Exchange 2010, Active Directory Blog

Export the IP Relay List on SMTP Virtual server Exchange 2010

2012-01-23T12:14:00.001-08:00

Everything seems to be much easy and less afford in PowerShell compared to all days. most of the information is needed can be gathered with simple PS instead of using complicated scripts here is how we would accomplish getting IP Addresses list on our relay list Exchange 2010.

We will use Get-ReceiveConnector cmdlet.

Get-ReceiveConnector | Select-Object -Property 'Identity','RemoteIPRanges' |FL

You can plug this into PowerGUI or run it from EMS as shown below

Working with PowerGUI will teach you real fast how to use PowerShell , here is the video to get you started.

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Customizing EMS for Exchange 2010

2012-01-12T09:47:00.001-08:00

If you have not customize the EMS in your environment for your profile you may want to make quick adjustments as below to make the EMS work more efficient for yourself. if you have the PS profile the notepad will open it for you as shown below.

if you do not have it, you can do quick test

Test-Path $profile

If you do not have it you get it “false”

and to create one

New-Item -path $profile -type file –force

This will force to create folder called “PowerShell” under my documents directory

Now short and sweat modifying profile PS1 is typing below PS

notepad.exe $PROFILE

Okay you can copy and paste the information below…

And below I have created folder called on my C drive Admin and subfolder Script and told my profile to connect there anytime it starts. The rest you can play with and adjust based on your preferences.

$Shell = $Host.UI.RawUI
$Shell.WindowTitle=”E15 PowerWay”
$Shell.BackgroundColor=”Black”
$Shell.ForegroundColor=”White”
$size = $Shell.WindowSize
$size.width=125
$size.height=50
$Shell.WindowSize = $size
$size.width=110
$size.height=300
Set-Location C:\admin\Scripts

Now have configured your PS profile based on your needs and ready to play with some of simple scripts which will help you administration of your environment..

~~References~~

Windows PowerShell Manual
http://technet.microsoft.com/en-us/library/ee692764.aspx
Windows PowerShell Profiles
http://msdn.microsoft.com/en-us/library/windows/desktop/bb613488%28v=vs.85%29.aspx

Best,

Exchange 2010 CAS ARRAY , SIMPLE DNS ROUND ROBIN

2012-01-05T13:34:00.001-08:00

How does round robin work with Exchange 2010 CAS Array deployment was a question I come a cross and wanted to clarify few things.

Now Lets say you have 4 CAS servers names

CAS01.Telnet25.org	10.10.10.101
CAS02.Telnet25.org	10.10.10.103
CAS03.Telnet25.org	10.10.10.103
CAS04.Telnet25.org	10.10.10.104

Lets say you set your CAS Array and modified RPCClientAccessServer attribute to be

outlook.Telnet25.org and all your databases tagged with same attribute.

Now each time your MAPI client want to connect to their respected mailboxes, they will want to locate this name , which is outlook.Telnet25.org, then your workstation will do DNS query to configured DNS servers on its TCP/IP properties and will ask , hey get me the IP address for outlook.Telnet25.org, I want to connect to my mailbox, the DNS server will go to its database and see there are 4 host records for outlook.Telnet25.org and will provide you the first one first now you get the IP address for outlook.Telnet25.org=10.10.10.101 which is CAS01 and CAS01 will let you connect to you your respected database and you start seeing your mails within outlook.

Now imagine 3 other users will do same and each time they go to DNS DNS will perform round robin and hand out IP address for outlook.Telnet25.org in fair order. So at the end of the day if you have 100 MAPI users your CAS load will be something like this

Now all you have done is, to leverage the CAS load , if any of your servers goes down let’s see what happens ?

If CAS01 goes down , now 75 Users will get ***(Disconnected)*** , You opened DNS console in your DC and delete the A record outlook.Telnet25.org=10.10.10.101=CAS Server IP, until the Client DNS catch expires, the client will keep trying to establish connection to its cached DNS information thus outlook continue to go bananas.

Even if you lower the DNS TTL record for outlook.telnet25.org.

‘

You can do the math if this is a good configuration or not, or you could purchase HLB and point outlook.Telnet25.org to HLB ( Hardware load balancer) IP and let HLB to handle the MAPI load and deal with situations like above without making your clients get disconnected. You can look it up on the net to see what HLB solutions available, some of them are very reasonable to be honest.

Best,

The Autodiscover service, How it is being configured & The name of the security certificate is invalid or does not match the name of the site…

2012-01-01T19:31:00.001-08:00

I recently run into issue where AutodiscoverVirtualDirectory internalUrl was set to specific URL in a good fate by trying to configure & troubleshoot Autodiscover service.
Everything you need to know is here in this white paper……..

Understanding the Autodiscover Service
http://technet.microsoft.com/en-us/library/bb124251.aspx

Now not to be confused the , if you run below cmdlet you will see the default is empty and there is no need to mess with these URL’s as they do not apply , configuring Autodiscover Service.

Get-AutodiscoverVirtualDirectory | fl *url*

For whatever reason you have if you want to fill these in this is what you would do

Set-AutodiscoverVirtualDirectory -InternalUrl
Note just change the –InternalURL to –ExternalUrl to set the external one.

Set-AutodiscoverVirtualDirectory -Identity 'autodiscover (default Web site)' -internalUrl 'https://autodiscover.SMTP25.gov/autodiscover/autodiscover.xml'

Okay what ever reason you did have and set these and did understand these are not the correct URL , here how you can set them back to normal $Null

Set-AutodiscoverVirtualDirectory -Identity 'autodiscover (default Web site)' -internalUrl ($null)

*Note change the –IntenalUrl to –ExternalUrl

What you want to configure is this one

Get-ClientAccessServer |fl identity,autodiscoverserviceinternaluri

* Note as you can see the second server mail2 is showing up on the availability services URL which will cause problems if the certificate installed on the CAS server wont have this common name. Some people does not want to expose internal names to outside by publishing within the Certificate some people wont care. IMO this does not create any security risk at all but many places I worked with use common name in the certificate. This is why ( Split DNS scenarios) you would set two A record in DNS and point to each CAS server ( assuming you have two) so that you would not see certificate name mismatch error.

Okay now hot to set the Autodiscover Service, I recommend reading the white paper first and getting good understanding how it works.
In a very common scenario this would be sample configuration……

You are running in split DNS model ( split DNS means , your internal name space matches your external name space) in my Lab I do have split DNS and my internal name space is telnet25.org my external DNS name space is also telnet25.org
You do have valid certificate , in this certificate you do have your common name, in my example I used mail.telnet25.org, and this is included into your certificate.
You have installed the certificate correctly on your CAS server or servers
You Set CAS array and did configure DNS to perform round robin , you most likely configured something like this RpcClientAccessServer=outlook.mycompany.com
You read and understood how SCP works

Okay here are the samples showing how to configure the basic
Modify the Autodiscover URL in the Service Connection Point

Set-ClientAccessServer -Identity CAS01 -AutodiscoverServiceInternalUri https://webmail.smtp25.org/autodiscover/autodiscover.xml

*Note make sure fallowing is configured based on your scenario

https://webmail.smtp25.org ( Change this , according to your scenario)
CAS01 ( Change this , according to your scenario)

***

Modify the InternalUrl attribute of the EWS
Set-WebServicesVirtualDirectory -Identity "CAS01\EWS (Default Web Site)" –InternalUrl https://webmail.smtp25.org/ews/exchange.asmx

***

Modify the InternalUrl attribute for Web-based Offline Address Book distribution
Set-OABVirtualDirectory -Identity "CAS01\oab (Default Web Site)" -InternalUrl https://webmail.smtp25.org/oab

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +http://smtp25.blogspot.com/ (Blog )http://telnet25.spaces.live.com/ (Blog)http://telnet25.wordpress.com/ (Blog)

Exchange Server 2010, SP2 has been released !!!!

2011-12-05T12:10:00.001-08:00

Exchange team has announced SP2 E210 , the highlights are

Hybrid Configuration Wizard,
Address Book Policies,
Outlook Web App Mini and
Cross-Site Silent Redirection,

but not limited……Check it out if you have not seen I yet….

Here is download link

A source-side operation failed. Error An error occurred while performing the seed operation. Error: Failed to open a log truncation context to source server….

2011-11-20T09:42:00.001-08:00

If you are trying to add mailbox database copy on your DAG member and un-able to do it, and also receiving fallowing errors , your remedy could be in this fallowing link.

http://blogs.technet.com/b/exchange/archive/2010/09/01/3410888.aspx

Error:

A source-side operation failed. Error An error occurred while performing the seed operation. Error: Failed to open a log truncation context to source server 'EX2.smtp25.org'. Hresult: 0xfffffae7. Error: The database was either not found or was not replicated.. [Database: DB4, Server: EX1.smtp25.org]

Failed to open a log truncation context to source server 'EX2.smtp25.org'. Hresult: 0xfffffae7. Error: The database was either not found or was not replicated.

Click here for help... http://technet.microsoft.com/en-US/library/ms.exch.err.default(EXCHG.140).aspx?v=14.1.218.11&t=exchgf1&e=ms.exch.err.Ex4543D9

Exchange Management Shell command attempted:

Add-MailboxDatabaseCopy -Identity 'DB4' -MailboxServer 'EX1' -ActivationPreference '2'

Elapsed Time: 00:00:02

now from the link above

http://blogs.technet.com/b/exchange/archive/2010/09/01/3410888.aspx

Identify the GUID of the database that is being added using this command:

Get-MailboxDatabase DAG-DB0 | fl name,GUID

On the server specified in the add command, using the database GUID identified, remove the following registry key:
HKEY_LOCAL_MACHINE

SOFTWARE
Microsoft
ExchangeServer
v14
Replay
State
<db-guid>
DumpsterInfo

Now compare the GUID’s and delete the ones matches from registry as shown…

Save registry and exit. you should be able to add mailbox database copy now, if Data Bases added goes into suspended mode, just make right click and update DB copy, it will take some time depending upon how big is the DB etc.

Setup wizard for update rollup 6 for Exchange server 2010 service pack 1 ended prematurely because of an error….

2011-11-18T20:38:00.001-08:00

If you are attempting to install RU on Exchange 2010 server and receiving fallowing error, there is easy way to go around to get the install working without such issues.

Problem: Install attempt RU XX on Exchange 2010 server is failing with above or similar error

Solution: Run the setup file with Administrator privileges

Cause: Most likely UAC turned on ( no need to try to turn it off )

Now here is the big secret , in old days we were able to say copy and paste into CMD window without typing the full path of the install file, you will quickly realize this is not working on Windows 2008 and you are like come on (-:

on the install file hold “SHIFT” key down and left click to get option “ Copy as path”

Open CMD as administrator and “paste” will work now , Wowwww got to love this, whom ever though of making such improvement into Windows 2008,

Now install will work flawless.

Oz Casey , Dedeal

MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog

Http://telnet25.spaces.live.com (Blog)

Http://telnet25.wordpress.com (Blog)

Disable permanently Outlook Team Calendar

2011-11-14T13:40:00.001-08:00

Outlook 2010 introduced new future called “Team Calendar”. This future might be annoying or not acceptable in certain cases and un-ticking check mark to make it not seen might not be sufficient enough. If so and you are wondering how to disable this here is the solution.

