Exchange 2010

Finally the Microsoft PST capture tool has arrived…

Tonino — Mon, 30 Jan 2012 18:55:00 GMT

As a result of customer feedback Microsoft acquired Red Gate’s solution to import PST files and continued to improve it to provide an enterprise ready PST discovery and importing tool. You can use the tool to import PST directly into your on-premise or cloud based Exchange 2010 environment.

This tool will not only scan the targeted computers for any PST files but also allows you to import PST file’s from NAS filers, although the later requires you to perform the discovery manually and upload the location of the discovered PST files into the tool for further processing. To discover PST files on the targeted computers the “PST Capture Agent” has to be deployed first.

PST Capture is comprised of the following components:

PST Capture Central Service At the heart of PST Capture is the PST Capture Central Service. The Central Service maintains the list of all PST files found in your organization and manages the data as it’s moved to the Exchange servers or Exchange Online.
PST Capture Agent Discovery of the PST files is performed by PST Capture agents that are installed on computers in your organization. The agents also send the PST files they find to the host computer when an import operation is started on the PST Capture Console.
PST Capture Console The PST Capture Console is the interface you use to configure PST searches, specify the target mailboxes for PST files, and track the status of PST import operations and reports. You can also use the console to import PST files stored on network attached storage (NAS) devices, on which you can’t install PST agents.

For optimal operation, you should install the PST Capture Central Service and the PST Capture Console on a dedicated computer, known as the PST Capture host computer.

Screenshot taken from the technical documentation:

For more information:

EHLO Blog Posting: .PST, Time to Walk the Plank

Download the MSI Packages

Technical Documentation

How to automatically avoid running Exchange VMs on the same Hyper-V server after a host failure

Michael Van Horenbeeck — Sun, 29 Jan 2012 23:27:21 GMT

If you are running Exchange 2010 in a virtualized environment, chances are that you are doing so in a cluster with multiple host servers; whether they are running VMware ESX, Microsoft Hyper-V or any other’s vendor hypervisor. In this article, we will take a look at how to achieve this for Exchange servers. (Note that this approach is actually valid for any other type of VM)

To minimize the risk that the failure of a single host affects multiple Exchange servers (and thus possibly causing more damage), you’d logically want the Exchange servers to run each on a separate host server – also after a failure. By doing so, you increase the resiliency of your Exchange environment because a single host failure will not be able to take out your entire Exchange environment. The same logic applies to any other application running on multiple servers (e.g. Domain Controllers).

Let’s take the example of a 3-node cluster with 2 Exchange servers:

On the first Hyper-V Host Server, we are running our first Exchange Server along with another VM
The second Hyper-V server is running our second Exchange server and some other VMs
The third Hyper-V host is only running some other VMs

In case our first server would fail, the EX01 VM would – by default – be allocated to one of the other available nodes which is running the lowest amount of VMs. In this case, that would be Hyper-V HOST3 (only running 2 VMs vs. 3 on HOST2). Because EX01 is moved to HOST3, both Exchange servers are still running on a separate host; so there’s no real issue here.

However, consider the following situation:

The third host is now running more VM’s than the second host. In case of a failure of the first Hyper-V server, the EX01 VM would normally be moved to the second Hyper-V host which is already running an Exchange server…
Although this does not necessarily need to be a problem, since it’s very unlikely that you will lose two hosts at once or with little time between failures, it is possible that you somehow also lose your second server and as a result fail both your Exchange servers and therefore your entire messaging environment. A scenario which you – obviously – would want to avoid.

AntiAffinityClassNames

“AntiAffinityClassNames” is a cluster group property which allows you to configure where Hyper-V will attempt to move a VM to (e.g. after a failure). You need to configure each VM (cluster group) with a similar value for the property. When a failure occurs and Hyper-V needs to move the VM from the failed host to another host, it will take the value of this property into consideration and avoid moving a VM to a host which already runs another VM with the same value for that property. Only if there’s no other alternative Hyper-V server available, both VMs will be placed on the same host.

Let’s take the example of above, but this time the AntiAffinityClassNames property has been set to “EXCH” on both Exchange servers:

If the first Hyper-V host would fail, normally the EX01 Virtual Machine would be moved to the second host because that hosts runs less VMs than the third one. However; because of the property we’ve just set, Hyper-V would notice that there is already a similar VM running on the second host and it will move the EX01 VM to the third host anyway:

The second VM that was running on HOST1 would be moved to HOST2 since we haven’t made any change to it’s configuration.

Configuring AntiAffinityClassNames

Unfortunately, there is no GUI where you can simply enter a value for that property. The property can only be set using the cluster.exe command line tool:

cluster group “<name>” /prop AntiAffinityClassNames=”<value>”

If we take the example above, we would need to enter the following:

cluster group “EX01” /prop AntiAffinityClassNames=”EXCH”

cluster group “EX02” /prop AntiAffinityClassNames=”EXCH”

To view if or what value has been set for a specific cluster group (VM), type the following:

cluster group “<name>” /prop (e.g. cluster group “EX01” /prop)

For more information on the AntiAffinityClassNames property, take a look here.

Until later!

Michael

Hybrid Configuration Wizard fails when using a Wildcard certificate

Michael Van Horenbeeck — Tue, 24 Jan 2012 21:32:32 GMT

With Exchange 2010 Service Pack 2, the Hybrid Configuration Wizard was introduced which helps you hooking up your on-premise Exchange Server with Office 365.

When the Hybrid Configuration Wizard (HCW) is ran, the following tasks are executed:

Verifies if both your on-premise and cloud environments meet the prerequisites
Provisions the Exchange federation trust
Creates organization relationships between your on-premise and Exchange online organization (both ways)
Modifies e-mail address policies
Configures F/B calendar sharing, message tracking and MailTips between both environments
Configures secure mail flow between your on-premise and Exchange online organization
Enables support for online archives

As part of the tasks above, the HCW tries to create a send and receive connectors (to and from Office 365) using the following cmdlets:

New-SendConnector -Name 'Outbound to Office 365' -AddressSpaces 'System.Collections.Generic.List`1[Microsoft.Exchange.Data.AddressSpace]' -SourceTransportServers 'Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[Microsoft.Exchange.Data.Directory.ADObjectId]' -Fqdn '*.exblog.be' -RequireTLS 'True' -TLSAuthLevel 'DomainValidation' -TLSDomain 'outlook.com' -ErrorPolicies 'DowngradeAuthFailures'

the FQDN in the cmdlet above is derived from the SubjectName of the certificate that is configured for the Exchange server. Since we’re using a wildcard certificate, the HCW will try using “*.domain.tld”. Doing so, however, will throw the following error:

Execution of the New-SendConnector cmdlet had thrown an exception. This may indicate invalid parameters in your Hybrid Configuration settings.

Cannot process argument transformation on parameter 'Fqdn'. Cannot convert value "*.exblog.be" to type "Microsoft.Exchange.Data.Fqdn". Error: ""*.exblog.be" isn't a valid SMTP domain."
   at System.Management.Automation.PowerShell.CoreInvoke[TOutput](IEnumerable input, PSDataCollection`1 output, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.Invoke()
   at Microsoft.Exchange.Management.Hybrid.RemotePowershellSession.RunCommand(String cmdlet, Dictionary`2 parameters, Boolean ignoreNotFoundErrors)
'.

Additional troubleshooting information is available in the Update-HybridConfiguration log file located at C:\Program Files\Microsoft\Exchange Server\V14\Logging\Update-HybridConfiguration\HybridConfiguration_1_24_2012_10_20_1_634629972013461101.log.

The error is thrown because the New-SendConnector cmdlet cannot handle a FQDN which includes a wildcard (“*”).

