11.7 The ExMerge utility

---

Microsoft PSS originally created ExMerge in 1997 as a tool to solve a specific problem: to export data from a user mailbox to a PST and then be able to import the data from the PST into a new mailbox on another server. Since the original version, Microsoft has greatly enhanced ExMerge to a point where it is now part of the formal kit and is an essential piece of an Exchange administrator's toolkit. You can access a copy of the latest ExMerge utility from the \support\utils\i386\exmerge directory on the server CD. Note that the program depends on a number of DLLs from the Exchange kit (such as DAPI.DLL), so you will have to move the program into the \bin directory before it will run. In addition, the Exchange 2003 kit includes a new version of EXMERGE that you must use for any operations with an Exchange 2003 server (it also runs against Exchange 2000 servers).

Originally, the move mailbox option only worked within a site-a limitation imposed by the first-generation site model and the fact that the site name is included in a mailbox's distinguished name. Administrators used ExMerge to move mailboxes between sites to overcome this difficulty. It is much easier to move mailboxes between administrative groups, but only if sufficient bandwidth exists to transfer the contents of the mailbox to the target server. With most mailboxes being larger than 50 MB today, moving a mailbox across a low-bandwidth or saturated link is not an attractive proposition. ExMerge is a useful option in this situation, albeit even if you stop users from accessing their mailboxes during the export/move/import process.

ExMerge is also a useful tool in a disaster recovery situation. Imagine that a server has suffered a catastrophic hardware failure and you must rebuild it from scratch. The quickest way to restore service to users is to build the server with empty databases, since this avoids the need for users to wait while you restore databases from backup, verify that everything has worked correctly, take further backups, and so on. Once users are up and running, you can restore the databases to an offline recovery server and use ExMerge to export the contents of the mailboxes to PSTs. Then, you can move the PSTs over to the live server and use ExMerge to recover the contents of the mailboxes and merge them into the new mailboxes that are now in use. This technique works for both Exchange 5.5 and Exchange 2000/ 2003 servers.

Some administrators go so far as to use ExMerge as a form of "poor man's backup" to protect the mailboxes of users they deem to be important and deserving of extra protection. In this scenario, administrators use scheduled runs of ExMerge to export the contents of the important mailboxes to PSTs, which are then backed up to tape or other backup media. The advantage here is that you can easily recover a mailbox by restoring a PST. The disadvantage is the time required to export the data and back up the PSTs.

ExMerge uses the familiar wizard-based format to gather parameters and establish what it is going to do. Two basic approaches are available. Either you move mailboxes in a one-step process, where an initial export to a PST is immediately followed by an import to the target mailbox, or you can opt for the two-step process. In this scenario, you export mailbox contents first followed by a separate import operation, which you normally perform after you have had the chance to transfer the PSTs containing the exported mailboxes to the target server.

You can configure many options to determine how ExMerge exports and imports items, whether to include messages that are in the deleted message cache, how to handle permissions on folders, and how to specify a date range to limit the number of messages that are extracted. Figures 11.39 and 11.40 give some idea of the range of options available to control ExMerge processing. Comprehensive information about these options is available in the ExMerge documentation (a Word document), which you can find in the same directory as the ExMerge program files. You should read the documentation carefully before starting any complex operation, such as running ExMerge on a recovery server.

Figure 11.39: ExMerge options.

Figure 11.40: Import options for ExMerge.

When ExMerge starts, you specify the name of the source Exchange server where the mailboxes are currently located. You can also instruct ExMerge to connect to either a local DC or GC to read mailbox information. If you connect to a DC, you can only process mailboxes belonging to accounts in the local domain. In most cases, an Exchange server only hosts mailboxes belonging to accounts in a single domain, so there is no real necessity to connect to a GC. If you do not specify a DC or GC, ExMerge uses the same controller information as the Exchange server that hosts the mailboxes, although the program seems to connect and fetch information faster if you specify the name of a suitable controller. You can view this information through the Directory Access tab of the Exchange server properties. Note that while you can use ExMerge to view mailbox information, you need to use an account that has sufficient privileges to access and export mailbox data, since otherwise ExMerge will fail when it attempts to connect to the mailbox. An account that holds Exchange Administrator permission on the source server is usually sufficient. In addition, the fields available to specify the names of the servers are not long enough to accommodate FQDNs.

