By Ashutosh GawaliIn this article, we will deep dive in the troubleshooting of MRM issues in Exchange Online.
Table of contents
Things to consider for MRM to process the mailbox.
- If the account for the mailbox is disabled and the mailbox type is regular, then MRM won’t process the mailbox.
- If the value of ElcProcessingDisabled is False, then the Managed Folder Assistant is allowed to process the mailbox.
- If the value of RetentionHoldEnabled is False, then retention hold is removed from the mailbox. The mailbox is subject to retention policies and managed folder policies.
If the mailbox is migrated by using the PST Import service, then the RetentionHoldEnabled parameter for the mailbox will set to True
- The Archive mailbox should enabled for the affected Primary mailbox and a Retention Policy containing a Retention tag (Move to Archive) should be applied on the mailbox.
- If the Archive mailbox is enabled for the Primary mailbox, but it is full, then the emails will not move to Archive mailbox as there is no space in the archive mailbox, in this scenario, we must enable Auto Expanding Archive for that user so another Aux Archive mailbox should be provisioned.
- In order to delete the email from the primary mailbox, there should not be any hold present in the mailbox.
- If the mailbox has a retention tag applied, but the retention tag is currently disabled, then no action (delete or archive) is taken on the email.
- Make sure that the Retention Policy applied on the affected mailbox, should not only have Personal Tag (Default and Retention Tags should also be present). If only the Personal Tag are present, then the personal tags needs to be manually applied on the folders by the Owner of the mailbox.
PS C:\Users\ashutosh> Get-RetentionPolicy -Identity "Default MRM Policy"
Name RetentionPolicyTagLinks Guid
---- ----------------------- ----
Default MRM Policy {Custom Personal Tag, 5 Year Delete, 1 Year Delete, 6 Month Delete, Personal 5 year move eeXXXXbb-0XX0-4XX1-8XX1-98XXXXXXXX14
to archive, 1 Month Delete, 1 Week Delete, Personal never move to archive, Personal 1 year
move to archive, Default 2 year move to archive, Junk Email, Recoverable Items 14 days
move to archive, Never Delete}- Use the below PowerShell command to confirm if there is any item present in the mailbox which is older than the retention age mentioned in the retention tag. (Check the value of OldestItemReceivedDate in the output)
PS C:\Users\ashutosh> Get-MailboxFolderStatistics -Identity aashu@aashu.co.in -FolderScope All -IncludeOldestAndNewestItems | fl FolderPath,*oldest*,*topsubject*
FolderPath : /Inbox
OldestItemReceivedDate : 05-09-2023 20:56:53
OldestDeletedItemReceivedDate :
OldestItemLastModifiedDate : 05-09-2023 20:56:56
OldestDeletedItemLastModifiedDate :
TopSubject :
TopSubjectSize : 0 B (0 bytes)
TopSubjectCount : 0
TopSubjectClass :
TopSubjectPath :
TopSubjectReceivedTime :
TopSubjectFrom :- Check the value of TopSubjectSize in the above Output, if the value is more than 35 MB (Example: 100 MB) then the size of email is 100 MB, by default the value of email send receive size of mailbox is 35 MB. In order for the email with 100 MB size to move to archive mailbox, we need to increase the default email send receive size of mailbox using the below command.
PS C:\Users\ashutosh> Set-Mailbox -Identity aashu@aashu.co.in -MaxReceiveSize 150MB -MaxSendSize 150MBUse MFCMAPI to check the retention tag.
We can use MFCMAPI tool to confirm the retention policy applied to the mailbox.
Download the MFCMAPI tool using the download link, If the Outlook on the machine is 64 bit, then download the 64 bit version of MFCMAPI tool.
- Setup the affected mailbox Outlook profile on machine.
- Open MFCMAPI, select Tools –> Options, and then select MAPI_NO_CACHE and MDB_ONLINE.
- Select Session > Logon, select the profile that contains the affected mailbox, and then select OK.
- Click twice on the affected mailbox, expand Root Container –> select Top of Information Store.
- Select Top of Information Store –> right-click Inbox, and then select Open associated contents table.
- Under Message Class column –> select IPM.Configuration.MRM and In the bottom pane, select the PR_ROAMING_XMLSTREAM property
- Double-click PR_ROAMING_XMLSTREAM, copy everything present in the Text section, paste it into Notepad, and then save the contents as an .xml file.
- After opening the .xml file in web browser, you will get to know all the tags applied on the mailbox.
Regenerates the IPM.Configuration.MRM File.
If you check the output of .xml file in web browser and find that there are several retention tags missing on the mailbox. In this scenario, delete the IPM.Configuration.MRM message that contains the PR_ROAMING_XMLSTREAM property using the below command.
PS C:\Users\ashutosh> Start-ManagedFolderAssistant -Identity aashu@aashu.co.in -FullCrawlExecuting the above command recreates the deleted IPM.Configuration.MRM message and updates the PR_ROAMING_XMLSTREAM to have the new policy tag.
Confirm MFA processing on mailbox.
