MessageXchange

Errors when launching EMS after (re)deployment

2011-06-08T18:30:00.000-07:00

After installing Exchange 2010 SP1 on all of the nodes in an environment, I was told that we were going to go with a different design, installing onto a different drive. The uninstall, and subsequent re-install to the other drive completed, and the installation went smoothly. Everything seemed to be in order with Exchange...when using EMC. When I launch EMS, however, I received the following error:

VERBOSE: Connecting to server.domain.com
[server.domain.com] Connecting to remote server failed with the following error message : The connection to the specified remote host was refused. Verify that the WS-Management service is running on the remote host and configured to listen for requests on the correct port and HTTP URL. For more information, see the about_Remote_Troubleshooting Help topic
.
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportException
+ FullyQualifiedErrorId : PSSessionOpenFailed
VERBOSE: Connecting to server.domain.com

I looked around for a bit and checked all of the normal things..

WinRM installed, configured and listening..check.

Powershell application pool started (and recycled)..check.

Validate Exchange-specific paths set to D:\ rather than C:\ in IIS...check.

Validate the kerbauth.dll is Local/Native to the PowerShell virtual directory, etc.. check.

Validated my account has remote PS rights..check.

At this point it definitely seemed to be either an IIS issue, or an authentication issue. The fix turned out to be one of the values in "C:\Windows\System32\Inetsrv\config\ApplicationHost.config," specifically:

<globalModules>
<add name="kerbauth" image="C:\Program Files\Microsoft\Exchange Server\V14\Bin\kerbauth.dll">

As you can see, this value is set to C:\ rather than D:\. Evidently uninstalling Exchange, and reinstalling it didn't change this value. Upon changing this value, EMS suddenly started working, and all was well.

We chose to go through and uninstall Exchange, as well as IIS, and redeploy regardless to be on the safe side. It seemed to be a small amount of work given that the systems were still pre-pilot, and there could potentially be more files that had not been updated. This approach works just as well, though it is obviously more time consuming.

Mailbox Auditing Explained

2011-03-02T10:09:00.001-08:00

What is mailbox audit logging?

Mailbox audit logging is used for tracking logons to a specific mailbox as well as actions and changes that are made during the session. It can also be used to track ‘Send As,’ ‘SendOnBehalfOf,’ creations, deletions, etc.

This logging can generate many logs which can consume a good amount of space, and is thus disabled by default.

Enabling mailbox audit logging on a mailbox

Example cmdlet to enable:

Set-Mailbox -Identity "JoshTest" -AuditEnabled $true

In order to perform mailbox audit logging, you need to be a member of a role group with the “Audit Logs” role assigned to it. Two default role groups that have this functionality are:

Organization Management
Records Management

You can create custom role groups as well; reference the ‘RBAC Explained’ article.

Enabling auditing will automatically include administrator and delegate actions by default, while omitting actions made by the mailbox owner.

Searching mailbox audit logs

There are three ways to search mailbox audit logs: Synchronous, Asynchronous, GUI (via ECP).

Example Type:

Synchronous.

Task Description:

Perform a synchronous mailbox audit log search with the goal of finding all audit log entries for JoshTest’s mailbox regarding admin/delegate actions in the time frame of 2/20/2011 – 2/25/2011, and display the results in the powershell window.

Cmdlet Example:

Search-MailboxAuditLog -Identity JoshTest -LogonTypes Admin,Delegate -StartDate 2/20/2011 -EndDate 2/25/2011

Full Syntax Considerations:

http://technet.microsoft.com/en-us/library/ff522360.aspx

Example Type:

Asynchronous.

Task:

Perform an asynchronous mailbox audit log search with the goal of finding all audit log entries for JoshTest's mailbox regarding delegate actions in the time frame of 2/20/2011 – 2/25/2011, and populate an XML file with the results to be delivered via e-mail upon completion.

Cmdlet Example:

New-MailboxAuditLogSearch "Delegate Actions on JoshTest" -Mailboxes "JoshTest" -LogonTypes Delegate -StartDate 3/1/2011 –EndDate 3/1/2011 -StatusMailRecipients Mailbox.Auditor@azaleos.com

Full Syntax Considerations:

http://technet.microsoft.com/en-us/library/ff522362.aspx

Example Type:

GUI / ECP

Task:

Perform a mailbox audit log search via the ECP with the goal of finding all audit log entries for a user regarding administrative actions on 3/1/2011, and populate an XML file with the results to be delivered via e-mail upon completion.

Steps:

Navigate to ‘Roles and Auditing’ and then ‘Auditing.’

Export mailbox audit logs:

Fill out the criteria for the user to search, the scope, and who to send the report to:

In time, you will receive the output in XML format at the e-mail address specified:

Full Considerations:

http://help.outlook.com/en-us/beta/37618aac-bd50-4322-9054-502461690ed9.aspx?sl=1

Interpreting the mailbox audit log

Example:

MailboxGuid="1a5348dc-2bdd-4606-9d22-59005ca2eb7c"

Owner="AVictim"

LastAccessed="2011-03-01T22:42:41.0772536-07:00"

Operation="SendAs"

ItemId="RgAAAADH7DJI8nRmW9d7HDLIvGH+JsErT8IbDiflR6zCD/BEMJIcAAAA4j5cAABaE7PuVtsyT6zCD/BEMJIcAAAA4pUbAAAJ"

ItemSubject="You're fired!"

OperationResult="Succeeded"

LogonType="Delegate"

ClientInfoString="Client=OWA"

ClientIPAddress="10.10.15.15"

InternalLogonType="Owner"

MailboxOwnerUPN="AVictim@raymond.com"

MailboxOwnerSid="S-1-5-21-1542865472-92671928-526660263-5723"

LogonUserDisplayName="A. Badman"

LogonUserSid="S-1-5-21-1542865472-92671928-526660263-3722"

OriginatingServer="EXCHANGE01 (14.01.0218.011)"

MailboxGuid="1a5348dc-2bdd-4606-9d22-59005ca2eb7c"

Owner=" AVictim"

LastAccessed="2011-03-01T22:42:41.061631-07:00"

Operation="Create"

ItemId="RgAAAADH7DJI8nRmW9d7HDLIvGH+JsErT8IbDiflR6zCD/BEMJIcAAAA4j5cAABaE7PuVtsyT6zCD/BEMJIcAAAA4pUbAAAJ"

ItemSubject="You're fired!"

OperationResult="Succeeded"

LogonType="Delegate"

FolderId="LgAAAABN9DVF1dUmR6o4DOZQiD9+AQBaE7PuVtsyT6zCD/BEMJIcAAAA4j5cAAAB" FolderPathName="\Drafts"

ClientInfoString="Client=OWA"

ClientIPAddress="10.10.15.15"

InternalLogonType="Owner"

MailboxOwnerUPN=" AVictim@raymond.com"

MailboxOwnerSid="S-1-5-21-1542865472-92671928-526660263-5723"

LogonUserDisplayName="A. Badman"

LogonUserSid="S-1-5-21-1542865472-92671928-526660263-3722"

OriginatingServer="EXCHANGE01 (14.01.0218.011)

Judging by this output, it looks like A. Badman has logged on successfully, created the original draft, and sent an e-mail as (Send As) A. Victim via OWA at 22:42:41 on 3/1/2011. It also looks like the e-mail wasn’t work appropriate with a subject like that!

MailboxGuid="1a5348dc-2bdd-4606-9d22-59005ca2eb7c"

Owner=" AVictim"

LastAccessed="2011-03-01T23:18:51.2507346-07:00"

Operation="HardDelete"

OperationResult="Succeeded"

LogonType="Delegate"

FolderId="LgAAAABN9DVF1dUmR6o4DOZQiD9+AQBaE7PuVtsyT6zCD/BEMJIcAAAA4j5RAAAB"

FolderPathName="\Inbox"

ClientInfoString="Client=MSExchangeRPC"

ClientIPAddress="10.10.15.15"

ClientProcessName="OUTLOOK.EXE"

ClientVersion="12.0.6550.5000"

InternalLogonType="Owner"

MailboxOwnerUPN="AVictim@raymond.com"

MailboxOwnerSid="S-1-5-21-1542865472-92671928-526660263-5723"

CrossMailboxOperation="false"

LogonUserDisplayName="A. Badman"

LogonUserSid="S-1-5-21-1542865472-92671928-526660263-3722"

OriginatingServer="EXCHANGE01 (14.01.0218.011)"

It would also appear that A. Badman has been busy deleting items from the mailbox as well. You can see from the log that this was done via Outlook 2007.

A quick-hit list of the important fields:

Field	Description
Owner	The owner of the mailbox that was accessed by a non-owner.
LastAccessed	The date and time when the mailbox was accessed.
Operation	The action that was performed by the non-owner. For more information, see the " What gets logged in the mailbox audit log?" section in Run a Non-Owner Mailbox Access Report
OperationResult	Whether the action performed by the non-owner succeeded or failed.
LogonType	The type of non-owner access. These include administrator, delegate, and external.
FolderPathName	The name of the folder that contained the message that was affected by the non-owner.
ClientInfoString	Information about the mail client used by the non-owner to access the mailbox.
ClientIPAddress	The IP address of the computer used by the non-owner to access the mailbox.
InternalLogonType	The logon type of the account used by the non-owner to access this mailbox.
MailboxOwnerUPN	The e-mail address of the mailbox owner.
LogonUserDN	The display name of the non-owner.
Subject	The subject line of the e-mail message that was affected by the non-owner.

Table originally pulled from outlook help link located here.

The full field list is here:

http://technet.microsoft.com/en-us/library/ff459237.aspx#Mailbox

RBAC Explained

2011-01-20T21:16:00.008-08:00

RBAC is a newer technology with Exchange 2010 that seems to have a lot of IT professionals scratching their heads; especially when it comes to the terminology. First off, what is RBAC?

Role Based Access Control (RBAC) is a new permission model introduced in Exchange 2010. In the past, manually changing ACLs could cause collateral damage, and often times had longer reaching implications. For this reason, Microsoft opted to go with a model where administrators could easily allocate permissions via default or custom Role Groups. Now let’s try to decipher what this means in a way that is easier to understand.

Role Group: A Role Group is essentially a special Universal Security Group (USG) that has members and Roles assigned to it. You can actually see these in ADUC. These Role Groups are essentially used like any other kind of group; they are for standard permission allocation to a subset of users.