Team Calendars , star popping up from people outlook. –Reason: the
AD Attribute called “Manager” is populated see picture
When manager is listed for given user, outlook is automatically creating calendar in this format Team: Name of the manager Calendar inside peoples outlook see picture

Fire up reg edit on the problem workstation…..Drill down to fallowing directory

[HKEY_CURRENT_USER
Software
Microsoft
Office
14.0
Outlook
Options
WunderBar

Create reg key if one does not exist “Value disablereportinglinegroupcalendar”

This policy setting prevents Reporting Line Group Calendar from appearing in the navigation pane.
If you enable this policy setting, Reporting Line Group Calendar will not appear in the navigation pane.
If you disable or do not configure this policy setting, My Reporting Line Group Calendar will appear in the navigation pane.

Before

After

The Microsoft Exchange Replication service failed to start the TCP listener Event ID:2121

2011-11-14T07:25:00.001-08:00

If you are getting fallowing errors Event ID:2121 , Source: MSExchangeRepl and your Exchange services are not coming up with fallowing errors…

Log Name: Application
Source: MSExchangeRepl
Date: 11/13/2011 5:50:17 PM
Event ID: 2121
Task Category: Service
Level: Error
Keywords: Classic
User: N/A
Computer: MCCNPWINMBX3.smtp25.org
Description:
The Microsoft Exchange Replication service failed to start the TCP listener. Error: Microsoft.Exchange.Data.Directory.NoSuitableServerFoundException: The Microsoft Exchange Active Directory Topology service on server localhost did not return any suitable domain controllers.
at Microsoft.Exchange.Data.Directory.DSAccessTopologyProvider.GetConfigDCInfo(Boolean throwOnFailure)
at Microsoft.Exchange.Data.Directory.TopologyProvider.PopulateConfigNamingContexts()
at Microsoft.Exchange.Data.Directory.ADSession.GetConfigurationNamingContext()
at Microsoft.Exchange.Data.Directory.Recipient.ADRecipientSession.GetWellKnownExchangeGroupSid(Guid wkguid)
at Microsoft.Exchange.Data.Directory.Recipient.ADRecipientSession.GetExchangeServersUsgSid()
at Microsoft.Exchange.Cluster.Replay.RemoteDataProvider.StartListening()
Event Xml:

Possible solution: If topology service is not able to figured out what subnet the Exchange server belong too. Simple way to check and fix this will be adding the subnet for the Mailbox server into ADSITE and services. Perform IPconfig /all on the Exchange server figure out what subnet it is sitting on and add the subnet in ADSITE and services, you will need to reboot or , restart net logon and Exchange Services.

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +http://smtp25.blogspot.com/ (Blog)http://telnet25.wordpress.com/ (Blog)

Exchange 2010 Database Size, EDB file Path etc.….

2011-11-02T21:10:00.001-07:00

You might wonder what is the size of your Exchange Server databases , and their path etc. In Exchange 2010 the task is pretty real easy.

Get-MailboxDatabase -Status | select ServerName,Name,DatabaseSize,EdbFilePath,LogFolderPath

Now here how the output would look like

to export this into CSV file add the fallowing at the end of PS

Export-Csv c:\scripts\DBSize.csv

Full Script would be like this

Get-MailboxDatabase -Status | select ServerName,Name,DatabaseSize,EdbFilePath,LogFolderPath | Export-Csv c:\scripts\DBSize.csv

Finally we will plug this into PowerGUI

Give it a name

Changes to the distribution list membership cannot be saved" error message when you try to remove members from an Exchange Server 2010 distribution!!!

2011-10-04T13:38:00.001-07:00

If you are un-able to modify the membership for DL’s you own after migration to Exchange 2010 couple things you will need to do to get this working.

here is the message , you might be getting when you try to group membership within outlook.

Issue: Users no longer able to modify Distribution groups they own ( they are specified as the owner of the problem DL) , trying to add , remove users into member list within outlook generating above errors

Log on to your E210 Server , open EMS

New-RoleGroup DistributionGroupManagement -Roles "Distribution Groups"

Add-RoleGroupMember DistributionGroupManagement -Member dedealoc

* In my case I have converted the existed DL to “Mail Universal Distribution Group *

~~Related KB~~

http://support.microsoft.com/kb/982349

Object is read only because it was created by a future version of Exchange: 0.10 (14.0.100.0). Current supported version is 0.1 (8.0.535.0).

2011-09-21T13:28:00.001-07:00

Issue: Removing Exchange PF database fails with fallowing error on E07 Server

The public folder database 'SG02PF1' cannot be deleted.
SG02PF1
Failed
Error:
Object is read only because it was created by a future version of Exchange: 0.10 (14.0.100.0). Current supported version is 0.1 (8.0.535.0).

Solution:

Log onto Exchange 2010 Server use fallowing PS command

Server Name:WINCMS
Storage Group Name SG02
Database Name: SG02PF1

Remove-PublicFolderDatabase -Identity "WINCMS\SG02\SG02PF1"

After Exchange 2010 Migration , Distribution List owner unable to make changes to DL’s they own.

2011-09-19T10:05:00.001-07:00

Issue: Distribution List owner unable to make changes to DL’s they own. You have start getting calls from users who are unable to make modification on the Distributions List they owned, and this worked fine prior to migration and yet working on Exchange 2010 Environment.

This is not actually a problems, or per say nothing is broken, as everything working as designed or suppose to be considering Exchange 2010….

The following error(s) occurred while saving changes:
Set-DistributionGroup
Failed
Error:
You don't have sufficient permissions. This operation can only be performed by a manager of the group.

here is what you need to fix this

How to Manage Groups that I already own in Exchange 2010?

1. Download “Manage-GroupManagementRole.ps1” from this link.

2. Place the script on the same directory as script folder on your Exchange 2010 server.

4. Run it from same directory per instructed and wait for changes to take affect and try once again.

Manage-Groupmanagmeentrole.ps1 -creategroup –removegroup

The Term 'New-MailboxExportRequest' is not recognized as the name of a cmdlet, function, script file, or operable program

2011-09-13T09:17:00.001-07:00

If you are trying to run the new MailboxExportRequest and getting above error here is what will help you to resolve the issue.

You can't use the Exchange Management Console (EMC) to create a mailbox export request. You must use the Shell. ( too bad I wish this was an option from GUI as well)
You have to install SP1 or newer on your Exchange 2010 Server
Create Shared folder with fallowing permissions “grant Exchange Trusted Subsystem read/write permission”
This is Simple File Sharing permissions ( NOT NTFS) see the picture
You have to run New-ManagementRoleAssignment first , otherwise you will get the error above
Once you run the commons close tour PS and re-open it

Example

Assign Role

******user name "BakinJM" change this to your own****

New-ManagementRoleAssignment –Role “Mailbox Import Export” –User “BakinJM”

Export Run

New-MailboxExportRequest -Mailbox BakinJM -FilePath "\\PC1\pst$\BakinJM.pst

Monitor Process

Get-MailboxExportRequest | Get-MailboxExportRequestStatistics

Clear the previous Request

Get-MailboxExportRequest | Remove-MailboxExportRequest

Import PST

New-MailboxImportRequest -Mailbox BakinJM -FilePath \\PC1\pst$\BakinJM.pst

The most comprehensive and easy to fallow post in this regard IMO…..

Henrik Walther

A look at the Import/Export Mailbox improvements in Exchange 2010 Service Pack 1 (Part 2

Steve Goodman

http://www.stevieg.org/2010/07/using-the-exchange-2010-sp1-mailbox-export-features-for-mass-exports-to-pst/

Create a Mailbox Export Request

http://technet.microsoft.com/en-us/library/ff459227.aspx

Set Permissions for Shared Folders

http://technet.microsoft.com/en-us/library/cc726004.aspx

Backup DAG with Windows Backup

2011-09-11T21:00:00.001-07:00

If you like to backup your Exchange server by using windows backup you need to make .reg changes on the DAG member host Active/passive database. Reg changes are very simple and does not need any reboot. Lets say you have 3 Exchange servers configured in DAG and all servers do have active/passive databases……….

Using Windows Server Backup on Database Availability Group MembersIf a server hosting the data being backed up is a member of a database availability group (DAG) and hosts both active and passive database copies, you must disable the Microsoft Exchange Replication service VSS writer. If the Microsoft Exchange Replication service VSS writer is enabled, the backup operation will fail.

http://technet.microsoft.com/en-us/library/dd876851.aspx

Navigate to

HKEY_LOCAL_MACHINE

Software
Microsoft
ExchangeServer
v14
Replay
Parameters.

Add a new DWORD value named EnableVSSWriter, and set its value to 0.Exit Registry Editor and then restart the Microsoft Exchange Replication service

See sky drive for creating backup……………

Error: Active Directory operation failed on MCCNPWINADS02.smtp25.gov. This error is not retriable. Additional information: Insufficient access rights to perform the operation.

2011-09-11T20:17:00.001-07:00

Are you moving mailboxes and getting similar errors if so here is quick way to fix this.

Error:

Active Directory operation failed on MCCNPWINADS02.smtp25.gov. This error is not retriable. Additional information: Insufficient access rights to perform the operation.

Active directory response: 00002098: SecErr: DSID-03150E8A, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

The user has insufficient access rights.

Click here for help... http://technet.microsoft.com/en-US/library/ms.exch.err.default(EXCHG.141).aspx?v=14.1.218.11&t=exchgf1&e=ms.exch.err.Ex6AE46B

Warning:

When an item can't be read from the source database or it can't be written to the destination database, it will be considered corrupted. By specifying a non-zero BadItemLimit, you are requesting Exchange not copy such items to the destination mailbox. At move completion, these corrupted items will not be available at the destination mailbox.

Open up ADUC snap in, turn on Advance futures

Locate user, go to security tab , click advance and make sure the box cheeked in where is says “ Include Inheritable permissions from this object’s parent”

Try to move MB after this,,,,

Error: Large BadItemLimit (1000) is specified. Please confirm your intention to accept a large amount of data loss by specifying AcceptLargeDataLoss

2011-09-11T19:41:00.001-07:00

Are you moving databases from Exchange X to Exchange 2010 and receiving below warning ? if yes you need to check AcceptLargeDataLoss out in Exchange 2010.

The AcceptLargeDataLoss parameter specifies that a large amount of data loss is acceptable if the BadItemLimit is set to 51 or higher. Items are considered corrupted if the item can't be read from the source database or can't be written to the target database. Corrupted items won't be available in the destination mailbox

Replace the mail address to your own…… and run this from PS on your Exchange 2010 server. You can change the acceptable corrupted item number as you wish…

New-MoveRequest -Identity 'brooksja@smtp25.gov' -TargetDatabase "DB10" -BadItemLimit 10000 -AcceptLargeDataLoss

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/

How to Find out Exchange What Exchange 2010 Version you are running on your Server.

2011-09-01T12:28:00.001-07:00

Use fallowing PS to figure out what version of exchange 2010 you are running.

[PS] C:\>Get-ExchangeServer | Format-Table Name, *Version*

http://social.technet.microsoft.com/wiki/contents/articles/exchange-server-and-update-rollups-builds-numbers.aspx

[PS] C:\>Get-help Get-ExchangeServer

[PS] C:\>Get-ExchangeServer | Format-List

Unable to connect to Exchange Server via remote PS Unable to load assembly "Microsoft.Exchange.Configuration

2011-08-31T09:38:00.001-07:00

IF you are trying to connect to your exchange server and failing with fallowing error, fallow the simple steps to fix the issue occurring

VERBOSE: Connecting to NPWINCAS03.SMTp25.gov

[npwincas03.SMTp25.gov] Processing data from remote server failed with the following error message: Unable to load assembly "Microsoft.Exchange.Configuration.O

bjectModel.dll" specified in "InitializationParameters" section. For more information, see the about_Remote_Troubleshooting Help topic.

