Failed to Backup Mailbox (No Access)

A Mailbox-Level backup produces errors similar to the following:

Failed to backup mailbox ___ on ___. The mailbox is hidden, disabled, deleted or user ___ does not have access to it.

This error likely will repeat each time the backup runs. It is possible this error is thrown for all mailboxes in the backup set or only a handful of them. Recreating the backup set does not usually fix this issue.

Explanation

When the backup software attempts to locate a mailbox it is backing up, there are a few things which may prevent it from locating or accessing that mailbox. If the mailbox is hidden, disabled, or deleted, it cannot be accessed by the Backup Agent. Also, the Backup Agent will attempt to locate mailboxes using their SMTP addresses. If the mailboxes in an Exchange instance have irregular SMTP addresses, this will cause some of them to be inaccessible. Additionally, if the Application Impersonation role has not been applied then the Backup Agent will have problems accessing some mailboxes.

Resolution

Hidden, Disabled, or Deleted Mailboxes

You can use the following Exchange Management Shell commands to get a list of mailboxes that are hidden, disabled, or deleted.

Hidden Mailboxes

Get-Mailbox | Where {$_.HiddenFromAddressListsEnabled -eq $True} | Select Name, Alias, HiddenFromAddressListsEnabled

Disabled or Deleted Mailboxes

Get-MailboxDatabase | Get-MailboxStatistics | where {$_.DisconnectDate -ne $Null} | Select DisplayName, Database, DisconnectDate

After determining which mailboxes are hidden, disabled, or deleted, you will need to restore or expose those mailboxes in order for them to be backed up.

Application Impersonation

If the service account being used to conduct Mailbox Level backups does not have Application Impersonation rights to a mailbox, it will not be able to retrieve mail from that mailbox. First, make sure you have created the Application Impersonation role and assigned it to the service account. Then use the following method to test if the service account can impersonate a specific mailbox:

1. Download, extract, and run EWSEditor from this link.
2. Go to File and then New Exchange Service... to open the Exchange Service Configuration window.
3. Fill in the following fields to test impersonation:
   
   • Service URL - Enter the EWS URL you used for the Mailbox Level backup set.
   • EWS Schema Version - Make sure to select the version which matches the Exchange version you are backing up.
   • Use the following credentials instead of the default Windows credentials - Enter the username, password, and domain of the service account you are using for Mailbox Level backups.
   • Check if using EWS Impersonation - Check the box next to this option, make sure Id Type is set to SmtpAddress, and type the email address of the mailbox you want to test in the Id field.
4. When you hit OK, you should be able to open the mailbox as the service account if impersonation is working. If it is not, you will be shown an error screen. A successful test will look like the picture below:
   

Mailbox SMTP Addresses

Occasionally, the backup software will be unable to resolve the email address to the right mailbox in Exchange. This is usually due to the mailbox missing the SMTP address the software is looking for. The backup software will use the EWS URL and service account credentials to infer what the email address will be - however, this does not always match the existing SMTP addresses for all mailboxes. For example, if the error message was Failed to backup mailbox psherman on company.com, the Backup Agent is looking for the SMTP address psherman@company.com. If that SMTP address is missing, the backup software will not be able to find the mailbox.

To see the SMTP addresses for all mailboxes, you can use the following Exchange Management Shell command:

Get-Recipient | Select Name -ExpandProperty EmailAddresses | Select Name, SmtpAddress

To get the SMTP addresses for a specific mailbox, you can use this command:

Get-Recipient -Identity <username> | Select Name -ExpandProperty EmailAddresses | Select Name, SmtpAddress

...where <username> is the username of the mailbox you want to look up.