Simple Ways to Restore Deleted Mailboxes in Exchange for IT Admins

Losing important mailboxes in Exchange can halt your team’s productivity and put sensitive data at risk. To prevent permanent loss, it’s crucial to act quickly to recover deleted mailboxes. Many mailboxes are deleted due to user errors, automatic rules, or incorrect settings.

• Users may delete emails without realizing the consequences.

• Automatic rules can remove mailbox items after a set period.

• Missing permissions or incorrect roles complicate the process to recover deleted mailboxes.

• Weak security measures, such as the absence of multi-factor authentication, increase risks.

Audit logs often reveal that mailboxes are deleted by users or automated tools. Being aware of these risks allows you to respond promptly and successfully recover deleted mailboxes.

Key Takeaways

• Move fast to get back deleted mailboxes. Use tools like Exchange Admin Center, PowerShell, or Microsoft 365 Admin Center. Do this before the retention time runs out.

• Know the difference between soft-deleted and hard-deleted mailboxes. This helps you see when you can recover mailboxes. Sometimes you need third-party tools or backups.

• Make sure you have the right permissions. Follow each step to reconnect or restore user and shared mailboxes safely.

• Back up Exchange data often. Watch mailbox activity to stop data loss. This helps you recover quickly if something goes wrong.

• Use best practices like turning on audit logging, retention policies, and multi-factor authentication. These steps help protect mailboxes and follow the rules.

Recover Deleted Mailboxes

You have a few good ways to get back deleted mailboxes. Each way works best in different situations. It depends on if you use Exchange Server or Exchange Online. You can bring back both user and shared mailboxes. The steps and limits are not the same for each. Follow these steps to get back deleted mailboxes fast and safely.

Exchange Admin Center

The Exchange Admin Center (EAC) helps you recover deleted mailboxes in Exchange Server. This tool uses pictures and menus, so it is easy for most IT admins.

1. Open the Exchange Admin Center and log in as an admin.

2. Go to Recipients and pick Mailboxes.

3. Click More (the three dots) and choose Disconnected mailboxes.

4. Find the mailbox you want to get back. You can search by name or email.

5. Click the mailbox and then click Connect.

6. Pick the user account to link the mailbox. For user mailboxes, pick the same user. For shared mailboxes, you might need to make or pick a system account.

7. Finish the steps and check that the mailbox is now active.

Tip: If you do not see the mailbox, look at the retention time. Disconnected mailboxes only show up for a short time after being deleted.

PowerShell Commands

PowerShell gives you more choices and control. It is helpful in big or tricky setups or when you need to get back many deleted mailboxes at once. You can use PowerShell in both Exchange Server and Exchange Online.

Exchange Online

To get back deleted mailboxes in Exchange Online, do these steps:

1. Connect to Exchange Online PowerShell:

Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

1. Bring back a soft-deleted mailbox with the Undo-SoftDeletedMailbox command:

Undo-SoftDeletedMailbox user@domain.com -WindowsLiveID user@domain.com -Password (Read-Host "Enter password" -AsSecureString)

1. If you took away the Exchange Online license, mailbox data stays for 30 days. Give the license back during this time to get access again.

2. After you restore, check that the mailbox works and you can use it.

Exchange Server

For Exchange on your own servers, follow these steps:

1. Open the Exchange Management Shell.

2. List mailboxes that are not connected:

Get-MailboxDatabase | Get-MailboxStatistics | Where-Object { $_.DisconnectReason -eq "Disabled" }

1. Connect the mailbox again:

Connect-Mailbox -Identity "MailboxGuid" -Database "MailboxDatabase" -User "UserAccount"

1. Make sure the mailbox is now in the active list.

Note: Always check if you have the right permissions before using PowerShell. If you do not have enough roles, you might get errors.

Microsoft Admin Center (Exchange Online)

The Microsoft 365 Admin Center is easy to use for getting back deleted mailboxes in Exchange Online. This way works best for soft-deleted mailboxes within 30 days.

