Recover a deleted mailbox from Exchange 2016

A mailbox was deleted in Exchange 2016 that should not have been, and the person needs it back. How long do I have and what is the procedure?

On premise Exchange 2016.

You likely have time, because Exchange 2016 does not immediately destroy a deleted mailbox, it disconnects and retains it and the recovery inside that window is a reconnect rather than a restore from backup:

1

Confirm it is retained: Get-MailboxStatistics -Database yourDB | where {$_.DisconnectReason -eq 'Disabled' -or $_.DisconnectReason -eq 'SoftDeleted'} lists disconnected mailboxes. Your mailbox should appear with its DisconnectDate, and the deleted mailbox retention period, 30 days by default, counts from there.

2

Reconnect it to a user account: if the person's AD account still exists and lacks a mailbox, Connect-Mailbox -Database yourDB -Identity 'DisplayName' -User 'domain\user' reattaches the retained mailbox to them, everything back as it was.

3

Handle the account also gone case: if the AD account was deleted too, recreate or restore it first, then connect the retained mailbox to the fresh account, the mailbox contents surviving independent of the account through the retention window.

4

Verify the person has their mail and calendar back, then review how the deletion happened, since a mailbox deleted by mistake usually points at a process worth tightening.

Past the retention window the answer changes entirely, from reconnect to restore from backup, so acting inside the 30 days matters. And the retention period itself is adjustable, Set-MailboxDatabase -MailboxRetention, worth extending on databases where deletion mistakes have happened before, buying a longer safety net for the price of some database space. The backup restore path, recovery database and mailbox merge, is the fallback the retention window exists to keep you from needing.

Found it disconnected with 26 days left, the AD account still existed so Connect-Mailbox reattached it in seconds and everything was back. Extended MailboxRetention to 60 days afterward since this is the second time this year. The reconnect versus restore distinction saved me spinning up a recovery database needlessly.