Locate PST Files on Remote Workstations

If you have Microsoft Outlook deployed in your organization or are planning a deployment, I am sure there have been conversations about PST (Personal Folder Storage) files:

There are a number of ways PST files can be controlled or managed. This includes:

1. Group Policy Templates – Reference
2. Custom Installation Wizard (CIW) or Custom Maintenance Wizard (CMW) from the Office Resource Kit (ORK) – Reference
3. Registry Modification – using a logon script perhaps

A challenge with methods 1 and 2 listed above is that most group policies and CIW settings only apply to New Outlook Profiles.

So the question arises: How do I know the name, location, and size of Existing PST files stored by information workers on local workstations? If you have already invested in migration tools, some can be used to ‘crawl’ workstations to gather this information. However, if you do not have the luxury of using such tools or are looking for a simpler solution, here is one which can be implemented via a login script:

The solution described in this blog is only a sample and will require additional coding to fully automate the process.

Disclaimer: Changes to the registry can cause undesired results including system instability. Please test this solution thoroughly before deploying into production.

ON CLIENT WORKSTATION

1. Navigate the registry to: HKEY_CURRENT_USER SoftwareMicrosoftWindows NTCurrentVersionWindows Messaging SubsystemProfiles

   If multiple profiles have been configured on the workstation, you will find a key representing each Outlook Profile.

2. Select an Outlook profile. For purposes of this blog, let’s say my Outlook Profile Name is "Outlook". So I select: HKCU SoftwareMicrosoftWindows NTCurrentVersionWindows Messaging SubsystemProfilesOutlook
   
3. Now search for a REG_BINARY value:
   • 001f6700 for Outlook 2003 – 2008
   • 001e6700 for Outlook 98 – 2000

   If multiple PST files exist on the workstation, your search will find multiple instances of the REG_BINARY value. Notice that the path to the REG_BINARY value changes for each instance of PST file. Example – If I have two Outlook PST files:

   The reference to my first PST file: "HLCU SoftwareMicrosoftWindows NTCurrentVersionWindows Messaging SubsystemProfilesOutlook627a9d56b540e64abb70db3817bd579301f6700"

   The reference to my second PST file: "HLCU SoftwareMicrosoftWindows NTCurrentVersionWindows Messaging SubsystemProfilesOutlook763cdcca473fe843ad8fd406044dfc9501f6700"
   

4. Read the Name and Path to the PST file. Oops, the data is in Binary. How do you read it? A Million Dollar question – The Answer at no charge J

If this was just one workstation, you could of-course read the value thru the Registry UI (sample below) – somewhat cryptic, but can be ascertained.

But what if we need to read this value programmatically? Here is a sample code in vbscript which shows how you can read this value programmatically (and the PST file size) using an explicit path to the Binary Key in the registry. Once you are familiar with the concept, you can easily write a wrapper to:

1. Enumerate Outlook Profiles
2. For Each Outlook Profile, find instances of the Binary Key
3. Read and/or Modify the Binary Key to manipulate the PST filename or path

Sample Script to read a single PST File Name, PST Path/Location, and PST File Size:

Const HKEY_CURRENT_USER = &H80000001

strComputer = "."

Revolutionize Your Business With Generative AI

From product design and software development to virtual agents, content creation, and reporting, GenAI is transforming business. Our AI experts help you unlock GenAI’s full potential and drive growth.

Let’s Get Started

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\" &_

strComputer & "rootdefault:StdRegProv")

strKeyPath = "SoftwareMicrosoftWindows NTCurrentVersionWindows Messaging SubsystemProfilesOutlook627a9d56b540e64abb70db3817bd5793"

‘Change the last value in the above key (right of Outlook) to reflect the path in the ‘registry where you can ‘find Binary values "001f6700" or "001e6700"

binValueName = "001f6700"

‘Change the above value to "001e6700" depending on version of Outlook

oReg.GetBinaryValue HKEY_CURRENT_USER,strKeyPath,binValueName,binValue

strPath = ""

For i = lBound(binValue) to uBound(binValue)

If binValue(i) <> 0 then

strPath = strPath & Chr(binValue(i))

End If

Next

strPSTFileName = Trim(strPath)

Set filesys = CreateObject("Scripting.FileSystemObject")

Set PSTFile = filesys.GetFile(strPSTFileName)

PSTFileSize = (PSTFile.Size/1024000)

WScript.echo "PST File Name: " & strPSTFileName & vbCrLf & vbCrLf & _

"PST File Size: " & PSTFileSize & " MB"

Once you have located the name and path to Outlook PST Files on workstations throughout your organization, you are now ready to do one or more of the following:

1. Enforce policies around existing PST files
2. Develop a plan to backup the Outlook PST files
3. Develop a plan to Archive e-mail using Microsoft or Third-Party archiving solutions
4. Develop a plan to Consolidate Outlook PST files to a network file share

   Hints:

• Use object.Move method to move the PST file
• Use object.SetBinaryValue method to write or modify a binary key in the registry