3. How to determine if a Rebuild was run

One way to check for a Rebuild is to use the repadmin tool from the Windows 2000 Support Tools. Use ADSI Edit or LDP to get the distinguishedName of the RUS you are troubleshooting. Then, from a command line, run:

repadmin /showmeta "" >rusmeta.txt

The resulting text file will contain a list of properties on the RUS object. Find the line corresponding to the msExchDoFullReplication property:

298589 Default-First-Site-Name\BILONGEXCH1 298589 2004-06-29 17:10:59 2 msExchDoFullReplication

When an admin chooses Rebuild, msExchDoFullReplication is set to TRUE, and the RUS later sets it to FALSE after the Rebuild kicks off. By looking at the timestamp shown in the repadmin output, you can see when this attribute was last changed, and thus when a Rebuild was last run.

Another way to check for a Rebuild is to turn down the diagnostics logging on everything but Address List Synchronization, and leave Address List Synchronization at Medium. Then, watch the application log for the following events. When a Rebuild is initiated, event ID 8329 is logged:

Event Type: Information
Event Source: MSExchangeAL
Event Category: Address List Synchronization
Event ID: 8329
Description:
The Recipient Update Service is starting a rebuild of DC=bilong,DC=test

Then, about every 10% of the way through the entire range of USNs, the RUS will report the progress of the Rebuild in event ID 8332:

Event Type: Information
Event Source: MSExchangeAL
Event Category: Address List Synchronization
Event ID: 8332
Description:
The Recipient Update Service has started to export a block of entries from DC=bilong,DC=test, beginning at USN 1. It will finish processing the directory when it reaches USN 298599

When the Rebuild completes, the RUS will log an 8330:

Event Type: Information
Event Source: MSExchangeAL
Event Category: Address List Synchronization
Event ID: 8330
Description:
The Recipient Update Service has completed the rebuild of DC=bilong,DC=test

Note that running a Rebuild usually is not useful for troubleshooting. The only difference between a Rebuild and an Update Now is that Rebuild causes the RUS to start over from a USN of 1. Update Now starts from the highest USN last recorded by the RUS, which is stored in the msExchServer1HighestUSN property on the RUS object in the Active Directory. So if the RUS is not working as expected against new or modified objects (the objects that would be touched by an Update Now), running a Rebuild will not help. Because of the time it can take for a Rebuild to complete in a large environment, carefully consider how much time it will take to resume normal RUS operation before you choose to do a Rebuild. Once a Rebuild has started, you must wait for the RUS to catch up before you can do any useful troubleshooting against new and modified objects. For more information on how the RUS queries for changes, see KB:328738.