Eseutil Explained — How to Repair Exchange and Outlook Databases the Right Way

Eseutil (Extensible Storage Engine Utility) is a Microsoft command-line tool used to repair, recover, check integrity, and defragment Exchange Server and Outlook databases stored in the Extensible Storage Engine (ESE) format — including .edb and .stm files. It ships with Exchange Server and is also present on systems with Outlook installed.

Part 1. What Eseutil Does and When to Use It

Eseutil operates directly on ESE database files at a low level. It is not a general-purpose file recovery tool — it is specifically designed for databases managed by the ESE engine, which includes:

• Exchange Server mailbox databases (.edb files)
• Outlook offline data files (.ost files — in some Exchange configurations)
• Active Directory database (ntds.dit — Eseutil works on this too, though AD has its own repair tools)

⚠️ Important: Never run eseutil /p (hard repair) as a first step. Hard repair physically removes corrupted pages from the database, which means data on those pages is permanently discarded. Always attempt soft recovery (/r) first and verify log replay options before running /p.

Part 2. Eseutil /r — Soft Recovery (Start Here)

Soft recovery replays transaction logs (.log files) to bring a database from a "dirty shutdown" state to a "clean shutdown" state. Most Exchange and Outlook database corruption issues are actually dirty shutdowns — the database was open when the system crashed, not physically corrupted.

Syntax:

eseutil /r <log prefix> /l <log path> /d <database path>

Example for Exchange:

eseutil /r E00 /l "C:\ExchangeDB\Logs" /d "C:\ExchangeDB\"

• E00 is the default log file prefix for Exchange mailbox databases. Your prefix may differ — check the database properties in Exchange Admin Center.
• If the log files are in the same directory as the database, /l can be omitted.

Check database state before running:

eseutil /mh "mailbox.edb" | findstr "State"

If the state shows Dirty Shutdown, run soft recovery. If it shows Clean Shutdown, the database is already consistent and does not need recovery.

💡 Tip: Always check the database state with eseutil /mh before attempting any repair or recovery operation. A clean shutdown database that shows errors may have logical corruption at the application layer, which Eseutil cannot fix.

Part 3. Eseutil /p — Hard Repair (Last Resort)

Hard repair physically removes pages that fail checksum verification. This can get a severely corrupted database to mount, but it discards any data stored on the corrupted pages.

Syntax:

eseutil /p "C:\ExchangeDB\mailbox.edb"

Before running hard repair:

1. Make a copy of the .edb file. Hard repair modifies the file in place and cannot be undone.
2. Run soft recovery first (Part 2).
3. Run integrity check: eseutil /g "mailbox.edb" — this identifies how many pages are damaged.
4. Accept that data on corrupted pages will be lost permanently.

After a hard repair completes, you must run a defragmentation pass:

eseutil /d "C:\ExchangeDB\mailbox.edb"

Then mount the database in Exchange and run New-MailboxRepairRequest to fix any residual logical corruption at the mailbox level.

🗣️ r/exchangeserver user: "Eseutil /p got our database to mount but we lost about 40 emails. The key thing is doing a copy first — the repair is destructive. We then restored those emails from a previous backup once the database was stable."

Part 4. Eseutil /d — Offline Defragmentation

After a hard repair, or periodically for large Exchange databases, offline defragmentation reclaims whitespace and compacts the .edb file. It creates a new, defragmented copy of the database.

Syntax:

eseutil /d "C:\ExchangeDB\mailbox.edb"

By default, Eseutil creates a temporary file in the same directory as the database. You need free disk space equal to the full size of the database during this process.

💡 Tip: For Exchange Server databases larger than 500 GB, offline defragmentation can take many hours. Schedule it during a maintenance window and monitor the temp file size to ensure you do not run out of disk space mid-operation.

Part 5. Eseutil vs. ScanPST — Which to Use?

ScanPST.exe (Inbox Repair Tool) is Microsoft's tool for repairing Outlook .pst and .ost data files on client machines. Eseutil is for server-side Exchange .edb databases.

If your users report Outlook errors with .ost or .pst files on their local machines, use ScanPST — not Eseutil. Eseutil on a client .ost file is technically possible but not supported by Microsoft for that purpose.

🗣️ r/sysadmin user: "We had a Junior admin run eseutil on a user's .pst thinking it was a server database. It completed without error but did nothing useful. ScanPST is the right tool for client-side files. Know which type of file you're dealing with before you start."

Part 6. Recover Deleted .edb or .ost Files

If an Exchange .edb file or an Outlook .ost file was accidentally deleted from disk, standard data recovery tools can retrieve it from the drive sectors — provided the drive has not been heavily written since the deletion.

Ritridata can recover deleted .edb and .ost files from NTFS volumes. Run the scan immediately after discovering the deletion, before any further large write operations occur on the drive. Once recovered, use Eseutil's integrity check and soft recovery to assess and repair the recovered database file.

Download Ritridata

FAQ

Q: Where is Eseutil located on my system? A: On Exchange Server, Eseutil.exe is in C:\Program Files\Microsoft\Exchange Server\V15\Bin\. On systems with Outlook installed, it may not be present — Eseutil ships with Exchange Server, not standalone Outlook.

Q: Can I run Eseutil while the Exchange database is mounted? A: No. Most Eseutil operations require the database to be dismounted from Exchange. Use Dismount-Database in Exchange Management Shell before running Eseutil.

Q: Eseutil /p says "Operation completed successfully" but Exchange still won't mount the database — why? A: A successful hard repair means Eseutil finished without crashing, not that the database is fully healthy. After /p, run /d (defrag) and then attempt to mount. If it still fails, the database may need to be restored from backup.

Q: How do I know which log prefix to use with eseutil /r? A: Run eseutil /mh "mailbox.edb" and look for the "Log Required" or "Base Name" field in the output. This shows the log prefix and the range of log files needed for soft recovery.

Q: Does Eseutil work on Active Directory? A: Yes. Eseutil can repair the AD database (ntds.dit) but Microsoft recommends using ntdsutil for AD-specific repairs. Eseutil on ntds.dit should only be used when ntdsutil-based repair has failed.

References

• Microsoft: Eseutil command reference
• Microsoft: Exchange database repair
• Microsoft: ScanPST — Repair Outlook data files
• Microsoft: New-MailboxRepairRequest
• Microsoft: Exchange backup and restore concepts