Microsoft has got a hotfix for this issue, but hasn’t made it publicly available (yet). The hotfix changes the behavior of the HCW so that it is forced to use a valid FQDN as service domain for the hybrid coexistence:

New-SendConnector -Name 'Outbound to Office 365' -AddressSpaces 'System.Collections.Generic.List`1[Microsoft.Exchange.Data.AddressSpace]' -SourceTransportServers 'Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[Microsoft.Exchange.Data.Directory.ADObjectId]' -Fqdn 'mail.exblog.be' -RequireTLS 'True' -TLSAuthLevel 'DomainValidation' -TLSDomain 'outlook.com' -ErrorPolicies 'DowngradeAuthFailures'

(Note the value of the FQDN parameter. It appears as the HCW is forced to put “mail.” in front of the domain name.)

In order to get the hotfix, you will have to open a ticket with MSFT support. Note that this is an interim update and you will have to uninstall it before installing regular Update Rollups (!). Actually, there is – to my knowledge – no need to keep the update installed after successfully configuring the hybrid scenario… Since I haven’t seen any official statement about this, please make sure that you follow the guidelines from the Microsoft support engineer.

Until later!

Michael

Exchange 2010 SP1: MoveRequest fails with “MapiExceptionNoSupport”

Michael Van Horenbeeck — Fri, 13 Jan 2012 16:55:09 GMT

One of my colleagues, Geert Gijsels, recently came across the following interesting issue.

During the moves of different mailboxes from Exchange 2003 to Exchange 2010 (SP1) there was a mailbox that repeatedly failed at 10% throwing a “MapiExceptionNoSupport”-error.
Together with the error, the following event would show up in the Application log of the Exchange 2010 Server:

The Move Request log contained the following information. I omitted some lines from the information for readability:

1/11/2012 2:38:17 PM [EX2010] 'domain.local/admin' created move request.
1/11/2012 2:38:19 PM [EX2010] The Microsoft Exchange Mailbox Replication service 'EX2010.domain.local' (14.1.355.1 caps:07) is examining the request.
1/11/2012 2:38:19 PM [EX2010] Connected to target mailbox 'Primary (a0b7df99-3726-409b-b767-102f078eecca)', database 'Mailbox Database - 01', Mailbox EX2010 'EX2010.domain.local' Version 14.1 (Build 218.0).
1/11/2012 2:38:19 PM [EX2010] Connected to source mailbox 'Primary (a0b7df99-3726-409b-b767-102f078eecca)', database 'EX2003\2nd_Storage_Group\MailBox2', Mailbox EX2010 'EX2003.domain.local' Version 6.0 (Build 7651.0).
1/11/2012 2:38:29 PM [EX2010] Request processing started.
1/11/2012 2:38:29 PM [EX2010] Mailbox signature will not be preserved for mailbox 'Primary (a0b7df99-3726-409b-b767-102f078eecca)'. Outlook clients will need to restart to access the moved mailbox.
1/11/2012 2:38:29 PM [EX2010] Source Mailbox information before the move:
Regular Items: 3166, 272.5 MB (285,690,080 bytes)
Regular Deleted Items: 30, 40.2 MB (42,149,589 bytes)
FAI Items: 150, 0 B (0 bytes)
FAI Deleted Items: 0, 4.871 KB (4,988 bytes)
1/11/2012 2:38:29 PM [EX2010] Initializing folder hierarchy in mailbox 'Primary (a0b7df99-3726-409b-b767-102f078eecca)': 125 folders total.
1/11/2012 2:38:30 PM [EX2010] Fatal error MapiExceptionNoSupport has occurred.
Error details: MapiExceptionNoSupport: IExchangeFastTransferEx.TransferBuffer failed (hr=0x80040102, ec=-2147221246)
Diagnostic context:
     Lid: 55847 EMSMDBPOOL.EcPoolSessionDoRpc called [length=1216]
     Lid: 43559 EMSMDBPOOL.EcPoolSessionDoRpc returned [ec=0x0][length=677][latency=0]
     Lid: 23226 --- ROP Parse Start ---
    …
     …
     Lid: 1750 ---- Remote Context End ----
     Lid: 26849
     Lid: 21817 ROP Failure: 0x80040102
     Lid: 22630
at Microsoft.Exchange.MailboxReplicationService.AsynchronousTransmitter.WaitUntilDataIsProcessed()
at Microsoft.Exchange.MailboxReplicationService.AsynchronousTransmitter.Microsoft.Exchange.MailboxReplicationService.IDataImport.ImportBuffer(Int32 opcode, Byte[] data)
at Microsoft.Exchange.MailboxReplicationService.AsynchronousTransmitter.Microsoft.Exchange.MailboxReplicationService.IDataImport.Flush()
at Microsoft.Exchange.MailboxReplicationService.ProgressTrackerTransmitter.Microsoft.Exchange.MailboxReplicationService.IDataImport.Flush()
at Microsoft.Exchange.MailboxReplicationService.FxProxyTransmitter.Microsoft.Exchange.MailboxReplicationService.IFxProxy.Flush()
at Microsoft.Exchange.MailboxReplicationService.LocalSourceFolder.Microsoft.Exchange.MailboxReplicationService.ISourceFolder.CopyTo(IFxProxy destFolderProxy, PropTag[] excludeTags)
at Microsoft.Exchange.MailboxReplicationService.SourceFolderWrapper.<>c__DisplayClass1.<Microsoft.Exchange.MailboxReplicationService.ISourceFolder.CopyTo>b__0()
at Microsoft.Exchange.MailboxReplicationService.ExecutionContext.Execute(GenericCallDelegate operation)
at Microsoft.Exchange.MailboxReplicationService.SourceFolderWrapper.Microsoft.Exchange.MailboxReplicationService.ISourceFolder.CopyTo(IFxProxy destFolder, PropTag[] excludeTags)
at Microsoft.Exchange.MailboxReplicationService.MailboxCopierBase.CopyFolderProperties(FolderRecWrapper folderRec, ISourceFolder sourceFolder, IDestinationFolder destFolder, FolderRecDataFlags dataToCopy)
at Microsoft.Exchange.MailboxReplicationService.MoveBaseJob.<>c__DisplayClass34.<>c__DisplayClass38.<CreateFolderHierarchy>b__31()
at Microsoft.Exchange.MailboxReplicationService.ExecutionContext.Execute(GenericCallDelegate operation)
at Microsoft.Exchange.MailboxReplicationService.MoveBaseJob.<>c__DisplayClass34.<CreateFolderHierarchy>b__30(FolderRecWrapper folderRec, EnumFolderContext context)
at Microsoft.Exchange.MailboxReplicationService.FolderMap.EnumSingleFolder(FolderRecWrapper folderRec, EnumFolderContext ctx, EnumFolderCallback callback, EnumHierarchyFlags flags)
at Microsoft.Exchange.MailboxReplicationService.FolderMap.EnumSingleFolder(FolderRecWrapper folderRec, EnumFolderContext ctx, EnumFolderCallback callback, EnumHierarchyFlags flags)
at Microsoft.Exchange.MailboxReplicationService.FolderMap.EnumSingleFolder(FolderRecWrapper folderRec, EnumFolderContext ctx, EnumFolderCallback callback, EnumHierarchyFlags flags)
at Microsoft.Exchange.MailboxReplicationService.MoveBaseJob.<CreateFolderHierarchy>b__2d(MailboxMover mbxCtx)
at Microsoft.Exchange.MailboxReplicationService.MoveBaseJob.ForeachMailboxContext(MailboxMoverDelegate del)
at Microsoft.Exchange.MailboxReplicationService.MoveBaseJob.CreateFolderHierarchy(Object[] wiParams)
at Microsoft.Exchange.MailboxReplicationService.CommonUtils.CatchKnownExceptions(GenericCallDelegate del, FailureDelegate failureDelegate)
Error context: --------
Operation: IMapiFxProxy.ProcessRequest
OpCode: TransferBuffer
DataLength: 3127
--------
Operation: IMapiFxProxy.ProcessRequest
OperationSide: Target
Primary (a0b7df99-3726-409b-b767-102f078eecca)
OpCode: TransferBuffer
DataLength: 3127
1/11/2012 2:38:30 PM [EX2010] Removing target mailbox 'Primary (a0b7df99-3726-409b-b767-102f078eecca)' due to an offline move failure.
1/11/2012 2:38:30 PM [EX2010] Relinquishing job

At first, there seemed to be a problem with the DACL of the mailbox (different folders had got certains rights for “NT Authority\Anonymous Logon” that were removed). Unfortunately, resetting the rights using PFDAVadmin yielded no solution.
A call was opened at Microsoft which revealed that this was a known issues and a hotfix was already available (KB2579051) but never made it into any Update Rollup:

http://social.technet.microsoft.com/Forums/hi-IN/exchangesvrmigration/thread/73a385d5-ea2f-47b9-87f0-c481b1f29b35

I’m currently trying to get more information on more information about what exactly could case this error and what the hotfix exactly does. As soon as I get more information, I’ll blog about it here.

