Request for testers: BES Exchange Ref ID / Folder ID script
Last week we ran into a situation at work where we needed to translate the Ref IDs and Folder IDs in the BES logs into the actual items in a user's mailbox. I couldn't find a way to do this, and our contact at RIM didn't know of a way either, other than poking around in the mailbox with MFCMAPI or OutlookSpy.
That's a really slow way of searching for a known ID, so I decided to write a script that would scan through a mailbox and dump some relevant information about each item as tab-delimited text. Specifically, the To/From, Subject, Sent/Received information about the items as well as the Ref ID and Folder ID tags that the BES applies. Once the data is dumped, it can be opened in e.g. Excel so that the Ref ID or Folder ID can be searched on.
This was made a little more complicated because RIM tags their custom fields using ANSI strings instead of Unicode like they're supposed to (maybe Exchange 5.5 uses ANSI? We only have 2003), but I was able to teach VBScript how to cast an ANSI string as Unicode.
Anyway, now that I think I have it working, I thought I would post it here in case anyone else would like to try it out. I would appreciate comments, and if it doesn't work for someone, it would be helpful to know which version of the BES and Exchange they are running, and on what OS(es).
The usage is from the command line, and is in the form:
cscript -nologo DumpMailboxItemData.vbs SERVER MAILBOX > Output.txt
Where SERVER is the user's Exchange server and MAILBOX is the name of the user's mailbox.
Obviously it needs to be run in the context of an account with at least read access to the target mailbox (e.g. BESAdmin).
Once the script finishes, the output text file can be opened in e.g. Excel and the Ref or Folder ID from the logs searched on.
I tested this on a 600MB mailbox being read over a WAN link and it took about half an hour. Running it locally on the Exchange server where the actual mailbox resides should be pretty speedy.
- Only messages created after activation are tagged with the Folder and Ref ID data.
- If a message is tagged, then the userxxx8217;s handheld is wiped and Enterprise Activated again, the previous messages will still be tagged, but those tags will not be updated by the BES. This can lead to inconsistencies in the field information for older items, particularly when trying to figure out which folder is mapped to by a particular Folder ID.
- Only email is tagged, not calendar appointments or contacts.
- Messages moved to the Deleted Items folder in Outlook do not have their Folder ID tag updated. This can be useful in determining which folder they were deleted from.
- The script can be customized to grab other fields, and/or not apply the ANSI -> Unicode cast if necessary.
very interesting script. The only problem i have when mailbox name is in the form of lastname, firstname. There is comma and space between them. I tried to use "lastname, firstname" but your script does not like that.
Any hints on how to supply mailbox with spaces in it?
Hi RipThorn. Did you put the "lastname, firstname" in quotation marks? I just tried that from the command line like this:
cscript -nologo DumpMailboxItemData.vbs someserver "lincoln, ben"
...and it worked correctly.
If that doesn't work for you, what error are you getting? Also, as a workaround, you should be able to use the SAM account name for the account associated with the mailbox if you use those on your domain.
I fixed it. It was permission issues rather than mailbox name. I was using exchange admin account to do that. Once i switched to bes admin account your script works perfectly.
After running it i have more question
I don;t see any calendar entries. I have a user that keeps getting calendar reminders but when you try to open it just gives you 'Appointment deleted externally. Changes will be lost and the viewer closed'.
And when you go to Outlook there is no calendar entries.
I was hoping that somehow i could trace calendar ref's and match them in user's Outlook calendar items
Cool! I'm glad it works.
If you put a single quote in front of this line:
gObjFolderExcludeHash.Add "Calendar", "Calendar"
(so it looks like this)
'gObjFolderExcludeHash.Add "Calendar", "Calendar"
It will remove the calendar from the exclusions list, and then when you run the script those items will be in the output.
I excluded it when running it myself because at least with the way our BES systems are configured, we don't get log entries for calendar appointments that include Ref IDs, and I didn't see anything that looked like a custom RIM field in the appointments like there are in the regular messages.
Do you know what the log level is set to on your BES? I might be able to tweak ours and figure out what the BES is using to track calendar appointments, which would help answer your question.
I was trying this and keep getting the follwing error when running the script.
the syntax used is:
cscript -nologo DumpMailboxItemData.vbs servername "firstname lastname"
the error i get is:
DumpMailboxItemData.vbs (1,7) MS VBScript compilation error: syntax error
I am also using the account which has all the required permissions
got it to work, had accidently entered a character in the script
All of my logs including MAGT are set to 4. should i bump it to 5 maybe?
Anywho. User got this reminder again for July 27, 2007 9:00 am July 27, 2007 9:30am.
