In Exchange 2010, the generating server for your Offline Address Books (OAB) can change, under certain conditions, without any admin intervention. The process described here happens only on Exchange 2010.

An Offline Address Book (OAB) is a collection of address lists downloaded by Microsoft Outlook so users can access recipient information and select/resolve recipients when composing messages offline or in Cached Exchange Mode. Offline address book generation (OABGen) is the process by which Exchange creates and updates the OAB. OAB generation occurs during the scheduled time – daily between 5:00-5:15 AM by default. You can customize the schedule and specify the originating Mailbox server for each OAB. The originating Exchange server generates new OAB files, compresses the files and then places them on a local share for web distribution. See Understanding Offline Address Books for more details.

Orphaned OAB Recovery is part of OAB maintenance; the goal is to recover orphaned offline address books. Orphaned is defined as "at least 25 hours overdue for an update". This is calculated based on the LastTouchedTime and Schedule properties of the OAB.

A single Exchange 2010 Mailbox server is selected in the organization to perform the Orphaned OAB Recovery task, and all Exchange 2010 Mailbox servers know the selected server using the same algorithm:

  1. List all the mailbox databases in the org
  2. Sort the list:
    1. First by server version
    2. Then lexically by objectGuid
  3. The owning server of the first database in the list is the "selected server"

All Exchange 2010 mailbox servers will log event ID 2001 in the Application event log, indicating that evaluation of OAB recovery has taken place:

Log Name: Application
Source: MSExchange OAB Maintenance
Event ID: 2001
Task Category: Orphaned OAB Recovery
Level: Information
Description:
The server responsible for performing the OAB recovery scan is <server>.

Event ID 2002 is logged on all Exchange 2010 Mailbox servers that are not selected to do OAB recovery:

Log Name: Application
Source: MSExchange OAB Maintenance
Event ID: 2002
Task Category: Orphaned OAB Recovery
Level: Information
Description:
Because this server is not the one responsible for performing the OAB recovery scan, the task is exiting.

Events 2003 and 2004 are loggedOn the Exchange 2010 Mailbox server that is selected to perform OAB recovery:

  • Log Name: Application
    Source: MSExchange OAB Maintenance
    Event ID: 2003
    Task Category: Orphaned OAB Recovery
    Level: Information
    Description:
    Orphaned OAB recovery scan has begun.

  • Log Name: Application
    Source: MSExchange OAB Maintenance
    Event ID: 2004
    Task Category: Orphaned OAB Recovery
    Level: Information
    Description:
    Orphaned OAB recovery scan has been completed.

Event ID 2005 is generated on selected server if no orphaned offline address books are detected:

Log Name: Application
Source: MSExchange OAB Maintenance
Event ID: 2005
Task Category: Orphaned OAB Recovery
Level: Information
Description:
No orphaned offline address books were found.

Event ID 2006 is generated on the selected Mailbox server when an orphaned OAB has been detected:

Log Name: Application
Source: MSExchange OAB Maintenance
Event ID: 2006
Task Category: Orphaned OAB Recovery
Level: Warning
Description:
<number of orphaned OAB detected> orphaned offline address books were found. The OAB Maintenance Servicelet will attempt to move these offline address books to functioning servers.

Then Recover Orphaned OAB Process is executed on the selected server and event ID 2007 is logged for each orphaned OAB detected:

Log Name: Application
Source: MSExchange OAB Maintenance
Event ID: 2007
Task Category: Orphaned OAB Recovery
Level: Information
Description:
The offline address book \Default Offline Address Book was successfully moved to server <MBX server>.

Tracking Offline Address Book Moves

To move the orphaned OAB to the selected Mailbox server, the process executes a Move-OfflineAddressBook command for each orphaned OAB using the system account [NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)"].

Note: You can also use the cmdlet to manually move the OAB generation process to another Mailbox server.

This command searches the admin audit log for all such moves between 1/5/2011 and 5/5/2011:

Search-AdminAuditLog -StartDate 01/05/2011 -EndDate 05/05/2011 -Cmdlets Move-OfflineAddressBook

RunspaceId : 34b7d8a3-5c29-4b94-9d9a-143b84a02416
ObjectModified : \ Default Offline Address Book
CmdletName : Move-OfflineAddressBook
CmdletParameters : {Identity, DomainController}
ModifiedProperties : {Server, LastTouchedTime}
Caller : NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)
Succeeded : True
Error : None
RunDate : 23/04/2011 13:21:00
OriginatingServer : (14.xx.xxxx.xx)
Identity : RgAAAAB7eTSlvjteQbvq59MpPJ50BwBXybVCyQZoTb5TtcDmP1TaAAAAA4udAABXybVCyQZoTb5TtcDmP1TaAAAIOUcPAAAJ
IsValid : True

Caller is "NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)"

Summary

In Exchange 2010, the Offline Address Book generating server can be changed with no admin action if specific OAB is deemed orphaned. Event ID 2006 [MSExchange OAB Maintenance] needs to be monitored.

Event ID 2007 [Source: MSExchange OAB Maintenance] will give us the information about what has changed as part of this process.

You can find the OAB recovery server by using the following steps:

  1. Restart “Microsoft Exchange Service Host” service on one of mailbox servers
  2. Check event ID 2001 logged by MSExchange OAB Maintenance in the Application event log:

    Log Name: Application
    Source: MSExchange OAB Maintenance
    Event ID: 2001
    Task Category: Orphaned OAB Recovery
    Level: Information
    Description:
    The server responsible for performing the OAB recovery scan is <server>.

Pierre Touratier