a new message has arrived

Hard to find the latest outlook patch/updates

2011-12-09T23:41:00.001+01:00

Having trouble keeping up with patches for outlook?
Look no further but here Update Center for Microsoft Office, Office Servers, and Related Products

Microsoft Exchange Server 2010 Service Pack 2 (SP2)

2011-12-05T18:43:00.001+01:00

Exchange SP2 has left the building.

It contains some interesting features. The one I like the most is Address Book Policies. With ABP the administrator can easily configure which users can see which Address Book/s. This gives the function that many organizations want to segment address book for users in a supported way instead of the really messy solution by ACL'ing different objects in Exchange.

Other feature is for example the good old OMA is back. It's like OWA but without graphics and probably most used by mobile devices. The official name is 'OWA Mini'.

For you people that want configure your on-premise Exchange installation with O365 in hybrid configuration there is the new 'Hybrid Configuration Wizard' that help you setup the configuration a lot easier than the myriads of manual steps needed before.

Pre-requirement info http://technet.microsoft.com/en-us/library/bb691354.aspx

Release notes http://go.microsoft.com/fwlink/?LinkId=235234

Download link http://www.microsoft.com/download/en/details.aspx?id=28190

Exchange Server 2010 Service Pack 1 Update Rollup 5 is released

2011-08-24T10:41:00.001+02:00

UR5 for Exchange 2010 SP1 is now released. It contains several bug fixes. Here is the description Exchange 2010 SP1 UR5 - 2582113.
Problem with PDF attachment from MAC clients should finally be resolved. Also the error message "There are no items to show in this view." in Outlook 2010 is resolved.

Here is the download link

The usual warning for customer running forefront security for Exchange is to disable forefront with "fscutility /disable" before applying rollup and afterwards enabled forefront again with "fscutility /enable"
How to Apply Exchange Service Packs and Rollups to a Computer that is Running FSE

Are you using TMG and having issues publishing Outlook Anywhere?

2011-08-13T00:31:00.002+02:00

Ever tried to publish Outlook Anywhere using NTLM with TMG and use Kerberos Constrained Delegation? Many people have tried and failed, or at least had some major trouble before they were finally able to get things going.
To help make things a little easier, here is a simple checklist on how to publish Outlook Anywhere using NTLM with TMG, using Kerberos Constrained Delegation.
The simplest scenario is a single Exchange server and a single TMG server.

	1. TMG must be domain joined to use Kerberos Constrained Delegation (KCD), which can be a problem for some organizations. http://www.isaserver.org/tutorials/Debunking-Myth-that-ISA-Firewall-Should-Not-Domain-Member.html. Domain where TMG is member of must be in Windows 2003 mode and it must be the same domain that your Exchange server is on.
	2. Configure KCD. With ADUC (Active Directory Users and Computers), Find the TMG computer object, select properties and the Delegation tab, click “Trust this computer for delegation to specified services only” and then select the “Use any authentication protocol”. Click Add button and then Click “Users or Computers” button and enter the Exchange server. Then click “OK” and scroll to find “http – server name”, click to select it, and then click OK twice to save the configuration. If you tick the checkbox “Expanded” while selecting protocol you will see that both the FQDN and host name will be in the list. What you have done now is allowed TMG computer to delegate credentials to the Exchange server, but only if it’s using HTTP, that’s why it’s called constrained delegation. Why do we mess with the Exchange computer object? Well, Exchange web services run under the local system account, if it was running using a service account, then we must use this account to delegate to instead.
	3. Create a Listener and publish rule on TMG. Start by creating a Listener. As the create Listener wizard goes by select these options: Select “Require SSL secured connections with clients”, Select an external IP and a certificate to be used by the listener. For Authentication you have several options and it all depends on what you want to do, but for this walkthrough select HTTP and Integrated. This means NTLM since we are connecting from internet where there is no Kerberos service is available (or have you put a Domain Controller on Internet?). Create the publishing rule by starting the Exchange Web Client Access publishing rule wizard. Select version of Exchange and Outlook Anywhere as the service, and also select “Publish additional folders…”. This will add paths for OAB, EWS and Autodiscover URL. Select “Publish a server farm of load balanced web servers”, “Use SSL to connect to the web server or server Farm”, Internal site name is important: enter a name that is on the certificate used by IIS on Exchange server, that is not the certificate clients “see” when connecting to TMG from internet. This certificate is seen only by TMG. Create a new Exchange server farm. Give it a name and add your Exchange server to it. For the connectivity monitoring, select “Send an HTTP/HTTPS Get request”. Farm is complete. For the public name, select a name that this publishing rule will accept traffic on. Select the Listener you created earlier. For the Authentication delegation select Kerberos constrained delegation and change the SPN to “http/*”. On user sets, select “All authenticated users”. This can be changed to an AD group to limit who is allowed to use the services you’re publishing.
	4. Configure Outlook Anywhere to use NTLM. Set-OutlookAnywhere -IISAuthenticationMethods 'Ntlm' -ClientAuthenticationMethod 'Ntlm'

Why do a farm of servers instead of just a single server? With a farm, you get the opportunity to do monitoring of the published server. This means that if you encounter that the published server doesn’t work while monitoring, it won’t even try to send traffic to the published server. Flexibility is another thing, you never know what will happen in the future, servers may be added, changed or removed and it’s easier to change the farm membership instead of redoing the publishing rule.
“Test Rule” button. This function is really good but when using KCD it will often fail. One reason for failure is that there is a firewall running between or on the published server which blocks traffic to port 445 and 139. TechNet has a good post related to “test rule” button failure
Another failure is when you set change configuration on the Authentication Delegation tab to use KCD and set the SPN to “http/*”, a star tell TMG to replace it with the published server FQDN when doing the KCD. Unfortunately, TMG doesn’t do this when you click “Test Rule” button. My thought on this is function behind “Test Rule” button only takes this text string and doesn’t translate the star to FQDN. KCD will fail because it is not allowed to delegate to http/*. To overcome this while testing your configuration,replace “http/*” with “http/x” where x is one of the previously allowed delegation. If you have multiple servers in your farm, you should change configuration and test every published server. When done, don’t forget to change back to “http/*”.
One more plus is that even if you have Basic authentication enabled on the Listener, you can still use KCD on the Authentication Delegation tab, which is good for clients who don’t know how to use NTLM.

The difference with this configuration is that we have a Load Balancer between TMG and CAS. This provides us with a couple of options. Either a) configure TMG to send traffic to Load Balancer, or b) configure TMG to send traffic directly to CAS.
The problem with the first option is that Load Balancer most likely thinks everything comes from TMG and therefore will not distribute traffic to all CAS, but instead sends it to only one of them. This can be fixed by using more sophisticated distribution algorithms on Load Balancer. But in order for that to work, we need to disable SSL between TMG and Load Balancer, and also allow HTTP to CAS. We also have another source to troubleshoot if something breaks. Another thing is the KCD configuration. Since there is no computer account for Load Balancer, the KCD needs to be configured with a name that TMG can use for the delegation. You must add the SPN string to the msDS-AllowedToDelegateTo attribute on the TMG computer account and finally this invented name must be configured in the publishing rule in the delegation tab as the SPN. This is a valid configuration, but with many variables’ in it I think it’s much too .The other option with TMG sending traffic to CAS servers directly and bypass Load Balancer is much easier to configure and to troubleshoot.
Picture only shoving a single TMG and a single Load Balancer but they can in fact me multiple of them for redundancy and load distribution. Either way, it doesn’t matter when you use KCD.
Connectivity monitoring
TMG will periodically connect to the published server. How TMG connects depends on the connectivity monitoring configuration. We selected to “Send an HTTP/HTTPS Get request” together with a URL. This means that TMG will connect to this URL and if it gets a response back it will allow traffic on this rule.
If you publish for example outlook anywhere you would most certain need to publish a couple of more URL’s than the /RPC such as /OAB, /EWS and /Autodiscover. Sad story here is that TMG cannot monitor more than one URL. If we monitor /rpc directory then all other can fail without TMG noticing it so TMG will still end traffic to one farm member even though for example the EWS service don’t work on it.
Solution can be to have individual publishing rule for each service you publish. Another solution could be your own developed solution. Create a script that monitor services of your choice, and simply create a file in an IIS directory if every service is working or delete the file if something is not working. In TMG we can then configure the URL to point to this file.
RPCping
If you published Outlook Anywhere you verify configuration with rpcping.exe.
Be aware of that rpcping has several parameters and you have to specify them correctly. Here is an example.
rpcping -t ncacn_http -s mapi.corp.contoso.com -o RpcProxy=oa.contoso.com -P "billg,contoso,Password2" -I "billg,contoso,Password2" -H 2 -u 10 -a connect -F 3 -v 3 -a connect -e 6001
This means connect to the rpcproxy name “oa.contoso.com” and the internal server name with mapi.corp.contoso.com. User name is billg, password is Password2,netbios domain name is contoso both for the rpcproxy auth and auth to internal server, e = 6001 means internal tcp port 6001 which is on out of the three ports used by outlook anywhere. The others are 6002 and 6004.
The other parameters aren’t that easy to figure out but you can read everything about them here http://support.microsoft.com/kb/831051.

More proxyaddresses scripts

2011-08-03T07:57:00.002+02:00

Remember the post about Remove proxy addresses Script? It was developed for Exchange 2007 and did not work for Exchange 2010.
People wrote comments with suggestions (thank you all for that) and I thought I published an updated version that work with Exchange 2010 together with another script that add SMTP addresses.

# Remove proxy addresses
# change the Get-Mailbox statement in line 7 to select only a subset of mailboxes

$DomainToRemove = "*@olddomain.com"

#get mailboxes and iterate through
Get-Mailbox -ResultSize Unlimited | foreach {
$_.Alias
# .emailaddresses returns array
# loop each email address
for ($i=$_.EmailAddresses.Count;$i -ge 0; $i--)
{
$address = $_.EmailAddresses[$i]
#Write-Host $address
# removes all addresses with $DomainToRemove
if ($address.SmtpAddress -like $DomainToRemove )
{
Write-host("Remove smtp adress: " + $address.AddressString.ToString() )
# remove address in the array
$_.EmailAddresses.RemoveAt($i)
}
}
# save changes
$_ | Set-Mailbox -EmailAddresses $_.EmailAddresses
Write-Host
}

And the Add proxy addresses script.

# Add proxy addresses
# change the Get-Mailbox statement in line 8 to select only a subset of mailboxes

$AddressSearchedFor = "*@domaintocopy.com"
$DomainToAdd = "@newdomain.com"

#get mailboxes and iterate through
Get-Mailbox -ResultSize Unlimited | foreach{
$_.Alias
# .emailaddresses returns array
# loop each email address
for ($i=$_.EmailAddresses.Count;$i -ge 0; $i--)
{
$address = $_.EmailAddresses[$i]
#Write-Host $address

# look for SMTP addresses in source
if ($address.SmtpAddress -like $AddressSearchedFor )
{
# get the left part of address
$a = [string] $address
$b = $a.indexof("@")
$a = $a.substring(5, $b-5 )
#Write-Host $

# Add SMTP address
Write-host("Adding smtp adress: " + $a + $DomainToAdd )
# add address in the array
$_.EmailAddresses.add("smtp:" + $a + $DomainToAdd)
}
# save changes
$_ | Set-Mailbox -EmailAddresses $_.EmailAddresses
}
Write-Host
}

Exchange Server 2007 Service Pack 3 Update Rollup 4

2011-07-08T00:21:00.001+02:00

UR4 for Exchange 2007 SP3 is now out.it contains several bug fixes. One particular fix is the one with MAC sending attached PDF and outlook cannot see it.

Read KB2509911 to see the full list of bug fixes. Here is the download link

Outlook authentication popup when database move or failover

2011-07-01T11:31:00.001+02:00

Have you noticed that when you run Exchange 2010 DAG and move the active database to another node, outlook throw an authentication prompt.

The behavior according to many sources including Microsoft is that a move or failover should go almost unnoticed by the end user. Well it does sometime, but many times outlook popups the authentication prompt.

Messed around in my lab with all kind of configurations and discovered that the prompt is to the outlook anywhere URL. This makes sense because the database goes offline and then another database goes online. This takes a short moment but the only component that should see this is CAS and outlook should still have connection to your Hardware Load Balancer or CAS if you don’t have a HLB. So if outlook is aware of a database goes offline then this is kind of valid.

To try things a little bit more I configured the system not to resolve the Outlook anywhere URL when connected to the internal network and then I did a move of active database again and I was very surprised that outlook still did popup for the outlook anywhere URL without actually being able to resolve it in DNS or even less actually connecting to it.

I figured there must be some caching going on here and to be safe I simply reboot everything. But outlook behaved the same, prompting me for credentials for an URL that could not be reached.

Finally I poked around in the configuration and decided to change the authentication scheme for outlook anywhere to Windows Integrated. I did not have a TMG or UAG in the system so I did not need to configure Kerberos Constrained Delegation (that’s another story).

Placed an outlook on the outside of the network and things went smooth; NTLM let me in directly with my cached domain credentials.

Moved outlook to the internal network and still everything worked as it should. Finally did move of the active database to another server. Outlook did not even blink, well almost, it just said it’s not connected and then a couple of seconds later it said connected again.

Well this must be one of the rare occasions when everything worked as it should according to various sources. Did about 20 more move of the active mailbox database and not a single time did outlook give me authentication prompt.

Well, I reconfigured outlook anywhere to use basic clear text authentication again and moved the database back and forth and about half the times outlook gave me the annoying authentication prompt.

Did some more testing with various setup and different version of outlook but the behavior is the same. When outlook anywhere is configured with basic clear text I get authentication prompts and when configured with Windows Integrated everything work without a hiccup.

Do we have any drawbacks by configure windows integrated authentication on outlook anywhere? Yes there is. Depending on if you have ISA/TMG/UAG doing Kerberos Constrained Delegation against your CAS, everything must belong to the same windows domain. Well, not exactly everything but all accounts used in the process, that is computer and user accounts.
This means if you have multiple forests or multiple domains and publishing Outlook Anywhere with pre-authentication on TMG/UAG, you’re almost forced to use Basic Authentication.

