New-MailboxExportRequest – Unable to Open PST File Access to the Path is Denied!

The New-MailboxExportRequest cmdlet is the most favored and used by the Exchange administrator when it comes to exporting data from mailboxes into PSTs. This particular cmdlet is vital in cases of backup, archive, and migration. One of the greatest challenges encountered by Exchange administrators is an error message:

“New-MailboxExportRequest: Access to the path is denied”

However, even after running the Exchange Management Shell (EMS) in administrator mode, you will face this problem. The only positive thing here is that this issue is generally not associated with any corrupted mailbox database or installation problems in your Exchange server.

This guide will help you find out the cause behind this error and then resolve it by following a few steps.

Understanding the Root Cause

To fix this problem, one needs to grasp how the mailbox export process works in Exchange. When issuing a New-MailboxExportRequest, Exchange does not do that using your admin credentials but rather hands over the work to another service, the Microsoft Exchange Mailbox Replication service (MRS).

However, being a network service, it follows other rules:

• No Local Paths: Exchange will not save the resulting PST file in a local directory like C:\PSTExports; it can only use network share paths.
• The Subsystem Account: The service uses a special security group called Exchange Trusted Subsystem to perform exports. This account must explicitly be granted access permissions to your desired location, otherwise, an “Access denied” error appears straight away.
• RBAC Role Assignment: Out of the box, even a domain administrator has no right to perform mailbox export operations on Exchange servers. The RBAC role must be assigned manually.

Step-by-Step Solution to Fix the Error

In order to export the mailbox, you need to go through these four different phases.

Phase 1: Add the Role “Mailbox Import Export” Role Assignment

Before proceeding with the folders, the most important thing is to ensure that your administrator’s account has all the RBAC permissions.

Step 1. Start the Exchange Management Shell (EMS).

Step 2. Type the following command on Powershell to check your role assignment:     

If this returns blank, you need to assign the role to your administrator account or group. Run this command:

Important note: Once you assign this role, remember that you need to stop and start Exchange Management Shell for the change to be effective.

Phase 2: Set up a Network Share (UNC path)

As we said before, Microsoft Exchange needs a Universal Naming Convention (UNC) path, like \\ServerName\ShareName\file.pst. You can’t use the usual path format.

1. Make a new folder on your server (for example, C:\ExchangePSTs).
2. Right-click on the folder and click Properties.
3. Go to Sharing tab and click on Advanced Sharing button.
4. Make sure to check Share this folder checkbox.
5. Write down the Network Path from there – you’ll need it for your PowerShell command.

This is where 90% of “Access denied” errors are born. You must grant rights to both the network share and the underlying Windows file system (NTFS).

Setting Share Permissions:

Step 1. In the Advanced Sharing dialog box (from Step 2), select the Permission button.

Step 2. Select the Add button.

Step 3. Enter “Exchange Trusted Subsystem” and select Check Names. Select the OK button.

Step 4. Place a check mark against Full Control on the “Allow” column of Exchange Trusted Subsystem.

Step 5. Include your Administrator’s account here too with full control (it is optional).

Step 6. Select the Apply and OK buttons.

Setting NTFS / Security Permissions:

Step 1. Move to the Security tab in the properties of the folder.

Step 2. Select Edit and then click on Add.

Step 3. As always, enter “Exchange Trusted Subsystem,” confirm its selection, and click OK.

Step 4. Select “Exchange Trusted Subsystem” and make sure that the following permissions are selected: Modify, Read & execute, List folder contents, Read, and Write.

Step 5. Click Apply and OK.

Testing the Export Request

At this point, you are ready to try running your export command once more.

Fire up your new Exchange Management Shell instance and proceed to run your command with your newly established UNC network path:

Monitoring the Progress

The export process is asynchronous in nature; therefore, your terminal window will get an indication of successful execution but the file generation itself may require some time. You can check the status of the export process using the below cmdlet:

Check the Status column where it will be changing its value from Queued, InProgress, to Complete. In case the status indicates a failure, you can explore the root cause of the problem using:

Alternative Solutions and Best Practices

Assuming you have checked your permissions correctly and yet are facing problems, you can try these further administrative procedures:

1. Clear out Old Requests

Exchange maintains logs of old requests to export mailboxes. In case there was any failure or pending requests in the past, these might interfere with the new export request. You can clear out these requests by:

2. Validate File Extension

Make sure that the target file name contains “.pst” as its extension in your command. The omission or misspelling of the file extension or network path format will trigger the failure in write process for Exchange server to revert to the “access denied” error code.

3. Verify Available Disk Space

Check if there is sufficient space on the drive where your network drive is located. For example, if your mail box size is 40GB while the disk space available is only 20GB, then the MRS service will prematurely interrupt the write process with path access error message.

Epilogue

In the write-up we will be exploring multiple ways to resolve “new mailboxexportrequest unable to open pst file access to the path is denied” error. One may go through the entire write-up and use a method that is most suitable for their requirements. And no matter which solution you are using, make sure to take backup of PST files using MacMister PST Converter for Mac & Windows. It is a solution that has the ability to transfer PST database into 15+ saving options such as PST, HTML, DOC, Yahoo, Gmail, Office 365, OLM and more.