Deleting a corrupt rule with MFCMAPI

On rare occasions in a Microsoft Office Outlook environment using Exchange Server, a user may be unable to delete a message or edit a server-side rule, perhaps the result of some form of item corruption or malformation. Outlook will typically return a somewhat non-descriptive error message such as “Action Failed” when attempting to remove the offending item. You can use a MAPI utility to identify, view, and delete the raw object directly from the store. Historically, MDBVU32.exe was the tool of choice.

The Microsoft Foundation Classes MAPI (MFCMAPI) utility, created and maintained by Stephen Griffin at Microsoft, simulates MAPI client access to data stores. It was really just sample extended MAPI code that evolved into an Exchange and Outlook utility and eventually replaced MDBVU32.exe as of Exchange 2007. MFCMAPI, recently renamed MAPI Editor, is updated every month or so with the latest version 6.0.0.1011 (January 2009) receiving a well deserved new icon reflected in Figure 1.

For a mailbox rule that can’t be edited or deleted using Outlook, you can use MFCMAPI to delete it. The most current version of MFCMAPI is available for download at Microsoft’s CodePlex site. MFCMAPI is typically run from the machine where the profile resides for the user that is unable to remove the offending item, in this case a rule. It really just needs a MAPI profile for the mailbox, so it can be run from any OS where a MAPI profile can be created. You will need to grant your account full permissions to the user mailbox. Also, to prevent logon to the local .ost file, disable cached mode prior to using MFCMAPI.

Launch MFCMAPI.exe and select Session, Logon and Display Store Table. If prompted, select the appropriate Outlook profile. You should now see a split window with different MAPI instances in the top frame similar to Figure 1. Double-click the Mailbox instance to get the Explorer-style window that allows you to see the folder hierarchy of the mailbox as shown in Figure 2. Expand the Root Container and then the object labeled Top of Information Store. Right-click the Inbox and select Open Associated Content Table. This will open a new MFCMAPI window showing the hidden messages for the inbox, including rules. Scroll the view in the top frame to the right to the Message Class column. The items of Message Class IPM.Rule.Message are the Outlook rules.

Incidentally, both server-side and client-side mailbox rules reside as hidden messages here. To identify a specific message (or rule), you’ll have to select the rule in the top pane in MFCMAPI and then scroll down in the lower pane to the property name ptagRuleMsgName and check the value against the rule name you were trying to delete in Outlook. Select the rule and click delete. This will prompt for a deletion type. To permanently remove the message, select DELETE_HARD_DELETE from the drop-down menu as shown in Figure 3. This process can be tedious where there are a lot of messages to view. You can also delete all the rules easily by selecting all items with the IPM.Rule.Message class. This delete is permanent and immediate. You can open Outlook again to confirm the rules are no longer present; go to the Tools menu, Rules and Alerts, and then look at the E-mail Rules tab.

As with any raw data tool, you should be warned that changing properties with MFCMAPI can lead to undesirable consequences. MFCMAPI gives access to so many properties in the information store, whether a local .pst or a mailbox in the Exchange Store. For example, I changed the received date of a message in my local .pst. I sent an email from a GMail account to my personal account which Outlook downloaded to my inbox. I closed Outlook and used MFCMAPI to view my inbox. I was able to sort by subject to identify the message, as shown in Figure 4. I changed the hexadecimal value for the MESSAGE_DELIVERY_TIME property using the Property Editor shown in Figure 5. There are other time values for CREATION_TIME, CLIENT_SUBMIT_TIME and LAST_MODIFICATION_TIME as well. Almost all MAPI message properties can be edited using MFCMAPI. Treat it with at least as much respect as your Registry Editor, because it is easier to restore the registry than your Exchange Server. As a final note, if you copied MFCMAPI to the user’s workstation to perform this task, don’t forget to delete it. It’s conceivable that a user could access his or her own mailbox with MFCMAPI.