• Go to the Microsoft 365 Admin Center and log in.

• Go to Users > Deleted users.

• Find the user whose mailbox you want to get back.

• Click the user and then click Restore.

• Follow the steps to finish restoring.

Important:

• You can only get back deleted mailboxes if the user account is still within 30 days.

• If the mailbox is hard-deleted or the time is up, you cannot get it back here.

• Bring back the user account first, then the mailbox.

• Fix any problems, like usernames or email addresses that are the same, before restoring.

• For shared mailboxes, you might need to make the user account again if it was deleted.

User vs. Shared Mailboxes: Key Differences

User mailboxes and shared mailboxes do not work the same when you recover them. User mailboxes have a clear way to disable and restore. Shared mailboxes are linked to system or disabled user accounts. If you delete the user account for a shared mailbox, the mailbox might go away. To get it back, you often need to make the user account again or unblock sign-in. In mixed setups, you must save mailbox details, disable the mailbox, turn it into a remote mailbox, and restore addresses and GUIDs. These steps help you get back deleted mailboxes without losing data.

Common Mistakes to Avoid:

• Not checking backup settings or permissions before you start.

• Missing sync problems, which can cause data issues.

• Not testing recovery steps first.

• To stop these problems, check backups, make sure you have permissions, and watch the recovery.

If you follow these steps, you can get back deleted mailboxes in both Exchange Server and Exchange Online. Always act before the time runs out and check restored data to keep from losing it forever.

Mailbox Deletion Types

Soft Delete

When you delete a mailbox in Exchange, it is not gone right away. The mailbox goes into a soft-deleted state first. Exchange keeps the mailbox and its emails for a set time. You can get the mailbox back during this time. Deleted items move to a special folder called Recoverable Items. Inside that folder, there is a subfolder named "Deletions." You or another admin can bring back these items or the whole mailbox before time runs out.

Soft-deleted mailboxes stay in the Microsoft Entra ID recycle bin for up to 30 days. You can use the Office 365 Admin Center or PowerShell to restore them. If you take away a license from a user in Exchange Online, the mailbox becomes soft-deleted. It stays recoverable for 30 days. In Exchange Server, if you delete a user from Active Directory, the mailbox disconnects but can still be restored for a set time.

Tip: Always check how much time is left before you try to recover. If the time is up, you cannot get the mailbox back.

Hard Delete

A hard delete means the mailbox or its emails are gone forever. Once you hard delete a mailbox, you cannot get it back. This happens if the soft-delete time ends or if you use PowerShell with special flags to force delete. For example, using Remove-Mailbox with -PermanentlyDelete erases the mailbox from the database.

You can also hard delete emails using tools like MFCMAPI or PowerShell commands such as Search-Mailbox -DeleteContent. These actions remove emails from the Recoverable Items folder, so you cannot get them back. Hard deletion also uses a security step called page zeroing. This step overwrites data so no one can recover it.

Note: Holds like Litigation Hold or eDiscovery Hold stop mailboxes from being hard deleted. These holds keep mailbox data safe for rules or laws.

Retention Periods

Retention periods tell you how long you can get back deleted mailboxes or emails. The default retention period in Exchange Online is 14 days. You can make it 30 days using PowerShell. In Exchange Server 2019, disconnected mailboxes stay in the database for 30 days by default. During this time, you can reconnect or restore the mailbox.

• Exchange Online:

  • Soft-deleted mailboxes can be recovered for 30 days.

  • Deleted emails stay in the Recoverable Items folder for 14 days, but you can make it 30 days.

  • Holds can keep mailboxes from being deleted.

• Exchange Server:

  • Disconnected mailboxes are kept for 30 days.

  • You can check mailbox status with Get-MailboxStatistics.

Remember: After the retention period, Exchange deletes the mailbox forever. You cannot get it back unless you have a backup or a third-party tool.