Predefined Role Group Example:

Discovery Management Role – Grants the ability to perform multi-mailbox search, and compliance exports. Encompasses the Legal Hold and Mailbox Search Roles.

Assigning a user to a Role Group:

Add-RoleGroupMember -Identity "Discovery Management" -Member

Role: A Role is basically a predefined list of Role Entities packaged up, and ready to assign to a Role Group (or directly to a user, though it is generally better to create a Custom Role Group if one does not currently exist that meets the need). By default, Exchange 2010 has 65 built-in roles.

Administrators can create child roles as well. These roles are limited by their parents by what rights they can have. Child roles cannot have more roles than the parent.

Predefined Role Example:

Mailbox Search – Contains the following permissions:

Mailbox Search	Get-ADServerSettings
Mailbox Search	Get-DomainController
Mailbox Search	Get-Mailbox
Mailbox Search	Get-MailboxExportRequest
Mailbox Search	Get-MailboxExportRequestStatistics
Mailbox Search	Get-MailboxSearch
Mailbox Search	Get-Recipient
Mailbox Search	New-MailboxExportRequest
Mailbox Search	New-MailboxSearch
Mailbox Search	Remove-MailboxExportRequest
Mailbox Search	Remove-MailboxSearch
Mailbox Search	Search-Mailbox
Mailbox Search	Set-ADServerSettings
Mailbox Search	Set-MailboxExportRequest
Mailbox Search	Set-MailboxSearch
Mailbox Search	Start-MailboxSearch
Mailbox Search	Stop-MailboxSearch
Mailbox Search	Suspend-MailboxExportRequest
Mailbox Search	Write-AdminAuditLog

To output the list of Role Entries assigned to the “Mailbox Search” role, you would run:

Get-ManagementRoleEntry "Mailbox Search\*”

Assigning a Role to a Role Group:

New-ManagementRoleAssignment -SecurityGroup -Role

Role Scope: A Role Scope is essentially the scope of the rights provided to the user receiving the permissions. All Roles have a default Role Scope, so if you don’t set one, then it will be provided with the defaults. You can also create custom scopes to quickly apply to Roles when necessary.

Example of a scope:

New-ManagementScope -name "Tier 3 Technicians" -RecipientRestrictionFilter {memberofgroup -eq "cn=Executives,ou=Exec,dc=domain,dc=com"}

Role Entries: These are the tools that Roles have access to in their toolbox, limited of course by scope.

Example: Get-User and other cmdlets

Role Assignment: This is the tricky one. A Role Assignment is essentially an object that links together a Role, a Role Group, and a Role Scope into one package. Anytime you apply a Role with a Scope to a Role Group (yes even if they are defaults), you are creating a Role Assignment.

Given how many different combinations you can have, Exchange comes with around 160 Role Assignments by default according to the Exchange team!

Role Delegates: A delegate is someone who can assign the role to users/groups/etc, but they don't necessarily have the role themselves. The most common application of this is that the Organization Management role tends to have delegate rights to most roles, which means they can assign roles to users or groups, while not having the permission themselves. The auditing for this comes in at the Admin Audit Log level.

Example:

The Discovery Management role can be assigned by the Organization Management role, but members of only the Organization Management role do not have the discovery functionality by default that those belonging to the Discovery Management role have.

Conclusion

The bottom line is that people learn in different ways. If this article didn’t help you, then the EHLO blog’s explanation very good as well, but with a slightly different style that may compliment your learning style.

One thing they mention is labeling them in a way that is familiar to us:

Who: Role Group

What: Role

Where: Scope

Glue (holds it all together) : Role Assignment

For the triangle of power explanation, visit the EHLO blog:

http://msexchangeteam.com/archive/2009/11/16/453222.aspx

Outlook 2003 doesn't work with Exchange 2010

2011-01-20T15:41:00.005-08:00

Having issues connecting to your Exchange 2010 mailbox with Outlook 2003? The issue is likely more simple that you think. In Exchange 2010 RTM, RPC encryption is turned on by default. While Outlook 2007/2010 use encryption by default, Outlook 2003 does not.

What this means for people in this situation, is that they have one of two choices:

1. Turn on encryption in Outlook 2003.

2. Disable encryption in Exchange 2010.

I recommend the former for security reasons, but it is fairly evident that MS has taken a different stances on this. In new deployments of Exchange 2010 SP1, RPC encryption is turn off by default. My guess is that this was to facilitate more seamless migrations for those clients moving from the 2003 realm to 2010.

Also, notice how I said “new deployments of Exchange 2010 SP1.” In an environment where Exchange 2010 RTM was deployed and upgraded to SP1, it will still be enabled by default.

Here are some quick steps to accomplishing these options:

1. Modify Outlook to enable encryption:

2. Modify the above value with a GPO:

a. Microsoft has already done the leg work on creating an ADM file for this. (See link below)

3. Disable encryption on Exchange 2010 SP1 Client Access Servers:

a. Set-RpcClientAccess –Server CAS1 –EncryptionRequired $False

Official TechNet article on the topic including a custom ADM file that accomplishes #2 (my recommendation).

http://support.microsoft.com/kb/2006508

Managing Large Quantities E-mail with Outlook / Exchange 2010

2011-01-18T20:29:00.008-08:00

I am always surprised at how many people fail to use Outlook to its full potential. Here are a few tips for high mail volume individuals that should make life much easier.

Rules

Most of us use Outlook rules, but we probably don’t use them as well as we could. In the days of old, I know many people had issues running into the max size limit for their rules. This was frustrating, but is now largely avoidable with Exchange 2010. In Exchange 2010, domain-based rules can now be held on the server side (they used to only work client-side which was nearly useless for people not logged into Outlook 100% of the time), allowing us to avoid adding all those clumsy names to our rules.

Example:

Another thing about Outlook rules, is the fact that a lot of people utilize rules for sorting e-mail for initial reading. In my opinion, this is a pretty poor use of e-mail rules. Rules should be (again, in my opinion) used more for filing e-mails for retrieval at a later date, while Search Folders should be utilized for easily locating new important mail, or mail with common special criteria. This is a great way to stay on top of what is going on when you receive excessive amounts of e-mail.

If you want to find an older piece of mail in your folder structure, you should be able to remove most of the variables from the equation by where you find the e-mail, leaving only the final criteria (typically body/subject/attachment). Sure, you can Ctrl+Shift+F, but who wants to take the time to do that when your Outlook rules can logically sort them for you?

A good example of a rule to sort with a broad brush would be move all mail from people belonging to specific DL to a certain folder.

Example:

In the above example, all e-mails coming from members of the Professional Services team would be placed in the ‘Deployment’ folder. If you had a few favorite individuals to break out from there, feel free to do so in separate rules; just be sure to move that rule higher up in priority, and add the clause to stop processing more rules so that you don’t end up with duplicates!

Search Folders

I am always astonished by how few people actually know about search folders. You might be asking yourself: “What are search folders, where are they, and how do I create them?”

Search folders are essentially query folders that dynamically build based on criteria across your entire mailbox. This allows it to populate with the mail you need to read, without moving them from the desired final destination for long term retrieval and organization. Near the very bottom of your folder structure, they are hidden like diamonds in the rough:

Here are some excellent uses for search folders that will make your life easier:

1. Unread Mail to Me (Any mail that is unread with your name on the To or CC line)

a. Mail that is sent directly to you is likely much more important to you, than e-mail sent to one of many distribution groups you may be a member of.

b. Example:

2. All unread mail from my managers

a. You’ll want to be sure you don’t miss any e-mail on process, or requests from management.

3. All unread mail to a specific group (Operations team, Sales team, Executive team, etc)

4. All Unread Mail

a. A quick catch-all to avoid diving through your many, many folders.

5. High importance e-mails

Don’t forget to pin these glorious folders to your favorites for easy access!

Discovery/Litigation with RBAC

2011-01-17T22:34:00.015-08:00

Have you tried running the Export-Mailbox command in Exchange 2010 SP1, only to be denied? These commands were typically utilized in Exchange 2007 for purging messages with certain criteria from mailboxes en masse, or for discovery searches. Import-Mailbox and Export-Mailbox now technically require the RBAC role Mailbox Import Export according to TechNet. This role was slated to not be assigned to any role group by default in Exchange 2010 SP1 (it was assigned to the Organization Management role in RTM). The only problem with this statement is that according to PMs at MS, this command is now deprecated despite TechNet articles discussing their use.

Exchange 2010 SP1 now splits this functionality into the Search-Mailbox and New-ExportMailboxRequest cmdlets. Search-Mailbox will perform a search and subsequent export to a mailbox (including deleting the original from the source mailbox if desired). This functionality satisfies the vacuum of Export-Mailbox’s departure for tearing messages with certain criteria out of user mailboxes in bulk. The New-ExportMailboxRequest cmdlet covers the need to export data to a PST file, and both of these cmdlets can search the mailbox dumpster.

While these commands are good, they are also quite powerful, and can be more than a legal worker would require. These commands are available to a user that is added to the ‘Discovery Management’ role group, however, which is also necessary to perform discovery searches in the more conventional way (via the Exchange Control Panel). Luckily most users won’t have the know-how, nor the means (Exchange Management tools) to perform these tasks in this manner.

The Discovery Management role group encompasses the Mailbox Search and Legal Hold roles, and allows things like multi-mailbox search, as well as saving results to a secured discovery mailbox via the ECP as mentioned above. A quick recap of how to get this process rolling is to:

Add the users to the Discovery Management RBAC role group.

Add-RoleGroupMember -Identity "Discovery Management" -Member

Create a Discovery Mailbox to act as a secure repository for search results.New-Mailbox SearchResults -Discovery -UserPrincipalName SearchMailbox@domain.com

Instruct the users to utilize the Exchange Control Panel (ECP) to perform multi-mailbox searches, and export the results to a Discovery Mailbox.

For a legal user to access the search functionality, they need log into their ECP, and choose ‘Options’ in the upper-right hand corner, and choose ‘See All Options…’

Pull down the management options, and choose ‘My Organization’

Choose ‘Mail Control,’ and click ‘Discovery’

Enter your search criteria:

Choose the Discovery mailbox that we created earlier to place the results (or choose to let it estimate):

Check the status:

From here you can click on the ‘Open’ link on the right, or the link in the notification e-mail if you chose to have one in order to access your results.