+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportException

+ FullyQualifiedErrorId : PSSessionOpenFailed

Open PowerShell

Enter fallowing PS command

$UserCredential = Get-Credential

Enter this one ( replace this to your own=npwincas03.smtp25.gov)

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://npwincas03.smtp25.gov>/PowerShell/ -Authentication Kerberos -Credential $UserCredential

Import-PSSession $Session

Next time you open EMS it should connect

Troubleshooting the Exchange Management Shell

http://technet.microsoft.com/en-us/library/dd351136.aspx

Use your network logon account to connect to a remote Exchange 2010 server

http://technet.microsoft.com/en-us/library/dd297932.aspx

TMG CAS 2007 ACTIVE SYNC Error, Status: 12309 The server requires authorization to fulfill the request. Access to the Web server is denied. Contact the server administrator.

2011-08-30T05:43:00.001-07:00

If you are having fallowing probes with your TMG , Active sync publishing please have a look your firewall settings to possibly remedy the issue.

Denied Connection NPWINTMG1 8/29/2011 11:56:54 PM
Log type: Web Proxy (Reverse)
Status: 12309 The server requires authorization to fulfill the request. Access to the Web server is denied. Contact the server administrator.
Rule: E210 CAS - Active Sync webmail.SMTp25.org

Source: 208.54.35.224:53699
Destination: 172.26.7.5:443

Request: OPTIONS http://webmail.SMTp25.org/Microsoft-Server-ActiveSync?Cmd=OPTIONS&User=dedealoc&DeviceId=androidc1734872834&DeviceType=Android
Filter information: Req ID: 0b5d481c; Compression: client=No, server=No, compress rate=0% decompress rate=0% ; FBA cookie: exists=no, valid=no, updated=no, logged off=no, client type=unknown, user activity=yes
Protocol: https
User: anonymous
Additional information
Client agent: Android/0.3
Object source: (No source information is available.)
Cache info: 0x8 (Request includes the AUTHORIZATION header.)
Processing time: 1 MIME type:

Open TMG, Drill down to FireWall Policy, locate the Active Sync rule you have and double click on it.

Authentication delegation
No delegation, but client may authenticate directly

Click on Users and set , this rule applies to request from fallowing user set
All users

Go to monitoring and make sure TMG servers ( if they are in Array) have been syncy, and test the rule.

Tips:

On the logs & Reports create filter to capture the authentication attempts etc.

Hopefully you will see everything green in the live logins and issues will get resolved (-:

New-TestCasConnectivityUser.ps1Error

2011-08-27T10:20:00.001-07:00

When you run TestCasConnectivityUser.ps1 , you need to have mail enabled test user account for the script to run properly.

new-TestCasConnectivityUser.ps1

Drill down to Script directory on your exchange server, and run “new-TestCasConnectivityUser.ps1”

Program Files
Microsoft
Exchange Server
V14
Scripts

Make sure the password you are using at the first time meets the password requirements and if you need specify the OU where the account will get created ( replace STP25.gov to your own Domain name space.)

Get-MailboxServer mccnpwinmbx1 | .\new-TestCasConnectivityUser.ps1 -OU STP25.gov/users

If you open ADUC you will be able to see this user, in the default users container.

get-user extest_e7a1882f51284

No running Test-OutlookWebServices -ClientAccessServer EXCCAS1 should work

Status: A packet was dropped because Forefront TMG determined that the source IP address is spoofed.

2011-08-23T20:04:00.001-07:00

TMG Logging is showing fallowing errors:……………….

Denied Connection MCCNPWINTMG1 8/15/2011 11:09:37 PM
Log type: Firewall service
Status: A packet was dropped because Forefront TMG determined that the source IP address is spoofed.
Rule: None - see Result Code
Source: Internal (172.26.4.22:55507)
Destination: Local Host (172.26.7.104:3389)
Protocol: RDP (Terminal Services)
Additional information
Number of bytes sent: 0 Number of bytes received: 0
Processing time: 0ms Original Client IP: 172.26.4.22

The network is reaching out to TMG internal interface is not recognized by the TMG server, thus TMG thinks the IP address is spoofed and drop the connection.

You need to tell TMG the Network or the IP Address itself does belong to Internal Network, so

Add static route to destination , for example

If we want to add static route for IP address 172.26.5.10 , and tell TMG what DGW to use to reach out this IP we would be using fallowing command from elevated command window ( CMD run as an administrator)

route add 172.26.5.10 mask 255.255.255.255 172.26.7.97 -p

Open MFTMG , click networking, Under Networks

Internal , internal Properties , click add range and add the IP address range.

Once you have completed this Click on monitoring, configuration and click to make sure TMG servers have been synched.

*** Before making any changes as good practice take backup of your TMG as the backup takes couple, minutes and you can go back if there are any unexpected issues, otherwise like me you will sit in the middle of the night and have to re-build everything (-: , un-necessary headache IMO***

**** Also as another good practice make the changes on the ARRAY MANAGER, if you are running TMG array***

TMG 2010 SETUP NIC CARD CONFIGURATION

2011-08-23T08:04:00.001-07:00

If you are setting up TMG and you would like to align your deployment with MS recommended & supported way; you will need to have each NIC for TMG to belong to two different network. ( this pertains two NIC scenario)

According to MS, if you do have both NIC sitting on the same network you will cause routing issues and many other usefully tips discussed here below KB…..

http://technet.microsoft.com/en-us/library/cc302678.aspx#NetworkAndRoutingIssues

TIP: Build the server with Single NIC and add the TMG server into domain by using same NIC, once server is added to domain, rename this NIC as "Internal" and make sure , you do not specify the DGW ( default Gateway ) on it.

The LAY out for each NIC shown below. Remember fallowing short list before install.

Each TMG server has two NIC cards ( Disable one and add the server indo domain by using that NIC, Use domain integration, lots of headache IMO otherwise, DMZ type of domain.)
After successfully joining domain , Rename the same NIC as "Internal" take out the gateway.
Enable second NIC name it "External" configure IP, SM and DWG on the External NIC.
Internal NIC depends upon static route table on the network routing, so you will need to use Route add command , as shown below to include these static routes.
Since Internal NIC has no DGW defined only way to get out from same network gateway to tell TMG how to get there " Static Route" persistence

route add 172.26.5.10 mask 255.255.255.255 172.26.7.97 -p

Mask 255.255.255.255 meaning is , if traffic comes to this IP=172.26.5.10, use this DGW=172.26.7.97

AS you can see you define route to one IP , not entire network, if you like to open entire network for routing you have to use CDIR subnet mask , for instance

route add 172.26.5.10 mask 255.255.255.0 172.26.7.97 -p

Mask 255.255.255.0 meaning is , TCP/IP traffic comes to this Network=172.26.5.0, use this DGW=172.26.7.97

Now we have route to entire network=172.26.5.0 thus any valid IP falls within this network TMG will know which DGW to use=172.26.7.97 I n this case

100 Access Denied RSA ACE/server rejected the passcode that you have supplied. Try again with a valid passcode.

2011-08-22T10:52:00.001-07:00

TMG 2010 RSA integration and fallowing error and the solution. You are receiving this errors because the secureid file is not present in one of the directories

C:\Windows\System32 directory

E:\Program Files\Microsoft Forefront Threat Management Gateway\sdconfig

Secure ID File what does it do ?

Secure ID File ( Contains node secret encryption key ) , if you are missing SecureID file on your server there are problems with creating secure ID on the TMG servers. The RSA servers passes back this file after first successful Authentication back to TMG server and TMG server suppose to put this file into SDCONFIG folder on the same directory you have installed TMG. The bottom line is you have to have this file on above both directories to make the RSA work. You can ask your RSA admin to create this file manually and give it to you to be put on the TMG server.

Sometimes the file gets created on the SYSTEM32 directory , yet present in the SDConfig, if this is the case you have to copy it manually from system32 into SDCONFIG directory.

Solution:
Manually create the secureid file from RSA server if it is not preset and give it to TMG administrator to place the file onto two locations on the TMG server. If it is present on the SYSTEM32, copy manually to SDCONFIG directory

C:\Windows\System32 directory

E:\Program Files\Microsoft Forefront Threat Management Gateway\sdconfig

The SDTEST Authentication Utility is used to verify that a computer running TMG Server can authenticate to a computer running RSA Authentication Manager. Note the following: SDTEST.EXE requires the SDCONF.REC to be located in the …system32 folder to run and test authentication successfully.

Install SDTEST into same directory as the TMG installation directory in my case this is E drive

E:\Program Files\Microsoft Forefront Threat Management Gateway

TMG 2010 Redirect HTTP Request to HTTPS /OWA

2011-08-22T08:02:00.001-07:00

Recently I have worked on how to redirect HTTP request to HTTPS on the TMG servers. As I see this very common scenario I am posting it here.
Remember this rule has to come before your publishing rule and details are posted on the sky drive. I will be posting video as well , soon……………………………

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +http://smtp25.blogspot.com/ (Blog)http://telnet25.wordpress.com/ (Blog)

TMG 2010 RSA things you have to remember.

2011-08-19T07:46:00.001-07:00

IF your setup requires you to setup TMG & RSA communication to meet two way government requirement and you have never done this keep reading hopefully the check list here will get you trough.

Assumption , you have configured your TMG server and you have RSA server in your network.

Summary

1. Add static route to RSA servers from TMG servers

2. Modify .Reg key on TMG server, specify what IP will be used for ACEClient

3. Go to network connections panel and make sure the Internal NIC is selected as the first NIC on the NIC bindings

4. make sure under networking from TMG, , Networks the RSA server IP addresses or Subnet is identified as internal subnet

5. You need to obtain SDconfig file from RSA Administrator (Generate Sdconfig from RSA server and save the file on TMG server on two places)

6. Locations for SDConfig on the TMG servers

C:\Windows\System32
E:\Program Files\Microsoft Forefront Threat Management Gateway\sdconfig

7. Download the tool from here ****Install this tool into same directory as the TMG binaries***

8. Your TMG and publishing rule for CAS2010 wont work unless you get the test working

1. On the TMG servers you have to make sure you have persistent static route added so that your TMG does know how to talk to RSA servers ( network routing)

Open CMD with Administrator privileges on TMG server and fallow the one line command ( Swap the IP address and proper DG , suits to your scenario)

RSA Server IP= 172.26.4.202

TMG Internal NIC = 172.26.7.105 / 27 ( /27 = 255.255.255.224)

TMG External NIC = 172.26.7.12 / 27

My default gateway for TMG server is =10.0.0.1

route add 172.26.4.202 mask 255.255.255.255 172.16.7.97 -p

Let me explain little bit what these 255.255.255.225 mean here, it means any traffic comes to destination IP=172.26.4.202 will be routed to Internal NIC Default gateway =172.16.9.97 on the TMG Server.

IF you want to have route to entire network, you would use Class less Subnet mask in this case it would be like this

This open entire network, not one host !!!!!!!!!!!!

route add 172.26.4.202 mask 255.255.255.0 172.16.7.97 -p

Delete Route ( if you make mistake and want to delete persistent route

route delete 172.26.4.202

IF you like to see static route table

route print

*****If there is no static route defined the TMG server will route the traffic to the external NIC=172.26.7.12 which is different subnet and Internal and external NIC, thus interfaces separated each other not only TMG firewall and most likely another ( CISCO etc) type of firewall. thus they wont allow to talk.****

Now on the TMG server you have to hack the register and tell TMG what the IP address will be used to talk to RSA server on each TMG server.

