Report NDRs because a mailbox was full for the previous day

If you have service levels to maintain in your environment and a finite amount of disk space, there is a pretty good chance that you have mailbox quotas set to prevent users from over running your storage space.

Periodically you may be asked to report on the messages that were rejected for your environment because of full mailboxes.  When Exchange rejects a message because a user’s mailbox is full, it generates an NDR (Non-Deliverable Report) with a status code of 5.2.2.  You can search the Message Tracking Logs for this status code to determine who failed to receive messages due to their mailbox being full.

The following oneliner will produce a simple CSV report at %temp%\TooFullNDR.csv that includes the sender, recipient, message timestamp and recipient status (for further diagnosis if needed) for the most recent 24 hour period.

get-transportserver | Get-MessageTrackingLog -EventId fail -start (date).adddays(-1) | where {$_.recipientstatus -like "550 5.2.2*"} | select timestamp, sender, @{Name="Recipients"; Expression={[string]::join(";",$_.recipients)}}, messagesubject,@{Name="RecipientStatus";Expression={$_.recipientstatus}} | export-csv $env:temp\fullndr.csv –NoTypeInformation

This is a sample of what the above will output if you didn’t capture it as a CSV.

Timestamp       : 11/07/2008 3:32:18 PM
Sender          :
Recipients      :
MessageSubject  : Urgent: past due invoice
RecipientStatus : 550 5.2.2 STOREDRV.Deliver: mailbox full. The following infor
                  mation should help identify the cause: "MapiExceptionShutoffQ
                  uotaExceeded:16.18969:AA000000, 17.27161:00000000D40000000000
                  00000F00000000000000, 255.23226:9D000000, 255.27962:FE000000,
                   255.17082:DD040000, 0.26937:94000000, 4.21921:DD040000, 255.
                  27962:FA000000, 255.1494:34000000, 255.26426:FE000000, 4.7588
                  :0F010480, 4.6564:0F010480, 0.22086:0F010480, 4.4740:05000780
                  , 4.6276:05000780, 4.23921:EC030000, 6.21970:0F01048040000C68
                  0F010480, 4.23921:EC030000, 6.21970:0F01048000806F670F010480,
                   4.24305:0F010480, 4.5721:DD040000, 4.6489:DD040000, 4.2199:D
                  D040000, 4.17097:DD040000, 4.8620:DD040000, 255.1750:71040000
                  , 0.26849:0F010480, 255.21817:DD040000, 0.26297:0F010480, 4.1
                  6585:DD040000, 0.32441:0F010480, 4.1706:DD040000, 0.24761:000
                  00000, 4.20665:DD040000, 0.25785:00000000, 4.29881:DD040000".
This entry was posted in Exchange 2007, Lotus Notes Conversion, PowerShell. Bookmark the permalink.