Credits: A big thanks to Geert for providing me the information and details for this blog post! Geert will shortly also be publishing his article about this issue on Xylos’ blog.

Having fun with Mime types in Exchange 2010

Koen Vermoesen — Mon, 09 Jan 2012 10:28:00 GMT

When you migrate from Exchange 2003 to Exchange 2010 you may have some problems with xml attachments. Al of a sudden xml attachments are send as application/xml mime type instead of text/xml. In our case the application was specifically looking for text/xml, and thus wouldn’t detect the attachment.

You could solve this problem by creating a transport rule as you can see below.

Select the conditions “from users that are inside or outside the organization” and ‘when the message header contains specific words”.
Select the action '”set header with value”.
Create the new transport rule.

To verify if the transport rule is working, you have to enable pipeline tracking on the HUB transport server. Now you can send a new message with a xml attachment to see if the transport rule changes the Content-Type.

In Exchange 2003 there was interface for editing and sorting these associations:

If you want to view the file type associations in Exchange 2010, you can do this with Exchange PowerShell by the following command:

“Get-OrganizationConfig |fl MimeTypes”

Changing the MimeTypes with EMS\EMC is not possible however. You have to do this with ADSI edit but the attribute is decoded.

You can decode it with the following PowerShell script:

clear
$file = "C:\local\export.txt"
$num1 = ""74 65 78 74 2F 68 74 6D 6C 3B 68…"
$array += $num1.Split() | ForEach{[Convert]::ToInt32($_,16)} | ForEach{[Convert]::ToChar($_)}
foreach ($char in $array)
{
if ($char -eq ';')
{
$out+="`r`n"
}
else
{
$out+=$char
}
}
$out
Add-Content $file $out

Or buy the developer a beer and ask him to change his code, what is what we did in the end.

Note 1: post co-authored by Frederiek Goemaere and Koen Vermoesen, with input from Danny De Haan and Emmanuel Cambier
Note 2: cross-posted on both Pro-exchange and Xylos blogs.

Fix for vulnerability in .NET Framework tested (and recommended) for Exchange Servers

Michael Van Horenbeeck — Fri, 06 Jan 2012 07:07:37 GMT

By the end of last year, Microsoft released an update to fix a vulnerability in the .NET Framework. The vulnerability could lead to an unrightful elevation of privilege.
More information about the patch can be found here: Microsoft Security Bulletin MS11-100

Microsoft’s Exchange Team has now fully tested and approved the patch for installation and recommends it to be installed on all servers running Exchange 2003/2007 or 2010.

The original article can be found here: http://blogs.technet.com/b/exchange/archive/2012/01/05/microsoft-security-bulletin-ms11-100-and-exchange-server.aspx

Multi-Tenancy Scaling Guide for Exchange 2010 Service Pack 2

Michael Van Horenbeeck — Tue, 03 Jan 2012 10:23:23 GMT

With Exchange 2010 Service Pack 2, Microsoft has changed their strategy on multi-tenancy. Before SP2 multi-tenancy was only supported using the Exchange 2010 hosting mode, but thanks to recent developments (Address Book Policies), you are now allowed to use the “normal” installation to create a multi-tenant environment. The details of the new support policy can be found here.

A few days back, Microsoft released a whitepaper / guide with some more information on how well Exchange 2010 scales for multi-tenancy. The guide includes more information on the ratio between hardware, number of users and the amount of tenants as well as some test results and best-practices towards the setup.

The guide can be found here.

Public Folder High Availability in an Exchange 2010 DAG environment

Koen Vermoesen — Mon, 02 Jan 2012 12:17:00 GMT

Both during the TEC panel discussion and the Pro-Exchange “Meet the product team” event some questions were asked about Public Folder HA. (Hi “Dave”!). A nice occasion to combine some of the screenshots we had lying around in a blog post.

If your company has an Exchange 2010 environment and it has to be highly available, you will most probably implement a DAG (Database Availability Group) and CAS Array (Client Access Array).

A DAG provides you with redundancy for mailbox databases. While Public Folders could rely on CCR clustering in Exchange 2007; they cannot make use of Exchange 2010 availability groups. Instead, you have to fall back to Public Folder replication to maintain multiple copies of your data.

Additionally, public folder connectivity also does not respect the “MAPI on the Middle Tier” (MOMT) principle. When your Outlook client connects to the Exchange environment, it will make a connection with the CAS Array as you can see below. For the connection to the Public Folder database, it will make a direct connection to the server that hosts the Public Folder database. That means that Outlook bypasses the CAS Array for Public Folders and connects to one of the mailbox servers in a direct way.

If that mailbox server becomes unavailable, you will still have access to your mailbox because you will be redirected by the CAS array to another mailbox server hosting an available copy of your mailbox. If you want to access a Public Folder, you will have a problem. The connection will fail because of the direct connection.

Microsoft has included a fix into Update Rollup 2 for Exchange 2010 SP1. However, installing this update alone will not fix the problem. We also need to enable “Public Folder Referrals” as they are disabled by default. (PF referrals allow you define exceptions on the normal routing cost calculations, specifically for Public Folders).

You can enable Public Folder referrals with the following command:

Can you spot the difference when running the command above again?

As you can see, Public Folder Referrals are now enabled but still empty. We will use server 3 as first referral because it is a sort of hot standby in our demo environment. As second referral we will use server 2. You will have to do this for every Public Folder database.

If you analyze the setup closely you can see we used some sort of cyclic permutation in the configuration above.

Now let’s take a look on how our client will use these referrals. If you start your Outlook client, it will try to connect to the default Public Folder database (notice the status which says “connecting”):

Exchange will return the referrals and your Outlook client will try to connect to the referrals (notice they have both an “established” status):

Note that in the background, Outlook will still try to connect to the default Public Folder database.

It may be possible that if you want to access some folder, Outlook will use the default Public Folder database and you will get an error.

After you restart your Outlook client, he will correctly connect to another Public Folder database.

Conclusion: Availability for Public Folders has been improved, however it’s not as transparent and granular as one might expect. There’s only a failover when there’s no connection to the server possible (mapi_e_network_error), not when just the PF DB is dismounted. There is a certain degree of user impact (popup error messages and time outs). In other words you will need to properly inform your users or customers and “manage their expectations”.

Alternatively, or in parallel, an administrator can change the Default Public Folder database configured for a mailbox database to ensure users a directed to a fully functional PF DB.

Note 1: post co-authored by Frederiek Goemaere, Michael Van Horenbeeck and Koen Vermoesen.
Note 2: cross-posted on both Pro-exchange and Xylos blogs.