Exchange 2010 Move Request, Import, and Export Considerations

2011-01-02T20:58:00.002-08:00

Given the number of new features in Exchange 2010, there are some new considerations to take into account. The first of these I will explore, as I can see it being something that my crew would find useful, is around move request, imports and exports.

Mailbox move requests and export/import requests can back up, as Exchange does not purge them automatically by default. For mailbox move requests, you can set an expiration time to whatever you like by using the following commands:

To set a 30 day automatic expiry for successful move requests:

Set-OrganizationConfig -DefaultExpirySuccessfulMR 30.0:00:00

To define that a move request does not automatically expire:

New-MoveRequest -DoesNotExpire $True

If you aren’t currently setting these to expire, you may want to consider setting this value (especially if you are performing migrations, or restructuring.

Unfortunately, I don’t believe you can manually set up expiration for Export/Import requests, however (New-Mailbox(EX/IM)portRequest is introduced in E2010 SP1). To purge these, you’d be looking at something like:

Get-MailboxImportRequest -Status Completed | Remove-MailboxImportRequest

Also, some nifty functionality was introduced around move requests as well (for those that perform mailbox moves often). You can now kick off a move that auto-suspends right before completion, and then resume them later on when the moves actually need to finalize and switch over.

To create the move request for all users in the “Seattle” office:

Get-Mailbox -Filter {Office -eq 'Seattle'} | New-MoveRequest -SuspendWhenReadyToComplete -SuspendComment 'Move Queued by Joshua on 22-Dec-2010 10:00' -BatchName ‘East Lake Users’ –BadItemLimit 1 -TargetDatabase 'DB1'

To resume the autosuspended moves to finalize the move:

Get-MoveRequest -MoveStatus 'AutoSuspended' -BatchName ‘East Lake Users’ | Resume-MoveRequest

Exchange 2010 Two Nodes Enter – ONE LIVES.

2010-12-20T09:40:00.003-08:00

Starting Active: MBX1

Starting Passive: MBX2

Starting Primary Active Manager: MBX1

The scenario is one where there are two DAG nodes (yes I know more is ideal, but that’s life) that must be brought down, and the active node has an issue from which it cannot recover. This can apply to site-wide power outages or other disaster scenarios as well.

The issues that can arise in this scenario seem to vary from my testing.

Test lab steps:

1. Shutdown both nodes.

2. Power on MBX2. Leave MBX1 offline.

3. Databases' status comes up as Service Down (as expected) for MBX1, and Disconnected/Resyncing for MBX2.

Issues and solutions that may arise:

1. Cluster won’t start on MBX2.

a. On MBX2, open a CMD prompt and run: ‘net start clussvc /fq’

b. This forces the cluster service up without concern for quorum.

2. EventID: 3154 MSExchangeRepl

Active Manager failed to mount database DB1 on server EXCHANGE. Error: An Active Manager operation failed with a transient error. Please retry the operation. Error: A transient error occurred during discovery of the database availability group topology. Error: Database action failed with transient error. Error: A transient error occurred during a database operation. Error: MapiExceptionNetworkError: Unable to make admin interface connection to server

a. Verify that MBX2 is the Primary Active Manager (PAM).

i. Generally after a failure of this type, the former Active Manager (if it was MBX1) will be offline, or unassigned.

b. The owner of the cluster core service group (“Cluster Group”) is the PAM. If this isn’t true, then we need to force the fact.

c. cluster . group "Cluster Group" /move:MBX2

3. Check PAM via ‘Get-DatabaseAvailabilityGroup -Status | fl name,primaryactivemanager’

a. Validate MBX2 as PAM.

4. EventID: 3170 MSExchangeRepl

Attempt to move active database ‘DB1’ from MBX2 to MBX1 failed. Error: An Active Manager operation failed. Error: The database action failed. Error: An error occurred while trying to validate the specified database copy for possible activation. Error: Database copy ‘DB1’ on server ‘MBX1’ has content index catalog files in the following state: 'Failed'.

a. Validate: Get-MailboxDatabaseCopyStatus | fl name, contentindexstate

b. Content index displays as ‘Failed.’

c. Move-ActiveMailboxDatabase - identity DB1 -ActivateOnServer MBX2 -SkipLagChecks -MountDialOverride BestEffort – SkipClientExperienceChecks

d. Process is repeated on all other databases. SkipClientExperienceChecks will ignore the bad content index.

5. All databases are mounted on MBX2, and MBX1 is still down.

6. Booted up MBX1 post-disaster and resume.

a. Replication comes up as ‘Healthy’ after a few minutes.

b. A reseed may be necessary depending on the size and circumstances, but it was never required for me.

iPhone IOS4 Issues

2010-07-02T09:05:00.001-07:00

As any iPhone enthusiast knows, IOS4 has been released. Unfortunately there have been a large number of reports of issues surrounding IOS4’s implementation of ActiveSync.

Issues reported include dramatic increases in resource usage on Exchange servers (causing potentially severe issues), issues with iPhone sending and receiving mail, and issues with iPhones not syncing correctly with regards to their mail and calendar items.

Apple has released a single update, but it only addresses one of the seemingly many issues. My company, Azaleos, is currently taking the stance of advising customers to hold off on upgrading until Apple and Microsoft work out these issues.

Additional Links:

http://msexchangeteam.com/archive/2010/07/01/455342.aspx?CommentPosted=true#commentmessage

http://support.apple.com/kb/TS3398

Script to pull database stats and e-mail results

2010-01-11T19:58:00.010-08:00

With some help from a coworker (irundis.com), I got this script put together for pulling database stats, and then e-mailing the results to an e-mail recipient. The idea is to just attach this to a scheduled task and let it run. It is a good thing I got help or I'm positive it wouldn't be quite this pretty.

Scheduled Task:

Program/Task:

C:\windows\system32\windowspowershell\v1.0\powershell.exe

Arguments:

-PSConsoleFile "C:\Program Files\Microsoft\Exchange Server\bin\exshell.psc1" -noexit -command ". C:\DBStats.ps1

-------------------------------------------------------------

Script (be careful about returns if you copy/paste)

-------------------------------------------------------------

function Get-MXDBData() {

PROCESS {

$identity = $_.Name

$FullID = $_.identity

$FilePath = $_.EdbFilePath.PathName

$SizeMB = [long]([long]((Get-ChildItem $FilePath).length) / 1048576)

$SizeGB = [long]($SizeMB / 1024)

$MBXCount = (Get-Mailbox -database $FullID).count

#Create the new custom object and add new members to the object

$obj = New-Object PSObject

$obj | Add-Member NoteProperty Database $identity

$obj | Add-Member NoteProperty "Size in GB" $SizeGB

$obj | Add-Member NoteProperty "Size in MB" $SizeMB

$obj | Add-Member NoteProperty "Mailbox Count" $MBXCount

#Output the object to gain access to all of its properties for later in the pipeline.

Write-Output $obj

}

Get-MailboxDatabase -Server SERVER | Get-MXDBData | export-csv -path c:\DBStats.csv -NoTypeInformation

################

# SMTP Mail Alert

################

$file = "c:\DBStats.csv"

#Create new .NET object and assign to variable

$mail = New-Object System.Net.Mail.MailMessage

#Sender Address

$mail.From = "sender@domain.com";

#Recipient Address

$mail.To.Add("recipient@domain.com");

#Message Subject

$mail.Subject = "Database Statistics Report";

#Message Body

$mail.Body = "Please see attached CSV for database size and mailbox count.";

#Connect to your Hub Transport (FQDN or NLB alias)

$smtp = New-Object System.Net.Mail.SmtpClient("fqdn.domain.com");

#Attach CSV

$attachment = new-object Net.Mail.Attachment($file)

$mail.Attachments.Add($attachment)

#Uncomment if no anonymous relay (best practice to have separate receive connector)

# $smtp.Credentials = New-Object System.Net.NetworkCredential("username", "passwd");

#Send Email

$smtp.Send($mail);

$attachment.Dispose()

Example of output before CSV:

Prevent Double-Booking Rooms in Exchange 2007

2010-01-08T17:49:00.003-08:00

My new responsibilities leave me little time to post, so I figured I'd dump a quick PS execution for admins quickly searching for a way to avoid double booking in their environment.

get-mailbox | where {$_.ResourceType -eq "Room" } | Set-MailboxCalendarSettings -

AutomateProcessing AutoAccept -AllBookInPolicy:$true -AllowConflicts:$false

ResourceType can be substituted for other types than Room as well.

The properties on have invalid data. If you click OK, default values will be used..

2009-10-28T08:34:00.004-07:00

A customer had a user with a mailbox throwing the following error whenever they tried to change a value:

The properties on [recipient] have invalid data. If you click OK, default values will be used instead and will be saved if you do not change them before hitting Apply or OK on the property page. If you click cancel, the object will be displayed read-only and corrupted values will be retained.

OK no problem, I'll just go in and get rid of anything that doesn't look right...wrong. The console wouldn't let me save the settings.

Apparently the storage quotas were such that the Prohibit Send Limit value was less than the Warning Limit. I was, however, unable to modify it in ADUC/DSA or in the EMC.

I attempted to change the value in EMS, but it threw the exact same error.

When finesse isn't enough, brute force wins. I popped open adsiedit.msc by launching adsiedit.msc from 'Run,' then navigated to where the user resided under Domain -> User OU, right clicked, and clicked properties. Sure enough the EMC and EMS were lying to me:

I modified the values to what I wanted them to be:

Voila.. Invalid Data errors are gone.

Digicert Intermediate Cert Eclipsed by Root - ActiveSync issues

2009-09-09T09:28:00.002-07:00

We recently ran into an issue where using a new Digicert certificate essentially broke activesync for most people in the company. The issue is that the new root certificate for Digicert isn't compatible with older browsers and devices (they don't come standard with the new root certs for Digicert like they might with Verisign and others). The primary phone of the organization was a Motorola Q, which made the issue quite visible.

The problem boiled down to this root cert taking precedence over the intermediate cert (Digicert calls it eclipsing which I suppose is a more valid term), which would have worked fine. After the Digicert Root Cert was removed, the issue was resolved.

Note: Be sure that the intermediate is in place and functioning or else you will break all of the modern phones and browsers as well.

Also as an alternative fix, you could install the root cert on the phones in question. This is more labor intensive, but might be viable if there are only a few old straggler phones floating around.