More information about Kerberos Constrained Delegation will be posted in a later post.

Office 2010 Service Pack 1

2011-06-30T10:09:00.000+02:00

Together with the release of Microsoft Office 365, Microsoft also released SP1 for Office 2010.

Read KB2460049, Description of Office 2010 SP1.

Download links is found in KB2510690, List of all Office 2010 SP1 packages.

Exchange Server 2010 Service Pack 1 Update Rollup 4

2011-06-30T09:54:00.002+02:00

UR4 for Exchange 2010 SP1 have fixed several bugs, both stuff that users see and also some things that only Exchange admin see.
Information about the update is found in KB2509910

Schedule your Exchange 2010 scripts

2011-04-28T14:58:00.000+02:00

If you’re running Exchange you most likely want to run script on a regular basis.

Here is how you schedule a Exchange 2010 management shell script.

Copy your script file into a folder of your choice. ex. c:\script\script.ps1

The most tricky part is how to actually start the powershell script to run. This is set on the actions tab.
Create new action with “start a program” and for program/script enter the path to powershell.exe
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe

for the argument textbox, enter
-Command “. 'C:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; C:\script\script.ps1”

The RemoteExchange.ps1 is the script that start a remote Exchange 2010 Management shell session to an Exchange 2010 server. The last part is the path to your script.

Several settings on the job depends on what your script does.
You might need to run the script highest privileges, Configure for Windows 7, Windows Server 2008 R2 etc.

If you know that your script normally take 5 min to run, it’s a good practice to use settings to either stop if it runs for a long time and also block multiple instances to run at the same time.

Another handy thing you can include in your script is actually to make the Exchange snapin to load from the script instead of having the task load it.
Here is an example.

# some Exchange script
# bla bla.

# Load the Exchange snapin if it's no already present.
function LoadExchangeSnapin
{
    if (! (Get-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010 -ErrorAction:SilentlyContinue) )
    {
        Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010 -ErrorAction:Stop
    }
}


# The meat of the script!
&{

    "*** some Exchange Script started ***" >> scriptlogfile.log
    [DateTime]::Now >> scriptlogfile.log

    # Load the Exchange cmdlets.
    & LoadExchangeSnapin

    # the rest of the script

    [DateTime]::Now >> scriptlogfile.log
    "*** some Exchange Script ended ***" >> scriptlogfile.log
}

Powershell multi-value attributes

2011-04-06T22:26:00.001+02:00

Now and then you encounter that you must handle multivalued properties in Exchange Management Shell (EMS). This can be a little tricky of you don’t know how to do this.

I will give some examples to highlight different syntaxes you can use. I will use the attribute RemoteIPRanges on ReceiveConnector but examples can be used on any multi-value attribute.

Adding some IP ranges. This will overwrite every IP range already present.
Set-ReceiveConnector <Connector name> -RemoteIPRanges "192.168.10.10", "192.168.10.11"

List multivalued properties.
Get-ReceiveConnector <Connector name>).RemoteIPRanges

Adding additional IP. This is completed by first save the range array into $range variable. Adding values to the $range variable and then write the info in $range variable to the receiveconnector.

$range = (Get-ReceiveConnector <Connector name>).RemoteIPRanges

$range += "192.168.10.12"

Set-ReceiveConnector <Connector name> -RemoteIPRanges $range

You can also remove entries from the array with the same method as adding.

$range -= "192.168.10.12"

Because you have all entries in the $range variable you can do things like copy ranges from one connector to another one.

$range = (Get-ReceiveConnector <Connector name>).RemoteIPRanges

Set-ReceiveConnector <another Connector name> -RemoteIPRanges $range

Question about Exchange licensing?

2011-02-17T22:15:00.001+01:00

A lot of question I get is about licensing, when do I need Enterprise CAL, can I create a Database Availability Group with Standard version etc.

Well Microsoft has a god page for telling you all alternatives and options. Microsoft Exchange Server 2010 Licensing

Lync 2010 cumulative update 1 – Jan 2011

2011-02-01T11:17:00.001+01:00

Lync CU1 Jan 2011 updates

Software	KB
Lync 2010 (32 and 64 bit)	2467763
Lync Server 2010	2493736
Lync 2010 Phone Edition (Tanjay)	2493722
Lync 2010 Phone Edition (Aries-Aastra)	2493724
Lync 2010 Phone Edition (Aries-Polycom)	2493723
Lync 2010 Attendee (Admin Install)	2467762
Lync 2010 Attendee (User mode install)	2467761
Lync 2010 Attendant (32 & 64 bit are a combined patch)	2467760
Lync 2010 Group Chat Client	2467765
Lync 2010 Group Chat Admin	2467764

Happy patching

Lync goes RTM

2010-10-29T07:39:00.001+02:00

Next version of Microsoft Office Communication Server named Microsoft Lync has now gone RTM. Read the whole story at Unified Communications Group Team Blog

Now we all just wait for the media to be available.

Exchange 2010 Service Pack 1 is now available

2010-08-25T21:45:00.001+02:00

After some wait Exchange server 2010 Service Pack 1 is now released.

Read about all the new and improved features here

Download it here and read the release note very carefully before installing.

happy patching

Problem with OCS 2007 R2 Cumulative Update 6 (CU6)

2010-08-09T12:28:00.001+02:00

CU6 for OCS 2007 R2 was released a couple of weeks ago. OCS 2007 R2 CU6

The simplest way of installing is to download and run the ServerUpdateInstaller. This will install all of the needed patches to your OCS server.

Unfortunately there is a problem that you might encounter when doing so. The FrontEnd service will not start and you will se this in the eventlog. “The Office Communications Server Front-End service terminated with service-specific error 3287186749 (0xC3EE7D3D).”. Reason is that serverinstaller does not contain all updates needed. The FrontEnd server patch needs an updated database to run correctly.

What you need to do is to ununstall KB983472 and then install the OCS2009-DBUpgrade.msi to upgrade the databases used by OCS.

OCS2009-DBUpgrade.msi is found in KB 2032834, Description of the cumulative update package for Office Communications Server 2007 R2 database: July, 2010

After databases have been upgraded you can reinstall KB983472 or simply run serverinstaller again and since databases are updated, the OCS FrontEnd service will start normally.

Power to the People: Exchange 2010 SP 1 Allows Users to Reset their OWA passwords

2010-08-04T15:31:00.001+02:00

For many generations, Outlook Web Access allowed users to change their password, but only after they had successfully logged on to OWA. With Exchange 2007 Service Pack 3 and the upcoming Exchange 2010 Service Pack 1, administrators now have the ability to change the password pretty much the same way users do when they log on to Windows on their PC.

This enables administrators to set the bit to force users to change their password the next time they logon. This new feature also lets users change their password after it has expired, without having to call the helpdesk for assistance.

How does it work?

First users are presented with the ordinary OWA logon form.

If the account is being forced to change its password, a new form will be displayed that contains fields for the account name and new and old passwords.

If the user fills in everything correctly, then they will be presented with a status form simply saying their password was changed.

After pressing the OK button, the user will be presented with the ordinary logon form again so they can logon with the newly set password.

Enable password change functionality.

Changing passwords in this manner has to be enabled – it is not enabled by default. This is done by setting a bit in registry on your CAS servers.

In the “HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA” subkey, create a DWORD (if needed) named ChangeExpiredPasswordEnabled and give it a value of 1 (one) to enable the functionality, and 0 (zero) to disable.

After you change the registry value, you must do a “iisreset /noforce” to activate the new setting.

Now all you administrators can sit back, relax, and enjoy letting peoples’ passwords expire or setting the “User must change password at next logon.” (Even though we all know that the chances of the user calling the help desk anyway are still pretty high!)

Consider authentication method.
Rest password functionality will only work if you have Forms Based Authentication enabled on CAS.

If you’re protecting CAS with ISA/TMG and doing FBA on ISA/TMG, then you probably have authentication set to Basic or Windows Integrated on CAS, so this functionality will not be enabled.
To solve this, enable the change password functionality on ISA/TMG: http://blogs.technet.com/b/sooraj-sec/archive/2009/12/20/password-change-with-isa-server-2006.aspx (However, if you ask me this method does not perform the password reset functionality as nicely as Exchange OWA.)

Another way to solve this is to change how OWA is published by enabling FBA with the new password reset functionality on CAS and not performing the authentication on ISA/TMG. On the other hand, this workaround could raise some security concerns so I urge you to look closely at all your options before choosing the password reset method that best suits your company’s needs.

I hope that this tutorial on OWA password reset changes in Exchange 2007 SP 3 and 2010 SP 1 has been informative for you. Now that administrators can reset OWA passwords easily, or even better allow users to reset their own passwords, it should no doubt reduce the volume of calls the help desk receives.

Error in Exchange Management Console when removing Domain Controllers

2010-07-25T13:02:00.001+02:00

When rearranging and upgrading to never OS it’s very common to install a new DC and then remove the old one instead of doing in place upgrade. This is all fine Active Directory wise. Exchange Server itself will dynamically detect new and removed Domain Controllers and Global Catalog servers and adjust accordingly but Exchange Management Console is not dynamic in the same way.

Symptoms is when you start or navigate in EMC you get error messages indicating error in LDAP query or missing Domain Controllers.

You might also see error messages in the Application log indicating unavailable LDAP or DC/GC.

Why is this happening?
EMC caches Domain Controller names in the MMC temporary files and unfortunately it will not be clever enough to query another DC or GC when the current one is not responding or has been removed.

How to solve the problem?
Solution is quite easy: clear the MMC cache.

Close all open MMC. Start a new empty MMC, in the menu, select File/Options and then on the Options Window and Disk Cleanup tab, press the “Delete Files” button. Close the empty MMC.

Next time you start EMC it has no cache to read from and will dynamically select a new DC.

There is another way of doing this. Close all open MMC and then delete the file “C:\Users\%username%\AppData\Roaming\Microsoft\MMC\Exchange Management Console”.

As you can see this cache is per user which unless the administrator creates a process of clearing the cache when needed, each user that runs EMC must clear the cache itself.

If you’re interested, “C:\Users\%username%\AppData\Roaming\Microsoft\MMC\Exchange Management Console” file is in XML format and can be viewed if you like, but I wouldn’t advice you to make any changes to it.

Exchange 2007 Service Pack 3 is out the door

2010-06-21T23:24:00.001+02:00

Microsoft has now released Exchange Server 2007 Service Pack 3.
With SP3 it is now possible to run Exchange 2007 on Windows Server 2008 R2.

Download Exchange 2007 SP3 from here
The link with what’s new in Exchange seems to be incorrect. but here it is anyway http://go.microsoft.com/fwlink/?LinkId=154404

Don’t run of and upgrade your OS to Windows Server 2008 R2 because of this. It’s most likely not supported when Exchange is installed.

Happy patching

Exchange 2010 Update Rollup 4 is released

2010-06-18T08:48:00.002+02:00

Read the complete list of fixes here Exchange 2010 UR4 – KB982639

Worth mentioning is that if you’re using Microsoft update and Exchange DAG, updates will not be automatically detected. DAG/Cluster servers should be patched manually.

Installation package can be downloaded from download link for Exchange 2010 UR4

Exchange 2010 Site Disaster Recovery on a Dime! Part 3: Backup, Restore, Recovery

2010-05-11T20:49:00.002+02:00

I began this series by explaining how to build a low cost site or datacenter disaster recovery solution with the new Database Availability Group (DAG) feature in Exchange 2010. Next, I covered the process of failing over to your other site in case of a disaster. Naturally, I hope you never experience a disaster in your Exchange environment, but if you do this article will ensure you are prepared.

In Part 3, I will walk you through the steps of performing a Backup, Restore, and finally a Recovery. While it is important to know how to do a proper backup, it is equally if not more important to be able to use it in case disaster strikes.

The Backup Process
Performing a backup of Exchange 2010 databases is not that difficult; just make sure that your backup software uses VSS technology since the traditional streaming backup API is not available in Exchange 2010.

The built-in Windows Server Backup has this capability, but it lacks many other functions that a real backup solution has. Therefore, I tend to rank Windows Server Backup as a poor man’s backup software. See my earlier post about Windows Server Backup and Exchange 2007 for more details. While the article is written for Exchange 2007, it is also applicable to Exchange 2010.

Other vendors are working on their backup software to ensure its compatibility with Exchange 2010 and some already have it working. An example is Microsoft’s Data Protection Manager 2010.

No matter which backup software you use, the steps for doing a backup are essentially the same. Backup software communicates with VSS, which in turn communicates with the Exchange Write that is installed during the Exchange installation. During this process, only changed blocks on disk will be transferred to the backup software, which is responsible for saving and storing data for later retrieval. By transferring only changed blocks on disk the backup time is decreased and so is the number of bytes on the wire.

In the example we have been using for this series, we have one server running in the primary datacenter and another server in the Disaster & Recovery (DR) datacenter.
The question arises: ‘Where do I do the backup -- on one or both servers?’ The answer is ‘It depends.’ (Don’t you love this answer!)

Your options are:
1. Do the Exchange database backup on one server and Exchange database copy of the other servers
2. OR backup only one server, but which one?

For the Exchange Admin who has been around Exchange awhile, the question about purging transaction log files always comes up. The beauty of the DAG design in Exchange 2010 can be seen during this process: when doing backup of a database in a database availability group (DAG), it will automatically purge the corresponding transaction log files on all replicas of that database. The server running the database where the backup is performed communicates to the other servers having a database replicated, telling them that a backup has been done and that it is now time to purge transaction log files. Which files to purge depends on several factors, such as checkpoint, replay lag time and truncation lag time. Thus, you should not expect them all to be purged with a normal full backup. With this in mind, make sure to size your transaction log LUN correctly if using replay lag time and truncation log time.

The Restore Process
The process of restoring a database located in a DAG is pretty much the same as doing it on a mailbox database that is not a member of DAG replication. The decision you must make is whether to use the lagged copy of the database or to perform a traditional restore.

How can we take advantage of the lagged database copy?
Lagged database copies can be used for recovering a logical corruption in a mailbox or mailbox database, or recovering individual mails or folders within a mailbox. The recovery process is simple, but you must consider the replaylagtime settings carefully so that you can discover a problem in time to use the lagged database copy before transaction log files are replayed into the lagged database.