Restore to Another Mailbox

Sometimes you need to put a deleted mailbox into a different mailbox. This can happen if a user account is gone, if you need to get data for rules, or if other ways to recover do not work. The table below shows when you might need to restore to another mailbox:

New-MailboxRestoreRequest

You can use the New-MailboxRestoreRequest cmdlet to move mailbox content. It works for disconnected, soft-deleted, or inactive mailboxes. You can move the data to an active mailbox. This works in both Exchange Online and Exchange Server. You must have the right permissions before you start.

Follow these steps:

1. Open Windows PowerShell as an admin.

2. Find the soft-deleted mailbox with:

Get-Mailbox -SoftDeletedMailbox

1. Get the GUID of the mailbox you want to restore.

2. Find the mailbox you want to restore to with:

Get-Mailbox

1. Run this command to restore:

New-MailboxRestoreRequest -SourceMailbox <SourceGUID> -TargetMailbox <TargetGUID> -AllowLegacyDNMismatch

1. Check the status with:

Get-MailboxRestoreRequest

1. If there are errors, use:

Get-MailboxRestoreRequestStatistics

1. Remove finished requests with:

Remove-MailboxRestoreRequest

Tip: Add the -TargetIsArchive switch if you want to put data in an archive mailbox.

Reconnect Disconnected Mailbox

You can connect a disconnected mailbox to a new or old user account. You can use the Exchange Admin Center (EAC) or Exchange Management Shell (EMS). The way you do it depends on the mailbox state.

To reconnect using EAC:

1. Log in to EAC.

2. Go to Recipients and then Mailboxes.

3. Click 'More' (...) and pick 'Connect a mailbox'.

4. Pick the mailbox that is not connected.

5. Choose the user account to connect.

6. Finish the steps.

To reconnect using EMS:

Connect-Mailbox -Identity "<MailboxName>" -Database <DatabaseName> -User "<UserName>"

Note: Always act before the retention time is up. After that, you cannot connect the mailbox unless you have a backup or use another tool.

After Retention Expires

Third-Party Tools

When the retention period ends, you cannot use built-in tools to restore mailboxes in Exchange Server or Exchange Online. You lose access to native recovery options. Now, you need third-party recovery software. These tools help you get mailboxes back from offline or broken databases. For example, Kernel for Exchange Server can fix mailboxes from dismounted databases. It also recovers deleted emails and lets you export mailbox content to PST or Office 365. EdbMails is another trusted tool. It recovers deleted mailboxes from offline EDB files and works with many Exchange versions. You can export recovered mailboxes to different formats for backup or rules. Stellar Repair for Outlook and Kernel for Outlook PST Recovery help recover data from damaged PST or OST files. These tools are easy to use and work well. You can use them even if Exchange Server or Active Directory is not working.

Tip: Pick a tool that fits your Exchange version and what you need. Try the tool on a test database before doing a full recovery.

Backup Solutions

Backups are very important for mailbox recovery after retention ends. If Exchange deletes mailbox data forever, you cannot get it back without a backup. Backup solutions keep mailbox data safe outside of Exchange retention rules. You can use Backup Manager to mount Exchange databases as Recovery Databases. This lets you restore mailboxes fast without restoring the whole database. Tools like Lepide Exchange Recovery Manager and MyRecover help you recover mailboxes and permissions. These tools let you restore shared and user mailboxes, even after 30 days. Always make regular backups and check that they work.

• Backup solutions:

  • Restore mailboxes from offline .edb files.

  • Let you mount databases for faster recovery.

  • Keep mailbox data safe past retention limits.

Note: If you do not have backups, it is almost impossible to recover mailboxes after retention ends.