After you specify the parameters for the export run, ExMerge displays the set of Mailbox Stores on the host server. You can opt to select mailboxes from a particular Store or all available Stores. ExMerge then fetches a list of the mailboxes and displays them for you to select the mailboxes for processing. You will not see mailboxes that belong to deleted accounts on the list, so if you want to take a copy of a mailbox as part of the procedure when someone leaves the company, make sure that you do this before you delete the account. Depending on the number of mailboxes in the Stores and the size of the AD, this step can take some time to complete and apart from a "Please wait" message, there is no indication that everything is working smoothly. However, if you are patient, ExMerge will return and you should see a display similar to that shown in Figure 11.41.

Figure 11.41: Selecting mailboxes to process.

After selecting the mailboxes to process, the last step is to define where to create the PSTs. Exporting mailbox data can take up a lot of space, and you should estimate that the space reported by ExMerge for mailboxes will double when they are exported. For example, I exported a 550-MB mailbox and ExMerge created a 732-MB PST. While you can limit the amount of space used by not exporting items in the deleted items cache, the way that messages are stored inside a PST is the underlying reason why so much space is used; make sure that you have sufficient available space before you begin to process mailboxes. In addition, try to perform exports outside the hours of peak user demand, since the processing required to move items out of a mailbox to a PST is quite intensive. In the previous example, ExMerge took 29 minutes to process the 550-MB mailbox.

In addition to reporting ongoing progress (Figure 11.42), ExMerge logs details of all of its processing into a log file called c:\exmerge.log. The following code segment lists all the steps taken to export the contents of my mailbox. The level of detail here is typical of the standard (minimum) level of logging; you can increase the level of logging by specifying a command- line qualifier or changing the setting in the ExMerge.ini initialization file.

Figure 11.42: The export process begins.

You can change the name of the standard log file by editing the ExMerge.ini initialization file and specifying the new name in the LogFile- Name section. Note that if multiple threads are running, each thread has its own log file named ExMerge-Thread1.log, ExMerge-Thread2.log, and so on.

**************************************************************** Microsoft Exchange Mailbox Merge Program, v6.0.5762.3 Start Logging: April 08, 2002 13:01:36 **************************************************************** [13:01:36] Logging Level: None [13:01:36] Reading settings from file 'D:\exchsrvr\BIN\EXMERGE.INI'.  [13:01:38] Accessing Domain Controller 'DBOGCEU01' [13:01:38] 'DBOEXCVS1' is running Exchange Server 2000 or later [13:01:38] Source server read from settings file is 'DBOEXCVS1'. [13:01:38] Reading list of subjects for messages to be selected from file '' [13:01:38] Reading list of attachment names for messages to be selected from file '' [13:01:38] List of folders to be ignored has been read. 0 folders in the list. [13:01:38] Current machine locale ID is 0x409 [13:01:38] Operating System Version 5.0 (Build 2195)  [13:01:50] Accessing Domain Controller 'DBOGCEU01' [13:01:50] 'DBOEXCVS1' is running Exchange Server 2000 or later [13:01:53] Searching the Active Directory for mailboxes homed on the following databases: [13:01:53] CN=Mailbox Store (DBOEXCVS1),CN=First Storage Group,CN=InformationStore,CN=DBOEXCVS1,CN=Servers,CN=NSIS European Messaging Team,CN=Administrative Groups,CN=hp,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=cpqcorp,DC=net [13:09:54] Found 11 mailboxes, in the Active Directory, homed on the specified databases. [13:13:47] Using attribute 'PR_MESSAGE_DELIVERY_TIME' for date operations. [13:13:47] Replacing data in the target store. The program will overwrite existing messages in the target store, by first deleting these messages and then copying the messages from the source store. [13:13:47] Replacing only older items in the target store. [13:13:47] Option to copy deleted items from the dumpster has been selected. Recoverable deleted items will only be copied when extracting data out of mailboxes on servers running Microsoft Exchange Server version 5.5 or later. [13:13:47] Associated folder data will NOT be copied to the target store. [13:13:47] Using 'English (US)' (0x409) as the default locale (Code page 1252) [13:13:47] All mailboxes will be processed, regardless of locale [13:13:47] Initializing worker thread (Thread0) [13:13:47] Copying data from mailbox 'Redmond, Tony' ('TONYR') on Server 'DBOEXCVS1' to file 'D:\EXMERGE\TONYR.PST'. [13:42:56] Number of messages processed for mailbox 'Redmond, Tony': 17914 [13:42:56] Number of folders processed for mailbox 'Redmond, Tony': 111 [13:42:56] Successfully completed copying mailbox 'Redmond, Tony' to file 'D:\EXMERGE\TONYR.PST'. [13:42:57] Number of items copied from the source store for all mailboxes processed: 17914 [13:42:57] Total number of folders processed in the source store: 111 [13:42:57] 1 mailboxes successfully processed. 0 mailboxes were not successfully processed. 0 non-fatal errors encountered. [13:42:57] Process completion time: 0:00:29:10