Components needed for the recovery include a ‘recovery mailbox database’. The first step is to create a recovery mailbox database:

New-MailboxDatabase -Name RecoveryDB -Verbose -Recovery –EdbFilePath E:\Recovery\RecoveryDB.edb –LogFolderPath E:\Recovery -Server FQDNofServerInRecoverySite

This will create a recovery mailbox database with paths set to E:\Recovery

Next step is to get a file copy of the mailbox database you want to extract data from into the E:\Recovery folder. You could use a regular restore from your backup, but it’s often faster to make a copy of the lagged database. You may use the amount of transaction log files that suits your purpose.

Before doing a file copy, it is best to pause the replication with the Suspend-MailboxDatabaseCopy command:

Suspend-MailboxDatabaseCopy 'database name\FQDNofServerInDRSite'-SuspendComment "Recover data from database" -Verbose

We use VSS to do a shadow copy of the database we want to extract data from. The Syntax for vssadmin.exe command line tool is “vssadmin create shadow /For=”

As you can see, you can only do a VSS shadow copy for full volume, meaning the volume is either a disk such as D:\ or a mountpoint. You probably have database files and transaction log files on separate disks, so you must create shadow copies for both disks.

vssadmin create shadow /For=D:
vssadmin create shadow /For=G:

Pay attention to the result you get:
Shadow Copy Volume Name:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2

In previous versions of Windows, you could simply do a copy from the strange path above to your recovery folder, but this seems to be have either broken or been taken away in Windows Server 2008 R2. This is how it used to look:

copy “\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\path_to_your_edb_file” E:\RecoveryDB

But I discovered another way of doing it, with explorerer.exe:
Right click on your C drive, select Properties and Previous Version Tab. Here you should see the newly created shadow copy. Select it and click open. A new window opens in which you can drill down to wherever your Exchange database files are located and simply do a file copy of the edb file and corresponding transaction log files to the E:\Recovery folder. Which transaction log files you need to copy depends on how far forward you want to replay information into the database. Simply check the file stamps on the files. Warming: In real life, this file copy will take a long time!

The Recovery Process

Now we can do a recovery of the database in E:\Recovery folder. Start by deleting the checkpoint file “xxx.chk”. Next use eseutil from an elevated command prompt in the E:\Recovery folder:

eseutil /r xxx /a

Where xxx is the transaction log file prefix, such as E00. Output will look something similar to this:

Extensible Storage Engine Utilities for Microsoft(R) Exchange Server
Version 14.00
Copyright (C) Microsoft Corporation. All Rights Reserved.
Initiating RECOVERY mode...
Logfile base name: e00
Log files:
System files:
Performing soft recovery...
Restore Status (% complete)
0 10 20 30 40 50 60 70 80 90 100
----------------------------------------
..............................

This could take a long time depending on how many transaction log files you have to roll into the database file. The speed of rolling transaction log files is approximately 2 log files per second.

Next step is to rename the edb file to recoverydb.edb since that was the name chosen when we created the recovery database.

If everything has gone well, we can simply mount our recoverydb:

Mount-MailboxDatabase RecoveryDB

To see what mailboxes there is in the RecoveryDB, use:

Get-MailboxStatistics -Database RecoveryDB

To extract data from the Recovery database, use the Restore-Mailbox command:

Restore-Mailbox -RecoveryDatabase RecoveryDB -TargetFolder Recovery -Identity 'target mailbox' -RecoveryMailbox 'mailbox to get data from' -BadItemLimit 999 –Verbose

You could use several more parameters with Restore-Mailbox such as -ExcludeFolders, -SenderKeyWords, -AttachmentFilenames, -ContentKeywords, -AllContentKeywords, and many more. See the documentation on TechNet for full syntax of Restore-Mailbox.

When restore-mailbox command is finished, you will see a folder structure inside the ‘target mailbox’ named ‘Recovery’ with the extracted data beneath.

Now it’s Time to Clean Up

Now that you have managed to extract data from the lagged copy, you must start cleaning up (‘But Mom!’) First delete the shadow copy; otherwise, it will eventually fill up the shadow storage disk space.

Start by listing your current shadow copies with:

vssadmin list shadows

Look for the shadow you made before. (For example, timestamp is good to use.) Then delete the shadow copy with:

vssadmin delete shadows /Shadow=ShadowId

Where shadowID looks like {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

When you have finished, use the Recovery database. Simply delete it with:

Remove-MailboxDatabase RecoveryDB

And delete files in the E:\RecoveryDB folder.

Don’t forget to un-pause the replication of transaction log files with Resume-MailboxDatabaseCopy:

Resume-MailboxDatabaseCopy -Identity 'Mailbox Database 2036433681\FQDNofServerInDRSite' –ReplicationOnly

-ReplicationOnly is there to stop ActiveManager from accidentally activating the database DR site.

What if you encounter a corrupted file and need to recover the complete server but also want to go back a few hours in time? (and your DeLorean is all out of plutonium…)
You can always use your regular backup, but you could also use the lagged copy. Using the lagged copy in this scenario is even simpler than described above. Suspend replication, delete checkpoint file and as many transaction log files as you need to “go back in time.” Then select the amount of time and use eseutil /r to replay the transaction log files left on disk.

Next step is to do a switchover to the recovery site and server. Please see part 2 of this series for more detail: Exchange 2010 Site Disaster Recovery on a dime! Part2: Navigating the Failover process

Another approach would be to use a dial-tone database together with a recovery database. I will save this discussion for a future article.

Exchange 2010 Site Disaster Recovery on a dime! Part2: Navigating the Failover process

2010-04-13T21:46:00.001+02:00

In Part1 of this series I explained how to build a low cost site or datacenter disaster recovery solution using Microsoft Exchange’s new DAG feature. In this article, I will endeavor to explain what manual steps are required to failover to your other site in the event of a disaster.

First of all let’s discuss what types of problem can occur. There are a variety of problems that can happen ranging from simple disk failure to a tornado smashing the datacenter in the primary site. In this article, I would like to address how you would manually activate your backup exchange server if your primary server’s mother board or disk failed. Next, I will outline the steps to take if you experience the dreaded total site failure and then I will finally conclude with how to fail back to your primary site when everything returns to normal.

OK, so how do we recover from for example a motherboard failure?
If you find yourself in this situation, you can be sure that your primary Exchange server will be offline and not functional. The good news is that in this situation all your other core infrastructure will be up and working, including critical items like your domain controllers and DNS servers.

The first thing you will notice is that your Outlook clients will still try to connect to the original MAPI endpoint (RPC Client Access Service located on CAS). To quickly rectify this situation, simply just change the A record in DNS for the ClientAccessArray to the IP of CAS in the DR site. The Time To Live on this record should be a couple of minutes making the change to a new IP as fast as possible. Another thing you also should consider is the time it takes for DNS replication/updates to propagate throughout the network.

Next it will be time to get the databases up and running on your DR server.

First verify that all Exchange services are running on the DR server. If the services have been turned off this could cause other problems with transaction log replication.

The most simple step is to move all active databases from the primary site to be activated on the DR site. The following command should be run on a server in the DR site, most likely from the Exchange server.

First remove the activation block on mailboxes in the DR site

Resume-MailboxDatabaseCopy 'mailbox database name\FQDNofaServerinDRSite

Perform this step on every mailbox database you want to activate. There is a chance that databases will mount automatically when resuming mailboxdatabasescopies. You can verify status by running Get-MailboxDatabaseCopyStatus on Exchange server in DR site.

Get-MailboxDatabaseCopyStatus -server FQDNofaServerinDRSite | fl Name, Status, ActivationSuspended, ContentIndexState, Activecopy

If databases are mounted and the ActiveCopy is True, you are done with the activation and outlook should now be able to connect and start receiving and sending mail internally. Next reconfigure services and applications to make Exchange reachable from Internet with SMTP, Outlook anywhere, OWA, Active Sync etc. If you have ISA or other reverseproxy server, reconfigure it to the server in the DR site instead of the server in the primary site. Other services that might need to be reconfigured are autodiscover and InternalUrl in several IIS virtual directories.

If mailboxes don’t mount correctly, you can manually run the following command:

Move-ActiveMailboxDatabase –Server FQDNofaServerinPrimarySite –ActivateOnServer FQDNofaServerinDRSite

Depending how Windows and Exchange managed to handle the crash you might encounter some errors, making the activation a little more difficult. Things that might happen range from the index is not up to date on the DR server or all transaction log files have not been copied to the DR server. The solution is to specify some extra parameters on the Move-ActiveMailboxDatabase command.

For example, -SkipClientExperienceChecks is good to use when index is not up to date.

If you have not configured AutoDatabaseMountDial on the mailbox server, by default it is set to lossless and there is always a chance that replication have not copied all transaction log files to DR server, then you have to use the –MountDialOverride with a parameter such as BestAvailability or GoodAvailability.

Other parameters that might be needed are –SkipLagChecks or –SkipHealthChecks.
You might have to use several parameters together to get databases up and running.

Move-ActiveMailboxDatabase –Server FQDNofaServerinPrimarySite –ActivateOnServer FQDNofaServerinDRSite –MountDialOverride:BestAvailability –SkipLagChecks –SkipHealthChecks -SkipClientExperienceChecks

More information about Move-ActiveMailboxDatatabase is found on Technet. http://technet.microsoft.com/en-us/library/dd298068.aspx

When you have replaced the motherboard on Exchange server in the primary site and replication starts going from the DR site to primary site, you’re good and it’s time to plan the switchover to the primarysite. This is done with the same step as above. Plan the switchover to a time during off hours since the switchover will take a couple of minutes due to the necessary DNS updates, AD replication and time it takes to run the commands above.

Finally, you should run the Suspend-MailboxDatabaseCopy again to disable automatic activation of databases in DR site.

Suspend-MailboxDatabaseCopy -Identity 'Mailbox Database 2036433681\FQDNofServerInDRSite' -ActivationOnly –Verbose

This last step is needed because activation is reset when you do a switchover between servers. Be sure to remember to do this for every mailbox database on your servers.

If you can’t get things started on Exchange in the primary site due to problems with corrupt database or transaction log files, you might have to reseed files from the server in DR site. Use the Update-StorageGroupCopy and possibly with the –DeleteExistingFiles parameter.

Recover from a disk failure is pretty much the same as above but it only involve databases and transaction log files located on the faulty disk.
Another cool thing is that you can even test a database switchover in production. To do this, first create a database in the primary site and make a copy in the DR site the same way all the other databases were created. Next create a mailbox in the test database, logon and send some test messages back and forth. Activate the test database on the DR server, edit the hosts file with the FQDN of the CASarrayname and the IP of Exchange in DR site and start outlook again. You should now be able to connect with Outlook to the DR server and use outlook the normal way with disturbing any other users.

Recover from a disaster in the primary site.
This is more problematic scenario, but the steps are basically the same as above. The slightly more complex steps are caused by the fact that you don’t have any servers or network connectivity in the primary site and that your cluster will not have access to its quorum, and as a result it will be in a failed state.

How do you solve this problem?
First you need to make your cluster working.
In the DR site, stop the failover cluster service if started and the start it again with the forcequorum switch.

net start clussvc /forcequorum

The next step is to active all databases on the DR server. This is done in the Move-ActiveMailboxdatabase command the same way as before.

You may also have to manually mount the databases.

With a complete site failure in the production site you most likely need to live with the DR site for a while which calls for more actions than just getting your Exchange server up and running. You also need to get traffic to and from Internet flowing, both mailflow and user access to Exchange. Autodiscover is your friend to update configuration in outlook, so make sure you have configure all URL’s correct.

So in the whole there is a lot more to reconfigure than just Exchange to do a site failover.

http://technet.microsoft.com/en-us/library/dd351049.aspx

How do you fail back to your primary site after the disaster?

We have forced quorum on our cluster and if we restart the cluster service or reboot the server, the cluster service will fail to get quorum. This is important when servers go online in the primary datacenter since we don’t want to have a forced quorum in the secondary site when servers startup in the primary site.

If everything wasn’t that bad and we could simply power up everything in our primary site, replication should start working again.
But you have to do some things like, reconfigure your File Share Witness, restart cluster service on secondary Exchange server, and basically all steps we did to move everything to secondary site but now change everything to point to our primary site again. But don’t rush things here, let Active Directory get to a stable state first and then slowly move things back to normal.

Depending on what state servers are in and what happened you may not want to start Exchange in primary site, but remove it from DAG and rebuild Exchange, join it to DAG etc.

As you have probably noticed, there are lots of variables and therefore it is not easy task to write a step by step guide on what to do for every situation. It would be recommended to write out the basic steps and your configuration information to make the transition easier when you are dealing with the stress of the situation. The best tip I can give to all of you is to learn how things work and play with the various scenarios in a lab. The experience you gain from this will be your best friend when the unexpected happens in real life.

Exchange Server 2010 Service Pack 1 archiving enhancements

2010-04-08T07:57:00.001+02:00

Microsoft Exchange team released an article on there blog about all the enhancements that will be in the upcoming Service Pack 1 for Exchange 2010.

The number one thing amongst several customer is that is now possible to have the online archive mailbox located on a separate database than the ordinary mailbox is.

There are of course many other cool new features such as access to the archive from Outlook 2007 and not only from Outlook 2010 or OWA 2010, and many many more features.

Read the whole story on You Had Me At EHLO

Running OCS on Windows Server 2008 R2 is now possible

2010-04-03T10:27:00.001+02:00

For you people that want to run Office Communication Server 2007 R2 (OCS R2) on Windows Server 2008 R2, this have not been possible before and if you have tried you have gotten yourself in technical problems. But the wait is finally over; with a couple of fixes it is now possible. One sad thing is that there is no support for upgraded OS, you have to install new boxes with Windows Server 2008 R2 and then install OCS R2 on them and move everything from the old server to the new servers.