Trying to click to open - appointment appears with no subject line or location, shows as none (for reocurrence)
I've run your script this time i enabled Calendar but can;t seem to find anything at 9:00am
this is driving me nuts
I don;t see any ref id for those calendar entries
below is your script in action
Folder Sender Recipient Subject Sent Received PR_RIM_MSG_REF_ID PR_RIM_MSG_FOLDER_ID
\Calendar Mah, Tina [NULL] Telecon HR [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Balance of care data submission [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Lissa [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Glenn on call [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Hair cut [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Dentist [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Dentist [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Vacation [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Helen [NULL] [NULL] [NULL] [NULL]
\Calendar Mah, Tina [NULL] Inta on-call 7/20/2007 14:47 7/20/2007 14:47 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Tina on-call 7/20/2007 14:48 7/20/2007 14:48 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Kim on-call 7/20/2007 14:49 7/20/2007 14:49 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Glenn on-call 7/20/2007 14:49 7/20/2007 14:49 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Brent on-call 7/20/2007 14:49 7/20/2007 14:49 [NULL] [NULL]
\Calendar Poll, Chris [NULL] Canceled: Operational Planning - Latest Version 7/23/2007 8:52 7/23/2007 8:52 [NULL] [NULL]
\Calendar Gra, Claire [NULL] Follow up to meeting with WWLHIN re. ALC's 7/23/2007 13:34 7/23/2007 13:34 [NULL] [NULL]
\Calendar Gra, Claire [NULL] LHINvitation - "Champions of Change" Symposium 7/23/2007 13:48 7/23/2007 13:48 [NULL] [NULL]
\Calendar Gra, Claire [NULL] Annual Report & APs 7/23/2007 15:43 7/23/2007 15:43 [NULL] [NULL]
\Calendar Be, Dawn [NULL] Canceled: Corporate Score Card Refresh Project 7/24/2007 15:29 7/24/2007 15:29 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Board meeting 7/24/2007 16:29 7/24/2007 16:29 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Meeting re. the P Drive 7/25/2007 0:20 7/25/2007 0:20 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Research Day 7/25/2007 0:22 7/25/2007 0:22 [NULL] [NULL]
\Calendar Mah, Tina [NULL] Meeting Toronto 7/26/2007 13:52 7/26/2007 13:52 [NULL] [NULL]
\Calendar Mah, Tina [NULL] no meetings 7/26/2007 16:39 7/26/2007 16:39 [NULL] [NULL]
If the 9:00AM appointment is a recurring one, it might not show up in the output in the place you expect it to. Is there anything suspicious if you look by the subject line?
If you are comfortable using its interface, MFCMAPI might let you find and delete the problem appointment too.
Also, the reason I was asking about your log levels is I thought you were seeing Ref IDs for calendar appointments in your BES logs. Maybe I misunderstood? I don't see anything in our logs for appointments other than a notification that a sync happened.
Hey - sweet script! This will be very useful thanks :smile: We use Exchange 5.5, so I had to use the mailbox alias as opposed to the display name in order for MAPI to log on.
EDIT: Same NULLness problem with calendar appts/mtgs as RipThorn ^^^
There is not subject or body or location details. nothing
When you open it it just says Appointment delete externally. Viewer will now close. Very weird
I created a separate entry for this problem.
Here is an updated version of the script that also tries to find a RefID for calendar items. This is hot off the presses (and the way the BES stores the calendar RefIDs is fairly complicated), so I would definitely appreciate hearing from people regarding whether it works or not.
There is a separate column for the calendar RefIDs because they're obtained in a different way.
I found a better way to get the reference to the BlackBerry calendar data. Here is an updated version of the script that should also run a bit faster as well as catching more of the appointments' RefIDs:
hi guys, my scripting knowledge is poor so looking for a hand!
I've run the script as I need to get some refID's out of a mailbox.
All I get is 3 prompts, which are handed out by the lines
WScript.Echo "Missing one or more arguments."
WScript.Echo "Usage: cscript -nologo DumpMailboxItemData.vbs28 [SERVER] [MAILBOX]"
WScript.Echo "Example: cscript -nologo DumpMailboxItemData.vbs mailserver01 blincoln"
do I just edit these lines and replace parts of them with the correct servername and mailbox or is there somewhere else I need to input these?
Any help greatly appreciated
it's ok guys, got it working now. saw the bit about running it from the command line and passing the parameters that way!!
Problems Running Script
I have not much of a clue on scripting and was after some help ? I have got the updated script file which i basically saved as a .vbs file and tried to run with the suggested Syntax. I get an error saying
\DumpMailboxItemData1.vbs(364, 1) Microsoft VBScript compilation error: Expected statement
The syntax i used to run it was as follows
\cscript -nologo DumpMailboxItemData1.vbs server samaccountname > Output.txt
Anyhelp would be appreiated as we have a user that BES doesnt like and we are expeting it t be somthing dodgey in the mail account ?
Sorry guys just figured that line was ------------- :)
I removed this and now get the following,
DumpMailboxItemData1.vbs(106, 2) Microsoft VBScript runtime error: ActiveX component can't create object: 'mapi.session
??Any help would be great
RefId is not returned.
When trying to get RefID I get:
Collaboration Data Objects - [MAPI_E_NOT_FOUND(8004010F)]
for both items in gArrFieldsToRead.
You are using the 1.2 version from later in the thread, right? If not, start by using that one. If that isn't the problem, try changing this line:
Const gCastFieldNamesANSIToUnicode = True
Const gCastFieldNamesANSIToUnicode = False
...and see if it works then. I heard something about RIM supporting Unicode in one of the more recent BES service packs.
If it *still* doesn't work after that, which version of the BES are you on?
Still no go!
Thanks blincoln, but it is to no avail!
I'm on BES 4.1.4 (Exchange).
I'm using the latest version here (1.2), but still getting the same issue with or without unicode flag being set.
A quick check of the mailbox using MDB Viewer (mdbvu32.exe) does not show any of the fields in gArrFieldsToRead (PR_RIM_MSG_REF_ID, PR_RIM_MSG_FOLDER_ID). I also tried looking for &H62030003 and &H62040003, but they are not there either. My device is definetley on the BES since I'm the BES "master"...
Also, I made a change to the script which some of the users my find useful - instead of EXCLUDE folders I added INCLUDE folders - so, if you want to check one folder quick, it would be much easier than specifying 50 folders to exclude.
I will post the mod as soon as I get the 2 fields to work..
|All times are GMT -5. The time now is 09:51 PM.|
Powered by vBulletin® Version 3.6.12
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.