Use the below command to confirm if the MFA is processing the mailbox, or to know, how many emails are attempted to be deleted or archived by MFA.
PS C:\Users\ashutosh> $logProps = Export-MailboxDiagnosticLogs "aashu@aashu.co.in" -ExtendedProperties
PS C:\Users\ashutosh> $xmlprops = [xml]($logProps.MailboxLog)
PS C:\Users\ashutosh> $xmlprops.Properties.MailboxTable.Property | ? {$_.Name -like "ELC*"}
Name Value
---- -----
ElcFaiDeleteStatus DeleteNotAttempted
ElcFaiSaveStatus SaveSucceeded
ElcLastRunArchivedFromDumpsterItemCount 0
ElcLastRunArchivedFromRootItemCount 0
ElcLastRunDeletedFromDumpsterItemCount 0
ElcLastRunDeletedFromRootItemCount 7
ElcLastRunSkippedNoTagItemCount 0
ElcLastRunSkippedNotExcludedItemCount 0
ElcLastRunSkippedWithTagItemCount 0
ElcLastRunSubAssistantProcessingTime 2283
ElcLastRunTaggedFolderCount 0
ElcLastRunTaggedWithArchiveItemCount 0
ElcLastRunTaggedWithExpiryItemCount 0
ElcLastRunTotalProcessingTime 8953
ElcLastRunUpdatedFolderCount 11
ElcLastRunUpdatedItemCount 0
ELCLastSuccessTimestamp 6/11/2024 4:39:06 AMImportant ELC Properties.
| ELC Property | Details |
| ElcLastRunArchivedFromDumpsterItemCount | The number of items MFA moved from the Recoverable Items folder structure to the archive mailbox. |
| ElcLastRunArchivedFromRootItemCount | The number of items MFA moved from the IPM folder tree into the archive mailbox. |
| ElcLastRunDeletedFromDumpsterItemCount | The number of items MFA deleted from the Recoverable Items folder structure. |
| ElcLastRunDeletedFromRootItemCount | The number of items MFA deleted from the IPM folder tree. |
| ElcLastRunUpdatedItemCount | The number of individual items that were tagged or untagged by MFA on its last run. |
| ElcLastSuccessTimestamp | The last time that MFA processed the mailbox without any errors. |
Check Mailbox Diagnostic Logs.
Execute the below command to export the mailbox diagnostic logs for the mailbox.
PS C:\Users\ashutosh> Export-MailboxDiagnosticLogs "aashu@maashu.co.in" -ComponentName MRMIf we get an error message [Logs for component ‘MRM’ weren’t found in mailbox], it means the MRM is processed on the mailbox without any errors.
But if we get the error message like [Microsoft.Exchange.WorkloadManagement.ResourceUnhealthyException: Resource’DiskLatency(Guid:xxxx Name:INDxx-db128 Volume:\?\Volume{xxxx})’ is unhealthy and shouldn’t be accessed OR Resource ‘Processor’ is unhealthy and should not be accessed] then it means that MFA is facing some issues with the mailbox and cannot be successfully executed on the mailbox. This type of error usually goes away after few days.
Export the email to check the properties.
Below are the steps to export the properties of any email using MFCMAPI tool.
In this example, we want to export the properties of an email which is currently present in the Junk Email folder.
- Download the MFCMAPI tool using the download link, If the Outlook on the machine is 64 bit, then download the 64 bit version of MFCMAPI tool.
- Setup the affected mailbox Outlook profile on machine.
- Open MFCMAPI, select Tools –> Options, and then select MAPI_NO_CACHE and MDB_ONLINE.
- Select Session > Logon, select the profile that contains the affected mailbox, and then select OK.
- Click twice on the affected mailbox, expand Root Container –> select Top of Information Store.
- Select Top of Information Store –> right-click Junk Email folder, and then select Open associated contents table.
- Once the Save Message To File options shows up, select the option Text file (saves all properties of message to a text file) and save the file as .xml file to the computer.
- Open the recently save .xml file from the computer to check all the properties of the email.
Example of email properties are PR_SENDER_EMAIL_ADDRESS, PR_MESSAGE_DELIVERY_TIME, PR_SENSITIVITY, PR_RECEIVED_BY_NAME.
Email Properties related to Retention Tags.
Below are the email properties that are related to Retention Tags on the mailbox.
- PR_ARCHIVE_DATE: Specifies the date and time in UTC, on this date the Item (email) will be archived.
- PR_ARCHIVE_PERIOD: Specifies the number of days that a Item (email) can remain unarchived.
- PR_ARCHIVE_TAG: Shows the GUID of an archive tag.
- PR_RETENTION_DATE: The date and time in UTC, on this date the Item (email) will be deleted.
- PR_RETENTION_PERIOD: The time period the item will be kept in the mailbox (not deleted).
- PR_POLICY_TAG: Specifies the GUID of a retention tag.
Above are the basic troubleshooting we need to perform in the issues with MRM not working or emails not deleting or moving to online archive mailbox from primary mailbox.