Read this article for instructions http://support.microsoft.com/kb/982021/

Worth mentioning is that group chat server is still not supported on Windows Server 2008 R2 and domain functional level cannot be 2008 R2 mode http://technet.microsoft.com/en-us/library/ee692314(office.13).aspx

Exchange 2010 Site Disaster Recovery on a dime! Part1: Building the solution

2010-02-16T22:10:00.005+01:00

Since Microsoft has made significant improvements to how Exchange handles disaster recovery of databases, many organizations have started to wonder how they can effectively prevent site, datacenter and other such disasters from occurring. But not every company has the budget to implement a new infrastructure, so how can such companies still take advantage of these new techonolgies? The answer is in this article -- I will explain how this can be accomplished with only two Exchange 2010 servers. In Part 1 we will discuss how to build the solution; then in Part 2 we will move on to discover how to activate the disaster recovery site.

Please note that this solution does not give you High Availability, but it will provide you with a solution for site and server disaster.

This solution builds and depends upon the Exchange 2010 feature called Database Availability Group (DAG). DAG is the new High Availability feature of Exchange 2010 that is the evolution of the Exchange 2007 CCR, LCS and SCR replication technology. A DAG can be built with as little as 2 Exchange server mailbox roles, and with as many as 16, making this a very flexible solution. The beauty of the Exchange 2010 DAG feature is that can also contain other Exchange server roles such as CAS and HUB, which is an attractive option for smaller organizations. To demonstrate the scalability of the DAG feature, I will use only two servers in my example – one in the production site and one in the Disaster Recovery site. This represents the smallest installation that can be done for DAG, but remember this is a flexible solution so at any point if you need to scale out with multiple DAG members the steps you would perform are nearly identical.

Building the solution.
In both the production site and the Disaster Recovery site we need a server with Windows Enterprise edition since DAG relies on Microsoft Failover Clustering which is only available in the Enterprise edition. (Remember that Exchange comes in either Standard or Enterprise edition. The Standard edition can be used with up to five databases, but if you need more than five then it is necessary to utilize the Enterprise edition of Exchange.) Both sites also need Domain Controllers and Global Catalog Servers. The DR (Disaster Recovery) site is most likely a different site in Active Directory to prevent users from accessing it.

Installing Exchange.
To install Exchange, you simply perform a standard Exchange installation in both sites. When you are finished you will have one Exchange server in the production site and one Exchange server in the DR site. Both servers can have all standard roles (i.e. Mailbox, HUB and CAS), but you can also install them on separate servers and have multiple roles on multiple servers.

To test that everything is functioning properly, I recommend creating a mailbox on each database that is mounted on each server, and then sending a test email from one mailbox to the other. Our configuration thus far is very basic since no clusters or DAGs have been built yet. At this point, our example consists of two Exchange servers located in different Active Directory sites.

Since DAG is one of the hottest new features in Exchange 2010, many articles have been written on the subject. Hence, I will walk you through the steps of creating a DAG fairly quickly.

Creating a DAG.
In the Exchange Management Console, under the Organization Configuration, Mailbox and the ‘Database Availability Groups’ tab, right click and select ‘New Database Availability Group.’

The Create a DAG wizard starts.

Next, enter a name for your DAG. If you have a server with a HUB role but no mailbox role, then the wizard will select the HUB server and create the witness directory for you. If you don’t have an available HUB server, then you must manually specify the ‘Witness Server’ and a ‘Witness Directory.’

At this stage I need to caution you that a permission issue might occur when creating the File Share Witness directory. This is because it’s not the logged on users security context that is utilized when creating the File Share Witness directory, but rather the Exchange server computer account. The solution is to add the ‘Exchange Trusted subsystem’ group to the witness server local administrators group. This is also necessary becasue in order to create a DAG you must also create a computer account in Active Directory. Thus, you might need to delegate ‘Exchange Trusted subsystem’ group to create and manage the computer account in Active Directory, or at least in a pre-populated disabled computer account.

Exchange Management Shell or Wizard?
If you prefer Exchange Management Shell over the Wizard, below is the command you need to create a DAG:

New-DatabaseAvailabilityGroup -Name DAG1 -WitnessDirectory C:\DAG1 -WitnessServer FQDNofaServerinPrimarySite -DatabaseAvailabilityGroupIpAddresses 192.168.15.233,192.168.25.233 -Verbose

The Exchange Management Shell is a better approach than the Wizard when you consider the following: with the Wizard you cannot set a fixed IP on your DAG. Instead, it will use DHCP to assign an IP. This is important to consider since it is recommended that you have an IP in every subnet that contains DAG members. The reasoning behind this is that when DAG moves to a different IP subnet, it needs to have a valid IP address on that IP subnet.

Adding the parameter Verbose will allow you to receive clues in case something goes wrong as the command runs and pulls more information for you.

Why is having fixed IP for your DAG preferable to using DHCP?
Remember that a DAG is actually a failover cluster, and in order for the cluster to function IP must be up and running. Since not every company uses DHCP on the server subnets (some only use it on client subnets), it is often more convenient to have fixed IP.

The next step is to add your Exchange mailbox servers to your DAG.

Click ‘Manage Database Availability Group Membership’ and then add the mailbox server to it.
If everything works out accordingly, then the Failover Cluster role will be installed on the servers you added to your DAG. You can start the Failover Cluster Management tool and see that there is a cluster called DAG1 that contains your two mailbox servers. The computer account should also be enabled, and the witness directory should be shared and also populated with a couple of files.

Below is the Exchange Management Shell comand that you must run one time for mailbox server that you add:

Add-DatabaseAvailabilityGroupServer -Identity DAG1 -MailboxServer FQDNofMailboxServer –Verbose

Remember to allow AD replication between each step, otherwise you may not be able to join servers to your DAG.

You should also see that a DAGNetwork has been created, and if you have multiple networks on your mailbox servers then there should be multiple DAGnetworks. Even though you should run DAG on a single network, it is oftentimes better to have mutiple NIC and networks in your server because it gives you the ability to separate MAPI, Cluster and replication traffic into different networks.

The next step is to add databases to your DAG members in order to enable replication. Up to this point, each server had only one database mounted but now we would like to add more to it.

Click the ’Add Mailbox Database Copy’

Next, select which servers you want to hold a copy of the mailbox database and the ActivationPreference.

Below is the Exchange Management Shell command:

Add-MailboxDatabaseCopy -Identity 'Mailbox Database 2036433681' -MailboxServer FQDNofServerInDRSite -ActivationPreference 2

This step can potentially take a long time since the database is seeded to the DR (Disaster Recovery) site; how long it takes depends on the database size and available bandwidth.

Now we must set some parameters on the mailbox database so that it is not automatically activated.

From Exchange Management Shell (EMS) run the following command:

Suspend-MailboxDatabaseCopy -Identity 'Mailbox Database 2036433681\FQDNofServerInDRSite' -ActivationOnly –Verbose

This will ensure that replication is still happening automatically while ensuring activation will not.

Next, run every mailbox database to both your servers with the ActivationPreference set to 1 on the server in the production site; then, set the database copy on the server in the Disaster Recovery site to ‘suspended’ for activation.

Configuring Replay Lag Time
Configuring Replay Lag time is something that you should seriously consider doing. Lag time is how long the passive copy will wait until the transaction log is replayed into the database. Replication is still happening as fast as possible.

Below is the EMS command:
Set-MailboxDatabaseCopy -Identity 'mailbox database 1976375852\FQDNofServerInDRSite' -ReplayLagTime 0.1:0:0 –Verbose

(Please note: 0.1:0:0 means 1 hour. In real life you should most likely set this to a higher value.)

There is also another paratemeter that you might want to use--the Truncation Lag Time.

Below is the EMS command:
Set-MailboxDatabaseCopy -Identity 'mailbox database 1976375852\FQDNofServerInDRSite' -TruncationLagTime 0.2:0:0

(Please note: 0.2:0:0 means 2 hours. In real life you should probably set this to another value.)

How long you set the ReplayLagTime and TruncationLogTime for depends on two things: 1) How long it takes you to notice a corruption on the production site, and 2) How long it takes to replay all transaction log files if you activate the DR site. For instance, if you know you can detect a corruption in the active datacenter within 10 hours, then you should probably set the ReplayLagTime to 12 hours or so to allow for recovery of all non-corrupted data. Also consider the amount of disk space you have when setting the ReplayLagTime.

More information about Managing Mailbox Database Copies can be found on Technet: http://technet.microsoft.com/en-us/library/dd335158.aspx

For more information on creating a DAG, click here: http://msexchangeteam.com/archive/2009/06/14/451609.aspx

Creating the CASArray.
Now your DAG and databases should be all ready to go! Remember to monitor the replication with Get-MailboxDatabaseCopyStatus –Server FQDNofServer

CopyQueueLength and ReplicationQueueLength should show small numbers if possible, preferably zero or one, but in real life you would see higher values depending on your bandwith, serverload, etc.

Why do you need a ClientAccessArray?
Technically, this is not needed but rather highly recommended because it’s easier to manage a system that has one, and since it’s only a name that you can move to another IP, you can also move your client connection point.

Move client connection point?!
Yes, the Outlook MAPI connection is moved from the Information Store on the mailbox server to the CAS (and the CASArray name if you have one defined.)

New-ClientAccessArray -Name CASArray-HQ -Fqdn FQDNofYourDesiredEndpoint -Site ADsiteInPrimaryDatacenter

For more information on the New-ClientAccessArray, click here: http://technet.microsoft.com/en-us/library/dd351149.aspx

Now configure all your databases to have the CASArray-HQ object as the RPCClientAccessServer. This will ensure that Outlook conencts to CASArray FQDN instead of the actual server name.

Get-MailboxDatabase Set-MailboxDatabase -RpcClientAccessServer CASArray-HQ

You must also create a record in DNS with FQDNofYourDesiredEndpoint with an IP of your Exchange server in the primary datacenter. Set the TTL to a low value, such as 5 minutes, to make the switchover go faster to the Disaster Recover site.

When Outlook connects, it will now connect to the ‘FQDNofYourDesiredEndpoint’ name. Also, if you look at the MAPI settings, Outlook thinks that the FQDNofYourDesiredEndpoint is the Exchange mailbox server.

Configuring Autodiscover
For Outlook to connect properly you must make sure to configure Autodiscover correctly.

At this point you should have two servers with the Mailbox, HUB, and CAS roles on each one, a DAG with the two servers (one in each AD site), and a CASArray located on the server in the primary AD site.

Failovers will not occur automatically because of the configurations we did on the mailbox databases. Thus, if you reboot the primary server then clients will lose connection to their mail.

I hope you have enjoyed this tutorial on Exchange Server 2010 Disaster Site, and that you were able to follow my instructions and begin preparing your organization for the worst-case scenario: site or server disaster. Now that you know how to build the solution, in Part 2 of this piece we will move on to discussing how to activate the disaster recovery site, at which point I will explain how to backup, test and perform a switchover should your Exchange server fail.

Running Exchange CCR on Windows Server 2008

2010-02-16T01:30:00.002+01:00

Then there is a really good hotfix for you to fix some problems with cluster functionality on Windows 2008.

Under some conditions the cluster cannot form a quorum and the cluster will fail. More info is found on Tim McMichael’s blog.

Fix is named 978790 and downloaded from KB978790

Exchange 2010 help file needed

2010-02-09T14:32:00.001+01:00

If you are the person who wants to have the help file on your PC instead of going to the Exchange 2010 technet documentation website, here is the download link for the February release.

Both the website and chm file is regularly updated, so come back from time to time for updates.

To virtualize Exchange or not to virtualize Exchange?

2009-12-30T13:36:00.001+01:00

A very common question I hear when talking to customers is whether or not they should run Exchange in a virtualized environment. The answer I give them is multifold: yes, there are benefits to running Exchange virtually, but you must carefully think first about the prerequisites and make sure it is the best move for your environment.

Virtualization is not magical. Some people have the misunderstanding that because you run virtualized, you don’t need to size your servers. This line of thinking will quickly get you in trouble. You still need to figure out how much RAM, CPU and storage you need, both for volume and for performance reasons. The rules are simple: scale your server in the same way you would if you were using physical hardware, and then apply it to your virtual server.
If you figure out that your server is going to need 16GB of RAM and 1000 IOPS, then make sure that the virtualized server has the same resources available; otherwise, your Exchange servers will have performance issues.

Performance. Think about what virtualization environments look like today when considering your hardware’s performance, you should take into account how virtualized environments are deployed. Most companies deploy one or more physical servers, possibly in a clustered configuration, hosting several virtualized servers on each physical server. This means that each physical server must be able to handle the load for every virtual server instance running on the physical one.
With today’s hardware, this is most likely not a problem if you think about CPU or memory (CPU and RAM are not that expensive and can be added later if needed); but when it comes to storage, that is another story. Every server needs disks, both for booting from and for saving the application data to. If running 5 servers on one physical, then the physical server must have 5 times the disk volume—always keep in mind the importance of performance.
For example, let’s consider the following configuration:
Imagine that you have 5 virtualized servers, each having a 50GB disk for OS and a 100GB disk for storing data, which is 150GB times 5 servers and you end up with 750GB. This is no problem for modern disks since a single disk can easily hold 750GB of data. But if you would have run those 5 servers on physical hardware, then you might have put in 4 spindles and created 2 mirrors with 2 disks each. This would render you a fairly good performance on disk. Then if you also have 5 servers with this configuration, that results in 20 disks.

Now compare that disk performance to the single disk performance. Exchange designers have for a long time been used to and forced to think in number of spindles instead of volume because of the disk performance, but this knowledge isn’t that widespread and there is a chance that the people who maintain the virtualization platforms don’t have this knowledge. With this being said, you most likely end up with your virtualized environment connected to a pretty beefy storage containing a lot of disks to withstand the IO performance need.

Virtual hosts affect each other. With several virtual machines running on a single hardware, one virtual machine that is running very high on CPU can drain the physical server on CPU resources, leaving the other virtual machines with little to no CPU resources, causing them to perform slowly. Virtual platforms have configuration settings to limit this behavior, both from draining resources and for maintaining some amount of resources for virtual machines.
This applies to not just CPU resources, but to all other resources also shared by the physical server.

