So lets imagine the below scenario:
"You have a single exchange server environment and all your users are on one mailbox server and the server abruptly shuts down due to some hardware issue and when it comes back up the exchange database cannot be mounted and it is in a dirty shutdown state and the log files which are required are missing..... (One messed up situation to be in right?)
But thankfully you have a full backup from last night and we can use that to restore the database but in the mean time you want users to have temporary email access so that they can at-least send and receive emails while you recover the failed database in the background and that my friends calls for a Dial tone recovery!
What I will show you is how you can recover a failed database in the background while the users have temporary access to a new database and once the old database is restored we will merge all the information together (If the last sentence does not make any sense.. doesn't matter just follow the below procedure!)
- As you can see below the database by the name of "EXW" is dismounted and I don't have the log files to mount it successfully, so what I am going to do is go to the database location and copy out the files from there and also copy the log files to an alternate location (We will require the log files at a later stage)
After the database and the log file folders are empty, try and mount the database and test email flow. So now you have a situation where the users can connect to the server and send/receive emails but cannot access the old information, so lets work on restoring the old database from backup.
- Create a Recovery Database using powershell with the below command
New-MailboxDatabase -Recovery -Name RecoveryDB -Server <servername> -EdbFilePath <path> -LogFilePath <path>
- Verify that the recovery database is created and dismounted using the exchange console (Dont mount this database as yet)
- Then go to your backup application and restore the failed database from the last good backup which was completed and re-direct the files to the newly created recovery database folder and also dont select the option to replay the log files after the restore has been completed. (We will perform the soft recovery manually)
- After the database has been successfully restored along with the log files it will be in a "Dirty Shutdown" state you can check that by using the ESEUTIL command and also you can see the state as "Dirty Shutdown" and the Logs which are required for this database.
Eseutil /mh <drag and drop the recovered edb file in command shell>
- Next what you need to do is replay the log files in the database to bring it to a clean shutdown but there is something else which has to be taken into account. The backup which was restored was from last night and the server crashed lets say sometime in the afternoon the following day so there would be some emails which were sent and recived after the full backup was completed and we have those log files with us (Remember in STEP 1 I asked you to copy the log files of the failed database to an alternate location)
- So copy those log files in the location where the database was restored from backup
- After that open up the shell and and issue the below command to perform a soft recovery
Eseutil /R E00 /l<path to the log files> /d<path to the database file> /i /a
- Once the soft recover has been completed perform an eseutil /mh on the recovered database file and see if its in a clean shutdown (If everything went well it should be)
- Rename the recovered database file to the filename you have used while creating to Recovery Database in a the earlier step (I had created the recovery database with the file name as "Recover.edb")
- Also make sure under the properties of the Recovery Database in the EMC the value for "This database can be overwritten by a restore is checked"
- Mount the recovery database using the EMC and once it successfully mounts you can dismount it.
So now we are in a situation where the users are accessing the temporary database to send and receive email without having access to all the old information ofcourse and you have successfully restored the failed database from backup and also replayed all the log file in it upto the point of failure to get it as up to date as you possibly can.
Now what you need to do is basically switch the temporary database files and the recovery database files between each other. So go ahead and dismount the production database (The users will face and outage when you do this but if you follow what I say correctly then outage will be minimal)
- Once the Production database is dis-mounted copy the database and the log files to a safe location on your server
- Next rename the dismounted recovery database file which in my case is "Recover.edb" to the name which matches the production database file (Mine is Exw.Edb) and place it under the folder of the production database.
- Mount the Production database and once completed the users can connect to it again and this time they will have access to ALMOST all the old information before the failure.
- Now we need to merge the new information from the temporary database that we had mounted back to the production database so that the recovery process is complete.
- Rename the temporary database file to the name of the recovery database file (In our case since we had mounted a blank database and used the file name "EXW.EDB" to act as the temporary database... we need to rename this to "RECOVERY.EDB")
- Once you change the name of place the file in the location of the recovery database you should be able to mount it successfully
- Now you need to merge the information and for that you are going to use to RESTORE-MAILBOX command using the EMS.
Get-Mailbox - Database EXW | Restore-Mailbox -RecoveryDatabase RDB
Once the below command has been completed you will see the below events in the application log for each user.
- You can now dismount and delete the recovery database and run a full backup of your exchange database immediately!!
So this ends your restoration process and you can now go ahead and continue browsing for point less information on the internet!