Recording of TechNet Webcast “Integrating AD RMS with Exchange, Exchange Online in Office 365 and Windows Phone 7”

Michael Van Horenbeeck — Sun, 18 Dec 2011 21:11:17 GMT

Hi!

here’s the recording of my TechNet Webcast on Integrating Active Directory Rights Management Services with Exchange and Exchange Online.
I do apologize for my hoarseness towards the middle and the end of the video.

I hope you’ll enjoy it!

Michael

Session abstract:

Integrating AD RMS with Exchange or Office 365 adds an additional layer of security on top of your data whenever it is shared through email by preventing certain user actions like forwarding, printing, saving attachments etc. In this webcast we will go through the details of the marriage between AD RMS and Exchange 2010 SP1 on-prem, Office 365 and Windows 7. We'll discuss the limitations or Rights Management and go through the steps needed to setup, configure and integrate AD RMS with both on-prem and cloud deployments.

Link to TechNet Edge: http://technet.microsoft.com/en-us/edge/Hh707892

The Exchange 2010 Scripts

Michael Van Horenbeeck — Sun, 18 Dec 2011 20:58:41 GMT

Introduction

Both Exchange 2007 and Exchange 2010 are accompanied by a bunch of pre-created scripts that allow you to perform various tasks ranging from configuring some extra services to some basic reporting. These scripts reside in a “scripts”-folder within the Exchange installation folder and can easily be reached using the “$exscripts”-variable (which contains the path to the folder) from the Exchange Management Shell:

Almost every Service Pack that was released introduced some new scripts. Because Exchange 2010 SP2 recently hit the road, I decided to create an overview of the new scripts that shipped with it along with the existing ones. In the overview I will try to gather the available information and explain the script’s purpose. I will also try to keep this list up to date if newer scripts would be released in the future.

Did you know?

The TechNet website offers a lot of scripts with various purposes that can be used with different versions of Exchange. The repository contains scripts from both the MS Exchange Team as other Exchange professionals and are freely available for download. Check out the TechNet Script Repository for more fancy scripts!

The “stars” of the scripts folder

The following list contains all scripts from the Exchange 2010 Scripts folder with information I gathered from various resources (mostly TechNet) as well as personal experiences. Sources and additional information are always mentioned under “More information:”

Name

Purpose

AddReplicaToPFRecursive.ps1

This script will add replicas to existing Public Folders and is often used during migrations from one Exchange version to another (e.g. Exchange 2003 to Exchange 2010).

To execute the script, use the following syntax:

AddReplicaToPFRecursive.ps1 –Server <oldservername> –ServerToAdd <newservername> –TopPublicFolder <pfname>

AddUsersToPFRecursive.ps1

This script will add user permissions to Public Folders.

Note: If you use the script, but a user has already access to a specific Public Folder, the script will throw a warning.
More information: http://technet.microsoft.com/en-us/library/aa998834.aspx

AggregatePFData.ps1

The script aggregates and captures information collected from three cmdlets:

Get-PublicFolderItemStatistics
Get-PublicFolderStatistics
Get-PublicFolder

The following information is aggregated at the public folder level, and not at the item level:

Last user access and last user modification times
Owner of the public folder
Properties such as MailEnabled, HasRules, ItemCount, FolderType, HasModerator, and TotalItemSize

More information: http://technet.microsoft.com/en-us/library/ee633474.aspx

AntispamCommon.ps1

This script is referenced by other anti-spam scripts in Exchange 2007 and is not intended to be used directly.

CheckDatabaseRedundancy.ps1

Checks the redundancy of databases by validating that they have at least N configured and "healthy" copies. Active and passive copies are both counted.

To use this script you need to provide either $MailboxDatabaseName or $MailboxServerName.To generate events for Monitoring, you need to provide -MonitoringContext switch.

Note: This scripts will only provide an output if a DAG is present in the environment.

CheckInvalidRecipients.ps1

This script is designed to return information on invalid recipient objects and possible attempt to fix them.

The script will attempt to fix two classes of errors:

Primary SMTP Address Problems: If a recipient has multiple SMTP addresses listed as primary or the primary SMTP is invalid, the script will try to set the WindowsEmailAddress as the primary SMTP address, since that is the address Exchange 2003 would have recognized as the primary (although E12 does not)
Distribution Group Hidden Membership: If a distribution group has HideDLMembershipEnabled set to true, but ReportToManagerEnabled, ReportToOriginatorEnabled and/or SendOofMessageToOriginatorEnabled are set to true, then the membership is not actually securely hidden. The script will set ReportToManagerEnabled, ReportToOriginatorEnabled and SendOofMessageToOriginatorEnabled to false to fix the distribution group.

Note: to automatically try fixing reported problems, the –FixErrors switch needs to be provided.

CITSConstants.ps1

This file contains global constants used by CI Troubleshooter library

CITSLibrary.ps1

This file contains Content Index Troubleshooter functions

CITSTypes.ps1

This file contains additional types used by CI troubleshooter library

CollectOverMetrics.ps1

This script reads DAG member event logs to gather information about database operations (such as database mounts, moves, and failovers) over a specific time period. For each operation, the script records the following information:

Identity of the database
Time at which the operation began and ended
Servers on which the database was mounted at the start and finish of the operation
Reason for the operation
If the operation was successful, including the error details if the operation failed

The script writes this information to .csv files with one operation per row. It writes a separate .csv file for each DAG.

More information: http://technet.microsoft.com/en-us/library/dd351258.aspx#CollectOver

CollectReplicationMetrics.ps1

This script provides an active form of monitoring because it collects metrics in real time, while the script is running. It collects data from performance counters related to database replication. The script gathers counter data from multiple Mailbox servers, writes each server's data to a .csv file, and can then report various statistics across all of this data (for example, the amount of time each copy was failed or suspended, the average copy or replay queue length, or the amount of time that copies were outside of their failover criteria).

More information: http://technet.microsoft.com/en-us/library/dd351258.aspx#CollectRep

configure-SMBIPsec.ps1

This script is to be used to help add the necessary IPsec configuration to protect SMB (File Share) communication.

ConfigureAdam.ps1

You can use the ConfigureAdam.ps1 script in the Shell to modify the default configuration of the Active Directory Lightweight Directory Services (AD LDS) on the Edge Transport server.

After you install the Edge Transport server role, you can use the ConfigureAdam.ps1 script provided with Exchange 2010 to modify the ports and directories that AD LDS uses. The ConfigureAdam.ps1 script invokes the dsdbutil command to change the registry settings for AD LDS.

ConfigureNetworkProtocolParameters.ps1

Configures a Global Catalog running on the machine on which the script is run to listen on the standard NSPI Rpc-over-Http port 6004. This would enable Rpc-over-Http connections from Outlook clients to a GC, RpcProxy'ed by CAS boxes.

More information: http://technet.microsoft.com/en-us/library/bb124159(EXCHG.65).aspx

ConvertOABVDir.ps1

This script will convert the OAB virtual directory to an IIS web application, as well as, create a new application pool, MSExchangeOabAppPool. Converting the OAB virtual directory is necessary to support different authentication methods like Kerberos and Certificate authentication.

Note: You need to execute this script on each Client Access Server.
More Information: http://gallery.technet.microsoft.com/scriptcenter/525fb1dc-b612-4998-a2d1-55f32a6c35ac

ConvertTo-MessageLatency.ps1

This script enables you to get latency information any email still in the Message Tracking Logs. This can be useful in troubleshooting scenarios where you have to deal e.g. with slow email delivery.

DagCommonLibrary.ps1

A collection of DAG-related functions for use by other scripts.

DatabaseMaintSchedule.ps1

Random generates maintenance and quota notification schedule time based on the specified criteria.

DiagnosticScriptCommonLibrary.ps1

Library file used by scripts in the Management Pack for Exchange 2010 (SCOM)

Disable-InMemoryTracing.ps1

This script will undo the changes made by the Enable-InMemoryTracing.ps1 script.