Virtualization adds complexity. By now you’ve gathered that virtualization adds complexity. The most likely scenario is that you end up with a bunch of virtualized servers with disk files located on a SAN. There is also a good chance that you need some more education to maintain not just the ordinary Exchange server environment, but also to manage the virtualization platform as well as the SAN infrastructure.
There is always going to be a time when something happens to the environment for unknown reasons, which inevitably leads to really complex troubleshooting. In smaller companies there is often one person maintaining everything in IT; but in larger companies there are several departments maintaining one piece of the puzzle, making troubleshooting even more complex! Situations might arise that involve several people blaming each other, saying things like ‘There is nothing wrong with my SAN!’ I’m sure many of you have taken part of such conversations.

Virtualization is not free. The complexity mentioned above is not free, unfortunately. Education costs money and time. If you also add the time spent on maintaining multiple systems and most likely some troubleshooting to get them working together, you can easily see that it will cost more money than a standard windows server with Exchange on it. An ordinary windows technician should be able to maintain a standard windows box with perhaps some local attached disk drives.
On the other hand, what can be free under some circumstances is the software license for the virtualization platform. Keep in mind, however, that this is often a small amount of money compared to all the labor and education costs that will be incurred. Plus, there might be costs associated with putting the environment in a SAN.

Flexibility. Virtualization technology is great for flexibility. It is often very simple to add resources such as disk or memory to a virtualized server, and if done correctly it is easy to add servers as they are needed. With the easy provisioning of servers, virtualization is great for lab environment where you often need to add or restore servers quickly. In a lab you can also test things and don’t need to be afraid of breaking your system since it is easy to restore them.
There is always the element of patching a running system. The process for patching a virtualized server is the same as for a physical one. Some people argue with this and say that they can do a snapshot of the server before patching and if something breaks they will just roll back the snapshot. This, however, is not feasible with Exchange since it relies on the configuration being in Active Directory.

Consider this scenario:
There is a patch for Exchange available that you want to install, so you do a snapshot of your virtualized Exchange server and apply the patch. After the reboot or restart of services you notice that the patch doesn’t work in your environment. ‘No problem,’ you think, ‘I will just go back to my snapshot.’ This is not the best course of action, however. Not only because you will “go back in time”, making people lose mail between the time when your snapshot was taken up to the present time, but also because this patch wrote or changed something in Active Directory. By going back, the installation before the snapshot doesn’t like the information being present in Active Directory, causing Exchange to fail. I don’t think this will be a common problem with Exchange, but it is something to be aware of. My recommendation is to do a snapshot of AD and Exchange at the same time as the rollback, not separate.
Exchange supportability Running virtualized is not limited to use of Microsoft technology with Hyper-V. Microsoft has a program called Microsoft Server Virtualization Validation Program (SVVP) http://www.windowsservercatalog.com/svvp. This program allows other vendors to go through tests so that their virtualization technology can be validated and approved by Microsoft. Being a vendor that is a member of SVVP makes it supportable by Microsoft to run Exchange on; therefore you are not limited to Hyper-V.

Microsoft has published a document with policies and recommendations for running Exchange 2007 and Exchange 2003 virtualized, and can be found here: http://go.microsoft.com/fwlink/?LinkId=124624
Information about Exchange 2010 will be published shortly, but in essence it will be very much the same as for Exchange 2007.
This document should be read carefully by the people doing Exchange design work, otherwise you may be out of support from Microsoft. Most important point to remember is that your storage and high availability are designed correctly.

Security is of course something to think about, and the virtual servers we treat the same way as if they were physical. Those servers must be protected and patched just like any other server. There is also the challenge of who can access and manage the virtualized environment? Running Exchange in a virtualization environment adds complexity in terms of security, and is definitely something to consider carefully.

Ask yourself some questions:
What if someone could get access to the physical servers and simply copy the disk file? That person could then sit quietly and try to withdraw data from the file. Thus, it is important to think about permission on files, servers and management tools.
What about if you move a virtualized Exchange server to a physical server that is not located inside a locked computer room, or to a hardware that doesn’t have the needed resources? As you can see, security around virtualization involves many components.

Now that you have all the information, let’s return to the original question about running Exchange in a virtualized environment. Ready for my final answer? Yes, it can be done and many benefits will be incurred as a result, but you must pay close attention to the design outside of Exchange and keep in mind all the prerequisites, pitfalls, and misconceptions that you could face.

Looking for help upgrade to Exchange 2010

2009-11-27T16:06:00.001+01:00

If you’re looking for information to upgrade from an earlier version of Exchange to Exchange 2010.

One of the first thing you should do is to visit Exchange 2010 Deployment Assistant. This is a wizard and step by step guidance on things you need to do before/during and after the upgrade from Exchange 2003/2007 to Exchange 2010.

Try it out, it will really help you understand what you need to do.

Exchange 2010 released to public

2009-11-09T21:01:00.001+01:00

Exchange 2010 has now been released to general public. Here is the Exchange 2010 download link that i promised in my previous post Exchange 2010 is code complete

As Exchange 2010 is now officially release to public Forefront Security for Exchange 2010 is also released. Download forefront for Exchange here

Exchange 2010: The New Archiving Feature

2009-10-14T14:02:00.001+02:00

There is a lot of buzz surrounding the new archiving feature in Exchange Server 2010. But where there is buzz there are always the unavoidable rumors and misunderstandings surrounding the new feature.

When you ask an Exchange administrator about archiving, most of them think of the archiving product as a tool that replaces messages and/or attachments with a shortcut often called a stub, and then takes the original item and stores it in the archive system. This is a deeply-entrenched misunderstanding, and when Microsoft revealed that the Exchange 2010 archiving function does not take items away from Exchange store, people started to shout and exclaim, This is not a true archiving solution! I admit that at first I agreed with this outcry from the Exchange community, but the more I thought about it, the more I realized there are good reasons to keep items inside Exchange.

First, you must put yourself in the shoes of a regular user. He or she often has a mailbox quota enforced and when the user gets a warning message they typically move items away from Exchange and store them in a PST file. This seemingly innocent move causes a very big problem. PST files, as their name implies, stands for Personal Store and should be stored locally on end users’ hard drives. The result? There is no longer any backup on those mail items, and even if you go the unsupported route and save the PST file on a file share somewhere, the backup software often has issues with doing backup of these files since Outlook has them open. What about using special tricks, such as open file agents, you might ask? Unfortunately, the backup software will still experience difficulty in performing the backup of open files even with such tricks. Outlook also changes the archive bit on the PST file, which in turn triggers the backup software to perform a backup even if there is no change in the file from Outlook. This will cause the backup to run for an extensive length of time since there are typically many PST files scattered across numerous file shares.

Another roadblock administrators may face when storing PST files “over the network” is that networks are unreliable and do not always function properly. Even if the networks are working, users are prone to closing the lid on their laptops, causing the network link to close and the PST file to corrupt since it was not properly closed by Outlook. This is also the main reason why PST files are not supported on file shares. The corrupt PST file is also notorious for engendering end users to call the help desk, and essentially forcing the administrator to initiate a restore of the hopefully backed up PST file. Other problems exist with PST files located on a share, including but not limited to: slow network performance when open, and when closing Outlook.

The risk of taking data out of Exchange and storing it inside PST files is that you are moving corporate data from a safe environment located inside Exchange databases to an unsafe environment. Since PST files can easily be corrupted and/or lost, they are not a secure alternative to storing business-critical data. By moving corporate data out of Exchange you may in essence be breaking laws regarding retention and compliance because the administrator no longer has control of email content. Let us not forget that corporate assets are in danger of being lost by moving data out of Exchange.

Other issues to consider include legal discovery and reducing the burden of searching and restoring mail data. When moving data from Exchange to PST files, you have the potential of losing all those things.

Other archiving solutions often solve all or many of the aforementioned problems by using the “stub” approach, and can provide some kind of search capability.

The stub approach is something that most vendors claim to be a viable alternative, but keep in mind this also introduces problems since items are removed from Exchange and are no longer indexed and searchable from a native client, forcing you to utilize the vendor client. That process entails installing and maintaining another client, which can be complex both for the end user and for the administrator. Most vendors also claim that you would reduce the amount of data in Exchange with the stub approach. That is often true, but in many cases you do not reduce the data as much as you expect since the stub is another item in the Exchange database with a couple of Kb in size. By replacing a 10Kb mail with a stub of 5 Kb, you only save 5Kb of data. This is something that you should consider if you import PST files to Exchange and then archive those imported items-- this will in fact increase mailbox size by a couple of Kb per item you import even if you later archive it.

Microsoft’s approach to archiving in Exchange 2010 is not to move items from Exchange and store it somewhere else, but in fact to leave it inside Exchange. There are several reasons for this. By leaving data inside Exchange, both users and administrators no longer need to learn and manage another system. The end user experience is the same as having a PST file connected to Outlook, and users can still drag and drop mail back and forth between their mailbox and the archive, making it incredibly simple for users to take their PST files and import them to the archive. Administrators would be happy since they no longer must cope with all the problems caused by PST files, but users will also be happy since the archive is indexed and searchable. Some companies must also comply with regulations and policies that force them to do searches across multiple mailboxes. This is also built in and is performed from the Exchange Control Panel (ECP) by users that have the delegated permission to do so. You can also turn a mailbox on ‘Litigation hold,’ meaning that even if a user deletes items, empties their ‘Deleted Items’ folder, and clears the dumpster area, mail is still maintained in the new Exchange 2010 dumpster version 2 area. This area is not reachable by end users but only by members of the ‘Discovery Management’ role group.

But what about the increased database size in Exchange?
The archive is technically an additional mailbox in the same database as the primary mailbox and shows up in Outlook in the same way a PST file would. People often react and say that the archive must not be in the same database because it should be on cheaper storage-- that’s fair and is most viable if we are talking about Exchange 2003. It’s common knowledge that the IO load that Exchange 2007 places on your storage has dropped by approximately 70% as compared to Exchange 2003, and with all the enhancements done for Exchange 2010, the IO footprint has dropped about the same amount again, making it possible to run all your Exchange databases on cheap and less performing disks. This means that you don’t need the costly SAN for your Exchange databases but in fact can use cheaper storage like SATA disks.

What about backup and restore time?
With the increased volume in Exchange databases, you may think that the backup time will increase, but that is not entirely true. The streaming backup API is taken away from Exchange 2010 and what is left is the VSS API for backup. With VSS, you only do backup of the changed blocks on disk and most of the mail in the archive is just sitting there, and therefore the block on disk is never changed. Sadly, the story for doing restore is not improved, and with the increased volume you also get increased restore time. But there is a simple solution for that-- don’t do backup. This is a very controversial thing to say, but with Exchange 2010 Database Availability Group (DAG), you can replicate data to several mailbox servers (up to 16) and if a database or disk blows up, another copy of your databases will be set as primary, and most likely will not even be noticeable to the end user since all client connections don’t go direct to mailbox servers but instead go to Client Access Servers (CAS). You can also stretch members in the DAG across datacenters to solve the case where a datacenter stops working. It also provides a replica of your data offsite. So the question to ask is, Why do you backup your Exchange data? http://anewmessagehasarrived.blogspot.com/2009/05/why-do-you-backup-exchange-databases.html

Why bother creating an archive mailbox at all?
The reason for creating an archive mailbox is probably something you base on the size of each user’s data volume. It is only the primary mailbox that is synced to the cached Outlook, and Outlook has issues with performance if the OST file is growing large. Therefore, by moving data to the archive the OST file will be smaller and Outlook will in turn perform better in cached mode. To see the archive, you must be online and have contact with Exchange and be using Outlook 2010 or OWA 2010, hence the name ‘Online Archive.’

Must users manage their archive manually?
No, the administrator can create policies that either move mail from mailbox to archive or delete mail. This is similar to what was first introduced in Exchange 2003 as recipient policies that were often used for clearing things out of the mailbox to the ‘Deleted Items’ folder or delete items completely. In Exchange 2007 this feature was enhanced a bit and changed its name to Message Record Management (MRM), and displays as Managed Folders in EMS and EMC. Exchange 2007 also introduced ‘Organizational Folders’ that could hold certain policies regarding how long mail must be maintained and what to do when they expire.
The problem with MRM version 1 was that it could only be applied to a folder or type of message, not one individual mail. With Exchange 2010 the administrator can still use the old way of applying policies on folders, but there are also new policies that allow users to apply a policy directly to individual mail items, (MRM version 2 if you will.) Policies are created by the administrator and if applied to folders, then users have the option to apply policies on individual mail items depending on how the policies are created.

The administrator can set different quotas on the primary mailbox and the archive. An example would be that the primary mailbox quota is 2GB and the archive is 15GB. With a couple of policies the administrator can choose to delete everything older than 10 years, and messages older than 1 year are moved to the archive. There also exist a couple of user policies that a user can set, allowing them to: ‘Keep this message for 5 years,’ ‘Keep this message for 1 year,’ ‘Delete this message in a month’ or ‘Delete this message in 5 months,’ giving a very flexible and efficient way of managing messages in Outlook.

Microsoft definitely has a good thing going with their Exchange 2010 archiving solution. For those of you not swayed yet, keep in mind that this is the first version of archiving within Exchange. The archive makes it possible to get rid of PST files and along with them all the problems they cause. Any administrator would agree that having data safely inside the Exchange store, managed and searchable with Exchange native tools, instead of having extra software and hardware to maintain is worth disregarding any rumors or misconceptions surrounding this brand new feature.

Exchange 2010 is code complete

2009-10-09T13:30:00.001+02:00

As you may have heard, the long wait for Exchange 2010 is over since it is code complete.

While we are waiting for a download link or a DVD to run setup from, here is some more info Exchange Team Blog

Forefront for Exchange and Windows built-in Firewall on a CCR cluster

2009-09-14T22:39:00.002+02:00

Are you running Exchange 2007 in a CCR configuration with Windows firewall tuned on?

Then you have probably encounter the problem “ERROR: cannot connect to service” when starting Forefront for Exchange administrator.

The solution is to allow some traffic through the Windows firewall as stated in KB929073.
This will allow you to start Forefront admin tool on the node running the Exchange Clustered Mailbox Server (CMS).
But you will still get an error when launching Forefront admin on the passive node and connect over the network to CMS.