Reference:

https://www.digicert.com/ssl-support/windows-cross-signed-chain.htm

You can also run a good test for this and other issues at:

https://www.digicert.com/help/

KB968389 LSASS Reboots

2009-09-09T07:53:00.001-07:00

Recently we had an issue with an Exchange server constantly rebooting. The symptoms were extremely indicative of virus infection. Terminations of LSASS.exe, timed reboots, and permission revocations, were all occurring, and so we were immediately assuming Sasser/Blaster.

It then began to seemingly cause issues with domain communication. Upon checking the system properties, the domain registered as *Unknown* and it was nearly impossible to perform any action as all permissions had been stripped (we were using a domain account so this sort of made sense).

After having a local tech bounce the box and login with the KVM, the issue seemed resolved for these domain level issues, and we never saw them again. The original LSASS issues and reboots continued, however. Not wanting to waste any more time, we gave PSS a call. They informed us that a patch we had installed, KB968389, was likely causing the issue. Despite passing our patch testing and being installed on numerous other environments, MS told us that they have been informed of other sites experiencing the same issue. Removing the patch resolved the issue.

In summary.. KB968389 = Bad if you like a stable environment

RIM Finally Fixes PDF Vulnerability on BES

2009-06-09T18:32:00.003-07:00

http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB18327

I know it was out on the 4th, but I haven't had time for my blog lately unfortunately.

Powershell Reboot

2009-05-18T14:46:00.004-07:00

Ever need to reboot a server remotely, and no standard tools (shutdown, etc) are working?

Can't RDP the box or get to it any other way?

I discovered a little trick about a year and a half ago, and it has been saving my life, and those of my colleagues ever since. I just actually had to use it, which reminded me that I ought to post it.

$server = gwmi win32_operatingsystem -computer USSERVER1

$server.reboot()

Performing this will provide you with some output. As long as it comes back with an output of zero, you are good to go. I believe the target server doesn't even need powershell installed; just the one you are using to reboot it.

IOPS / Disks

2009-05-12T19:50:00.004-07:00

It has been a while so I decided I'd post on something I've been having to work with a lot lately.

I/O can be a key bottle neck in disk intensive systems...such as Exchange.

First let's establish some disks and their relative IO load capacity:

Fiber Channel 15k: 150-180 IOPS

SAS 15k: 150-180 IOPS (notice about the same, but less price than FC..)

Small Form Factor (SFF): Faster..usually ~230

SATA 7.2k: Claim 60-80, some will argue as low as 40.

Let's assume for our test case that we look at a customer with 1000 mailboxes on Exchange, and average-heavy users (spanning from light to very heavy). Let us also assume they have a BES, an Archive server, AV, and DPM.

.32 IOPS per user is about a heavy user. To gauge the others, view the follow:

DPM: Add 20%

Archiving: Add 50% if performing compliance, 25% for compression/storage

AV: 50%

BES: Debatable.. I've heard any where from 2x to 7x!?! I'd believe any of them.. Let's say 2x for the sake of argument. You're welcome RIM.

That .32 I/O mailbox has now turned into a 1.2 I/O mailbox (rough estimation that is usually on the safe side given involvement from outside entities).

1000 x 1.2 = 1200 / Disks = IOPS required per disk.

For our example let's say the company has a Stovevault S500. This particular unit comes with a shelf of 14, 7200 RPM disks. Remember to not include parity disks! 14 - 2 = 12

1000 x 1.2= 1200 / (14 - 2) = 100 IOPS/disk

Now let's compare.. 100 IOPS/disk requirement. SATA 7200 RPM disks can pull 60-80 advertised (40 according to many in practice).

Looks like we have a problem. Couple easy, though potentially costly ways around this. The fact is we need more IOPS. This can mean more speed, or it could mean more spindles..or both.

How about another SAN with, say, fourteen 15k SAS disks? (150-180) > 100 -- Looks much better.

How about adding another shelf to the S500?

1000 x 1.2= 1200 / (28 - 4) = 50 IOPS/disk -- Looks better than advertised, but a bit above what some research has turned up. This may work in production, but it would be ill advised to implement a system in which you run it so close it's breaking point right from the get-go.

So what good are SATA disks then? SATA disks still have their uses. Archiving storage, file storage, home drives, or any other storage that isn't being bombarded with read/writes will suffice with this type of storage, and a fraction of the cost.

If you want additional specifics, check out:

http://msexchangeteam.com/archive/2007/01/15/432207.aspx

There is an updated link off of it too.

**EDIT**

SATA disks can be great for Exchange 2010 depending on the deployment!

Exchange 2010

2009-04-14T22:53:00.003-07:00

In the words of my compatriot Kevin, we can now officially speak of Exchange 2010!

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=1898ed2c-2f88-48ac-824e-d3d20fad77d7

More to come despite my recent drought..

ArchiveXchange - Archive Attender 3.5 released!

2009-03-20T21:39:00.006-07:00

The Azaleos offering for ArchiveXchange is making strides! Thanks to our friends at Sherpa Software hearing our input, as well as our customers' input, we now have access to new and exciting features to work with.

The console has been overhauled:

An auto aging stub feature has been added:

All stub activity can now be acted upon based on criteria, and best of all for my practical purposes, archive auto creations! Auto archive creations based on thresholds are essential for keeping maintenance windows small, especially when journaling. It allows admins to essentially have 'save points' where data ceases to change, and thus, remains more stable in the isolated environment. Maintenance need only be run against the deltas!

Another benefit to upgrading is the new web-based search features. As the product continues to evolve toward a hybrid product, more options open up to users as to if they want full reliance on stubs, searching, or both.

The listed upgrades combined with other admin and user bound benefits make this a great release, and a product worth watching when comparing to other technologies.

Deleting a Message From Everyone's Mailbox

2009-03-04T12:25:00.001-08:00

Need to delete a message from everyone's mailbox at the server level? Here is the command for you:

Get-Mailbox | Export-mailbox -SubjectKeywords "FillintheSubject" -StartDate "03/04/09" -EndDate "03/04/09" -TargetMailbox "Admin" -TargetFolder "Inbox" –DeleteContent

You can also add -ContentKeywords for additional filtering.

Apparently I'm Published at CTR

2009-02-19T08:08:00.003-08:00

Not my best writing, but you all know how on-the-job technical writing goes. Information gets stripped, vocabulary cut down, etc. :)

It was posted on Computer Technology Review. You can check it out here.

Parts on order!

2009-02-15T21:04:00.008-08:00

Finally buckled and decided a new computer is for me. After a ton of research, my build is as follows. This isn't meant to be the biggest beast on the block, but price for power, it seems to be the best bargain.

I went mostly with NewEgg.com because I just like the service I've gotten from them in the past.

AMD Phenom II X4 940 Deneb 3.0GHz 4 x 512KB L2 Cache 6MB L3 Cache Socket AM2+ 125W Quad-Core Black Edition Processor on a Foxconn A79A-S AM2+/AM2 AMD 790FX ATX AMD Motherboard. This was a combo from NewEgg and seemed to be the best deal. I originally was only looking at Intel processors, but after reviewing numerous benchmarks, I couldn't beat the power for the price.

HIS Hightech H487F1GP Radeon HD 4870 1GB 256-bit GDDR5 PCI Express 2.0 x16 HDCP Ready CrossFire Supported Video. Though the GPU is slightly under the next bump up, the price price jumped significantly.

Corsair ddr2-1066 pc2-8500 4gb. I would have gone with the cheaper Patriot, but Fry's was out, and I missed the deals on NewEgg. I'd probably save the $40 and go with Patriot if I had it to do over again. Corsair's warranty is better though, so that is a plus.

1.5 TB SATA drive from Dell. Can't beat ~$100 + shipping. Coworker hooked me up with a coupon. Now I just need to figure out how I'm going to fill 1.5TB..images perhaps..

750w Corsair PSU. I am no expert on power, nor do I claim to be. That being said, it was a good price and single 12V rail with good reviews. I was looking at the ThermalTake with it's 4x 12V rails, but from what I've read it really doesn't matter how many rails it has as long as the single has decent components (which mine should). The split rails can help with power management, but a single rail also helps make to ensure that core components have the power they need without being limited. (4 rails could mean 13A, 16A, 18A, 8A which can just get confusing). If I'm way off base here, feel free to leave me a comment and contradict me. :)

I went with the Sunbeam CR-CCTF 120mm "Core Contact Freezer" for cooling. From what I can tell, the ThermalRight 120 Ultra Black Edition seemed like the best choice, but at half the price, the SunBeam was more appealing to me. All reviews point toward it being quite comparable. Tomshardware and Frostytech both show the "Core Contact Freezer" as being near the top of the charts. Can't beat $30 from NewEgg for a quality product.

I'll be using Arctic Silver for the thermal compound as well. We'll see how it goes. Should be here in a few days.. Hopefully everything fits in the case and on the motherboard without covering RAM slots..

Windows 7 Tips and Tricks

2009-02-11T22:36:00.002-08:00

Here is a good little list of tips and tricks for Windows 7. The problem steps recorder looks cool among other things. Also has the fix for mp3 corruption with WM12.

http://www.maximumpc.com/article/features/20_windows_7_tweaks_tips_–_every_secret_uncovered_date?page=0,0

Creating a Custom Volume in DPM

2009-02-04T19:36:00.022-08:00

Why?

Custom Volumes are good when you’d like to offload a backup of something to a specific place rather than using the disk pools. My example was that the current backup location was on the same filer as my source data. I wanted to offload this single application’s backups to a separate SAN than the source data in order to have the ability to recovery from a hardware failure. There may be reasons to use this for Exchange, but I would avoid as disk pools are more seamless. The planning for a deployment of Exchange should account for this. My example is backing up archives.

Prerequisites

The prerequisites are that you have available storage, the DPM agent installed on the target, and the needed VSS hotfix on the target.

Procedure

1. Create storage

a. Carve out a volume/lun (or use DAS)

b. Attach that storage to the machine via iSCSI, a VHD hard drive if virtual, or whatever other means.

2. Figure out how much space you need for your volumes.

a. You can follow the MS guidelines using the calculator:

i. http://blogs.technet.com/dpm/archive/2007/10/31/data-protection-manager-2007-storage-calculator.aspx

b. OR you can just use DPM to pull what you’ll need. This only applies to backing up current data, with however many recovery points you need. You will want to tack some extra on for growth.

i. Create a new protection group.

ii. Choose the data you want to protect

iii. Choose your retention

iv. Click modify

v. These are the values for today, so leave some overhead.

