new user called "Test" and attached the broken mailbox to it... It seems to be ok now... however...

I have now found LOADS of strange stuff around my server...

everything file or folder i look at under the permissions bit seems to have a strange unknown user "S-1-5-21-3201456927-15689..." Its the same number that has access to this broken mailbox...

Is this normal??

Or am I stupid and have we been hacked?

Cheers
 

fitz

Woah.. I'm still here?
Staff member
Political User
Joined
Apr 26, 2004
Messages
4,082
#3
what version of exchange? what version of AD? what version of Windows is this running on? Was this an upgrade/migration from a previous version of Exch? What is the SID of your backup account?

edit:
What is the last 3 digits of this:
S-1-5-21-3201456927-15689...
 
Last edited:

o0_Enigma_0o

OSNN Junior Addict
Joined
Jul 19, 2006
Messages
48
#4
Hi mate,
Thanks for the reply...
Windows Server 2003 SMS runnign Exchange version 6.5 And AD - Version 5
as for the last numbers -> 1156

the back up system seems to be using the administrators account...
is it safe to post the SID here?
 

fitz

Woah.. I'm still here?
Staff member
Political User
Joined
Apr 26, 2004
Messages
4,082
#6
Hi mate,
Thanks for the reply...
Windows Server 2003 SMS runnign Exchange version 6.5 And AD - Version 5
as for the last numbers -> 1156

the back up system seems to be using the administrators account...
is it safe to post the SID here?
You shouldnt need the rest of the SID.. the middle parts are all domain specific anyway.. the 1-5-21 implies a domain account, the last numbers (1156) implies it is a non-default account or group (ie: not the built-in domain admins/domain users/etc)

Try using this utility to convert the SID to and readable format..

By guess off the top of my head would be the backup service account is the one hitting the mailboxes. Are you doing brick level backups?

It almost sounds like you have a bad tombstoned object.. but I don't know if that is should be happening on an SBS server.
 

o0_Enigma_0o

OSNN Junior Addict
Joined
Jul 19, 2006
Messages
48
#7
Hi Guys,

The guy that left was a normal user.
I will have ago with that util and let you know what I find.

Not sure about the Brick level backups... We have Veritas Backup Exec... if that helps :)

Cheers
 

fitz

Woah.. I'm still here?
Staff member
Political User
Joined
Apr 26, 2004
Messages
4,082
#8
Hi Guys,

The guy that left was a normal user.
I will have ago with that util and let you know what I find.

Not sure about the Brick level backups... We have Veritas Backup Exec... if that helps :)

Cheers
Are you backing up individual mailboxes or just the information store as a whole?
 

o0_Enigma_0o

OSNN Junior Addict
Joined
Jul 19, 2006
Messages
48
#9
Erm...
Both... I think
We have a Job that backs up everything on the server including the info store... then it backs up the database of mailbox's... so I think it will do the mailboxes individually
 

Members online

No members online now.

Latest posts

Latest profile posts

Perris Calderon wrote on Electronic Punk's profile.
Hey ep!

All good with me, applying for microsoft mvp right now, should have done this a while ago.

Notifications don't work, I only found your response by comming back to hunt up some threads, if you want, give me your email address so we can keep in touch easier, mine is perriscalderon at gmail
Perris Calderon wrote on Electronic Punk's profile.
Ep, glad to see you come back and tidy up...did want to ask a one day favor, I want to enhance my resume , was hoping you could make me administrator for a day, if so, take me right off since I won't be here to do anything, and don't know the slightest about the board, but it would be nice putting "served administrator osnn", if can do, THANKS

Been running around Quora lately, luv it there https://tinyurl.com/ycpxl
Electronic Punk wrote on Perris Calderon's profile.
All good still mate?
Hello, is there anybody in there? Just nod if you can hear me ...

Forum statistics

Threads
62,030
Messages
673,548
Members
89,039
Latest member
Barrous