Many organizations use ExMerge to move mailboxes around during migrations, most often when they restructure the organization through server consolidation. While this is a good way for you to move a small number of mailboxes from server to server, you should be aware that the way ExMerge works impacts single-instance storage. The net effect is that the target Mailbox Store will grow faster than if single-instance storage were respected. In addition, there is limited support for rules, and you have to check that permissions are correctly in place after ExMerge imports mailboxes onto a server.

Beyond its obvious uses, ExMerge offers some surprising features. For example, you can use the message selection feature to instruct ExMerge to scan a mailbox and select items based on subject, text string, substring matches, or names of attachments. You could then use ExMerge to "clean" Mailbox Stores by looking for specific items, extracting them to PSTs, and then removing the items from the mailboxes. Figure 11.43 shows how you can set up certain criteria, such as looking for an attachment called "joke.txt" (one of the well-known viruses sends its payload in such an attachment) or messages with certain subjects. ExMerge does not search nested messages and attachments, so it is by no means the perfect tool, but it is able to apply a certain degree of clean-up if required.

Figure 11.43: Looking for specific items.

It is now very common for an organization to be required to provide copies of messages and documents to lawyers seeking information in a discovery action. You can use the ExMerge item selection (filtering) functionality to scan mailboxes to locate items that match criteria defined in the action. The lawyers will probably require printed copies of each message and may not accept that ExMerge cannot find every item that they want, but this is a good way to perform an initial scan to determine whether the Store holds any matching material.

Just as recovery servers hold sensitive information in recovered databases, you need to secure the PSTs created by ExMerge until you use them to recover mailboxes and then delete them. Given that any Outlook client can open a PST and that it is easy to crack a password-protected PST, it is unwise to leave PSTs containing user mailbox data anywhere that a casual browser can find them.

11.7.1 Running ExMerge in batch mode

Administrators most commonly run ExMerge interactively, but it also supports batch-mode execution, so you can schedule exports with batch jobs run by the Windows Scheduler. This is a useful feature if you want to do something such as remove all matching instances of a particular message or attachment from a large set of mailboxes. Instructions for batch mode are contained in the ExMerge documentation.

You can also script a run of ExMerge, providing a separate initialization file to process messages in a PST and import them into a mailbox. This technique is viable in migration projects, where you are able to export data from another messaging system to a PST. For example, the MailMover utility from Simpler Webb (www.swinc.com) can export mailbox contents from HP OpenMail systems to PSTs, and there are similar capabilities available for other email systems such as Eudora and TeamWare. As mentioned earlier, you can also use ExMerge to detect specific items in mailboxes. These items might be infected with viruses or contain offensive or sensitive material that you want to eliminate. To approach this problem, you would script ExMerge to run in batch mode (perhaps overnight) to examine targeted mailboxes, locate the desired items with filters, and then remove them. This is no substitute for installing proper protection against email viruses, but it is something that you can use to rid a server of offending items if they get through your defenses.

ExMerge is certainly a tool that has proved its usefulness to many system administrators, but it is unlikely that Microsoft will put more effort into future development. The Move Mailbox and Migration wizards have functionality that essentially eliminates the need for an ExMerge-like utility, and you can expect Microsoft to enhance these features over future service packs-for example, to support mailbox moves between different Exchange 2003 organizations.

11.7.2 Other recovery utilities

While they are less common than the other types of Exchange add-on utilities, there are tools that you can use to recover data from a Mailbox Store without ever having to install Exchange on a server. Remember that Store databases are just that-databases-and that a public API exists (MAPI). Put the two together and you can see how you could build a utility that uses MAPI to connect to a database and read information for purposes such as item recovery, mailbox backup, searching messages, or retrieving information in response to legal discovery requests. The best known of these utilities is probably Ontrack's Powercontrols (www.ontrack.com). These tools are not especially expensive and they can save your skin if a problem occurs, so it is worth investigating the utilities that are currently available on the market to determine whether to incorporate them into your recovery toolkit.

---