Troubleshooting

Mailbox recovery can fail for many reasons. You might see sync problems, missing mailboxes, or restore errors. If you have sync problems, check Exchange transaction logs and turn on circular logging. If mailboxes are missing in the recovery console, restart Exchange services and refresh the protected server. If some mailboxes do not show up, add the 'Authenticated Users' group with 'Read Exchange Information' permission in Active Directory. If you cannot restore to the original place, check if the database lets you overwrite from recovery. Other problems can be storage limits, database issues, or permission problems. Always check permissions, database status, and service health before you start recovery.

1. Look at transaction logs for errors.

2. Restart Exchange services if mailboxes are missing.

3. Change Active Directory permissions if needed.

4. Make sure the database lets you overwrite.

5. Ask support for help if you still have problems.

Alert: Write down your recovery steps. This helps you fix problems faster and keeps you from making the same mistakes again.

Best Practices

Prevent Data Loss

You can stop data loss in Exchange by doing a few things. Turn on mailbox audit logging. This helps you see who deletes, moves, or sends emails. You will always know what happens in your system. Be careful with user permissions. Only give users the access they need. Do not use complicated folder permissions. They are hard to handle and can cause mistakes.

• Turn on Litigation Hold or In-Place Hold. These keep mailbox items safe, even if someone deletes them. You can get back emails that users delete by mistake.

• Learn about retention policies and use them. Exchange keeps deleted mailboxes for 14 to 30 days. Restore mailboxes during this time so you do not lose them forever.

• Use Data Loss Prevention (DLP) policies. Pick built-in templates or make your own rules to protect important information. Policy Tips in Outlook warn users before they send risky emails.

Tip: Use the Exchange Admin Center to set up DLP and retention policies. Test your rules first to avoid mistakes.

Regular Backups

You should back up your Exchange data often. Set up automatic daily backups to meet your Recovery Point Objectives (RPO). This makes sure you can restore mailboxes to a recent state and lose less data.

• Use full, incremental, and differential backups together.

• Try third-party tools like Veeam Data Cloud for Microsoft 365 for more safety.

• Test your backup and recovery steps often. Make sure you can restore data when you need it.

• Encrypt your backups and set alerts to watch backup health.

Backups save you from losing data by accident, server problems, or ransomware.

Monitoring

Monitoring helps you find problems early and keep Exchange safe. Set alerts for strange things, like lots of deletions or failed logins. Use role-based access control and multi-factor authentication to stop people who should not get in.

• Watch mailbox activity with audit logs.

• Check backup status and health.

• Look at DLP and retention policy reports.

• Use Exchange Online Protection tools like anti-spam and anti-malware filters.

Checking often and using strong rules helps you stop data loss, follow the law, and keep your group safe.

---

To get back deleted mailboxes, you need to move fast and do these things:

1. Use the Exchange Admin Center or PowerShell to bring back mailboxes before time runs out.

2. Link mailboxes to user accounts and check if the data is there.

3. Change retention settings if you need more time to recover.

4. If the time is up, use third-party tools to help with recovery.

Making backups often and taking care of mailboxes helps stop data loss, keeps your group working, and saves money. Doing these things helps keep your data safe and your business open.

FAQ

How do you check if a mailbox is soft-deleted or hard-deleted?

You can use PowerShell to see the mailbox status.

Get-Mailbox -SoftDeletedMailbox

If you see the mailbox, it is soft-deleted. If you do not see it, it might be hard-deleted or past the time limit.

Can you recover a mailbox after the retention period ends?

No, you cannot use built-in tools after the time is up.
You need a backup or a third-party tool to get the mailbox back.

What should you do if the mailbox does not appear in the Exchange Admin Center?

• Try refreshing the EAC page.

• Check if you have the right permissions.

• Make sure the mailbox is still in the retention time.

• Use PowerShell to look for mailboxes that are not connected.

Is it possible to restore only specific emails from a deleted mailbox?

Yes, you can use eDiscovery or Content Search in Exchange Online.
You can also use PowerShell or other tools to export and restore certain emails.