Usage:

.\Disable-InMemoryTracing.ps1

enable-CrossForestConnector.ps1

When you want to establish direct mail flow with servers that are running Exchange in a different Active Directory forest, you must configure both Send- and Receive connector with.

This script will adjust the permissions on a Send Connector (add ‘ANONYMOUS LOGON’ to the Send Connector)

More information: http://technet.microsoft.com/en-us/library/bb123546.aspx

Enable-InMemoryTracing.ps1

This script will enable In-Memory tracing by changing the InMemoryTracing value from $false to $true in the EnabledInMemoryTraces.config in the bin directory, found under the the Exchange Install Folder.

Usage:

.\Enable-InMemoryTracing.ps1

enable-OutlookCertificateAuthentication.ps1

This script will configure the different virtual directories so that Outlook can used Smart Card Authentication.

More information: http://technet.microsoft.com/en-us/library/hh227263.aspx

ExchUCUtil.ps1

Script that makes necessary changes so that OCS/Lync can read UM data from Exchange.

More information: http://technet.microsoft.com/en-us/library/dd572267(office.13).aspx

Export-OutlookClassification.ps1

Script that exports your message classifications so that they can be imported into Outlook. The script will generate an XML-file.

More information: http://technet.microsoft.com/en-us/library/aa998271.aspx

Export-RetentionTags.ps1

This script is used in conjunction with the Import-RetentionTags.ps1 script and exports existing Retention Policy Tags to an xml file. It has proven to be useful in deployments where also Exchange Online (Office 365) is used.
If a user applied Retention Policy Tags prior to moving his mailbox to the cloud, they need to be exported from the on-premise environment and imported to Office 365. This has to be done prior to moving the mailbox.

Running the script is relatively easy:

.\Export-RetentionTags.ps1 <path_to_xml_file>

More information: http://technet.microsoft.com/en-us/library/dd297955.aspx

get-AntispamFilteringReport.ps1

You can run this script to draw a report for the Exchange Anti Spam Agents. The following values are accepted as command parameters:

messagesrejected
messagesdeleted
connections
messagesquarantined

Usage:

.\Get-AntispamFilteringReport.ps1 <command> –report <path>

get-AntispamSCLHistogram.ps1

This script will output the total number of emails calculated for every SCL Rating.

Usage:

.\Get-AntispamSCLHistogram.ps1

More information: http://technet.microsoft.com/en-us/library/aa995744.aspx

get-AntispamTopBlockedSenderDomains.ps1

This script will show you which domains have the largest share in the amount of spam sent to you.

Note: this information can sometimes be misleading because spammers tend to spoof real email addresses. This script cannot and does not take this into account. However, for domains that you are absolutely sure you don’t want to get emails from, this might prove very useful.

get-AntispamTopBlockedSenderIPs.ps1

This script will show the top 10 IP addresses that have sent you spam. This can be useful for building up a list of IP’s to blacklist.

get-AntispamTopBlockedSenders.ps1

This script will provide the top 10 of email addresses that have sent you spam.

get-AntispamTopRBLProviders.ps1

This script can be used for “monitoring” the RBL provides that are configured for your environment. It will provide you an overview of the configured RBL’s and the amount of “hits” they have provided you with.

get-AntispamTopRecipients.ps1

This script will provide you with an overview of the email addresses within your organization that are prone to receiving spam.

get-setuplog.ps1

This script will “parse” the Exchangesetup.log and show it on screen in a more readable way.

Get-UCPool.ps1

This script will query Active Directory and report back on any UC Pools that might have been configured for OCS/Lync

GetDatabaseForSearchIndex.ps1

This script will return the database that is associated with a set of catalog files.

Usage:
To use the script, run a Get-Childitem of the directory containing the catalog files and pipe it through to the script.

Get-ChildItem <path> | GetDatabaseForSearchIndex.ps1

GetSearchIndexForDatabase.ps1

This script does exactly the opposite of the GetDatabaseforSearchIndex.ps1 script. It will provide you the path to the catalog files for the database you provided with the script.

Note: to use this script add the database name after the script. E.g.: GetSearchIndexForDatabase.ps1 “Mailbox Database”

Import-RetentionTags.ps1

This script will import Retention Tags that have previously been exported with the Export-Retentiontags.ps1 script.

install-AntispamAgents.ps1

This script will install and enable the following Anti-Spam agents on a Hub Transport Server:

Connection filtering
Content filtering
Sender ID
Sender filtering
Recipient filtering
Sender reputation

Note: after running the script the Microsoft Exchange Transport services needs to be restarted.
For more information: http://technet.microsoft.com/en-us/library/bb201691.aspx

LargeToken-IIS_EWS.ps1

This script was released with Exchange 2010 SP1 RU4 in order to solve the following issue:
http://support.microsoft.com/kb/2491354

Note: This script requires PowerShell v2. It uses Remote Registry Service & WS-Management on E2K10 CAS Servers.

LargeToken-Kerberos.ps1

This script was also released with Exchange 2010 SP1 RU4 in order to solve the following issue:
http://support.microsoft.com/kb/2491354

The script will change the value for the MaxTokenSize registry key.

More information: http://support.microsoft.com/kb/327825 & http://support.microsoft.com/kb/263693

MailboxDatabaseReseedUsingSpares.ps1

This script is used for reference only. Executing the script will fail as a referenced library is missing. This library is actually used within Microsoft but is not available for the public.

Note: A big thanks to Tonino for helping me out with this one.

ManageScheduledTask.ps1

This script allows to add/modify/remove scheduled tasks through PowerShell.

The following parameters are accepted:

Install

DeleteExisting

ServerName

TaskName

PsScriptPath

PsScriptArgs

Uninstall

Disabled

Enable

TestExistence

RunFromSetup

Usage:
To create a new scheduled task that will run a custom script called “custom.ps1”, run the following cmdlet:

ManageScheduledTask.ps1 –Install –ServerName <servername> –PsScriptPath .\custom.ps1 –TaskName “Custom Script”

MigrateUMCustomPrompts.ps1

This script is used to migrate a copy of the UM custom prompts in Exchange 2007 (UM) to Exchange 2010 (UM). Custom prompts are audio files used in the Exchange UM Role that contain customized welcome-messages and –announcements.

More information: http://technet.microsoft.com/en-us/library/gg309147.aspx

Move-TransportDatabase.ps1

This script will move the Transport Database (mail.que) and log files to a new location. Next to moving the files, the script takes also care of stopping/starting the necessary services and it will create the target folder (including permissions) if it does not exist yet.

Usage:

Move-TransportDatabase –queueDatabasePath <path> –queueDatabaseLoggingPath <path>

MoveAllReplicas.ps1

When you are migrating Public Folders (e.g. when transitioning from Exchange 2003 to Exchange 2007 or 2010) all replicas must be moved off the legacy environment before you can decommission it.

Although you could perform this action manually as well, the script will allow you to easily perform the action of moving all existing replicas to the (new) server that you define.

Usage:

Moveallreplicas.ps1 –server<sourceserver> -newserver<destinationserver>

MoveMailbox.ps1

By default, Exchange 2010 performs mailbox moves asynchronously. However; in some cases an Administrator might require moves to be executed synchronously. In that case ,this script can be used.

Usage:
The script accepts pretty much the same parameters used with the New-MoveRequest cmdlet

.\MoveMailbox.ps1 –Identity <id> –TargetDatabase <targetdb>

More information: http://technet.microsoft.com/en-us/library/dd876878.aspx

new-TestCasConnectivityUser.ps1

In order to use some of the end-to-end diagnostic cmdlet in Exchange 2010, you need to create a test-user that can be used to execute the cmdlets.

A good example where this is needed, if when you deploy System Center Operations Manager. The cmdlets executed by SCOM to check the Exchange’s health require, the test user to be present.