HKEY_LOCAL_MACHINE
SOFTWARE
SDTI
AceClient

PrimaryInterfaceIP"="172.26.7.105"

Cannot rename this connection. A connection with the name you specified already exist. Specify a different name.

2011-08-16T20:56:00.001-07:00

If you are trying to rename the existing NIC and receiving above warning on VMWare host fallow the easy steps to fix the problem, hidden NIC card in the device manager is causing issues….

1.Click Start, click Run, type cmd.exe, and then press ENTER.
2.Type set devmgr_show_nonpresent_devices=1, and then press ENTER.
3.Type Start DEVMGMT.MSC, and then press ENTER.
4.Click View, and then click Show Hidden Devices.
5.Expand the Network Adapters tree.
6.Right-click the dimmed network adapter, and then click Uninstall

http://support.microsoft.com/kb/269155

How to Disable SSLv2 on a Windows Server 2008 and Windows Server 2008 R2

2011-08-09T12:19:00.001-07:00

If you are trying to fallow the WIKI post "How to Disable SSLv2 on a Windows Server 2008 and Windows Server 2008 R2" after doing the work, you reboot the problem server, and after rebooting your security scan is still alarming about "SSLv2" enabled on the problem server , create the fallowing key instead.

Open the registry and create a key named Server under the following entry :

HKEY_LOCAL_MACHINE
SYSTEM
CurrentControlSet
Control
SecurityProviders
SCHANNEL
Protocols
SSL 2.0

Under the registry key Server, create a DWORD value named “DisabledByDefault” and change the value data to “00000001”
Reboot the server

Wiki

Move Public Folders All replica to Exchange 2010 Server PS Script

2011-08-01T20:24:00.001-07:00

If you are in the middle of migration and it is time to move all PF folder replicas from Exchange 2007 to Exchange 2010 server PS is your friend.

Lets say your Existing Exchange 2007 Server name is EXC07 and you want to move all PF replicas to newly build Exchange 2010 Server called EXC210 , you can use fallowing PS commands…..

Connect to your Exchange Server , open EMS

Navigate fallowing directory from PS command line

[PS] E:\Program Files\Microsoft\Exchange Server\V14\Scripts>

AddReplicaToPFRecursive.ps1
RemoveReplicaFromPFRecursive.ps1
ReplaceReplicaOnPFRecursive.ps1
MoveAllReplicas.ps1

Now we are ready to execute existing scripts sits on this directory. All PF replicas sits on the server called “EXC07” and I like to add Exchange 2010 Server called “EXC210 into PF replica folders as second server.

.\AddReplicaToPFRecursive.ps1 –Server EXC210 –TopPublicFolder \ –ServerToAdd “EXC07”

Remove Replica ( pay attention Exchange server must have all of its public folder replicas removed before it can be decommissioned…. )

.\RemoveReplicaToPFRecursive.ps1 –Server EXC210 –TopPublicFolder \ –ServerToRemove “EXC07”

Now System folders

.\AddReplicaToPFRecursive.ps1 -TopPublicFolder "\NON_IPM_Subtree" ServerToAdd
"EXC210"

To view a list of the replicas in the public folder hierarchy

Get-PublicFolder -recurse |fl name,replicas

Move all replicas from EXCH07 to EXC210

MoveAllReplicas.ps1 –Server EXC07 –NewServer EXC210

For System Folders

Get-PublicFolder -recurse \non_ipm_subtree |fl name, replicas

To compare content replicated between the source and destination servers

Get-PublicFolderStatistics | FL

Also

Get-PublicFolderStatistics –Server ServerA

Compare Output to ServerB

Get-PublicFolderStatistics –Server ServerA

Resources:

Missing Mail Icon in the Control panel

2011-07-28T12:54:00.001-07:00

Are you looking for mail icon on the control panel and yet to figured out where did it go on X64 OS ?

Everything else seems to be there but mail icon and you need to get to mail icon

Here is the fix might help you locate it (-:

Go to control panel and locate , View 32 bit Control panel items

Next windows pops up, the mail icon is in there

You must close all dialog boxes before you can close Exchange management console!!!!

2011-07-26T04:53:00.001-07:00

Platform Windows 2008R2 , Exchange 2010 SP1 installed.The issue is each time Exchange management console is open, upon closing attempts it is crashing with fallowing message and un-able to close the EMC.

Fix: There is none as of today ( 7-26-2011), as the problem is related to IE 9.0, which is crashing MMC, thus receiving fallowing message and un-able to close EMC. You need to use each time task manager to terminate the EMC or un-install IE 9 by going control panel…

To uninstall Internet Explorer

The following instructions apply to both Windows 7 and Windows Vista.

Click the Start button , type Programs and Features in the search box, and then click View installed updates in the left pane.
Under Uninstall an update, scroll down to the Microsoft Windows section.
Right-click Windows Internet Explorer 9, click Uninstall, and then, when prompted, click Yes.

RIM the “PlayBook “

2011-07-20T10:19:00.001-07:00

As many of you do know RIM has released tablet version recently and called it “PlayBook” BlackBerry PlayBook tablet. Since day one I have been thinking why the name was chosen so wrong.

What kind of business would willing to get these device called “PlayBook” to their employees (-: , well certainty it is not my company , (-: , beside joke I strong believe the name for the product is chosen very wrong and has to be changed ( I love my BB by the way), so I decided to kick of campaign to see what you guys think , and find the best suitable name RIM new device deserve. For example

RPAD ( RIM Portable Application Device)

what do you guys think ? (-:

Read the Review here

BlackBerry PlayBook review

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog

PST Capture Tool Exchange 2010

2011-07-05T10:34:00.001-07:00

This has been asked since long time, I remember. Finally the toll will be available according to MS Exchange Team announcement. Compact smaller fast Exchange database made most of deployments to success and PST files kept on the network always been headache and challenge for many of us. Once again having such tool will make our job easy… looking forward to get a hold of the tool (-:

Enable & Disable ActiveSync For Exchange 2007 and 2010 Users

2011-06-28T12:58:00.001-07:00

Issue: Your company asked Default behavior for new user mailbox creation , ActiveSync future to be disabled. You find out by default every MB user has ActiveSync future turned on. If you have some of your users wished to use ActiveSync while majority of the users are disabled the out the box Exchange configuration nor GUI will come into rescue but PowerShell.

See fallowing KB articles for disabling ActiveSync ,

This topic describes how to disable Microsoft Exchange ActiveSync. When you disable Exchange ActiveSync on a computer that is running Microsoft Exchange Server 2007 that has the Client Access server role installed, you disable the application pool that Exchange ActiveSync uses. An application pool is a group of processes that Internet Information Services (IIS) uses to perform a task.

To see ActiveSync Enabled users run fallowing PS ( Get is harmless, as the PS does not make any changes, you need to watch out for set function (-: )

Get-CASMailbox -resultSize unlimited -filter {activeSyncEnabled -eq $true}

Disable Active Sync for All Users

get-Mailbox | set-CASMailbox -ActiveSyncEnabled:$False

Enable ActiveSync for All Users

get-Mailbox | set-CASMailbox -ActiveSyncEnabled:$True

Now we will disable it for Everyone but for some selected users with fallowing Script

Get-Mailbox | set-CASMailbox -ActiveSyncEnabled:$True | Get-content C:\ActiveSyncEnabledUsers.txt

On the C drive of my server I have created simple TXT file for the output

last one

Get-Mailbox | ForEach {Get-ActiveSyncDeviceStatistics -Mailbox:$_.Identity} | ft DeviceFriendlyName, Devicetype, DeviceUserAgent

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Considering Domain Controllers on Virtual Environment.

2011-06-13T07:50:00.001-07:00

Planning Considerations for Virtualized Domain Controllers most concerns and pointers have been discussed on the fallowing KB#888794. I have decided to post some of the highlights from fallowing article.

IMO if passible at the least implementing one Physical DC make sense. Sizing the Domain controller correctly makes difference. The correct among of CPU, Memory and sufficient HD space need to be provided. Considering Proper AD excusing from AV scanning is also important.

Remember healthy Dc will translate as healthy applications. Exchange Server is one of the most famous application utilize Active Directory heavy. One thing I have witnessed over years , having issues with AD will cause all other applications to suffer this includes slowness and poor performance and translates as bad user experience.

Main pointer with Virtualization

Lingering objects,
DNS Considerations,
Backup Issues,
USN Rollback issues.

An effort to boot with the latest zone contents, the Microsoft DNS Server service waits 15 or more minutes for Active Directory to inbound replicate before loading an AD-integrated DNS zone.

Virtual host computers should not point to virtualized DNS Server running on the local virtual host compute

use System state backup for Active directory , do not use “snapshot”

USN Issues

When a USN rollback occurs, modifications to objects and attributes that occur on one domain controller do not replicate to other domain controllers in the forest. Because replication partners believe that they have an up-to-date copy of the Active Directory database, monitoring and troubleshooting tools such as Repadmin.exe do not report any replication errors

Things to consider when you host Active Directory domain controllers in virtual hosting environments
http://support.microsoft.com/kb/888794

USN issues
http://support.microsoft.com/?id=875495

Deployment Considerations for Virtualized Domain Controllers
http://technet.microsoft.com/en-us/library/dd348449%28WS.10%29.aspx

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Exchange 2010 VSS Backup failed.Unknown Error, Error Code: 0x80042313

2011-05-23T08:09:00.001-07:00

Problem: VSS Backups are failing with fallowing errors. “Backup failed.Unknown Error, Error Code: 0x80042313”

SnapManager backup finished with the following result:Backup group set #1:,Backup SG [SG10]: Failed

~~Solution:~~ I hate to say it but the solution will be rebooting the server. The reason why you are seeing the errors will be related couple things. First of all the most logical thing to do is to see Exchange Writer status to determine the state of the Exchange writer. If

High disk activity does not allow VSS to create a shadow copy in the default time period when the volumes are frozen for snapshot VSS will time out. Investigating high I/O issues and fixing them would be better approach.

~~Note:~~

A snapshot failure may leave volumes with the read-only and hidden attribute bits set. This configuration may leave volumes in an unusable state, even after you restart the computer. To see the disk signature you need to use diskpart utility from elevated command prompt (cmd.exe)

C:\>DiskPart

DISKPART> ATTRIBUTES disk

If this is yes , the attribute read ONLY!!!!

DISKPART> ATTRIBUTES disk
Read-only : Yes
Boot Disk : Yes
Pagefile Disk : Yes
Hibernation File Disk : No
Crashdump Disk : Yes

Select Volume 0 ( substitute the corresponding volume in your case)
List Disk
select disk 0

attributes disk clear readonly

Try to do snapshoot after clearing the read ONLY attribute

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Managed Folders Deleted Item 180 Days Retention Policy Exchange 2007

2011-05-20T19:47:00.001-07:00

Task: Create mailbox retention policy to purge anything over 180 days old out of everyone's deleted items folders only!!!!! Apply this policy to everyone

Fallow the Easy steps below to get the task done.

Open EMC, Org & Configuration, click on Mailbox

Select ONLY!!!!!! where you want the policy to apply in this case we will pick deleted items

The task has been completed

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

OFFICE 365 Outlook Anywhere Setup & Simplicity

2011-05-19T07:05:00.001-07:00

Office 365 easy usage and stable administrative console seems to be very enjoyable. Configuring major business critical services seems to be very easy from BETA perspective. I like to show you guys how easy to set , OWA, Lync, Outlook anywhere in office 365 cloud services.