3. Carve out your two volumes; one for replica, one for recovery point.

a. Right click the unallocated space, and choose New volume..

b. Choose Simple (other options may not be grayed out)

c. Choose the Size – I had 200gb to play with, so I allocated 160 to replica and 40 to recovery point.

d. Rinse repeat for the other. This does not have to be on the same disk.

4. Create the Custom Volume and Protection Group

a. Go back to DPM and create the Protection Group as we outlined before.

b. Pull down the menu for storage, and choose custom volume

c. Assign the replica volume and recovery point volume to their respective places. Leave it at no formatting.

d. Choose manually as it is your only option.

e. Click create group (ignore the values in the box..)

f. Once this is all done, you must just manually create the new replica (Perform consistency check), and you’re set!

Afterthoughts

In order to expand storage with this configuration, you cannot use DPM, but rather you must use standard windows disk management. I realize there are no screenshots, but it was a disaster with the formatting on this blogger. I will make them available upon request.

Blackberry Users Setting Out of Office in Outlook 2003 Won't Update on Exchange 2007

2009-01-27T15:40:00.001-08:00

There is a known issue that I decided to post on because there seems to be a relatively small amount of information out regarding it. The problem is blackberry users configuring their out of office in Outlook 2003, but the change doesn't show up on OWA. This can cause old out of office settings to be used as well, and only seems to apply when the user has the unique cocktail of Outlook 2003 and a blackberry that connect to an Exchange 2007 server.

The known work-arounds for this issue are to use Outlook 2007, or run Outlook with the /cleanrules switch. You will, of course, want to export your rules first just in case.

Unfortunately RIM does not support the OOO feature (a phone call from our NOC to RIM discovered this) which was technically re-written in Exchange 2007. They supposedly released a fix in a service pack, but the BES in this case had the service pack which does not increase my faith in RIM despite the love I harbor for its constant desire for attention (reboots).

You do not have permission to send to this recipient

2009-01-12T18:41:00.000-08:00

If you get the following while sending to an internal recipient, chances are you haven’t set your environment to accept for the domain you are sending to.

Your message did not reach some or all of the intended recipients.

Subject: Subjects are fun!

Sent: 1/1/2009 1:00 PM

The following recipient(s) could not be reached:

Lastname, Firstname on 1/1/2009 1:00 PM

You do not have permission to send to this recipient. For assistance, contact your system administrator.
user@domain.com

The example that prompted me to post this was one where admins were adding SMTP addresses on to their users for domains that they weren’t configured to be responsible for. How do we solve this? In this case the servers were Exchange 2003, so we will start there. We need to open ESM, navigate to Recipients -> Recipient Policies

Right click and choose New -> Choose E-Mail Addresses

Navigate to the E-Mail Addresses (Policy) tab, click New, and choose SMTP Address.

Enter an example SMTP address with domain you'd like to be able to send to.

Enter a name and select who you'd like to automatically receive this policy (I left mine blank as they wanted to sporadically assign the e-mail address as needed.)

Click OK. it should ask you to run this policy now, but if it doesn't you may right click your new policy and choose 'Apply this policy now...'

In Exchange 2007 you need only make your Exchange organization authoritative for the domain in question. The place to do this is under Organization Configuration -> Hub Transport -> Accepted Domains tab.

Add your domain here as authoritative and it will accomplish the same feat.

There are other causes for this issue, but this is the most common from what I have seen.

Why not to yell at your hardware - I/O monitoring

2009-01-06T06:47:00.001-08:00

This is just too good to not link to off a coworker's site.. Proof yelling at your hardware can be a bad thing!

http://www.hedonists.ca/2009/01/06/dont-yell-at-your-kit

Failing over to SCR target

2008-12-29T13:38:00.001-08:00

Any of you who have done this knows it is a touchy game. Luckily a coworker (Kevin Miller) decided to put all the info in one place, along with some good suggestions to think about whilst performing this procedure.

You can check it out here.

RPC/HTTP -- Outlook Anywhere Login Prompts Fail

2008-12-17T16:24:00.008-08:00

The issue came up where users couldn't gain access to their email via RPC over HTTP / Outlook Anywhere. An authentication prompt comes up, but does not allow the user to authenticate.

When checking their configurations, everything seemed at first to be in order. Upon checking into it further, I noticed that their mail FQDN is mail.domain.com, but it looks like the common name on the certificate is just domain.com (though mail.domain.com was also on the cert under the subject alternative names). While the cert was registered as valid, it did not match up for the mutually authenticated session. The problem? The red outlined boxes didn't match up.

After changing the principal name to msstd:domain.com rather than msstd:mail.domain.com such that it matched the certificate name, the authentication began to work once again.

Calendar Items Disappearing From Mailbox - BlackBerry

2008-12-16T09:14:00.004-08:00

When calendar items are disappearing from peoples' mailboxes, the first thing I ask nowadays is "Do you own a Blackberry?" The reason for this is simple. If the Blackberry handheld runs out of memory, the first things it goes for are your calendar items.

While it is a good idea to upgrade your your phone's memory anyways, you can also help your memory utilization by properly closing windows such that they do not continually occupy space. It is also a good idea to periodically reboot your phone to clean this up.

I can't tell you how valuable this information is when users come to you wondering what happened to their meetings. Kudos to my coworkers that attended the RIM/BlackBerry/BES training for the initial identification of this problem!

Reference:

ExpertsExchange Forum

BlackBerry Forum

Issues mounting NDMP Backed Up Luns

2008-12-15T09:26:00.009-08:00

A coworker of mine cracked the case on this one with a bit of help from NetApp, but I thought I'd share as it was a strange little issue. First off, what is an NDMP backup?

NDMP stands for Network Data Management Protocol, and was actually pioneered by Network Appliance (NetApp) in association with Intelliguard. The purpose was to backup various platforms and provide interoperability. Fast forward back to our current predicament..

The current predicament is that someone uses Veritas to backup and restore. They want to be able to restore from this, and have it correctly mount such that a they can recover data in Exchange. The problem is that the restored lun won't mount in Snapdrive or otherwise. Initially NetApp merely told us that the lun had to be in the root of the share rather than in a folder.. no problem. Veritas must restore to a folder, but we can move it after the fact to the root.

We then try to mount the lun, but it doesn't work. It instead tells us that it is already mounted.

The trick that my compatriot discovered was that it requires you to change the name as well by doing the following via command line:

lun move /vol/Volume1/restore.lun /vol/Volume1/restorenew.lun

He was then able to mount the lun. Go team.

SMTP Categorizer Queue Length Spikes

2008-12-09T10:00:00.008-08:00

The issue has cropped up with the Categorizer Queue Length intermittently spiking. First off what is the Categorizer Queue Length?

This counter basically determines the items that reside in the categorizer queue. The categorizer does a few things. It resolves/validates recipients, determines whether the message should be queued for local or remote delivery, expands Distribution Lists (DLs), and detects limits and restrictions.

The first thing to check in order to resolve the spikes, would be that there are ample Global Catalog servers (GCs) and Domain Controllers (DCs) in the environment to perform the look-ups. The best way to check this is on the DSAccess tab in ESM (2k3), or the System Settings tab under the properties of the Exchange server (2k7).

It would also be prudent to run a network diagnostic tool in search of a bottleneck.

Microsoft also recommends monitoring the processor utilization of Inetinfo.exe (categorizer component) and using the e2kdsinteg config object from the ConfigDSInteg tool in order to check for malformed objects that could be slowing the process of directory look-ups. You can get the tool here.

Knowing that the environment probably wasn't the shining star on the top of the Active Directory hill, this was the first thing to check.

The e2kdsinteg log came back with numerous entries for old mail servers, and objects not seen by human eyes in many moons. My advice was to continue to run diagnostics for bottlenecks, and to investigate the purging of these rogue/malformed objects.

Outlook Anywhere Failing - RPC End Points - 6004

2008-12-08T12:43:00.012-08:00

It was brought to my attention that autodiscover was not behaving correctly externally. I ran it through Microsoft's Exchange connectivity tester @ http://www.testexchangeconnectivity.com/ and received the following output:

To resolve this first simple part I just went into the EMS and gave it an ExternalURL via:

Get-AutodiscoverVirtualDirectory | set-AutodiscoverVirtualDirectory -ExternalUrl https://autodiscover.domain.com/Autodiscover/Autodiscover.xml

I now received this error:

"Failed to ping RPC Endpoint 6004 (NSPI Proxy Interface)"

..and also RPC_S_SERVER_UNAVAILABLE error (0x6ba) was thrown by the RPC Runtime

Most curious about an RPC error at this level. Perhaps a connection between the Hub/Cas and MBX server or MBX server and AD/DCs/GCs? The environment was not 2008, nor was it using IPv6.

The following is what fixed my issue:

Using the configurations here I was able to remedy the situation. Basically what happened was that it could not use DSPROXY via HTTP, and it is a known issue. The fix is to:

1. Changes for Mailbox servers..

a. create a DWORD called "Do Not Refer HTTP to DSProxy" at HKLM\System\CCS\Services\MSExchangeSA\Parameters\ and the value set to 1. This will, as it spells out, stop it from trying to use DSProxy when using HTTP.

b. HKLM\System\CCS\Services\MSExchangeSA \Parameters key "NSPI Target Server" to the FQDN of the domain controller that you would like used for profile creation.

2. Changes for Client Access Servers..

a. Ensure that the "PeriodicPollingMinutes" key at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeServiceHost\RpcHttpConfigurator\ is set to zero. This will ensure that the system won't continue to over write our settings every 15 minutes.

3. b. Also modify "ValidPorts" at HKLM\Software\Microsoft\RPC\RPCProxy such that it lists the DCs which can be accessed via port 6004. An example of this would be:

domaincontroller.domain.com:6004;domaincontroller2.domain.com:6004

4. Changes for all Global Catalog (GC) servers..

a. Be sure that there is an REG_MULTI_SZ entry created named NSPI interface protocol sequences at HKLM\System\CurrentControlSet\Services\NTDS\Parameters\ and the value set to "ncacn_http:6004"

Testing autodiscover/Outlook anywhere now yields the following output in the connectivity tester:

You can double check these settings by configuring a profile in Outlook, then Ctrl+RightClicking the outlook icon on the system tray, and running "Test E-Mail Autoconfiguration."

For the full explanation I highly recommend reading the official blog post by Siddhartha Mathu at:

http://msexchangeteam.com/archive/2008/06/20/449053.aspx

Good read!

