In Exchange 2010, the generating server for your Offline Address Books (OAB) can change, under certain conditions, without any admin intervention. The process described here happens only on Exchange 2010.
An Offline Address Book (OAB) is a collection of address lists downloaded by Microsoft Outlook so users can access recipient information and select/resolve recipients when composing messages offline or in Cached Exchange Mode. Offline address book generation (OABGen) is the process by which Exchange creates and updates the OAB. OAB generation occurs during the scheduled time – daily between 5:00-5:15 AM by default. You can customize the schedule and specify the originating Mailbox server for each OAB. The originating Exchange server generates new OAB files, compresses the files and then places them on a local share for web distribution. See Understanding Offline Address Books for more details.
Orphaned OAB Recovery is part of OAB maintenance; the goal is to recover orphaned offline address books. Orphaned is defined as "at least 25 hours overdue for an update". This is calculated based on the LastTouchedTime and Schedule properties of the OAB.
A single Exchange 2010 Mailbox server is selected in the organization to perform the Orphaned OAB Recovery task, and all Exchange 2010 Mailbox servers know the selected server using the same algorithm:
All Exchange 2010 mailbox servers will log event ID 2001 in the Application event log, indicating that evaluation of OAB recovery has taken place:
Log Name: Application Source: MSExchange OAB Maintenance Event ID: 2001 Task Category: Orphaned OAB Recovery Level: Information Description: The server responsible for performing the OAB recovery scan is <server>.
Event ID 2002 is logged on all Exchange 2010 Mailbox servers that are not selected to do OAB recovery:
Log Name: Application Source: MSExchange OAB Maintenance Event ID: 2002 Task Category: Orphaned OAB Recovery Level: Information Description: Because this server is not the one responsible for performing the OAB recovery scan, the task is exiting.
Events 2003 and 2004 are loggedOn the Exchange 2010 Mailbox server that is selected to perform OAB recovery:
Log Name: Application Source: MSExchange OAB Maintenance Event ID: 2003 Task Category: Orphaned OAB Recovery Level: Information Description: Orphaned OAB recovery scan has begun.
Log Name: Application Source: MSExchange OAB Maintenance Event ID: 2004 Task Category: Orphaned OAB Recovery Level: Information Description: Orphaned OAB recovery scan has been completed.
Event ID 2005 is generated on selected server if no orphaned offline address books are detected:
Log Name: Application Source: MSExchange OAB Maintenance Event ID: 2005 Task Category: Orphaned OAB Recovery Level: Information Description: No orphaned offline address books were found.
Event ID 2006 is generated on the selected Mailbox server when an orphaned OAB has been detected:
Log Name: Application Source: MSExchange OAB Maintenance Event ID: 2006 Task Category: Orphaned OAB Recovery Level: Warning Description: <number of orphaned OAB detected> orphaned offline address books were found. The OAB Maintenance Servicelet will attempt to move these offline address books to functioning servers.
Then Recover Orphaned OAB Process is executed on the selected server and event ID 2007 is logged for each orphaned OAB detected:
Log Name: Application Source: MSExchange OAB Maintenance Event ID: 2007 Task Category: Orphaned OAB Recovery Level: Information Description: The offline address book \Default Offline Address Book was successfully moved to server <MBX server>.
To move the orphaned OAB to the selected Mailbox server, the process executes a Move-OfflineAddressBook command for each orphaned OAB using the system account [NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)"].
Note: You can also use the cmdlet to manually move the OAB generation process to another Mailbox server.
This command searches the admin audit log for all such moves between 1/5/2011 and 5/5/2011:
Search-AdminAuditLog -StartDate 01/05/2011 -EndDate 05/05/2011 -Cmdlets Move-OfflineAddressBook
RunspaceId : 34b7d8a3-5c29-4b94-9d9a-143b84a02416 ObjectModified : \ Default Offline Address Book CmdletName : Move-OfflineAddressBook CmdletParameters : {Identity, DomainController} ModifiedProperties : {Server, LastTouchedTime} Caller : NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost) Succeeded : True Error : None RunDate : 23/04/2011 13:21:00 OriginatingServer : (14.xx.xxxx.xx) Identity : RgAAAAB7eTSlvjteQbvq59MpPJ50BwBXybVCyQZoTb5TtcDmP1TaAAAAA4udAABXybVCyQZoTb5TtcDmP1TaAAAIOUcPAAAJ IsValid : True
Caller is "NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)"
In Exchange 2010, the Offline Address Book generating server can be changed with no admin action if specific OAB is deemed orphaned. Event ID 2006 [MSExchange OAB Maintenance] needs to be monitored.
Event ID 2007 [Source: MSExchange OAB Maintenance] will give us the information about what has changed as part of this process.
You can find the OAB recovery server by using the following steps:
Pierre Touratier