After log into Admin console the download section has Desktop application assistance executable which will literally do everything for you. All you need to do is to download it and fire it up from your desktop.

If you already do have profile and outlook needs more attention here are super simple steps to configure local outlook to work with your SMTP domain ( Outlook Anywhere Access)

Go to your control panel locate the mail icon

you will need to configure additional E-mail account as shown below , you you need to provide is your full e-mail address and the correct password and let outlook do the rest of the work for you.

Now you have your outlook & Lync ready to go

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Exchange 2010 DAG & hypervisor-based clustering is supported now

2011-05-16T06:34:00.001-07:00

Exchange 2010 is finally supported with DAG and hypervisor-based clustering, or migrations scenarios with SP1 support. This has been on going issues the official support finally is brought into E210 SP1 and here is the list of vendors supported on SVVP . If you look at the list I am sure most of you will will be happy to see the officially supported partners such as “VMware”

Here is the link……………

If you like to read the official announcement here is the link

Exchange Team

Best Practice E210 Hyper V Documents download link

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog).

Cannot remove Mail Box, receiving, Active Directory operation failed on VMdc2.smtp25.internal. This error is not retriable. Additional information: Access is denied.

2011-04-16T16:37:00.001-07:00

Problem :

Unable to remove user mailbox, when you have sufficient enough rights.

Microsoft Exchange Error
Action 'Remove' could not be performed on object 'Jeff Bakin'.

Jeff Bakin
Failed
Error:
Active Directory operation failed on VMdc2.smtp25.internal. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031520B2, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

The user has insufficient access rights.

Solution:

Log into your Domain controller and fallow the steps below
Click Start type ADUC.msc
On the View Click on Advance futures , click on object tab and clear the check mark where it says “Protect object from accidental deletion”
Try to delete again, you should be fine.

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Microsoft.PowerShell_profile.ps1 cannot be loaded….

2011-04-12T13:09:00.001-07:00

If you have lunched PS and receiving fallowing errors , here is quick tip how to fix it
Problem: After lunching PS , receiving errors as fallows , Microsoft.PowerShell_profile.ps1 cannot be loaded….
Solution: Open PS and insert fallowing PS commands

PS C:\Windows\System32> Get-ExecutionPolicy

Run the below command with Elevated Privileges ( Administrator)

Set-Executionpolicy -ExecutionPolicy Unrestricted

Get-ExecutionPolicy –List

Running Scripts From Within Windows PowerShell

http://technet.microsoft.com/en-us/library/ee176949.aspx

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/(Blog)

Login Failed for user The user associated with a trusted SQL Server connection ( Microsoft SQL Server Errors : 18452)

2011-04-07T06:38:00.001-07:00

Issues: SP servers are recovering fallowing error “Login Failed for user The user associated with a trusted SQL Server connection ( Microsoft SQL Server Errors : 18452)”

Postmortem:

The SPN record in DNS for the Share point service account had issues, and for some reason the SP server could not get the SPN record for authentication thus below errors were generated.

Possible Solution: there might be multiple different scenarios why above generic event occurs the tools used in this example ( list is below) important to capture any authentication issues maybe causing problem.

Find out which DC is not honoring the mentioned SPN record. Run SSPIClient.exe and check the output see below

You may have to fire up ADSIedit and check the SPN entry for the SP service account , if you do remove the SPN entrees the authentications should fall back to NTLM and things should work fine. If so add the SPN value back and check to make sure the Domain controller SP is complaining about does have valid Kerberos and CName record, under DNS _msdtc . Remember these records are dynamically created records when DC reboots it registers these records into DNS database, so that DC can offer such services to its clients. Check TPC/IP configuration on the DC to make sure which DNS server the DC is configured to talk too. If DC is configured to point itself and running AD integrated DNS, try to point it to another DC on different AD Site and FlushDNS and register via fallowing commands…….

IPconfig /FlushDNS
IPConfig /RegisterDNS
Also re-start Netlogon service on the domain controller and try to authenticate once more.

Tools used:
SSPIClient.exe: Security Support Provider Interface. Tracks the authentication process and generates a log.

Kerblist.exe: CLI tool. Reset the Kerberos cache (purge) and list the cached Kerberos (tickets). Reboot of any server effectively execute the purge on all servers.

Adsiedit.msc: Standard AD tool. Used to edit the SPN record of svc-intra.sql account.

Eventlogs Windows standard tool for log analysis.
Network Monitor or NetMon: Capturing network packets on Windows platform (not used).

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/(Blog)

Rename Local Admin account and Reset password on your Domain.

2011-04-04T08:14:00.001-07:00

Issue: Let’s suppose there has been some security concerns in your company and you are asked to re-name local administrator account and change its password on all your workstation. We will get the work done VIA GPO.

Solution : Create GPO and apply to all workstation in your forest /Domain.

On the domain controller , click on start type gpmc.msc

Expand Group policy objects , new GPO and give it a name in this example we will use “Rename_Local_Admin_reset Password”

Click edit

User Configuration
Preferences
Control Panel

new local user and modify the options the way you want it. We are updating existing local administrator account with our selection

Now apply the GPO to all computers

here is the result from local PC

Before GPO

After GPO

from workstation if you like to see the results right away

gpupdate /force

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

OFFICE 365 first look to Admin Console

2011-04-01T22:13:00.001-07:00

Office 365 is coming up soon many futures seems to be looking pretty good.

The admin overview on top left cornet listing , important task to set your company going. Under setup clicking overview is getting you real nice page with so many useful links. As an Administrator I believe you will find the console user friendly and it is easy to navigate.

The entire idea behind office 365 is make admins forget worrying about their Servers as far as server maintenance goes and provide them useful GUI to get their daily work done to manage their environment. At the same time user experience is expected to be very enjoyable, same services offered today on premises are moved into cloud base usage.

I truly believe most of business , where they have enough bandwidth and stability will enjoy , such services being offered by the cloud base systems.

The entire cloud experience armed with many resources this includes videos and articles and they are clicks always from admin after they log into their company management page.

I will post more as I get more information about office 365 here in my blog, If you have any questions please post it here I be glad to get them answered for you…..

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Raise the Forest & Domain functional level Win2008

2011-04-01T21:56:00.001-07:00

If you need to raise FFL & DFL and you worries about breaking things here are couple suggestions and bit more break down to make better understanding about Domain and forest functional levels.

Problems may raise up : make sure you do not have any NT4.0 , Win 2000 and 2003 Domain controllers in your environment. If you do the worst case you can move the services on these DC’s to Win08 DC’s and get them out peacefully or forcefully from your active directory.

Remember : Raising the domain and forest functional levels are one-way task once it has been done going back not supported except Rebuild the domain or forest or restore it from a backup !!!!!!!!!!!!!!!!!!!!!!

What to watch out: In reality raising DFL FFL is DC to DC task and there should be none or rare application dependency performing such task. As always if you are concern big time and yet you are not sure, build LAB environment with problem application and test your scenario to make sure you are not going to introduce additional problem. Remember if you need to go back , you have to restore your entire Forest/Domain from backup which will be biggest nightmare ever (-:

Upgrading functional levels in a new Windows Server 2008 forest

When you install the first domain controller in a new Windows Server 2008 forest, functional levels are set by default to the following levels, and they remain at these levels until you raise them manually:

Windows 2000 native domain functional level
Windows 2000 forest functional level

Functional levels are set at these default levels to give you the option of adding Windows Server 2003–based domain controllers to your new Windows Server 2008 R2 forest. After you create a forest root domain, the domain functional level for each domain that you add to the Windows Server 2008 R2 forest is set to Windows Server 2003. However, if you want all domain controllers in your new Windows Server 2008 R2 environment to run Windows Server 2008 R2, set the forest functional level, and then the domain functional level, to Windows Server 2008 R2 when you install the first domain controller in your forest. Doing this saves time and enables all forest-level and domain-level features in Windows Server 2008 R2.

Windows Server 2008

All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available:

Distributed File System (DFS) replication support for the Windows Server 2003 System Volume (SYSVOL)
DFS replication support provides more robust and detailed replication of SYSVOL contents.
Some Access Based Enumeration (ABE) functionality on DFS File servers that run Windows Server 2008.
AD DS is not required for standalone DFS namespaces to support ABE. But for domain-based namespaces, use the Windows Server 2008 mode namespace, which requires the following:
- Windows Server 2003 forest functional level
- Windows Server 2008 domain functional level
For more information, see Choose a Namespace Type (http://go.microsoft.com/fwlink/?LinkId=180400).
Advanced Encryption Standard (AES 128 and AES 256) support for the Kerberos protocol
Last Interactive Logon Information
Last Interactive Logon Information displays the following information:
- The total number of failed logon attempts at a domain-joined Windows Server 2008 server or a Windows Vista workstation
- The total number of failed logon attempts after a successful logon to a Windows Server 2008 server or a Windows Vista workstation
- The time of the last failed logon attempt at a Windows Server 2008 or a Windows Vista workstation
- The time of the last successful logon attempt at a Windows Server 2008 server or a Windows Vista workstation
For more information, see Active Directory Domain Services: Last Interactive Logon (http://go.microsoft.com/fwlink/?LinkId=180387).
Fine-grained password policies
Fine-grained password policies make it possible for you to specify password and account lockout policies for users and global security groups in a domain. For more information, see Step-by-Step Guide for Fine-Grained Password and Account Lockout Policy Configuration (http://go.microsoft.com/fwlink/?LinkID=91477).
Personal Virtual Desktops
To use the added functionality provided by the Personal Virtual Desktop tab in the User Account Properties dialog box in Active Directory Users and Computers, your AD DS schema must be extended for Windows Server 2008 R2 (schema object version = 47). For more information, see Deploying Personal Virtual Desktops by Using RemoteApp and Desktop Connection Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=183552).

Windows Server 2008 R2

All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features:

Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorization based on a user’s logon method.
Automatic SPN management for services running on a particular computer under the context of a Managed Service Account when the name or DNS host name of the machine account changes. For more information about Managed Service Accounts, see Service Accounts Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=180401).

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

The Network operation failed because active directory domain service could not configure the computer account ServerName$ on the remote active directory domain controller RemoteDCName.yourDomain.local “Access Denied”

2011-04-01T21:44:00.001-07:00

Problem: When you ran DCPromo you are receiving fallowing errors, The Network operation failed because active directory domain service could not configure the computer account ServerName$ on the remote active directory domain controller RemoteDCName.yourDomain.local “Access Denied”

Solution:

Open ADUC.msc on the remote DC where the complain is coming from, on the find objects snap in click drop down menu and change the query to “computers”

Find the computer object, , click on object tab and take out the option says “Protect object from accidental deletion”

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog

Exchange 2010 some new cool futures

2011-04-01T08:18:00.001-07:00

Exchange team has published an article announcing some cool futures coming soon. In nutshell the futures are……………….

OWA Automobile Edition: Exchange team and a major US automaker will soon announce OWA integration into new line of cars to maximize end-user productivity. Car windshields are to be replaced with LCDs (who needs windshields anyway?) Additionally, when it's time for oil change, you will get a reminder popup.
Exchange Configuration: Due to long-lasting popularity of public folders, we are making required engineering changes to store Exchange configuration data in public folders, rather than Active Directory. We are now working through seemingly paradox fact that in order to read that configuration, public folder database needs to be mounted; which requires configuration to be read in the first place. From public folders... which are not mounted... because configuration is not accessible, as the folders are not up at the time. Anyway, we are sure we'll figure it out by SP2 RU1

Read more

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog

OUTLOOK 2010 Where did Message Headers go !!!