New Blog - Jeremy Hayes

2008-12-08T10:30:00.003-08:00

Another of my coworkers has created a blog over at: http://www.irundis.com/

Primary topics will probably be powershell based.

Archive Attender - HTML Formatting on x64

2008-12-03T11:22:00.002-08:00

As a followup to my previous blog located here, this issue has now been resolved. With combined efforts of Azaleos and SherpaSoftware, we have successfully rolled out this update to our first 6 clients. It was much anticipated, and has been well received so far.

OWA Exception - Exchange Cluster Name Stolen

2008-12-02T08:48:00.009-08:00

ERROR:

While attempting to access OWA..

Outlook Web Access could not connect to Microsoft Exchange. If the problem continues, contact technical support for your organization.

Copy error details to clipboard

Show details

Request

Url: https://email.domain.gov:443/owa/forms/premium/StartPage.aspx
User host address: XXX.XXX.XXX.XXX
User: Username
EX Address: /o=DOM/ou=Exchange Administrative Group (--)/cn=Recipients/cn=
SMTP Address: SMTP ADDRESSS
OWA version: 8.1.336.0
Mailbox server: MBX SERVER

Exception
Exception type: Microsoft.Exchange.Data.Storage.ConnectionFailedTransientException
Exception message: Event Manager was not created.

Call stack

Microsoft.Exchange.Data.Storage.EventPump..ctor(EventPumpManager eventPumpManager, String server, Guid mdbGuid)

Microsoft.Exchange.Data.Storage.EventPumpManager.GetEventPump(StoreSession session)

Microsoft.Exchange.Data.Storage.EventPumpManager.RegisterEventSink(StoreSession session, EventSink eventSink)

Microsoft.Exchange.Data.Storage.EventSink.InternalCreateEventSink[T](StoreSession session, EventWatermark watermark, ConstructSinkDelegate`1 constructEventSinkDelegate)

Microsoft.Exchange.Clients.Owa.Core.OwaFolderCountAdvisor..ctor(UserContext userContext, StoreObjectId folderId, EventObjectType objectType, EventType eventType)

Microsoft.Exchange.Clients.Owa.Core.OwaNotificationManager.CreateOwaFolderCountAdvisor(UserContext userContext, StoreObjectId folderId, EventObjectType objectType, EventType eventType)

Microsoft.Exchange.Clients.Owa.Premium.StartPage.OnInit(EventArgs e)

System.Web.UI.Control.InitRecursive(Control namingContainer)

System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Inner Exception
Exception type: Microsoft.Mapi.MapiExceptionNetworkError
Exception message: MapiExceptionNetworkError: Unable to make admin interface connection to server. (hr=0x80040115, ec=-2147221227) Diagnostic context: ...... Lid: 8600 dwParam: 0x721 Msg: EEInfo: ProcessID: 4208 Lid: 12696 dwParam: 0x721 Msg: EEInfo: Generation Time: 2008-12-02 16:23:58:282 Lid: 10648 dwParam: 0x721 Msg: EEInfo: Generating component: 3 Lid: 14744 dwParam: 0x721 Msg: EEInfo: Status: -2146893022 Lid: 9624 dwParam: 0x721 Msg: EEInfo: Detection location: 150 Lid: 13720 dwParam: 0x721 Msg: EEInfo: Flags: 0 Lid: 11672 dwParam: 0x721 Msg: EEInfo: NumberOfParameters: 3 Lid: 12952 dwParam: 0x721 Msg: EEInfo: prm[0]: Long val: 9 Lid: 12952 dwParam: 0x721 Msg: EEInfo: prm[1]: Long val: 6 Lid: 12952 dwParam: 0x721 Msg: EEInfo: prm[2]: Long val: 0 Lid: 24060 StoreEc: 0x80040115 Lid: 23746 Lid: 31938 StoreEc: 0x80040115 Lid: 19650 Lid: 27842 StoreEc: 0x80040115 Lid: 20866 Lid: 29058 StoreEc: 0x80040115

Call stack

Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, Int32 ec, DiagnosticContext diagCtx)

Microsoft.Mapi.ExRpcAdmin.Create(String server, String user, String domain, String password)

Microsoft.Exchange.Data.Storage.EventPump..ctor(EventPumpManager eventPumpManager, String server, Guid mdbGuid)

I've seen numerous things fix errors like this.. Resetting the Information Store (or verifying that it is started), or restarting the AD Topology Service and then the Information Store (one starts before the other, so creating a dependency would be a good idea) are both common fixes. This problem was not fixed by either.

This particular issue seemed to only affect OWA Premium users, but not Lite users. We also received sproadic reports of issues creating MAPI profiles.

About an hour earlier, we had fixed a clustering issue where the network name was in a failed state. After checking the event logs, it was obvious that the disaster recovery machine was stealing the network name after an SCR fail over was tested.

Event Type: Error

Event Source: ClusSvc

Event Category: Network Name Resource

Event ID: 1214

Date: 10/31/2006

Time: 7:30:45 AM

User: N/A

Computer: NODE1

Description:

Cluster Network Name resource 'Network Name (EXCHANGE)' cannot be brought online because the name could not be added to the system for the following reason: You were not connected because a duplicate name exists on the network. Go to System in Control Panel to change the computer name and try again.

Event Type: Error

Event Source: NetBT

Event Category: None

Event ID: 4321

Date: 10/31/2006

Time: 7:45:23 AM

User: N/A

Computer: NODE1

Description:

The name "EXCHANGE :20" could not be registered on the Interface with IP address XXX.XXX.XXX.XXX. The machine with the IP address XXX.XXX.XXX.XXX did not allow the name to be claimed by this machine.

We had rebooted the SCR server to get Exchange up and working, but we had neglected to shut it down until it could be cleaned up. The problem is that it came back up and caused problems with Exchange authenticating, and thus generated a number of Kerberos errors. Upon checking, a coworker noticed that the DCs weren't showing up as accessible in the EMC. After shutting down the SCR node completely and failing Exchange over, the DCs repopulated, and OWA worked. The moral of the story is don't leave your SCR failbacks in an incomplete state, or you get the fun task of scheduling a new maintenance window to perform clean ups.

Warning 2601, errors 2604 and 2501

2008-11-11T04:23:00.003-08:00

Recently we received the following errors on a client:

Warning 2601, errors 2604 and 2501 -- In the event viewer.

A series of things can fix this issue.

1. Verify the Exchange server(s) is a member of the "Exchange Servers" and "Exchange Install Servers" groups. Verify that these groups are under the manage/audit rights for the default domain policy (Under local policies -> user rights assignments).

2. It could be related to the order Exchange services start up. I think this was the right order:

"Microsoft Exchange Active Directory Topology Service"

"Microsoft Exchange Anti-spam Update"

"Microsoft Exchange EdgeSync"

"Microsoft Exchange File Distribution"

"Microsoft Exchange IMAP4"

"Microsoft Exchange Information Store"

"Microsoft Exchange Mail Submission"

"Microsoft Exchange Mailbox Assistants"

"Microsoft Exchange POP3"

"Microsoft Exchange Replication Service"

"Microsoft Exchange Search Indexer"

"Microsoft Exchange Service Host"

"Microsoft Exchange System Attendant"

"Microsoft Exchange Transport"

"Microsoft Exchange Transport Log Search"

"Microsoft Search (Exchange)"

3. The one that actually fixed the issue for me was to simply restart the Net Logon service and the "Microsoft Exchange Active Directory Topology Service."

Cannot enable a user for Communications Server

2008-11-10T09:47:00.002-08:00

Why can't I enable users for Communications Server? The option doesn't show up.

I have found that when I try to enable users on an x64 box, it doesn't show up. You must run it via 32-bit with:

dsa.msc -32

ESEUTIL - Maintenance and Recovery

2008-11-05T09:01:00.025-08:00

ESEUTIL can provide a number of database functions including defrags and repairs. I will be quickly covering a few of the more important tasks/scenarios.

ESEUTIL is in "C:\Program Files\Microsoft\Exchange Server\Bin" by default, and the rest of the commands I show run from this directory.

OFFLINE DEFRAG

-------------------------------

Offline defrags, under normal circumstances, do not need to be run. This is because online maintenance typically does a good job of keeping things in order. It may not get everything cleaned up, but what little bit it doesn't typically gets grown into anyways. The need comes in when a chunk of users gets deleted, or if you have to add a very large quantity of users.

Steps:

Determine White Space

a. eseutil /ms c:\exchange\data\sg1\mb1.edb

**Must be run on an database that is not mounted**

b. Check event 1221 in the event log.

Once you determine that you have enough white space to warrant an offline defrag..

Run the Defrag

eseutil.exe /d c:\EXCHSRVR\mdbdata\SG1MS1.edb

DATABASE IN AN INCONSISTENT STATE

------------------------------------------------------------------------

Steps:

a. Check current state:

eseutil.exe /mh C:\exchange\data\SG1\MB1.edb

Notice how the database is in a Dirty Shutdown state?

b. Typically to recover from this, we need only run a variation of the following command:

eseutil /r E00 /d "C:\Exchange\Data\SG1\MB1.edb" /l "c:\exchange\logs\sg1"

As shown below, this did the trick.

c. If this didn't work, we may have need to fall back on a full repair. This is typically only used if log files are missing, the database is corrupt, or some other catastrophic event has occurred. It is executed by instead using the /P switch, and basically it tosses any pages that it does not perceive as fixable. According to Microsoft, you should follow this up with an isinteg.exe run, but I've been told by enough people that it is bad mojo to keep me shying away from it unless I have to.

Other ESEUTIL functions are more informational such as /G /M and /K.

You can reference the official Microsoft site for eseutil here.

Chrome Privacy Guard

2008-10-31T12:31:00.002-07:00

"Google's new browser "Chrome" has raised a big wave of people that mistrust the new browser. A big point for this is the unique ID that will be assigned to the user's installation of Chrome. Because of that I wrote a small tool that automatically deletes the unique Client ID before each run of Google Chrome."

You can check it out here.

OWA Loop Back to Login Page Issue

2008-10-28T10:13:00.003-07:00

After the installation of RollUp 4 there were issues getting to OWA on one of the CAS servers. 404 errors were received. After reregistering ASP with IIS via:

%SYSTEMROOT%\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe –I

We received an error to check the ASP log. In the log, it was trying to create aspnet_client. This did not exist on the CAS server that was not functioning. We changed the home directory to c:\inetpub\wwwroot, reregistered, and iireset. The folder was created successfully. After changing the redirect back to owa as per their configuration, the login form came up again.