The solution is to create two firewall rules that allows the traffic. These can be created with the GUI but its easier to describe

netsh advfirewall firewall add rule name="Forefront for Exchange Controller Service" dir=in action=allow program="C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server\FSCController.exe" description="Allow connection to Forefront for Exchange controller service" enable=yes profile=any localport=RPC protocol=TCP security=notrequired

and the second rule

netsh advfirewall firewall add rule name="Forefront for Exchange Admin tool" dir=in action=allow program="C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server\FSSAClient.exe" description="Allow connection to Forefront for Exchange admin tool" enable=yes profile=any localport=RPC protocol=TCP security=notrequired

You need to do this on both nodes and also restart the Forefront Controller service, but this will also restart several other services.

You have to change the path in the commands if you have installed Forefront in a different location than default.

You can also narrow down from where connections can be executed with the remoteIP parameter and the network classification with profile parameter.

netsh advfirewall firewall add rule name="Forefront for Exchange Admin tool" dir=in action=allow program="C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server\FSSAClient.exe" description="Allow connection to Forefront for Exchange admin tool" enable=yes profile=domain localport=RPC protocol=TCP security=notrequired remoteip=localsubnet

netsh advfirewall firewall add rule name="Forefront for Exchange Admin tool" dir=in action=allow program="C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server\FSSAClient.exe" description="Allow connection to Forefront for Exchange admin tool" enable=yes profile=domain localport=RPC protocol=TCP security=notrequired remoteip=10.10.10.0/24

Another thing that is important when running Forefront for Exchange in a CCR environment is to have the checkbox ‘Redistribution server” on “General Options” checked, otherwise the passive node will not be able to get updates from the active node.

Exchange 2007 Service Pack 2 backup feature

2009-09-13T20:43:00.002+02:00

It has been a lot of disappointment of the missing feature of a native backup solution in Exchange 2007 when running on Windows Server 2008. It has been so much roar out there that Microsoft decided to do something about it. With Exchange 2007 Service Pack 2 the native backup of Exchange capability is back.

It will not be a separate software or anything that is visible in a GUI somewhere, it will just be an added feature of Windows Server Backup since Windows Server 2008 don’t use NTBackup anymore.

The Windows Server Backup is aimed towards small or even medium size organizations and also as test and troubleshooting tool, so don’t expect to much of it.

How to do a backup of Exchange with Windows Server backup?
First you must install Windows Server Backup. This can be done from servermanager, add feature and select Windows Server Backup feature or from command prompt with “ServerManagerCMD.exe -i Backup Backup-Tools”. There is no reboot required and after the installation.
Start Windows Server Backup on your Exchange server. You must do the backup locally, there is no over the network backup capability. A shortcut is created during installation in Administrative Tools or you can run “wbadmin.msc”

After Windows Server Backup has started you can select to create a scheduled backup schema or simply do a single backup. Click the “Backup Once…” link in the Actions pane, The Backup Once Wizard starts. Select “Different Options” and then click “Next >”, Select either “Full Server” or “Custom”, if Custom is selected you are prompted with options of which disk to backup.
There is no option of only doing backup of Exchange databases or only selecting some folders. The granularity is the complete disk and nothing smaller.
Select the disks that you know contain Exchange files. You will not see that Exchange databases and transaction log files are selected for backup, you must know where your Exchange files are located. Click “Next >”.
Next option is to select the destination for the backup. If you select Local drives you must select a destination drive that are not included in the backup. The other option is a Remote shared folder, then you have to enter a shared folder on another server on your network. Backup will be created in a subfolder called WindowsImageBackup with the Access Control of either Inherit or Do not inherit (equals, you specify an account that are granted permission to the backup files).
If the destination location already contain a backup it will be overwritten.
Next selection is to either do a VSS copy backup or a VSS full backup, there is no option of the old traditional streaming or incremental backup.
Copy backup will simply copy the selected disk or disks to the destination, the full backup will do the same but also purge the application log files . This is the Exchange transaction log files and this is the option you should select if you’re not using any other backup software on your Exchange database files.

Backup will be placed in a folder called WindowsImageBackup and consist of a couple of XML files and the selected disks stored as VHD files. Virtual Hard Disc files are pretty cool, it is the native file format for hard disc with Microsoft virtualization technologies and you can copy or transport those files around and mount them on other computers for examination or whatever reason you might have.

Doing recovery of Exchange databases with Windows Server Backup.
When doing a recovery the database in question must be dismounted first. In a real world scenario it is already since you probably lost a hard drive or you did a disaster recovery installation of the server and its now time for recover the databases. Databases will be dismounted if needed by the Windows Server Backup.

Start the recover wizard by clicking “Recover …” in the actions pane in Windows Server Backup.
A recovery of Exchange database and transaction log files can either go to the original location and replace the original files or be destined to the Recovery storage Group (RSG) or even to a different server.
For this exercise select the local server and then select a time when you did the backup you want to recover, next select applications since it is the Exchange application data we want to recover and then select Exchange. If you click on the “View Details” button you will see databases that will be recovered, you cannot select individual databases to be recovered, all databases will be recovered. To have a more granular option; you must create multiple backups with different databases in each backup and for this to work each database and transaction log file must be on separate disk since the smallest option of granularity is the complete disk. The checkbox “Do not perform a roll-forward recovery of the application databases” means that Exchange will not roll forward transaction log files into the the recovered database. Next option is to recover to the original location or another location. Select original location. Recover to a different server or different location will be explained in another article.
Click recover on the Confirmation page if you is satisfied with you selections and to start the recover of you Exchange databases.
If you did not have dismounted the databases before you started the recovery they will be dismounted by Windows Server Backup. Permission to dismount databases is required for this to work as expected.
If everything goes well, database and transaction log files will be read from backup and written back to disk and finally transaction log files will be replayed into the database

Conclusions:
Does it work? The answer is, it depends. It will work if being used for doing backups and doing restore in a disaster scenario. It will not behave as expected when doing restore to a different server or different location, such as the Recovery Storage Group.

Windows Server Backup with Exchange plug-in don’t have granularity when doing backup or when doing a recovery, it will recover whatever there is on the backup. It’s all or nothing type of backup and restore.

Windows Server Backup can be configured to do scheduled backup from the GUI, but you can also use Windows Server Backup from the command line. This gives you more flexibility to make your own schedules with different options. I am thinking destinations here since each destination can only hold one backup, so if doing multiple backups to the same destination, only the last will be preserved.

Command line reference for Windows Server Backup.
http://go.microsoft.com/fwlink/?LinkId=93131

How to use the command line and to do a restore to the Recovery Storage Group is a story for another day.

Exchange 2007 Service Pack 2 is released

2009-08-25T07:26:00.002+02:00

Finally the Exchange 2007 Service Pack 2 has left the building and are downloadable by the public.

Of course it contains all bug fixes included in previous rollup’s for Exchange 2007 but it also contains some new features such as a plug-in for Windows Server Backup to natively do Exchange backup without buying any 3:rd party software. This one has been a long standing request that now is fulfilled.

Some other noticeable features included in SP2
* Enhanced Auditing
* Public Folder Quota
* Configure Diagnostic logging via GUI/Exchange Management Console
* Named properties bloat will stop since SP2 don't propagate x-headers to MAPI properties anymore. This is the same behavior as in Exchange 2010. See earlier posting about Named properties bloat part 1 and Named properties bloat part 2
* Dynamic AD schema update

Bu before even installing SP2, you must first extend Active Directory schema. Prepare your AD team for this!!

And if you’re planning on upgrading to Exchange 2010, SP2 for Exchange 2007 is a prerequisite and must be installed on every Exchange 2007 server before Exchange 2010 can be introduced into an Exchange 2007 organization. Read my other article about transition to Exchange 2010. Thinking about Exchange 2010? Understand the Prerequisites

Some more information about Exchange 2007 SP2
http://msexchangeteam.com/archive/2009/05/11/451281.aspx

Download link for Exchange server 2007 SP2. Be to careful to read the “Release notes” and “what’s new in Exchange 2007 SP2” documents on the download page before installing.

Exchange 2010 is starting to look good

2009-08-18T08:37:00.002+02:00

Now that the RC (Release Candidate) is out in public Exchange 2010 Release Candidate info page I can only say that it’s starting to look really good. Features that before where only talked about now is in this build and also work pretty good.

From now on to RTM version, it is mostly bug checking and performance tuning.

For you that seek for the 32bit version of Exchange 2010, the answer is, there will not be any 32bit version of any kind, no demo version, no admin tools no nothing.

Here is the Exchange team info msexchangeteam blog

Some thoughts about applications sending SMTP messages to Exchange

2009-07-31T01:16:00.001+02:00

Most organizations have applications that need to send mail, either to internal recipients or to have a SMTP server to relay there mail destined for external recipients.

Common configuration is that they figure out the server IP address where the application runs on and then enter the IP on the allow relay list on Exchange 2003 virtual server, if then run Exchange 2007 they often are a little bit puzzled until someone shows them MSExchangeteam 'Allowing application servers to relay off Exchange Server 2007'.

Why do I think this is bad?
First, most applications don't need the relay permission, admins often think so but the truth is that they don't need it.
Servers are not static, IP changes, name changes both on the application side and the Exchange side. If the server get infected with something bad, it is not just the application running on the server that are allowed to relay but everything running on the server since its the IP that are allowed to relay.
Remember this: IP restrictions are not authentication.
Have seen applications that are hardcoded to connect to a specific IP or names meaning that either IP or name can be changed on the Exchange server.
Resolution is of course to have applications easy to reconfigure with destination SMTP server’s name.

Another problem is when there is some kind of anti spam software running on Exchange. This will often make the applications mail end up being classified as spam and make Exchange admins trying to configure the anti spam software to white list some mail. Sometimes this cant be done and sometimes it can making admin workload bigger than before.
Resolution here is to educate developers in SMTP. They often doa good job of building applications but are very often bad at SMTP. They find a free SMTP engine on Internet and they stick it in there applications and in the end they manage to send a SMTP mail but it is often bad formatted in various way making the anti spam software react and classify it as spam.
Resolution here is of course knowledge about SMTP.

Back to the relaying part of sending mail. One very good solution here is to have the submitting application to authenticate SMTP session. By sending authenticated SMTP mail to Exchange, it will get the permission to relay, it will most likely bypass antispam software depending of software of course. It will also make the application easier to move to another server without reconfigure Exchange. Another thing with authentication and SMTP is that if I authenticate as ‘application 1’ I am only allowed to use ‘application 1’ email address, I cannot use another SMTP sender address..

My recommendations to developers, building applications sending SMTP mail.
* Use a good SMTP engine that do work. Have encountered one that didn’t like the tarpit time you can configure in Exchange 2003 and are default activated on Exchange 2007. This engine simply could not work with tarpit.
* Use authentication when submitting mail. NTLM is of course better than Basic, but if using basic authentication, use it over TLS.
* Ability to easy change SMTP configurations such as server name, sender and receiver SMTP address, TCP port etc.
* Have redundant SMTP server configuration. The SMTP server that you’re using may not be up and running. If mail are critical, consider having some queue functionality in the application that can try to resend mail. One queue functionality would be to use the local windows SMTP service, but this will only work if application run on Windows boxes and the local SMTP service is working.
* Use only valid sender and destination SMTP addresses. If there is NDRs, they should go back to an existing mailbox that someone can monitor and act upon.

There are of course recommendations to Administrators as well.
* Clearly communicate to developers what the rules are for submitting SMTP mail to Exchange. No hardcoded configuration, no anonymous submission etc.
* Add a good name for your SMTP servers, such as ‘smtp.ADdomainname’ for developers to use instead of giving them the real servername or IP. With a standardized name across all applications you can make them use another server when there is need. If you internal Active Directory name is company.local your smtp server name would be SMTP.company.local
* Set up internal MX records for the AD name space. Same advantage as above.
* If you have multiple HUB server, Load balance TCP port 587 across those servers and make applications use SMTP submission port 587 (this is the client receive connector that are default created on Exchange 2007) instead of the default 25. Don’t load balance port 25 since it will break functionality in Exchange such as authentication.
* Be very careful of what mail you let through to internet, maybe you should block applications to send to Internet on connectors to maintain your good name on Internet. Companies have ended up on various blacklists because developers have built bad SMTP mail or have a buggy application that spray mail across Internet.

There are probably many more options/alternative/thoughts around this, but these are just some that regularly pops up.

OCS Remote Connectivity Analyzer

2009-07-29T23:19:00.001+02:00

Some of you might know of the Exchange Remote Connectivity Analyzer that I wrote about a year ago 'Test Exchange Connectivity website'

Now there is new Remote Connectivity Analyzer, this time for OCS (Office Communicator Server). This is work in progress so don't count on full functionality yet but with your feedback the tool will improve.

The URL is here https://www.TestOcsConnectivity.com

Update Rollup 9 for Exchange Server 2007 Service Pack 1 (KB 970162) is released

2009-07-16T21:28:00.002+02:00

Rollup 9 for Exchange Server 2007 SP1 is released.

Read about all the included fixes and download from here KB 970162

Some noticeable fixes are: Note that this in not the complete list but just some of the fixes. For a full list see the link above.