2011-03-23T12:56:00.001-07:00

If you noticed message headers in outlook 2010 is not where you would see them on outlook 2007 , simple right click and going message options seems to be missing from outlook 2010. Time to time you might need that option or even ask your client to get there if you need the header information. Recent post on MSexchange team is showing how to bring the valuable future back into outlook 2010.

Open Outlook , Click on down arrow in the Quick Access Toolbar

Pick all commands

message options click add.

now you see it on top

Respectfully,
Oz Casey, Dedeal

MVP Exchange Server
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog)

OFFICE 365 BETA Exchange 2010

2011-03-16T06:05:00.001-07:00

First look at office 365 and I wanted to share my early findings. If you have not heard the service is intent to bring Microsoft Office, SharePoint Online, Exchange Online and Lync Online services available to users in the cloud. The Admin interface for Office 365 is pretty comprehensive surrounded with many help links and other technical notes. I am pretty sure during time of BETA the usage of interface will evolve and get better. As far as functions goes product seems very solid and highly promising. I will be writing more as I do more test drive into Exchange and Lync portion here in my blog.

http://office365.microsoft.com/en-US/online-services.aspx
Microsoft Announces Office 365
http://www.microsoft.com/presspass/press/2010/oct10/10-19office365.mspx
Office BETA Program Try now…
http://office365.microsoft.com/en-US/office365-beta.aspx

Best,

ocd

SYSVOL & NETLOGON

2011-02-04T13:40:00.001-08:00

Question:

What is the difference in between SYSVOL and NETLOGON folders speaking of ACTIVE directory?

Answer:

IN Active directory there are two critical folders which are shared by each domain controller. These folders are SYSVOL and NETLOGON.

Now,

SYSVOL, is used by the domain clients Windows 2X and upper versions to apply GPO ( Group Policies) When you create GPO from DC1 , the GPO gets put into this folder so that it can be replicated to other domain controllers within your Domain name space.

NETLOGON, is used by domain clients to obtain logon script, same goes for the logon scripts when you configure one logon script same scrip gets copied via network connectivity by FRS to other domain controllers

Now AD replication scope is Forest-wide, while SYSVOL replication scope will be Domain wide. The replication problems in AD may cause replication issues problems inconsistent SYSVOL and this will be bad effect to your environment.

FRS uses same connection objects and scheduled , except same site partners, Which Active directory replication uses, so no wonder when AD replication is having issues, so does SYSVOL replication gets effected by this problem. AD replication topology could lead to SYSVOL replication failure.

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog)

Restart BlackBerry Services in RDC order

2011-02-01T09:00:00.001-08:00

We have talk about this in the past several time, as it come up again I wanted to mention one more as I find this very useful when it comes to BES servers and restarting its related services on the BES server. See below table as your reference….

R	Blackberry Router	Service establishes connections,Manages the connection to the wireless network for the BlackBerry Enterprise Server. Also routes data to handhelds that are connected through the BlackBerry Handheld Manager.
D	BlackBerry Dispatcher	Establish connection to Exchange, Performs data encryption and compression services for all data that the BlackBerry Enterprise Server sends or receives
C	Controller	Controls all other services, Monitors key BlackBerry Enterprise Server components and restarts them if they stop responding

*** Rest of the services can be restarted in any order***

BlackBerry Alert
When configured, sends alerts when events at the specified level occur on the
BlackBerry Enterprise Server.
BlackBerry attachment
Converts attachments into a format that can be viewed on the handheld.
BlackBerry Database Consistency Service
Synchronizes data between the BlackBerry Manager database and user
mailboxes.
Blackberry Mobil data service
Provides secure access to online content and applications on the corporate
intranet or Internet through the BlackBerry Enterprise Server.
BlackBerry Policy service
Supports wireless IT Policy, service books, and third-party application delivery for
the BlackBerry Enterprise Server.
BlackBerry Synchronization service
Synchronizes PIM application data wirelessly between the handheld and the mail
Server.

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog)

WHITE SPACE EXCHANGE 2010, Where did 1221 Go?

2011-01-29T20:26:00.001-08:00

One of important Exchange Server application task & process always been the white space and how we deal with it as Exchange administrator. White space always been one of the most asked, case & specific area in Exchange Server. If you remember in previous versions of Exchange event log 1221 would be logged on the application logs and we would sum these up to find out the total white space in Exchange databases.

Now, as far as basic goes , dealing with Exchange white space always been simple. We don’t take database "off line" and try to run defrag on it, we simply create new DB and move Mail Boxes into newly created DB. Once we are done moving all mail boxes, we would delete the DB has the white space.

The big reason we would do this would be backup considerations, as we would not want to backup white space , otherwise Exchange always been smart enough to find the white space each night after online maintenance and mark the white space as "re-usable" area for the related DB.

Now in Exchange 2010 there are no more 1221 event logs, because Exchange 2010 is dealing with white space in bit more advance approach. Background database maintenance and 24/7 online defragmentation process is explained in details as fallows.

If you like to see the available space on the database you can run fallowing

Get-MailboxDatabase Database1 -Status | FL AvailableNewMailboxSpace

Database White Space

The database size on the physical disk isn't just the number of users multiplied by the mailbox storage quota. When the majority of users aren't approaching their mailbox storage quota, the databases consume less space and white space isn't a capacity concern. The database itself will always have free pages, or white space, spread throughout. During background database maintenance, items marked for removal from the database are removed, which frees these pages. The percentage of white space is constantly changing due to the efforts of the 24x7 online defragmentation process.

You can estimate the amount of white space in the database by knowing the amount of mail sent and received by the users with mailboxes in the database. For example, if you have 100 2-GB mailboxes (total of 200 GB) in a database where users send and receive an average of 10 MB of mail per day, the amount of white space is approximately 1 GB (100 mailboxes × 10 MB per mailbox). The amount of white space can exceed this approximation if background database maintenance isn't able to complete a full pass.

Click here to read more

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog)

Smtp; 5.1.0 - Unknown address error 550-'5.7.1 Command rejected' (

2011-01-18T09:32:00.001-08:00

Issue : Sending mail to specific recipient is failing with SMTP XXX code.

Solution: fallow the steps below

Delivery has failed to these recipients or distribution lists:

Dedealoc@inbase.com

An error occurred while trying to deliver this message to the recipient's e-mail address. Microsoft Exchange will not try to redeliver this message for you. Please try resending this message, or provide the following diagnostic text to your system administrator.

The following organization rejected your message: [163.250.4.31].

Diagnostic information for administrators:

Generating server: smtp02.smtp25.gov

Dedealoc@inbase.com

[163.250.4.31] #<[163.250.4.31] #5.0.0 smtp; 5.1.0 - Unknown address error 550-'5.7.1 Command rejected' (delivery attempts: 0)> #SMTP#

~~More Explanation~~

If you get a ticket from your helpdesk or you are the Tier 1 person and have no idea what to do, keep reading as I will talk about very basic how to troubleshoot such issues.

Now let’s quickly understand couple basic mail flow principles. When sending mail, the sending server attempts to try to locate the mail, in reality it is up to receiver weather to receive such e-mail or not. Furthermore the recipient mail server could be generating whatever error code for it wants for whatever reason it has.

Forget about mail servers and now think about a postman, who works at the neighborhood post office. He loads his truck with bunch of mails and start delivering them, if you do not have dedicated post box in front of your home he drops the envelope in there. It is up to you whether you pick them up or not in this example.

Same post man might have another packet for you this time he won’t drop into mailbox in front of your home, he knocks on your door and, tries to get signature from you. Let’s suppose you open the door, postman told you, sir I have package for you, please sign the computer before I give it to you.

Now it is up to you to tell the post man, I don’t care about this package, I won’t sign anything just take this back? ( this is perfectly possible ) in this case post man will take the package and write note on it most likely say something like rejected by blah blah , 550-'5.7.1

~~Steps to Understand what went wrong~~

Now to investigate such issues the easiest thing to do go here www.testexchangeconnectivity.com
In here you will perform Inbound SMTP test
Put the destination recipient mail address here

Now you can see the reason why your mail server could not deliver the message, in reality no mail will route to this address as the recipient mail servers does have errors indicated in below picture

~~So now how you are going to fix this?~~

You really cannot fix this as you are not generating the errors ( your mail server) nor you are the administrator of recipient mail servers. I guess you can locate the technical support people for the destination SMTP address space and open ticket or talk to someone , saying, hey we have been trying to sent you guys mail your mail server is keep rejecting it , can someone fix these problems or tell us when you will accept mail.

~~Conclusion:~~

The point I wanted to make is to lead some of you to develop troubleshooting skill and process and stick to it. Many of errors in such easily can be identified by using online tools, Telnet from command line into port 25 to destination mail server or any other way.

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog)

Exchange 2010 is Best Mail Server

2011-01-13T10:53:00.001-08:00

If you have not seen the recent post on MS Exchange website please take a moment as check it out. Exchange 2010 is for sure is the best messaging application and made significant changes in messaging business…..

First look: Exchange 2010 beta shines

Microsoft Exchange 2010

continues Redmond's longstanding market leadership in mail servers and related software. This release shows why the company's once-reviled product continues to be deployed widely in enterprises: it works, it scales, and it continues to gain important new features. In our tests, we saw improved management, administration, and reliability features plus an enhanced experience for users that includes automatic transcription of voicemails, delivery reports for messages, and extensive self-service options. Although light on wholesale changes and heavy on refinements, Exchange 2010 is nevertheless a major step up from Exchange 2007.

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.wordpress.com/ (Blog)

Exchange 2010 Design Questions & Some Useful Links……

2011-01-04T08:37:00.001-08:00

One of the most frequent asked question is how to locate resources if Exchange 2010 migration is on the way. If you do not have previous experience and wish to go for migration you may want to check fallowing resources before and during migration.In general migration process is much simpler if I have to compare the previous migration scenarios, I need to admit going from E03 to E210 or E07 to E210 is fairly simple. The question is what hardware to purchase? your scenario might be or will be different, if you are purchasing new HW , talk to Vendor to see their best practice papers they normally do have established baseline which may make your job easy.

The future of Exchange product line seems to be “Online” hosted services, only reason I say this is the key factor “Cost”. MS seems to be very push when it comes to MS hosted platform, I have seen MB prices goes down to couple bucks with adequate & reasonable price. After all it could make more sense to go to Cloud. This of course is not cast into stone as I said every one will have different scenario needs etc.

Whatever your scenario, below links may help you going forward and good luck on your migration.

And always check out Exchange Team blog.

Respectfully,
Oz Casey, Dedeal

Exchange 2010 AutodiscoverVirtualDirectory

2010-11-25T22:40:00.001-08:00

I recently had to spend a lot of time to try to fix issues related to Free/Busy and come to truth one more Certs in the Exchange 2010 playing big role. The AutodiscoveryVirtual Directory, OBA configuration, and how outlook finds Free/Busy is explained here in in Elan Shudnow blog read here this excellent post…..

I wanted to share the CMDLET to blow the AutodiscoverVirtualDirectory and re-create it, due to corrupted XML file.

Exchange Server name is “EXC01” replace this to comply your environment if you are about to delete the Auto Discovery Directory in IIS, it is pretty save to fallow the steps below….