Upon trying to log in to OWA, however, we were presented with a new problem. OWA would log in, but then boot the user right back to the FBA login page. To solve this issue, all it took was recreating the OWA virtual directory with the following commands:

Remove-OwaVirtualDirectory -identity "CASSERVER\owa (Default Web Site)"

New-OWAVirtualDirectory -OWAVersion "Exchange2007" -Name "CASSERVER\owa (Default Web Site)"

Reset IIS again (iisreset)..

Users are now able to log in to OWA on this CAS server. Now all that was left to do was reenable NLB for the front end cluster, change he authentication settings back, change back the default domain, and reset the internal/external OWA addresses.

Microsoft Critical Security Release - MS08-067

2008-10-26T12:47:00.002-07:00

http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx

New Security Bulletin Technical Details

Identifier	MS08-067
Severity Rating	This security update is rated Critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, and rated Important for all supported editions of Windows Vista and Windows Server 2008.
Impact of Vulnerability	Remote Code Execution
Detection	Microsoft Baseline Security Analyzer can detect whether your computer system requires this update.
Affected Software	All currently supported versions of Windows
Restart Requirement	The update requires a restart.
Removal Information	· For Windows 2000, Windows XP, Windows Server 2003: Use Add or Remove Programs tool in Control Panel or the Spuninst.exe utility · For Windows Vista and Windows Server 2008: WUSA.exe does not support uninstall of updates. To uninstall an update installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates and select from the list of updates.
Bulletins Replaced by This Update	MS06-040 is superseded on these operating systems: Windows 2000 SP4, Windows XP SP2, Windows XP X64, Windows Server 2003 SP1, Windows Server 2003 X64, Windows Server 2003 SP1 for Itanium-based Systems.
Full Details:	http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx

To summarize.. Go update if you haven't already.

Journaling + Archive = Ideal Litigation Searches -- Part 3 ?

2008-10-23T08:04:00.009-07:00

Some notes when installing Journaling with archiving..this is sort of a part 3 to my previous two blogs.

The more journaling mailboxes you utilize, the more you can take advantage of Archive Attender multithreading. It is hard capped at one thread per mailbox though. In order to ensure archiving keeps up in the event of a failure (especially if you are using a single journal mailbox), a good idea is to have tiered archiving policies as sort of layered message traps by date:

An example of the policy to be on the front line would be:

Other policies would be between dates, with the final policy applying to anything older than the second to last policy's criteria.

I've noticed significant improvement once policies were added. This method also sort of safe guards you against back logs by already have a system in place to deal with them.

If you are bent on journaling at the Hub Transport level, you may want to at least split internal and external mail into two different mailboxes. If you are journaling at the database level, then you could go as far as to have a separate journal mailbox for each database.

Not enough storage is available to complete this operation

2008-10-21T21:54:00.003-07:00

I realize this is a rudimentary issue, but I saw it in my notes and remembered how annoying it was.

"Not enough storage is available to complete this operation"

Here is the registry key to quickly eliminate this annoying bugger:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters]

"MaxPacketSize"=dword:00000001

"MaxTokenSize"=dword:0000ffff

Quotes

2008-10-20T20:55:00.002-07:00

Though I've tried to make this blog as professional as possible by leaving off most personal info, I've decided to start leaving quotes of the | time period | up in the upper right hand corner. I have no plans to leave a history, so if you catch it you catch it. I say "time period" because I refuse to commit to daily changes.

I'm jaded, bitter, aproachable, identifying across lines, smart enough to realize everyone has an agenda, dumb enough to no longer care, and hiding in plain sight. Enjoy.

Adding Trusted Sites - Unblocked Downloads

2008-10-20T11:42:00.005-07:00

At times you'll need to add your domain to trusted zones, and allow it to launch items. This is necessary to avoid the annoying popup blocking that occurs when opening archived messages (especially if you do so frequently). To get around this you can do the following:

1. Create a reg file out of the text between the lines. Be sure to replace domain.net with yours.

--------------------

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\domain.net]

"https"=dword:00000002

--------------------

Running this will add your domain to the trusted zones.

2. You can then make the change on HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings \ Zones \ 2

Zone 2 = Trusted Sites

Value data for 2200

• 0 - Automatic prompting for file downloads is Enabled

• 3 - Automatic prompting for file downloads is Disabled

Value data for 2201

• 0 - Automatic prompting for ActiveX controls is Enabled

• 3 - Automatic prompting for ActiveX controls is Disable

Now instead of getting this:

You'll get this right away:

Exchange SP1 Rollup 4

2008-10-17T13:34:00.001-07:00

Here is the link with the changes:

http://support.microsoft.com/?kbid=952580

My particular favorites are:

949512

950076

952152

That is all.

How to Publish More Free Busy Data

2008-10-16T16:01:00.007-07:00

It has been a bit since I posted, so I figured I'd toss out some easy fodder for those that don't know (which seems to be a lot more than I thought initially).

Unfortunately there is no quick easy server side change to publish more free/busy data for a user. It is a client side setting. The setting itself can be deployed this way:

Tools -> Options ->Calendar Options-> Free/Busy Options -> Permissions Tab -> Other Free/Busy.. -> Modify the number of months to publish.

Being a client side change, if you want to roll it out on a mass scale you'll either have to build it into your ghost images, or you'll have to roll out a GPO/login script. I went to find the exact one, and ran across the Exchange team's blurb on it:

http://msexchangeteam.com/archive/2004/06/10/152698.aspx

A Good Summary For Explaining Databases/Logs

2008-10-07T09:37:00.000-07:00

This.

http://www.exchangerecovery.org/modules.php?name=Forums&file=viewtopic&t=26&view=previous

Mail.que Issues - White Space, Defrags, etc

2008-10-07T07:52:00.008-07:00

What is the Mail.que?

The Mail.Que is an ese database that acts as the transport queue on your Exchange 2007 server - Hub Transport or Edge Transport roles only.

Why would I need to run maintenance/fix issues with mail.que?

Issues can arise with the mail.que file getting very large, and fragmented. This can cause problems ranging from performance issues, to a full blown outage on an Exchange environment. This scenario can come about from multiple avenues, but a couple of seemingly more common culprits can be email blasts (especially with a large attachment on it), or if the database has not been maintained.

If my mail.que file gets large/fragmented, how do we rein it in?

Prerequisites:

1. You must be at least an Exchange Server Administrator. (Local admin on the Edge Transport server).

2. Per Microsoft, the following rights must exist to the mail.que:

Network Service: Full Control

System: Full Control

Administrators: Full Control

3. If you are planning to restore the mail.que file to another transport server, that server must have the same roles as the server you are taking it from. Mail delivery issues can arise if this is not the case, or if that server is located in a different AD forest (in which case you may have to resubmit through the categorizer).

Now that the prereqs are out of the way, we can begin to repair the database.

Step 1: Locate the database.

Unless you've changed the location, the database should reside at "C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Queue" on a Hub Transport server.

You can find the location on an Edge Server in the EdgeTransport.exe.config file under C:\Program Files\Microsoft\Exchange Server\Bin. Look for the 'QueueDatabasePath' and 'QueueDatabaseLoggingPath' values.

Step 2: Move the database out.

Stop the MSExchangeTransport service then move the following files to a temporary location: Mail.que, Trn.chk, Temp.edb, Trn.log, Trnnnn.log, Trnres00001.jrs, Trnres00002.jrs, and Trntmp.log.

Upon restarting the MSExchangeTransport service, a new mail.que will be created so mail and continue to flow.

Step 3: Recovering/Maintaining the Database

Open a command prompt and navigate to the directory where you moved the database to.

eseutil.exe /r Trn /d

This command will run a recovery against the database. You could run this from another location, but you'd have to specify where the database exists after /d. Either way works.

eseutil /d mail.que

This command will defrag the database and rid it of any white space that has ballooned it up, thus increasing performance and/or resurrecting it.

Step 4: Prepare for reinsertion of the old mail.que.

The first thing we need to do is to pause the queues via:

Net Pause MSExchangeTransport

This will stop the flow into queues and delivery all current mail.

Just to make sure the queues are clear before we continue, lets have a look.

VIA Get-Queue in the Exchange Management Shell:

VIA Exchange Management Console:

It would probably be a good idea to resubmit your unreachable queues, though this is optional.

If you want to, MS provides us the following command to do so:

Retry-Queue -Identity "Unreachable" -Resubmit $True

You can recover your poison queues too, though I personally don't usually bother.

Learn more about queues.

Step 5: Reinjection.

Now all we have to do is reinsert the old mail.que. Stop the MSExchangeTransport service, copy the old files back in, and Start MSExchangeTransport.

This is the part where I stray from the MS plan. I would recommend to go back to Step 4 and let the queues drain out again. Once they are empty, stop the MSExchangeTransport service, delete the mail.que database, and restart the MSExchangeTransport service letting the mail.que database recreate. The reason I say to do this is that I know a colleague of mine had an issue using the original mail.que file. It suffered corruption, and would balloon back out to upwards of 7 gigs with no real data in it to speak of! This type of behavior could bring the Exchange system to its knees. I'd just as soon start with a fresh slate.