947662 (http://support.microsoft.com/kb/947662/ ) The transport rule "when the Subject field or the body of the message contains text patterns" does not work accurately on an Exchange Server 2007 Service Pack 1-based computer

957137 (http://support.microsoft.com/kb/957137/ ) The reseed process is unsuccessful on the CCR passive node after you restore one full backup and two or more differential backups to the CCR active node in Exchange Server 2007 Service Pack 1

959559 (http://support.microsoft.com/kb/959559/ ) Transaction log files grow unexpectedly in an Exchange Server 2007 Service Pack 1 mailbox server on a computer that is running Windows Server 2008

961124 (http://support.microsoft.com/kb/961124/ ) Some messages are stuck in the Outbox folder or the Drafts folder on a computer that is running Exchange Server 2007 Service Pack 1

968205 (http://support.microsoft.com/kb/968205/ ) The Microsoft Exchange Information Store service crashes every time that a specific database is mounted on a computer that is running Exchange Server 2007 Service Pack 1

968621 (http://support.microsoft.com/kb/968621/ ) The Microsoft Exchange Information Store service crashes when you use a Data Protection Manager (DPM) 2007 server to perform a snapshot backup for an Exchange Server 2007 Service Pack 1 server

970086 (http://support.microsoft.com/kb/970086/ ) Exchange Server 2007 Service Pack 1 crashes when the Extensible Storage Engine (ESE) version store is out of memory on a computer that is running Windows Server 2008

Update for Forefront Security for Exchange 2007

2009-07-15T17:01:00.002+02:00

If you haven’t noticed yet, you can now download “Microsoft Forefront Security for Exchange Server with Service Pack 2”

You can download an evaluation version here http://technet.microsoft.com/en-us/forefront/serversecurity/bb738109.aspx

You should read the release notes as there is information about the installation or upgrade if you already have an earlier version installed.
Release notes is here http://technet.microsoft.com/en-us/library/dd775214.aspx

Named properties bloat part 2

2009-06-18T15:29:00.005+02:00

A while back I wrote about named properties and how they could make your databases run out of rows i a table and crash. http://anewmessagehasarrived.blogspot.com/2008/10/named-properties-bloat.html

Rollup 8 for Exchange 2007 service pack 1 changes the behavior a bit and does not propagate x-headers for unauthenticated mail and the upcoming service pack 2 will not even propagate x-headers for authenticated mail. The same goes for Exchange 2010. http://msexchangeteam.com/archive/2009/06/11/451596.aspx

I personally would like an on/off switch for this behavior in order for people to configure this as they please. As stated on the msexchangeteam blog, there could be applications that rely on these properties.

Thinking about Exchange 2010? Understand the Prerequisites

2009-06-11T07:02:00.004+02:00

Even though Exchange 2010 is not a finished product yet, it seems kind of strange discussing a transition to it at this stage, but there are some things that you should know if you are planning on upgrading your current Exchange environment to Exchange 2010 in the future.

Active Directory Prerequisites:

First there are requirements on Active Directory. All Domain Controllers must be running at least Windows Server 2003 SP2 in sites where you want to deploy Exchange 2010 servers. In addition, your Forest must be at a Windows 2003 functional level.

You can have Domain Controllers running Windows Server 2008 and even RODC, but Exchange will not use them. Domain Controllers should preferably run 64 bit version of Windows to run smoother and better handle the load from Exchange and other clients.

Exchange Prerequisites:

Your current messaging infrastructure cannot have any earlier release then Exchange 2003. If you do, you must first upgrade/transition to at least Exchange 2003.Exchange 2003 must be least Service Pack 2 and Exchange 2007 servers must also be running Service Pack 2 for Exchange.

So you can meet all the prerequisites by upgrading your Exchange servers to 2003 Service Pack 2 and then upgrading all your Global Catalog servers to Windows Server 2003 Service Pack 2.

Other notable items:

Exchange 2010 only runs on a 64 bit architecture. In fact, unlike Exchange 2007, there is not even a 32 bit demo or lab version.

In addition, Exchange 2010 will only work on Windows Server 2008 or Windows Server 2008 R2.

You must also apply schema updates to the Active Directory.

How to make the transition:

The transition begins with building the Exchange 2010 environment in parallel with your current Exchange environment, starting with your sites that are facing Internet. The reason for starting at the internet facing site is that you must start by, not replacing, but standing up a new CAS server, similar to what you did when introducing Exchange 2007. The big difference here is that Exchange 2007 CAS servers can proxy requests going to Exchange 2000 and 2003 backend servers but Exchange 2010 CAS servers cannot and will only send a redirect back to the client to the old Exchange 2003 Front End or Exchange 2007 CAS depending on where the mailbox is located. This means that you cannot replace your current Front End or CAS server, you must live with both the old and new system together as long as you have mailboxes located on old servers. Another thing you must do is to copy your current certificate to your new Exchange 2010 CAS server and get a new one and place it on the old Front End or CAS server. You will then have, for example, a certificate with the name of “mail.domain.com” on Exchange 2010 CAS and “legacy.domain.com” on the old Front End or CAS server.

When users connects to Exchange 2010 CAS and have authenticated, Exchange will know where the mailbox is located and if it is on the legacy Exchange it will send a redirect to the client to connect to the legacy URL that you configure. If the mailbox is located on Exchange 2010 everything is good and no redirection take place.

To make your life simpler, you should consider consolidating your namespace to only one name otherwise the transition will be more troublesome with more URL and certificates to deploy. Another important consideration to keep in mind is that you will need an extra Internet IP addresses during the transition.

Unified Messaging servers behave the same as CAS servers do, they do a redirect to the old UM server. So make sure that you send the initial SIP communication to Exchange 2010 UM server, and it will redirect if needed. This is true if you don’t have OCS connected to UM, in this case you need to create a new dial plan and assign it to the Exchange 2010 UM server.

An Exchange 2010 HUB server will not talk to an Exchange 2007 mailbox server but will be able to send mail to Exchange 2007 HUB that in turn can communicate with the old mailbox server. To make this work you also need extra HUB server, since the old ones must be around as long as you have legacy mailboxes.

Your existing mailbox servers obviously will have to remain in parallel, since both sets of servers have to be running, to move mailboxes in between them. Legacy mailbox servers can be uninstalled when they don’t have any mailboxes located on them. One of the cool new features in Exchange 2010 is the Online Move Mailbox. This allows administrators to move a mailbox without the user being disconnected during the process until the last minute when all mail have been replicated and Active Directory replication takes place. Online Move Mailbox is possible between Exchange 2010 server and from Exchange 2007 to 2010.

The only server you can replace is the Edge role and this can happen anytime during the transition, as long as you subscribe it to an Exchange 2010 HUB server.Be aware that all of these steps don’t work in the current public beta, but they will work when Exchange 2010 goes RTM sometime later this year. Also please remember as tempting as it might be, you should not put in the current beta in your production environment.

Start index Office 2007 files in Exchange 2007

2009-05-30T13:25:00.004+02:00

Do you want your Exchange server content index to understand Office 2007 file format?

Default installation of Exchange 2007 don't understand how to index office 2007 file format such as .docx files.

This can be discovered by doing a search from outlook in online mode or from OWA for words that you know is in the .docs file. If the search don’t find anything you must enable Exchange to understand office 2007 file format.

This is not difficult. start by download and install the Office 2007 filterpack. Installation is safe and do not stop any services or trigger a reboot.
After installation you must register the new iFilters in order for the Exchange content index engine to use them. This is done by editing the registry so be careful, How to register Filter Pack IFilters with Exchange Server 2007

When you have followed the article and imported the .reg file and restarted services you can try to send a e-mail with a .docx file attached and then search for some words that you know is in the word file. If everything is OK your search should find your word file.

But if your server already contain office 2007 files?
Then you can rebuild your search index on Exchange. This is easy to do. Stop some services, delete the index files and then start services again. To make this easier there is a powershell script that does exactly that. The default location is in the “C:\Program Files\Microsoft\Exchange Server\Scripts” folder and ahs the name “ResetSearchIndex.ps1”

Script takes several parameters, but if you want to rebuild index for every database you can run “.\ResetSearchIndex.ps1 -force –all”.

A word of caution when you rebuild your indexes. This will cause your server to run as fast as it’s resources allow it to and this will for sure make the disks spin like crazy and CPU utilization go up a lot. This will make your user experience bad. So the suggestion is to rebuild the indexes outside business hours.

happy searching !

Exchange Server 2003 support shift

2009-05-20T15:01:00.002+02:00

For you that still use Exchange 2003, Heads up!!

Exchange 2003 is now moved from Mainstream to Extended support on April 14, 2009.
http://support.microsoft.com/lifecycle/Default.aspx?p1=1773

What does this mean? Exchange 2003 is still supported for another 5 years.
Difference between Mainstream and Extended support can be found here http://support.microsoft.com/gp/lifepolicy

Non-security hotfix support
No-charge incident support
Warranty claims
Design changes and feature requests

As you can see there is not that much difference, but this is clear signal from Microsoft that Exchange 2003 life is coming to an end. This might be good time to start planning the upgrade to Exchange 2007 or Exchange 2010.

One way of still having full support is to purchase Extended Hotfix support.

Important to say is that you still have support when running Exchange 2003 as long as you pay for your incidents.

Why do you backup Exchange databases?

2009-05-19T05:19:00.003+02:00

The biggest challenge with Exchange backups facing administrators today is the time factor. This factor comprises both the time necessary to perform the backup and the time necessary to complete the restore. Users want to have more data in their mailboxes; but in order to adhere to the SLA commitment, quotas must be set on users’ mailboxes. The end result? Users get frustrated from having to constantly manage their mailboxes in order to maintain a pre-set quota limit.

This situation is most noticeable if you use the old traditional streaming backup API that has been in Exchange since the beginning and is still there today. Since there has not been any active development, however, the recommended backup method is to leverage VSS (Windows Volume Shadow Copy Service). http://msexchangeteam.com/archive/2008/08/25/449684.aspx

With streaming backup API, you transfer every bit and byte of Exchange database to the backup software while performing a full backup. VSS operates a little differently. Instead of streaming the database file, it reads changed blocks from disk and then hands it over to the backup software. This procedure saves a lot of time when doing differential or incremental backups. Depending on how you configure the backup software to handle VSS, it can perform tasks such as incremental backups while keeping track of which blocks belong where. From that, an administrator can build up a complete backup in case he or she needs to do a restore. The benefit is that small backups are always done--only the restore is large and takes a long time.

When doing backups with streaming API, it automatically performs a consistency check by reading every byte of the database file. With VSS, however, you must tell the backup software to do the consistency check, otherwise you risk backing up a bad database file.

An option is to allow your backup software to integrate with Exchange and permit the storage to leverage functionality found on the storage to handle copies of LUN’s. In this case, the backup will only take a few seconds as far as the Exchange server sees it. You should still complete the time-consuming task of transferring the files located on the backup LUN to tape or other disk. This solution is dependant upon whether or not your storage is configured with this functionality and whether or not your backup software can do the integration.

No matter what backup method you use, all the backup data must be stored somewhere.

What if there was a way to have all your Exchange data spread out to multiple copies that automatically were kept in sync? With Exchange 2007 CCR together with SCR, you could make this happen. CCR is built upon a Window’s failover cluster, and data is replicated between the two nodes automatically. This produces two copies of Exchange data, and by introducing an SCR you can also introduce a third copy.

What happens if you need more? Simply add additional SCR copies. SCR are techniques that do not replay the copied transaction log files at once; they have a “lag” before doing the replay into the Exchange database. Lag time can be configured so that you can run a CCR with instant replaying of transaction log files to have two copies of Exchange data always updated. Then, you can have one SCR copy lagging behind a couple of hours and additional SCR copies lagging behind a couple of days.

http://msexchangeteam.com/archive/2006/08/09/428642.aspx http://msexchangeteam.com/archive/2007/07/19/446454.aspx

A common scenario is a user who has accidently deleted something from his or her mailbox. This delete instruction has replicated to the two CCR nodes, but the delete instruction may not have been replayed to one of your SCR copies. In this case, you can still recover the deleted mail from your SCR copy by stopping replication and then replaying the transaction log to the SCR database. Finally, mount the database and retrieve the data.

Another cumbersome task is managing the huge amount of data in Exchange. This data causes a lot of IO to the disk subsystem where Exchange has its databases and transaction log files. This is another reason to keep the databases small.

With Exchange 2007 the IO drop by 70% so you can allow the databases to grow without spending a fortune on the storage system. http://msexchangeteam.com/archive/2008/07/10/449188.aspx

So what about the idea that you run Exchange 2007 in a CCR and SCR configuration to be sure that you have multiple copies of Exchange data around? You allow users to have large mailboxes and perhaps you switch your storage solution from an expensive SAN, both money-wise and technology-wise (i.e. specially- trained personnel, fiber channel technology etc.), to a cheaper solution like DAS or iSCSI.

The benefits of this switch would include cheaper storage, meaning that users will no longer have to delete items from their mailboxes and move them into a PST file. With large mailboxes, the need for a restore is minimized and, therefore, also the need for doing backups.

But there still can be a need for doing backup and restore if your databases and disk fails. Should this happen, you have multiple copies of Exchange data already. Plus, it is a very simple process to make the other node of the cluster start acting as your Exchange server with a healthy set of data--this is in most cases done automatically. You can also manually activate the SCR copy with its own set of data.

All this information pertains to Exchange 2007, but Exchange 2010 will solve this problem with its new cluster technique, Database Availability Group or DAG for short. http://technet.microsoft.com/en-us/library/dd633496(EXCHG.140).aspx

So the question is why do you do backup of your Exchange data? Some may say that they need to store a copy of all data offsite. Although this is a good and valid reason, it will also be solved by having the SCR copy located somewhere else. It could even be on the other side of the world!
I am not saying that running without backup will suite everyone, but chances are you will discover that backups are not as necessary as you initially thought.

Upcoming Exchange 2007 SP2

2009-05-12T17:53:00.002+02:00

What’s the deal you may ask, well there is a lot of new cool features in it except from the usual bugfixes.

One most requested feature is the ability to make backup of Exchange with built in tools in windows. With Service Pack 2 you get this with the Exchange Volume snapshot backup snap-in for Windows Server backup.

This is only one feature of many that are added in SP2. Read more at the You had me at EHLO blog site

The Only sad thing is that you have to wait until after the summer to get it.

Windows Server 2008 Service Pack 2 and Windows Vista Service Pack 2

2009-04-28T22:43:00.004+02:00

Service Pack 2 for Windows Server 2008 and Vista is now released.
Take a look here for more information http://technet.microsoft.com/en-us/windows/dd262148.aspx

The good thing is that the Exchange 2010 Beta can be installed on a Windows Server 2008 SP2.