Remove-AutodiscoverVirtualDirectory –Identity "EXC01\Autodiscover (Default Web Site)"

New-AutodiscoverVirtualDirectory -WebsiteName "Default Web Site" -WindowsAuthentication $true -BasicAuthentication $true

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.spaces.live.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

TMG&EDGE server 550 5.7.1 Unable to relay

2010-11-17T22:47:00.001-08:00

I have been working on one of our LABs last couple days to configure Exchange 2010 servers to work with TMG & EDGE. One of the problems I have faced was not being able to send mail from Exchange host to the TMG & EDGE and mail also was not coming in. Assuming the firewalls allowing traffic couple things I like to mention may save you time if you run into similar scenario.

First of all if you are not familiar with TMG and its configuration here what you need to have click here, this step by step doc will walk you trough the basic configuration.

Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010

The best thing or way to find out if SMTP traffic is leaving the Exchange host is to install sniffer on the Exchange host itself to be honest. After installing WireShark ( sniffer) install PortQueryUI or similar tool to generate SMTP traffic.

In my case SMTP traffic was not leaving the host due to McAfee E-policy blocking by default SMTP port on the Exchange servers (-: , Uhhhhhh if you skip this part and start jumping somewhere else you end up coming back here anyways.

So though process should be simple, does SMTP traffic leaving the Exchange host? If yes you will hit eventually TMG& EDGE assuming any firewall standing on your way in the middle is passing SMTP traffic.

After fallowing TMG guide if you are still unable to get Exchange host TMG& EDGE SMTP conversation you may want to check this ,

Get-ReceiveConnector

Get-ReceiveConnector "Reinjection" | Add-ADPermission -User "NTAUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTPAccept-Any-Recipient"

Add-AdPermission "Reinjection" -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights ms-Exch-SMTP-Submit,ms-Exch-SMTP-Accept-Any-Recipient,ms-Exch-Bypass-Anti-Spam

The safest way to check the SMTP flow is still the old way opening CMD and telneting on port 25 from host to destination and see what the response is IMHO.

Allowing application servers to relay off Exchange Server

http://msexchangeteam.com/archive/2006/12/28/432013.aspx

How to Create Team Calendar on Exchange 2010

2010-11-08T06:34:00.001-08:00

Here is the way to create team calendar on public folders. Remember this is being done from outlook client and you need to have proper right to do it.

Open outlook click on the bottom “Folder List” to see the PF folders if they are not visible.

Make right click on your inbox choose new folder, give it a name , click on folder contains and pick Calendar items
And make sure you are dropping the new folder the location you want, I pick PF folder locations.

here is the new Calendar item , set permissions etc. accordingly..

Some Tools for Day to Day Admin Life……

2010-11-08T06:14:00.001-08:00

Sometime often I get questions such, hey where did you get that , looks good. Beside looking cool (-: . I most often like to have tools make my life easy, and here some of them I like to share with you. I am sure there are many others and if you do know any other handy tool fell free to add it into list please……

Console.

PowerCMD

VisionApp Remote Desktop 2011

PowerGUI

DNSquery

The Microsoft Exchange server reported 0x80190194 the operation failed….. OAB

2010-10-21T11:40:00.001-07:00

Platform: Migration from Exchange 2003 to Exchange 2010. This is another issue come up after successful migration

Issues: Downloading offline address book generation fallowing errors on outlook clients.

The Microsoft Exchange server reported 0x80190194 the operation failed

First thing I think you need to check if you are having similar issues are

Check application logs to see if anything pertains the same issue
Find out what database the users is residing in ( problems user) and check the PF folder database ( is it pointing correct server )
Offline address book , can you create another one and let it replicate and use this new one on this DB to see if this resolves the issue?
Go to properties of OAB , make sure Version2, and Version 3 , enabled, public folder distribution enables and correct PF server is in there

If you are still having troubles

Delete the files under ( C:\Program Files\Microsoft\Exchange Server\Client Access\OAB )
Create new OAB
Restart the Microsoft Exchange File Distribution service and make sure the OAB is got generated on the directory mentioned above.

You can also keep watching application logs, increase the diagnostic logon if necessary on the CAS servers.

Deleted mailboxes will not appear in EMC

2010-10-19T10:28:00.001-07:00

if you accidently delete user mailbox from EMC or got confused about Disable & Remote and clicked on remove for particular user and now needing to get the mailbox yet able to see it under disconnected mailbox , recipient configuration?

** Deleted mailbox will be visible after online maintenance runs and completes** so if you do not want to wait and wish to re-connect the disconnected mailbox to another AD user object here is what you need to do run Clean-MailboxDatabase CMDLET.

Get-Mailboxdatabase | Clean-MailboxDatabase

This will clean all DBs in given SMTP organization.

My mail server name is mail2 , I would use fallowing CMDLET, substitute mail2 to your own mail server name.

Get-Mailboxdatabase | Where{ $_.Server –eq “mail2”}| clean-MailboxDatabase

Understanding Disconnected Mailboxes

DAG with two Servers will databases fail over automatically if one server dies?

2010-10-13T14:20:00.001-07:00

This seems to be one of the most asked question and answer will be yes and also no it depends the given setup scenario. I think the main point to understand is the new attribute called “RpcClientAccessServer” and the term Middle tier speaking of MAPI locating user mailbox.

let me try to elaborate in a simple way , now in your scenario you have two server member of let's say DAG1

Ex1= DB1, DB2, DB3, DB4
EX1= DB1, DB2, DB3, DB4

Now let’s take a look at your MAPI clients (they are the outlook clients) if I am user A and my mailbox is located on DB1 , how will I get to my mailbox?

In a simple way, I open outlook , my outlook finds out the DNS server configured in the TCP/IP Stack and DNS server finds out what DC (Domain controller to talk too) , DC has bunch of information in regards to my E210 Servers and their configurations , the DAG configuration is also is located in the ADDS database.

My outlook simply is trying to find out which mail server to connect too to get the mails. So outlook says, hey I need to know the mailbox box for user A , which mail server I need to connect too???? The DC will check ADDS database and look for attribute

RpcClientAccessServer=ServerName

This is where the magic happens , this attribute tells the MAPI client & clients which DB to connect too.

Great, if you have not configured your CAS array yet, the attribute is set to first CAS server introduced within the SMTP domain, so most likely EX1 in this example ( Assuming we installed EX1 first and have not configured CAS Array yet)

Now let’s make assumption of this to connect this information to your question , you have two servers called EX1 and EX2 and you have 4 DB on these servers ( each)

Ex1= DB1, DB2 (Mounted, ACTIVE) --------DB3,DB4 (Healthy, WAITING TO BE ACTIVE IF NEEDED)

Ex2= DB3, DB4 (Mounted, ACTIVE)-------DB1,DB2 (Healthy, WAITING TO BE ACTIVE IF NEEDED)

If user A mailbox is located on DB3 meaning my outlook needs to connect to DB4 on EX2 to get my mail.
Now, I open my outlook
Outlook asked the question-What is the value of the attribute
RpcClientAccessServer
Outlook Gets the Answer by finding out the value in the attribute called RpcClientAccessServer=EX1
EX1 says hey the DB is mounted-ACTIVE on EX2 this time
DNS give the IP Address to MAPI to connect too
I get connected to EX2

This is the story about “Middle Tier” has been removed from MAILBOX to CAS servers, you no longer connect to your mailbox server directly.

Now lets come back to your question, EX1 is hard DOWN !!!!!! crashed what happens ????
You go through same process and get same answer which is RpcClientAccessServer=EX1
Your Outlook tries to connect to EX1 ( Which has blue screen) won’t happen , you see the Christmas balloon “Outlook trying to retrieve blah blah and desktop start difficult to manage (-: , uppsssss

**** IN reality EX2 is perfectly up and running you cannot get to it**** Because the ADDS is telling you to connect to RpcClientAccessServer=EX1

To remedy this now we configured this attribute RpcClientAccessServer=outlook.mycompnay.com

I made this up “outlook.mycompnay.com” call it anything you like this is DNS A record

outlook.mycompnay.com=X.X.X.X ( IP Address)

Now

EX1=10.10.10.100
EX2=10.10.10.101

outlook.mycompnay.com=10.10.10.10 , Are you seeing what is going on here??????

If EX1 is death, all I need to do is to do to DNS and update the IP Address of existing A record
outlook.mycompnay.com=10.10.10.101
NOW THIS IS EX2 which will make your outlook happy (-:

To make this automated you need load balancer or use poor man method to update DNS (-: your own

Create a Database Availability Group

http://technet.microsoft.com/en-us/library/dd351172.aspx

OWA 2010 Enable Redirection HTTP to HTTPS

2010-09-21T14:10:00.001-07:00

One of the most frequent asked question is how to redirect HTTP request for OWA in Exchange 2010 to SSL port. I have post in the past showing how to make simple modifications on OWA page, with easy approach. I will go over this one more time. If you set redirection time to “0” second with simple HTML code you do not even need to make the first splash page. I do like seeing the splash page hence I will first show you how to modify / Create the default IIS welcome page with simple steps listed here.

Click Here for SkyDrive

After downloading this file you need to open it with Adobe Photo Shop to make simple changes, your company name etc..
Open your Exchange 2010 Server , go to C drive , on the C Drive drill down to “C:\inetpub\wwwroot” folder in this folder find HTML file called “iisstart” make a right click on duplicate this HTML file
Now the image you see in here called welcome, we will be replacing this with one we will be creating with sample file I have provided, pay attention the welcome file extension is PNG but you can make this image in any format, I will show you how to change the HTML file to point to welcome.jpeg file instead of welcome.png file.
Once you have your own file same size as welcome file ( you can always modify this) place in this directory and open “iisstart.html” file by making right click and selecting open with notepad as shown below…..

For automatic redirection we will add below code into this HTML page right after <head> tag.

Rest of the HTML code is same as fallows

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<META http-equiv="refresh" content="4;URL=https:/mail.Inbase25.com/owa">
<title>INbase</title>
<style type="text/css">
<!--
body {
    color:#000000;
    background-color:#FFFFFF;
    margin:0;
}

#container {
    margin-left:auto;
    margin-right:auto;
    text-align:center;
    }

a img {
border:none;
}-->
<META http-equiv="refresh" content="0;URL=https://mail.Inbase25.com/owa"></style>
</head>
<body>
<div id="container">
<a href="https://mail.inbase25.com/owa"><img src="welcome.jpg" alt="OWA" width="771" height="611" /></a>
</div>
</body>
</html>

You will need to replace :mail.inbase25.com to your own publish DNS a record as mail.yourcompany.com

Simply change the HTML code it says “content="4;” to anything you like if you make this “0” redirection occurs fast and first page wont be visible at all.

As it is seen all we actually did was replacing simple HTMP code into default IIS page and direct port 80 request to SLL port. I assume you have proper firewall rules configured on your firewall to make this work.

This is supper easy way of accomplishing re-direction after deploying OWA in Exchange 2010.

Update Rollup 1 for Exchange Server 2007 Service Pack 3 has been released..

2010-09-14T13:51:00.001-07:00

This is first update on top of SP3 Exchange 2007 , the updates included fallowing fixes………..

KB 980301 The Microsoft Exchange Information Store service stops responding during a Volume Shadow Copy Service backup on an Exchange Server 2007 server

KB 983529 The EdgeTransport.exe process crashes and then restarts on an Exchange Server 2007 server

KB 973637 Exchange Server 2007 creates incorrect Lotus Notes proxy email addresses

KB 982928 The Msftesql.exe process continues using memory on an Exchange Server 2007 server

KB 983296 Exchange ActiveSync crashes on an Exchange Server 2007 server causing the client synchronization to be unavailable

Description of Update Rollup 1 for Exchange Server 2007 Service Pack 3

Download here

Exchange 2010 & Sp1 Deployment….