Scripts to Create Archive Attender Service Account

2008-10-03T12:42:00.003-07:00

Save this one as usercreation.vbs or something along those lines:

'Creates ArchiveUser in the Archive OU and assigns Password

Option Explicit

Dim objRootLDAP, objContainer, objUser, objShell, objNetwork, objLocalGroup, objDomainGroup, objWshNet

Dim strUser, strName, strContainer, strPassword, strDescription, strDomain, strLogon, strLastName, strDisplayName, strComputer

'Variables

Set objWshNet = CreateObject("WScript.Network")

strUser = "ArchiveUser"

strName = "Archive"

strContainer = "OU=Archive ,"

strPassword = "Password"

strDescription = "Archive Attender Service Account"

strLogon = "ArchiveUser"

'Automatically pulls Domain

strDomain = objWshNet.UserDomain

strLastName = "Archive"

strDisplayName ="ArchiveUser"

'Gets you bound to AD

Set objRootLDAP = GetObject("LDAP://rootDSE")

Set objContainer = GetObject("LDAP://" & strContainer & _

objRootLDAP.Get("defaultNamingContext"))

' Performs user creation

Set objUser = objContainer.Create("User", "cn=" & strUser)

objUser.Put "sAMAccountName", strUser '25

objUser.Put "givenName", strName

objUser.put "sn",strLastName

objUser.put "UserPrincipalName",lcase(strLogon)&"@"&strDomain

objUser.put "DisplayName",strDisplayName

objUser.put "name",strName

objUser.put "description",strDescription

objUser.Setinfo

' Do not force a change of password on first login

objUser.SetPassword strPassword

objUser.Put "pwdLastSet", CLng(-1)

objUser.SetInfo

' Enable the user account

objUser.Put "userAccountControl", 512

objUser.Put "userAccountControl", &H10000

objUser.SetInfo

WScript.Quit

Now that we have a user, lets give themlocal admin rights. You can name this localadmin.vbs or something like that:

Set objWshNet = CreateObject("WScript.Network")

strDomain = objWshNet.UserDomain

strComputer = objWshNet.ComputerName

Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")

strUser = "ArchiveUser"

Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser & ",user")

'Add user to group

If Not objGroup.IsMember(objUser.ADsPath) Then

objGroup.Add(objUser.ADsPath)

End If

We now have a user with local admin rights. What about Exchange rights though?

For Exchange 2007:

Create this script and name is ExchangeRights.ps1:

Add-ExchangeAdministrator -Identity ArchiveUser -role 'orgadmin'

$server = Get-MailboxServer

Add-ADPermission -Identity $server.Identity -User "ArchiveUser" -ExtendedRights ("Send As", "Receive As")

Get-MailboxDatabase | Add-ADPermission -user ArchiveUser -AccessRights GenericAll -ExtendedRights ("Send As", "Receive As", "MS-EXCH-STORE-ADMIN")

For Exchange 2003:

First enable the security tab to be displayed in ESM via this registry key:

HKEY_CURRENT_USER\Software\Microsoft\Exchange\ExAdmin

ADD--

Value Name: ShowSecurityPage

Data Type: REG_DWORD

Value: 1

Once that is done, you need only do to the org level in ESM and add full rights for your new account (be sure to include Send As / Receive As rights). If it isn't working, be sure that you didn't inadvertantly add the user to Domain Admins. Domain Admins was set to have an explicit deny set for send/receive as as part of Microsoft's security push.

If you are not wanting to set permissions at the org level, you can set the permission levels down further so long as they apply to all the users/databases that you wish to process against.

DPM - Consistency Checking Versus SLAs

2008-10-03T12:37:00.001-07:00

There can sometimes be issues with meeting SLAs while using DPM within tight constraints. The problem is that while consistency checking is essential, it kills other scheduled synchornizations while it runs.

"Synchronization with consistency check, also referred to as “a consistency check,” is the process by which DPM checks for and corrects inconsistencies between a protected volume and its replica. As part of the synchronization process, a consistency check performs block-by-block verification to ensure that all the data on the replica is consistent with the protected data. This process is slower than incremental synchronization because all the data on the replica is compared rather than just applying the data changes to the replica."

-Microsoft

Example:

Lets say your SLA is something very low such as having the ability to restore to the last 30 minutes. We set up a 30 minute synchronization in DPM, which in itself isn't bad (though it seems to be more commonly set around 3-4 hours). The issue comes when the consistency check runs, which could take for example 1.5-2 hours. This would result in at least 3 failed synchronizations, thus breaking the SLA.

The only methods I am aware of to somewhat work around this would be to modify the SLA, or manually schedule consistency checks.

Using LDIFDE & ADSIEdit to Verify Recipient Policies

2008-09-25T13:57:00.003-07:00

Originally I wanted to run something like this:

ldifde -f C:\test.txt -t 3268 -s DC.domain.com -j C:\ -r "(&(|(mailnickname=*)(objectClass=user))(|(homeMDB=*)(msExchHomeServerName=*))(userPrincipalName=*@domain.com))" -l "msExchPoliciesIncluded"

Unfortunately userprinicipalname doesn't play nicely with "msExchPoliciesIncluded." I'm guessing this is the case with more than one user defined attribute. Example output:

dn: CN=sname\, gname,OU=Users-Company,OU=User,DC=Corp,DC=com

changetype: add

If we change it to reflect only objectclass=user:

ldifde -f C:\test.txt -s DC.domain.com -j c:\ -r "(&(objectClass=user)(homeMDB=*))" -l "msExchPoliciesIncluded"

It pulls this as example:

dn: CN=sname\, gname,OU=User,DC=domain,DC=Corp,DC=com

changetype: add

msExchPoliciesIncluded:

{86129EE7-F6C7-4CE2-9549-C242356184C6},{3B6813EC-CE89-42BA-6F11-D87D4AA30DBC}

msExchPoliciesIncluded:

{7DF5DEB4-C2EA-4920-BC8C-5342BC1E95E6},{26491CFC-4EB1-4857-861B-0CB8DF22B5D7}

You can also find this in adsiedit here to verify:

WM 6.1 - MOTO Q9h

2008-09-23T08:03:00.006-07:00

I was a day or so behind my coworker Jeremy Phillips upgrading my MOTO Q. A couple good points are the threaded text messages, and the soft delete key for email (I've REALLY been wanting this). You should check it out his blog posting on this @ http://jeremyphillips.org/?p=176. as it has a couple pretty screenshots to illustrate the changes a little better.

I differ with Jeremy in that my phone seems a bit slower now, whereas his seemed faster. I speak primarily on basic functionality though, whereas he may have been coming from a purely activesync perspective. The only difference I can tell right off the bat is that my phone is a Q9h and his is a Q9c. I haven't put in the appropriate research to really decipher the major differences between my AT&T Moto Q and my colleague's Sprint doppelganger. Here are the specs though:

9Qh *

Simple, elegant and stylish, the ultra-slim MOTO Qâ„¢ 9h, at only 11.8 millimeters thick packs in a host of advanced features * QWERTY keyboard and large, crisp display * Quad-Band (GPRS/EDGE) functionality * Video capture and playback at 30fps * HSDPA technology for fast data transfers, streaming media and web browsingÂ¹ * Connectivity: EMU, USB 2.0 full speed transfers and data access * Integrated Class 2 BluetoothÂ® wireless technology (A2DP, AVRCP - stereo) for hands-free connectivity with compatible BluetoothÂ® enabled stereo devicesÂ² * Messaging via MMS, SMS, Instant Messaging and Windows Outlook Mobile * Supports a variety of audio formats including AMR NB, AMR WB, MWA, MP3, AAC, AAC+, eAAC+, WAV, MIDI * Video formats supported includeH.263, MPEG4, WMV, H.264 decode * Up to 2 GB of optional removable storage space with a microSD memory slot * Integrated 2.0 megapixel camera with digital zoom and LED photo indicator light * Special productivity features: Opera browser, Attachment Viewer or Editor, Voice Recognition, File Manager, Voice Notes, VPN capability and Anti-Virus protection

9Qc*

Network o Type + CDMA dual band ( 800/1900 MHz) o Data + CDMA2000 1xRTT/1xEV-DO rev.0 o 3G Support + Yes * Size o Dimensions + Help dummy popup info 4.6 x 2.5 x 0.5 inches (117 x 65 x 11.9 mm) o Weight + 4.8 oz (135 g) * Battery o Capacity + 1170 mAh o Talk + 4.55 hours ( 273 mins) of Talk time o Standby + 212 hours ( 9 days) of Stand-by time * Main Display o Resolution + 320 x 240 pixels o Type + 65 536 colors, Color, TFT o Features + 2.4 inches * Camera o Resolution + 1.3 megapixels Resolution o Video + Yes o Features + Flash, 8x Digital zoom * Multimedia o Video Playback + H.263, MPEG4, WMV, H.264 formats supported , Windows Media Player 10 o Music Player + MP3, AAC, AAC+, eAAC+, WAV, WMA formats supported , Windows Media Player 10 * Memory o Memory Slot + miniSD * Smartphone o OS + Windows Mobile for Smartphones o OS Version + 6.0 Standard o Processor + Intel StrongArm o Memory + 256MB Flash, 96MB RAM * Input o Predictive Text Input + Yes o Full Keyboard + QWERTY * Connectivity o USB + miniUSB 2.0 o Connectors + HeadSet Jack (2.5mm) * Other Features o PhoneBook + capacity depends on system memory, Multiple Numbers Per Contact, Picture ID, Ring ID o PIM + Alarm, Calendar, Calculator, TO-DO, Notes o Voice + Dialing, Commands, Recording, Speaker Phone o GPS + aGP

Tricking Exchange - A Different Database Move

2008-09-21T02:10:00.001-07:00

The issue arose of moving a database to a new location. Now there are built in commands for this:

FOR LOGS:

Move-StorageGroupPath -identity SERVER\StorageGroup -LogFolderPath X:\PathToLogFiles -SystemFolderPath X:\SystemFolderPath

FOR DATABASES:

Move-DatabasePath Server\StorageGroup\MailboxStore -EDBFilePath X:\PathToDatabase

The problem was that we wanted to specifically use eseutil to move the databases. We used eseutil to push a good copy over, however, we couldn't repoint the database without Exchange trying to copy it over. I believe you can repoint the registry, but we opted to just trick Exchange in a manner of speaking. Due to size constraints, we created a new empty database, ran the above command to move it, then deleted the new database and replaced it with the eseutil copied one. This mounted up and worked great.

An alternative method to the normal methods of moving it over if you have odd circumstances to work under.

Sychronization Errors - 0X80190193 / 0X8004010F

2008-09-18T12:20:00.004-07:00

12:11:28 Synchronizer Version 11.0.8200

12:11:28 Synchronizing Mailbox 'Kym Thomas'

12:11:28 Done

12:11:28 Microsoft Exchange offline address book

12:11:28 0X8004010F

AND

9:44:33 Synchronizer Version 12.0.6315

9:44:33 Synchronizing Mailbox 'Paul Morris'

9:44:33 Done

9:44:35 Microsoft Exchange offline address book

9:44:35 0X80190193

These can commonly be caused by the SSL check box being checked on the OAB virtual directory. This requires an iisreset to undo.

Azaleos Blog Note

2008-09-16T13:15:00.002-07:00

Checking the Azaleos blog link on the right hand side can be good for extra information about my business, and my coworkers. I submit some blogs there that I don't submit here as well.