Usage:

.\New-TestCasConnectivityUser.ps1

More information: http://technet.microsoft.com/en-us/library/dd638082.aspx

Prepare-MoveRequest.ps1

Before you can run the New-MoveRequest to move mailboxes across forests, a mail use needs to exist in the target forest. This script will create a mail user in the target forest (based on the user in the source forest) and will also copy the AD attributes from the source object to the target object.

More information: http://technet.microsoft.com/en-us/library/ee861103.aspx

RedistributeActiveDatabases.ps1

A Database Availability Group is an active environment in which database can (and will) be moved from one mailbox server to another for various reasons:

Maintenance
Failure
Corruption
…

Over time, databases could be active on servers other than the ones that you had foreseen initially. This script will allow you to “rebalance” your active databases on servers participating in your DAG, based on the db’s activation preference.

More information: http://technet.microsoft.com/en-us/library/dd335158.aspx

Reenable-AuditLoggingAgent.ps1

When upgrading to Exchange 2010 SP1, in Exchange 2010 RTM, running “Setup.com /prepareAD” the Admin Audit Log Agent gets disabled. It will not be running until the installation is completed. Run this script to fix this issue. The script will roll back the msExchangeVersion of the Agent.

Note: the issue goes away automatically once SP1 is completely installed.

Usage:

.\Reenable-AuditLoggingAgent.ps1

ReinstallDefaultTransportAgents.ps1

This script will reinstall the default Transport Agents for a Hub Transport or Edge Server. It can for instance be used to recover from an issue with transport agents.

Usage:

.\ReinstallDefaultTransportAgents.ps1

Note: the MS Exchange Transport services needs to be restarted after running this cmdlet.

RemoveReplicaFromPFRecursive.ps1

The script will remove a server from the replication list of a Public Folder and it’s subfolders. If the server isn’t listed, nothing is changed as well as when the server holds the only replica.

More information: http://technet.microsoft.com/en-us/library/aa997966.aspx

RemoveUserFromPFRecursive.ps1

This script removes a user from the client permissions list for a public folder and from all the folders beneath it in the hierarchy.

More information: http://technet.microsoft.com/en-us/library/aa997966.aspx

ReplaceReplicaOnPFRecursive.ps1

This script will replace a server listed as a replica by a new server for all public folders and the folders beneath it in the hierarchy. If the server to replace isn’t listed, nothing will be changed for that particular folder.

More information: http://technet.microsoft.com/en-us/library/aa997966.aspx

ReplaceUserPermissionOnPFRecursive.ps1

This script replace permissions of a user in the permission list for a public folder and the folders beneath it in the hierarchy with new permissions. If no permissions for the user can be found, nothing will be changed on that particular folder.

More information: http://technet.microsoft.com/en-us/library/aa997966.aspx

ReplaceUserWithUserOnPFRecursive.ps1

This script replaces a user with another user in the permissions list for a public folder or the folders beneath it in the hierarchy. If no permission entries can be found, nothing will be changed. Note that existing permissions will not be removed.

More information: http://technet.microsoft.com/en-us/library/aa997966.aspx

Reset-AntispamUpdates.ps1

This script resets baseline antispam data to original out-of-box state

Usage:

.\Reset-AntiSpamUpdates.ps1

ResetAttachmentFilterEntry.ps1

This script is used to reset the list of attachment-types that are blocked by the attachment-filtering feature, to the factory set defaults. It will do this by first removing the existing entries and then adding the default ones. If needed additional filenames or extensions can be added to the script.

Usage:

ResetAttachmentFilterEntry.ps1

ResetCasService.ps1

This script will reset and recreate the virtual directory for the service that you define.

Usage:

.\ResetCasService.ps1 <service> “<identity>”

for example:

.\ResetCasServices.ps1 owavirtualdirectory “owa (default web site)”

ResetSearchIndex.ps1

This script will remove the Search Index Catalog associated with the specified Mailbox Database.

Usage:

.\ResetSearchIndex.ps1 <databasename>

Note: optionally the –force parameter can be passed to the script as well. If –force is used, the script will not prompt for confirmation when deleting the Catalog directory.

ResumeMailboxDatabaseCopy.ps1

This script will resume activation and log file replication (copy and replay) for the specified mailbox database.

The script accepts the following parameters:

Datacenter
MailboxServer
Database

Usage:

.\ResumeMailboxDatabaseCopy.ps1 –database <dbname>

RollAlternateServiceAccountPassword.ps1

In a setup where Kerberos Authentication is used for MAPI client connectivity, a so-called Alternative Service Account (ASA) is used. You can use this script to generate a new password for the service account and propagate it to the Client Access Servers.

More information: http://technet.microsoft.com/en-us/library/ff808311.aspx

StartDagServerMaintenance.ps1

Whenever you need to do some patching on a server that is part of a DAG, there are some actions that you need to take to make sure that the node you are working on is temporarily disregarded by the DAG:

Move active databases to another DAG member
Pause the node in the cluster
Block the Database Copy Auto Activation on the mailbox server
Block replication and replay activities for each database hosted by the server
Optionally move cluster core resources to another server in the DAG

Instead of manually performing the tasks above, the StartDagServerMaintenance.ps1 script will perform all of the steps automatically.

The script is used together with the –Servername parameter which defines what server to put in ‘maintenance mode’.

Usage:

StartDagServerMaintenance.ps1 –ServerName <servername>

More information: http://technet.microsoft.com/en-us/library/dd298065.aspx

StopDagServerMaintenance.ps1

This script will reverse the action performed by the StartDagServerMaintenance.ps1 script.

More specifically, it will perform the following actions:

Run the Resume-MailboxDatabaseCopy cmdlet for each database copy hosted by the server
Resume the node in the cluster
Re-enable Database Copy Auto Activation (sets the DatabaseCopyAutoActivationPolicy to Unrestricted)

This script is also run with the –Servername parameter.

Usage:

StopDagServerMaintenance.ps1 –ServerName <servername>

More information: http://technet.microsoft.com/en-us/library/dd298065.aspx

StoreTSConstants.ps1

This file/script stores the default settings used by the Troubleshoot-DatabaseLatency.ps1 script.

More information: http://technet.microsoft.com/en-us/library/ff798271.aspx

StoreTSLibrary.ps1

A collection of Store Troubleshooter functions for use by other scripts like:

Troubleshoot-DatabaseLatency.ps1
Troubleshoot-DatabaseSpace.ps1

Troubleshoot-CI.ps1

This script monitors (and performs) troubleshooting on the Content Index catalogs. It detects and resolves the following issues:

Deadlocks
Corruption
Stalls
Backlog

This troubleshooter can be used against the server or just a database, and can be used to detect as well as resolve problems. It can also be used in just a monitoring context to log warnings and failure events in the app log.

For an usage example, check out on of my earlier blog posts: http://www.pro-exchange.be/blogs/exchange2010/archive/2011/11/21/troubleshooting-a-mailbox-database-copy-in-failedandsuspended-state.aspx

More information: http://blogs.technet.com/b/exchange/archive/2011/01/18/3411844.aspx

Troubleshoot-DatabaseLatency.ps1

This script is used by System Center Operations Manager (SCOM) to detect (and correct) latency issues on a database. Alternatively you can also create a scheduled task to run this script at predefined times.

The scripts executes the following tasks:

Checks whether database latencies are above the latency threshold of 70ms.
Checks whether the disk's transfers-per-second rate is less than the DiskReadRateThreshold performance counter and whether the disk's seconds-per-transfer rate is greater than the DiskReadLatencyThreshold performance counter. If this is the case, the script determines that the disk must be replaced because it's under low-load conditions but is exhibiting high latencies.
Checks whether a single user is using more than one thread over the last 10 minute period for longer than the value specified by the TimeInServerThreshold parameter. If this is the case, the user is likely contributing to the high latencies, and, as a result, the user's mailbox is quarantined. The user's mailbox is quarantined for six hours, during which the user won't have access to e-mail.