2010-09-08T06:32:00.001-07:00

SP1 for Exchange 2010 release for sure was great news and made Exchange 2010 more stronger. Most of the migration scenarios and people who wanted to wait to see at least SP1 release start shifting into upgrade path after Sp1 release. Those of you you did upgrade early will remember , one of the most confusing part was collecting all required updates to get Sp1 rolling. Here is the good new Exchange team made great post helping to easy Sp1 deployment. I think it is great post and supper useful. I am including link , in this link you will get to all download you need and some of the issues came up in deploying Sp1 also addressed here……

Exchange 2010 SP1 FAQ and Known Issues

SP1 Prerequisites

SP1 requires the installation of 4-5 hotfixes, depending on the operating system – Windows Server 2008, or Windows Server 2008 R2. To install the Exchange 2010 SP1 administration tools on Windows 7 and Windows Vista, you requires 2 hotfixes.

Note: Due to the shared code base for these updates, Windows Server 2008 and Windows Vista share the same updates. Similarly, Windows Server 2008 R2 and Windows 7 share the same updates. Make sure you select the x64 versions of each update to be installed on your Exchange 2010 servers.

Here’s a matrix of the up,,,, Read more click on above link

Remove Public Folders from Exchange 2003 to Exchange 2010

2010-08-26T14:20:00.001-07:00

If you are in the middle of migration or will start one and wondering how to deal with PF folders on your legacy Exchange 2003 server , here is the link and this is pretty much all you need to know and will do to move them from Exchange 2003 to Exchange 2010.

Click here

First create PF database on the Exchange 2010 server

Move existing Pf folder replicas from E03 server into this newly created PF database on E210 Server , by logging on E03 server…..

Make sure the Public folder is empty

Dismount the PF folders on E03 Server for a while to make sure no one is complaining

After making sure everything works fine delete the PF folder database on E03 Server , if you still have replicas you will receive fallowing… allow time for replication to finish

You could achieve same goal from PS on E210 server

\MoveAllReplicas.ps1 -Server MySourceServer -NewServer MyTargetServer

Get-PublicFolderStatistics -Server <server with public folder database to be removed>

How to Remove a Public Folder Database
http://msexchangeteam.com/archive/2007/07/09/445967.aspx
How to Remove a Public Folder Database
http://technet.microsoft.com/en-us/library/aa998329.aspx
How to Remove the Last Public Folder Database in the Organization
http://technet.microsoft.com/en-us/library/bb201664.aspx

Exchange 2010 SP1 is available for Download

2010-08-25T13:06:00.001-07:00

Finally Exchange 2010 SP1 has been released and here is the link for download. There are many changes in SP1 and to be honest most of you will be very happy to discover what they are. SP1 brings more stability in Exchange 2010 and I believe will help for migration scenarios. Click on the picture below to download SP1

Archiving white paper
Yes Virginia, there is an Exchange Server 2010 SP1
The Future of Exchange Starts Here: Exchange Server 2010 SP1 Is Now Available
What's New in Exchange 2010 SP1
More Exchange 2010 links

Respectfully,
Oz Casey, Dedeal
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog
http://telnet25.spaces.live.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Set OWA Private Computer Cookie Time-Out Value Exchange 2010.

2010-08-24T14:53:00.001-07:00

If you ever wondered how long it takes for your browser to close after opening OWA ( outlook web App) if there is no activity? here are the measurements.

Public 15 minutes
Private 8 days

For whatever reason you may have if you decide to change these default values here is the link how to get the work done. The simplest way to achieve desired goal is using PS. Let’s say we will increase the Public cookie time out settings from 15 minutes to 25 minutes.

set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\MSExchange OWA' -name PrivateTimeout –value 25 -type dword

copy and paste above PS code into EMS ( management Shell) , adjust the time as you wish , in this case we are going to set it to “25” minutes….

Cookies to control access

The first time that the user name and password are sent to the Client Access server to authenticate an Outlook Web App session, an encrypted cookie is created that's used to track user activity. When the user closes the Internet browser or clicks Sign Out to sign out of their Outlook Web App session, the cookie is cleared. The user name and password are sent to the Client Access server only for the initial user sign-in. After the initial sign-in is complete, only the cookie is used for authentication between the client computer and the Client Access server.

Read more click here…………..

Import and Export Certificate Exchange 2010

2010-08-19T22:00:00.001-07:00

Here is the scenario , we are doing migration from Exchange 2003 to Exchange 2010. We have existing certificate called webmail.smtp25.org and we wish to move this over to Exchange 2010.

I think this will be pretty common thing in these type of migrations. One thing I found out supper easy is not to kill yourself to try to share the existing cert and the URL being used to access the webmail. For instance if you are using webmail.yourCompany.com

webmail.yourCompany.com =Valid Cert = Exchange-2003 Server

And as soon as you moved first user on Exchange 2010 , accessing Existing URL wont work for the user on Exchange 2010. Here is what I have done couple times to get around this type of issues and make migration pretty seamless to end users (-: …..

I purchased new cert ( GoDady fro $10 bucks) and called it owa.yourCompany.com

owa.yourCompany.com=New Valid Cert=Exchange 2010

I configured this cert on the E210 server and told costumer everyone who gets migrated on E210 will use this link to access their webmail. This made my job supper easy and at the end of the migration I export the cert from E03 imported into E210 and done with migration.

STEP 1: Export Certificate and Private Key from the IIS 6.0 server

Create an MMC Snap-in for Managing Certificates:
1. Start > run > MMC
Go into the Console Tab > File > Add/Remove Snap-in
Click on Add > Click on Certificates and click on Add
Choose Computer Account
Choose Local Computer
Close the Add Standalone Snap-in window.
Click on OK at the Add/Remove Snap-in window

Open Certificates Console Tree
Go to Personal
Right click Certificates
Choose ALL TASKS
Select Import to start the Certificate Import Wizard
Click Browse
Locate the .pfx file
Click Open
Next
Finish

After this is completed rest of the work is supper easy go to EMC and drill down to server configuration , you will see the certificate there , just assign services to this certificate to finish the work

~~Resource Links~~

Exchange 2010, Active Directory Blog

Export the IP Relay List on SMTP Virtual server Exchange 2010

Get-ReceiveConnector | Select-Object -Property 'Identity','RemoteIPRanges' |FL

Customizing EMS for Exchange 2010

Windows PowerShell Profiles

Exchange 2010 CAS ARRAY , SIMPLE DNS ROUND ROBIN

The Autodiscover service, How it is being configured & The name of the security certificate is invalid or does not match the name of the site…

Exchange Server 2010, SP2 has been released !!!!

A source-side operation failed. Error An error occurred while performing the seed operation. Error: Failed to open a log truncation context to source server….

Setup wizard for update rollup 6 for Exchange server 2010 service pack 1 ended prematurely because of an error….

Disable permanently Outlook Team Calendar

The Microsoft Exchange Replication service failed to start the TCP listener Event ID:2121

Exchange 2010 Database Size, EDB file Path etc.….

Changes to the distribution list membership cannot be saved" error message when you try to remove members from an Exchange Server 2010 distribution!!!

Object is read only because it was created by a future version of Exchange: 0.10 (14.0.100.0). Current supported version is 0.1 (8.0.535.0).

After Exchange 2010 Migration , Distribution List owner unable to make changes to DL’s they own.

How to Manage Groups that I already own in Exchange 2010?

The Term 'New-MailboxExportRequest' is not recognized as the name of a cmdlet, function, script file, or operable program

Backup DAG with Windows Backup

Error: Active Directory operation failed on MCCNPWINADS02.smtp25.gov. This error is not retriable. Additional information: Insufficient access rights to perform the operation.

Error: Large BadItemLimit (1000) is specified. Please confirm your intention to accept a large amount of data loss by specifying AcceptLargeDataLoss

How to Find out Exchange What Exchange 2010 Version you are running on your Server.

Unable to connect to Exchange Server via remote PS Unable to load assembly "Microsoft.Exchange.Configuration

TMG CAS 2007 ACTIVE SYNC Error, Status: 12309 The server requires authorization to fulfill the request. Access to the Web server is denied. Contact the server administrator.

New-TestCasConnectivityUser.ps1Error

Status: A packet was dropped because Forefront TMG determined that the source IP address is spoofed.

TMG 2010 SETUP NIC CARD CONFIGURATION

100 Access Denied RSA ACE/server rejected the passcode that you have supplied. Try again with a valid passcode.

TMG 2010 Redirect HTTP Request to HTTPS /OWA

TMG 2010 RSA things you have to remember.

Cannot rename this connection. A connection with the name you specified already exist. Specify a different name.

How to Disable SSLv2 on a Windows Server 2008 and Windows Server 2008 R2

Move Public Folders All replica to Exchange 2010 Server PS Script

Missing Mail Icon in the Control panel

You must close all dialog boxes before you can close Exchange management console!!!!

RIM the “PlayBook “

PST Capture Tool Exchange 2010

Enable & Disable ActiveSync For Exchange 2007 and 2010 Users

Considering Domain Controllers on Virtual Environment.

Exchange 2010 VSS Backup failed.Unknown Error, Error Code: 0x80042313

Managed Folders Deleted Item 180 Days Retention Policy Exchange 2007

OFFICE 365 Outlook Anywhere Setup & Simplicity

Exchange 2010 DAG & hypervisor-based clustering is supported now

Cannot remove Mail Box, receiving, Active Directory operation failed on VMdc2.smtp25.internal. This error is not retriable. Additional information: Access is denied.

Microsoft.PowerShell_profile.ps1 cannot be loaded….

Running Scripts From Within Windows PowerShell

Login Failed for user The user associated with a trusted SQL Server connection ( Microsoft SQL Server Errors : 18452)

Rename Local Admin account and Reset password on your Domain.

OFFICE 365 first look to Admin Console

Raise the Forest & Domain functional level Win2008

Upgrading functional levels in a new Windows Server 2008 forest

The Network operation failed because active directory domain service could not configure the computer account ServerName$ on the remote active directory domain controller RemoteDCName.yourDomain.local “Access Denied”

Exchange 2010 some new cool futures

OUTLOOK 2010 Where did Message Headers go !!!

OFFICE 365 BETA Exchange 2010

SYSVOL & NETLOGON

Restart BlackBerry Services in RDC order

WHITE SPACE EXCHANGE 2010, Where did 1221 Go?

Smtp; 5.1.0 - Unknown address error 550-'5.7.1 Command rejected' (

Exchange 2010 is Best Mail Server

First look: Exchange 2010 beta shines

Exchange 2010 Design Questions & Some Useful Links……

Exchange 2010 AutodiscoverVirtualDirectory

TMG&EDGE server 550 5.7.1 Unable to relay

How to Create Team Calendar on Exchange 2010

Some Tools for Day to Day Admin Life……

The Microsoft Exchange server reported 0x80190194 the operation failed….. OAB

Deleted mailboxes will not appear in EMC

DAG with two Servers will databases fail over automatically if one server dies?

OWA 2010 Enable Redirection HTTP to HTTPS

Update Rollup 1 for Exchange Server 2007 Service Pack 3 has been released..

Exchange 2010 & Sp1 Deployment….

SP1 Prerequisites

Remove Public Folders from Exchange 2003 to Exchange 2010

Exchange 2010 SP1 is available for Download

Set OWA Private Computer Cookie Time-Out Value Exchange 2010.

Import and Export Certificate Exchange 2010