More information: http://technet.microsoft.com/en-us/library/ff798271.aspx

Troubleshoot-DatabaseSpace.ps1

Just as the Troubleshoot-DatabaseLatency.ps1-script, this script is used by SCOM 2007 to detect and correct any abnormal growth of either log files or database file (.edb). Alternatively, you can schedule a task to execute this script at predefined intervals.

The script executes the following tasks:

Keeps track of log generation rate for the highest log generators per database.
Keeps track of the available disk space for both the database and the log files.
Keeps track of the log generation rate. If it appears that the disk is going to run out of space within the value specified by the HourThreshold parameter (based on the log generation rate), further action must be taken.
If all of the preceding conditions are fulfilled, the script determines the list of top 25 users who accessed the database during the last one-hour period. The script then quarantines the top high-usage mailboxes for which the sum of the log generation rate is greater than the difference between the current generation rate and the sustainable generation rate that would allow tiding over the configurable time threshold. These users are quarantined for six hours, during which they won't have access to e-mail.
If the troubleshooter is unsuccessful at dropping the log generation rate to below the threshold level, it will write out events that translate into health model alerts. At this point, the script removes the database from provisioning by running the Set-MailboxDatabase cmdlet with the ExcludeFromProvisioning parameter set to $true against the specified database. You may need to move mailboxes to a new server to rebalance space.
If the troubleshooter quarantines more than 10 users, this indicates a systemic issue, which you need to follow up on. The health model will trigger an urgent alert from this condition.

More information: http://technet.microsoft.com/en-us/library/ff477617.aspx

uninstall-AntispamAgents.ps1

This script will reverse the actions performed by the Install-AntiSpamAgents.ps1 script and uninstall the Exchange Anti Spam Agents from the Hub Transport Server.

Note: the Microsoft Exchange Transport Service needs to be restarted after running this script. To verify that the transport agents have been uninstalled successfully, you can run the Get-TransportAgent cmdlet. Otherwise, you can also make sure that the Anti-spam tab is removed from the Exchange Management Console.

A first look at Exchange 2010 Service Pack 2

Michael Van Horenbeeck — Mon, 05 Dec 2011 21:49:49 GMT

As previously announced, Microsoft today release Service Pack 2 for Exchange 2010. Next to a few hundred hotfixes, the Service Pack includes the following enhancements and new features.
Many Exchange administrators have been eagerly awaiting these new features, amongst the most important ones are:

Hybrid Configuration Wizard
Cross-Site Silent Redirection
Address Book Policies
‘Changes’ to Mailbox Replication Server Proxy
Automatic mapping of Mailboxes

Let’s take a look at each of these features.

Hybrid Configuration Wizard

It is possible to connect an on-premise deployment of Exchange 2010 SP1 with Office 365. In such a “hybrid” configuration, Office 365 and the on-premise environment would act as “one”. Functionalities like Exchange Federation and Secure Transport made sure that users – no matter where their mailbox is located – couldn’t see the difference between either an on-premise or cloud-based user. Unfortunately, setting up such an hybrid deployment was not very easy. About 60 different steps were needed and in between a lot could go wrong.

The new Hybrid Configuration Wizard takes away the burden of the configuration by greatly automating the configuration-process.

When launching first, it will create a trust with the Microsoft Federation server and will also take care of the certificates to do so:

Before continuing, there are some prerequisites that you have to meet first:

Deploy and setup DirSync
Configure a trusted public certificate for your Exchange 2010 services

I will certainly be posting more about the HCW in the days coming…

Cross-Site Silent Redirection

In a scenario where two internet-facing Client Access Servers existed (in different AD Sites), a user would be presented with a link to click on when logging in into the “wrong” Client Access Server. After clicking the link, the user would also have to login again… Not very user friendly, is it?
Thanks to the Cross-Site Silent Redirection feature, the user will not get a link but will be silently redirected to his own Client Access Server without having to log in again.

The feature will only work if the following conditions are true:

Both CAS are enabled with Forms Based Authentication (to have SSO experience)
Both CAS must have an ExternalURL

How does it work?

When a user from NA connects to the CAS in Europe, the following will happen:

First the version of the mailbox will be checked (Exchange 2007 or Exchange 2010)
The mailbox location is verified
The ExternalURL-value for the remote CAS is obtained
The RedirectType-value is obtained:

Silent Redirect: If FBA is enabled on both sides, along with a redirect a hidden form containing the user’s credentials will be sent back. If not enabled, a simple 302 redirect is issued.
Manual Redirect: a manual redirect is presented (link to click on)

There are some scenario’s in which the silent redirect will not work. For instance if both Client Access Servers (local and remote site) are behind a TMG server that is not part of the same TMG array (thus using a different web listener), silent redirection will not work because the credentials cannot be passed to the remote Client Access Server. In that case, the user will be redirected but will have to logon again.

By default, cross site silent redirection is disabled. To enable it, you have to run the following cmdlet:

Set-OWAVirtualDirectory –Identity “company\owa(default web site)” – CrossSiteRedirectType Silent

Address Book Policies (ABP)

Those who have been working with Address List Segregation will be thrilled about this new feature. Address Book Policies allow you to easily segregate your address list into different parts so that one set of users will have a totally different view of the GAL than others.
An ABP is actually a collection of a GAL and custom OAB, Room- and address lists:

ABP’s can be configured using the New Address Book Policy Wizard (screenshot) or via PowerShell using the New-AddressBookPolicy cmdlet.

How does it work?

Well, other than before, ABP’s are not restrictive (they’re not based on revoking permissions to view a part of the GAL). They rather ‘assign’ a part of the GAL to a user.
The most noticeable part there is that it’s the CAS that’s responsible for applying ABP’s. Each request coming through the CAS will be evaluated against the ABP assigned to the user.
This also means that if the CAS is bypassed (e.g. with Outlook for MAC clients), ABP’s will not work.

ABP’s work in the following cases, whenever a user:

…opens the address list picked
…searches the GAL
…adds a room to a meeting request
…queries the directory (through CAS!)
…tries to view someone’s DL membership or members of a DL

I will get back on ABP’s shortly. There is a lot more to tell! If you cannot wait, you can always have a look at this presentation, given by Tonino a few weeks back on one of our events.

‘Changes’ to the Mailbox Replication Service Proxy

Previously, if you had to make changes to the MRSProxy, you had to make changes in the web.config file stored in the Exchange 2010 installation folder:

You had to enable the MRS Proxy when performing cross-forest mailbox moves (for instance in an Office 365 Hybrid Deployment with Exchange 2010). And although this isn’t an action that you had to perform regularly, I’ve always found it too much hassle.
That’s why I’m glad that Microsoft made the configuration possible through PowerShell:

By default, the MRSProxy is still disabled. To enable it, you will have to run the following cmdlet:

Set-WebServicesVirtualDirectory –Identity “EWS (Default Web Site)” –MRSProxyEnabled $true

Automapping of Mailboxes

Whenever a user would have Full Access to another mailbox, that mailbox would automatically be mapped in the Outlook of the user. There is now an option to disable automapping when adding mailbox permissions:

Add-MailboxPermission –AutoMapping $true/$false

This is it, for now. I will be posting later this week with some more in depth information about these new features.

See you soon!

Exchange 2010 Service Pack 2 is now available!

Michael Van Horenbeeck — Mon, 05 Dec 2011 08:06:00 GMT

Microsoft just released the long awaited Service Pack 2 for Exchange 2010. This update collects previous updates and brings some new functionality as well:

Address Book Policies (a.k.a. Address List Segregation)
Hybrid Configuration Wizard for Office 365

For more information about Exchange 2010 SP2, take a look at the presentation that Tonino gave at one of our earlier events: Event Presentation - Exchange- and Lync Load Balancing, Exchange 2010 SP2

The download is available for download here.

Restrict access to Exchange 2010 OWA by using Client Certificates

Michael Van Horenbeeck — Sun, 27 Nov 2011 18:59:45 GMT

Introduction

Recently, I got to a customer that wanted to protect access to Outlook Web App (OWA) with more than just the credentials of the user. At that moment they had already considered other options like using a token (e.g. RSA) or integrating a captcha on the OWA login form. However, these options required them to obtain additional licenses and products and was not really an option.

Although my first choice would have been to use a TMG, I had to look for alternatives and could come up with one that was relatively simple yet very effective: client certificates.

Client Certificates

Since OWA is basically a web page that is published through IIS you can easily protect the server, website or separate virtual directories using client certificates. If you enable the option, users/devices who are not able to “provide” a valid certificate will be denied access.

The solution based on client certificates requires you to have already deployed the following components (if not, you will have to deploy them):

Internal PKI
(automated) way of ‘pushing’ these certificates to the clients (preferably GPO).

Note: clients can also manually request the certificate if you use web enrollment on your internal CA.

There are some great resources on TechNet that explain and show how to setup such an infrastructure:

How does it work?

The principle behind Client certificate authentication is relatively simple and works in pretty much the same way as a web server proving it’s identity to client computers.
The internal root CA will generate a unique certificate for each computer/user. That certificate gets installed on the client’s computer. Upon authentication, the client will present that certificate to the web server. If the server can validate the certificate the computer will be granted access to the resource. In order for the web server to accept and check the validity of the certificate that is presented, it should trust the CA that created the certificate. Since our Exchange server is also a domain-joined computer, it will also trust the internal CA and is therefore able to check/validate the certificates presented by the clients. Alternatively, you can also use public SSL certificates, bought from a trusted third party CA:

1. The internal CA creates a certificate and also stores information about the certificate in Active Directory (maps certificate to a user).

2. The client stores this certificate in its local store.

3. Upon connection to the resource (OWA), the server will request the clients’ certificate after which the client will present the certificate that was stored locally earlier.

4. The web server (CAS) will lookup the client certificate to confirm it’s validity. If confirmed, the client is granted access.

Configuring IIS7

Assuming that your Exchange 2010 (SP1) is installed on a Windows Server 2008 R2, here are the steps that you need to take to configure certificate based authentication:

1. Open up the IIS Manager and navigate to the server node. Click ‘Authentication’ and enable Active Directory Client Certificate Authentication.

2. Navigate to the virtual directories you want to protect and double click ‘SSL Settings’. In this example, we’ll use OWA and ECP:

3. From within the SSL Settings windows, click “Require” under Client certificates:

Repeat steps 2 and 3 for each virtual directory you want to protect.

4. Run an ‘iisreset /noforce’ to apply the settings:

Authentication

We still need to configure the type of authentication we want to use in combination with the client certificates. If you don’t want your users to type in a password at all, you could enable Integrated Windows Authentication by running the following cmdlet from the Exchange Management Shell:

Or, if you still want forms based authentication:

Note: Make sure that you disable authentication methods you don’t want to be available.

By going to the authentication-options of the virtual directory (in the IIS manager), you can review what authentication options have been enabled:

Client experience

In the scenario that the user’s computer has got no client certificate, the following warning/error will be displayed:

However, if the client computer has a certificate stored, the user will be prompted to select the a certificate:

After selecting the appropriate certificate, the user will be transferred to the login page (in case FBA is enabled):

From there, users can continue by providing their credentials and logging in into OWA.

Recommended hotfixes for DAGs running on Windows Server 2008R2

Michael Van Horenbeeck — Tue, 22 Nov 2011 21:38:14 GMT

Microsoft released a blog post on the 20th November in which is explained how a short network communication failure might lead to the loss of quorum; bringing down all databases in the DAG (failover cluster).

The reason this might happen is because the Cluster Service does not handle certain cluster regroup messages correctly.
The recommended hotfixes are:

http://support.microsoft.com/kb/2549472 - Cluster node cannot rejoin the cluster after the node is restarted or removed from the cluster in Windows Server 2008 R2
http://support.microsoft.com/kb/2549448 - Cluster service still uses the default time-out value after you configure the regroup time-out setting in Windows Server 2008 R2
http://support.microsoft.com/kb/2552040 - A Windows Server 2008 R2 failover cluster loses quorum when an asymmetric communication fail

Scott Schnoll explained everything very well in the original article, which you can find here: http://blogs.technet.com/b/exchange/archive/2011/11/20/recommended-windows-hotfix-for-database-availability-groups-running-windows-server-2008-r2.aspx

Troubleshooting a Mailbox Database Copy in “FailedAndSuspended”-state

Michael Van Horenbeeck — Mon, 21 Nov 2011 21:55:00 GMT

Introduction

Exchange 2010 introduced the concept of Mailbox Database Copies in the scenario of a Database Availability Group. A Mailboxy Database Copy is – as the name might give away – a second (or third, or fourth…) copy of a mailbox database. Mailbox Database Copies are kept up to date with the source database (which is the active copy of the database on one of the member servers participating in a DAG) via a process called transaction log shipping. In short: transaction logs are copied from the active mailbox database to the different copies where the transactions are also replayed into the database. This creates consistent database copies across different servers, which allows a database to be easily mounted on another server if the primary – active – copy would fail.

To get more information on Database Availability Groups and Mailbox Database Copies, check out the following link: http://technet.microsoft.com/en-us/library/dd979799.aspx

Troubleshooting

Transaction Log Shipping is done through a DAG’s replication network. However; sometimes a database copy can get out of sync with the source database. There are different reasons why this can happen, of which the following are amongst the most common causes:

(Temporary) network interruption between source and target server
Unavailability of the passive database copies files (e.g. storage issues/storage unavailability)

To verify the status of a mailbox database copy, run the Get-MailboxDatabaseCopyStatus cmdlet:

The output will provide you with some more information about the copy. As you can see from the example above, the database is in a “FailedAndSuspended”-state. This means that the copy of the database is out of sync and currently not replicating.
Before we can troubleshoot this error, we need to make sure that the cause of this issue is resolved. If it were are (temporary) glitch in the network we could update and resume the copy. However, if the root cause is still be present, we cannot to update the copy.

Let’s see an example of such an error:

In this example, the paths to the database(s) were unavailable due to a misconfiguration. As a result, the database could not be updated. After sorting that error out, storage was reconnected back to the server after which the different paths became once again available.

Next, I proceeded to update the Mailbox Database Copy, but was faced with the following error:

After re-running the cmdlet, but this time with the –DeleteExistingFiles parameter; reseeding started:

Once reseeding was completed, the database copy returned to a healthy state:

A word on content indexing issues

Sometimes it’s possible, that only the content indexing catalog is affected. Errors with the CI catalog are indicated with the following error when running the Get-MailboxDatabaseCopyStatus:

To troubleshoot content indexing issues, Microsoft has created a script called “Troubleshoot-CI.ps1” which can be found in the Exchange\Scripts folder.

The script detects and resolves the following problems with the CI catalog:

Deadlocks
Backlogs (corrupt indexes)
Stalls (Indexes are not updated)
Corruption

In order to run the tool, you add the –detectandresolve parameter.

Results for that cmdlet will be displayed in the Event Logs:

Sometimes you might be required to reseed the Content Indexing catalog, which you can do running the following cmdlet:

Update-MailboxDatabaseCopy –CatalogOnly

This cmdlet will update only the CI catalog and leave the database untouched. If you add the –DeleteExistingFiles parameter, the existing files will be deleted and overwritten. Adding the –SourceServer paramter allows you to indicate what server the CI catalog needs to be copied from.

If you need more information on Exchange Search (including content indexing), please have a look at the following address: http://technet.microsoft.com/en-us/library/bb232132.aspx