Happy patching

Exchange 2007 books

2009-04-27T16:17:00.006+02:00

For you people out there that is still interested in learning Exchange 2007 or studying for one of the Exchange 2007 exams.
Technical Specialist, http://www.microsoft.com/learning/en/us/exams/70-236.mspx
IT Proffesional, http://www.microsoft.com/learning/en/us/exams/70-237.mspx and http://www.microsoft.com/learning/en/us/exams/70-238.mspx

I recently read two books, “MCITP Self-Paced Training Kit (Exam 70-237): Designing Messaging Solutions with Microsoft Exchange Server 2007” (http://www.microsoft.com/learning/en/us/Books/10937.aspx) and “MCITP Self-Paced Training Kit (Exam 70-238): Deploying Messaging Solutions with Microsoft® Exchange Server 2007” (http://www.microsoft.com/learning/en/us/Books/10938.aspx) that have a lot of information about Exchange 2007.
They are written as a study guide towards the exams, so they begin with instructions how to build your own lab environment followed by lessons and now and then also practices. I like this format since it gives the reader some theoretical knowledge and then they practice on it, this also needed if you want to really learn and pass the exams. I recommend that you take your time and use your lab do the practice tests thorogfully.
Both books have a lot of words and content, and if you really read and give it some thought you will learn a lot, but if you only read it fast from cover to cover you will probably not pick up that much new knowledge.

The overall impression is that those books are well written with an easy language to understand, they also have a lot of content to read through but on the other hand, Exchange is a big product with a lot of features.

Keep on reading.

More Exchange 2010 resources

2009-04-17T07:43:00.004+02:00

This link http://technet.microsoft.com/en-us/evalcenter/dd185494.aspx provides a lot of information about Exchange Server 2010

You will most likely bang your head against your keyboard a couple of times when playing around and try to do things.
Exchage 2010 forums is a good place to get help and provide help to peers http://social.technet.microsoft.com/Forums/en-US/exchange2010/threads

Exchange 14, sorry. Exchange Server 2010

2009-04-15T16:28:00.004+02:00

For you that have been waiting on the next version of Exchange Server, you can stop waiting and instead read and download it from http://www.microsoft.com/exchange/2010.
And yes the name will be Exchange Server 2010.
There is so much new cool and good stuff in there so start reading the help file and follow the link above for more info.

Direct download link is http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=1898ed2c-2f88-48ac-824e-d3d20fad77d7

Exchange monitoring tools

2009-04-05T11:30:00.002+02:00

Ever wanted to know what users doing to your Exchange server? If you're a serious admin you should want to know.
Most common is to use performance monitor to monitor all kinds of statistics and how much pressure there is on your Exchange server. You can for sure see how many users and how much load they generate on your server, this is all good but you cannot see what individual users are doing to your server which is really nice in case you need to troubleshoot for example performance issues.
Luckily there exists tools out there that monitoring MAPI clients in real time (well almost anyway) and the best thing is that they are free of charge.

Microsoft has one tool called "Microsoft Exchange Server User Monitor" or ExMon for short.
It has been around for a couple of years. It can monitor Exchange 2000 and Exchange 2003 and in the latest version even Exchange 2007.
Read more about the tool on Technet http://technet.microsoft.com/en-us/library/bb508855.aspx and the download link is http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9a49c22e-e0c7-4b7c-acef-729d48af7bc9

Unfortunate there seems to be something wrong with the download and you will not get the latest version that works with Exchange 2007, but I can only guess that this little glitch will be corrected shortly.

Recently I came across an almost identical tool "ExInsight for Microsoft Exchange".

You can read more about it and download it from http://www.bitrunes.com/

Both tools has there advanteges so there is no number one, they simply have different featue sets.

AOL and OCS 2007 R2 edge problem

2009-04-03T21:04:00.000+02:00

Some people have problem to get the federation with AOL going when they use OCS 2007 R2. This problem is now resolved. Check out this article on how to configure your x64 windows to make the federation work.
http://blogs.msdn.com/scottos/archive/2009/04/03/resolved-ocs-2007-r2-pic-fails-against-aol.aspx

Rollup 7 for Exchange Server 2007 Service Pack 1 is on its way

2009-03-18T23:05:00.000+01:00

In a few days Microsoft will release Rollup 7 for Exchange 2007 SP1.

See http://support.microsoft.com/kb/960384 for more info about this rollup.

Big outlook patches

2009-02-25T22:43:00.000+01:00

Maybe you have heard about all the great stuff for Outlook that is coming in Office 2007 Service Pack 2.
The good thing that you don't have to wait for the service pack to leverage all the goodies, there is two hotfixes that do great things for your outlook.

First there is the big one
http://support.microsoft.com/Default.aspx?kbid=961752

and the smaller one
http://support.microsoft.com/?kbid=967688

and some info what they contain for goodies
http://support.microsoft.com/?kbid=968009

Read those KB's and you will not want to live without these fixes.

You really need these patches, they contain so much good things that you simply cannot do without them. Number 1 is the big improvement for big OST and PST files. The performance gain is really outstanding if you have a couple of GB in your files.
Number 2 is the changed behavior when outlook closes that gives you fewer corrupt files and faster shutdown of outlook.
Number 3 is all the good calendar bugfixes.

Search for patches

2009-02-19T22:12:00.001+01:00

Have you ever wanted to easy see all patches for Exchange?
Well there is a really good way of finding out what patches exists.

Fire up your browser and enter this URL http://catalog.update.microsoft.com/v7/site/Search.aspx?q=Exchange+Server+2007
This searches for Exchange Server 2007 updates.

Here is the URL for Exchange Server 2003
http://catalog.update.microsoft.com/v7/site/Search.aspx?q=Exchange+Server+2003

and for OCS 2007
http://catalog.update.microsoft.com/v7/site/Search.aspx?q=Office+Communications+Server+2007

A good thing with this tool is that you can select multiple patches and then download them all at the same time, saved in a nice folder tree structure.

Update Rollup 6 for Exchange Server 2007 SP1 to be released in a few days.

2009-02-07T10:38:00.001+01:00

In a fewe days the Rollup 6 for Exchange 2007 Service Pack 1 will be released. It contains security fixes that is classified as severity, so keep your eyes open for it and start patching your Exchange servers when it arrives.

Live Meeting Recording Converter

2009-01-30T15:50:00.000+01:00

Live Meeting client has a really nice feature that allow the meeting to be recorded for viewing later either by people that could not attend or by people that want to review the meeting again.

The most common request I hear is that people want to save the recording in a more available format for easier offline viewing or distribution. Well, Microsoft listened and created a tool that converts the LM recording to a WMV file.

Simply download and install it.
http://office.microsoft.com/en-us/help/HA101215971033.aspx

When you have used the normal LM Recording Manager and processed the recording start the LM Recording Converter tool and start a conversion from LM to VMW

The tool is not perfect but it does its job fairly well and should be suitable for most people.

Office Communicator cannot download address book

2009-01-17T11:41:00.000+01:00

Recently I got contacted to help out with an OCS and Communicator problem.Scenario is: a simple deployment with two standard OCS servers, one Front End and one Edge.The problem was that some of the clients could not download the address book from OCS when they connected from Internet.

After some investigation I found that they used a certificate created by the internal CA, not exactly best practice but it should work.
Network monitor reveals that communicator will not even try to download the address book, it only contacts the URL and then says goodbye real quick. Well, I finally figured it out.
Certificate contains ‘Certificate Revocation List Distribution Points’ with a URL that is only reachable from the internal network. When communicator cannot reach the CRL distribution point stated in the certificate it will not go further and simply don’t download the address book.

What probably could have been done here is to make the CRL available to internet and change the path in the certificate (that means creating a new certificate). Not so simply in practice.

A simpler way is to change the client behavior not to bother with the CRL. It is not the recommended way, but it will do the job.
Change the setting in Internet Explorer advanced settings; uncheck the “Check for server certificate revocation” checkbox and you should be fine.

The best solution to this is to use a certificate from a commercial certificate authority that is trusted by most computers. With a public trusted certificate, federation and PIC/PIM can be used if there is a need.

The good side is that customer got the address book download working and they will change there own certificate for publically trusted one with reachable CRL paths and also enable federation with some of there partners.

OWA authentication and its affect on OWA functionality

2009-01-04T19:47:00.000+01:00

You’re probably aware of that you can configure different authentication methods for OWA (Outlook Web Access). But different authentication mechanisms for OWA alter some behavior in OWA.
When you install an Exchange 2007 CAS, OWA is configured with form based authentication (FBA). This gives the end user a HTML form to fill in with username, password and also some configuration on OWA’s behavior.

The checkbox “Use Outlook Web Access Light” gives a light version of OWA with no activeX controls or other IE only features. This is of course a less feature rich version of OWA than if you use IE. Advantage is that is consumes less bytes on the wire and is therefore suitable if you are on a low bandwidth connection. OWA light is also default selected if you use a non IE and cannot be changed.

Now to the interesting part: selection between Public and private computer.
Clicking on the show explanation link doesn’t give any good clues.

This is a public or shared computer. Select this option if you use Outlook Web Access on a public computer. Be sure to log off when you have finished using Outlook Web Access and close all windows to end your session.

This is a private computer. Select this option if you are the only person who uses this computer. Your server will allow a longer period of inactivity before logging you off.

OWA with forms based authentication saves information in a cookie on the client computer. One thing that is stored in the cookie is the idle time before the user is automatically logged off. By selecting Public computer gives the user an idle period of 15 minutes before the cookie expires and the user is logged off. The timeout period for Private computer is 8 hours. CAS is using several encryption keys and cycle them every half of the time out interval so the actual timeout is between 15 to 22.5 minutes and 8 to 12 hours for private computers.

Timeout values can be changed and is configured with registry values in the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OWA

Value names are “PublicTimeout” and “PrivateTimeout”, both are DWORD and numbers are in minutes.

some usefull links on the subject.
http://technet.microsoft.com/en-us/library/bb123719.aspx
http://technet.microsoft.com/en-us/library/bb124787.aspx
http://technet.microsoft.com/en-us/library/bb124819.aspx

Other behavior that is dependent on the Public/Private computer selection is “File and Data Access”.
With “File and Data access” the administrator can configure what servers and file types are accessible and how users interact with files by using Allow, Block, or Force save options.This gives the administrator a very good control on how files are accessed through OWA. The good part is that all configurations regarding file access in OWA is separate for public and private computer.
This gives the administrator the ability to have different OWA behavior dependent on what user select during OWA logon. for example a user logon with public computer and tries to download a document from a file server, this is blocked by OWA, but if user logon with a private computer option selected the file is successfully downloaded to the client.

Options that can be configured are: access to windows file shares, access to sharepoint document libraries, webready document viewing, direct file access.
You can also set what file types are allowed and what types are not. Very handy and extremely useful, the only hard part is to make users select the correct option, but I guess that is up to information and education.
http://technet.microsoft.com/en-us/library/bb124731.aspx

But what if you don’t want to use Forms Based Authentication?
There are three other standard authentication mechanisms to choose from: Basic, Windows and Digest authentication.
(Configuring Standard Authentication Methods for Outlook Web Access http://technet.microsoft.com/en-us/library/bb125207.aspx)

With Basic authentication you will always get prompted for username and password.

Once logged on, OWA treats this session as private computer regarding to attachment and data file access, but it will not use a cookie on the client to timeout the session and credentials will be cached by the browser until it’s closed or user click on the Log Off link. With the browser caching users credentials a user can use OWA and then point there browser towards another website and then hit back again and enter OWA without typing in any credentials, so it’s important to educate users about closing the browser or hit the Log Off link to secure access to there’s mailbox.

With Digest Authentication you get almost the same behavior as with basic authentication, except that OWA doesn’t know your credentials and cannot authenticate when you try to open a fileshare or a sharepoint document library. There is an exception when this work anyway and that is if you install CAS and Mailbox role on the same server.

With windows integrated authentication you get the same behavior as with Digest authentication except that if your browser is configured to use windows integrated for your CAS server website you will get automatically logged on with the same user as you’re logged on to windows with. This gives user a seamless access to OWA with typing in credentials. Windows Integrated uses the most secure authentication scheme but hopefully you’re forcing use of SSL on CAS website so this should be no problem to use other authentication than windows integrated.

So be careful when you set your authentication scheme on your CAS, more things change than you first might realize.

If you also have an ISA in front of your CAS, the possibilities and complexity raises, but that’s another story I save for later.

DPM SP1 is released

2008-12-20T10:56:00.000+01:00

DAta Protection Manaer SP1 is relased. Some of the new feauteras are protection of Hyper-V, Exchange SCR machines, local data backup of files, servers in other forests.
Read the "Description of System Center Data Protection Manager 2007 Service Pack 1" at http://support.microsoft.com/default.aspx/kb/959605 for complete feature list, download and installation instruction

Update Rollup 5 for Exchange Server 2007 Service Pack 1 (KB953467)

2008-11-21T08:43:00.000+01:00

Rollup 5 for Exhange Server 2007 SP1 is released.

Information about Rollup http://support.microsoft.com/?kbid=953467
Download link http://www.microsoft.com/downloads/details.aspx?FamilyId=652ED33A-11A1-459C-8FFE-90B9CBFE7903&displaylang=en

This rollup solve the problem with managed code services that may not start.
http://support.microsoft.com/kb/944752/

Named properties bloat

2008-10-28T19:41:00.000+01:00

Every mail item has some MAPI properties on them perhaps some non MAPI properties. Each of these properties get’s an ID and is store in the Named properties cache table. This table is located in each Exchange database and consist of three categories, nonMAPI properties, MAPI properties and Replication ID’s
Named property cache has a limit of 32766 ID’s. You can monitor how much of the table that is used with performance counter but you must first enable additional Information Store logging. http://support.microsoft.com/?kbid=254606 Article is for older version of Exchange, but it still apply for Exchange 2007

Change the Library string located in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\Performance
Change the string value from c:\exchsrvr\bin\mdbperf.dll to C:\Program Files\Microsoft\Exchange Server\bin\mdbperfX.dll (or to wherever your mdbperfx.dll is located)
After you modify this registry value, you must restart Performance Monitor to see the new counters. The new counters are located under the MSExchangeIS Mailbox and MSExchange Public object. Counters that you should monitor is:
Rows in NamedProps Table
Rows in ReplidMap Table
Rows in NamedProps Table
Rows in ReplidMap Table

How does the named properties table get populated?
Remember that this table is per database, this means that when a message is stored in a database, property ID’s from the message is stored in named properties table and if those ID doesn’t exist they will be added. So over time this table grows. Message can be from outlook, a public folder replication message or a message received by SMTP.

Properties on messages within Exchange are transferred with help of the XEXCH50 blob or with help of X- headers. X- Header in SMTP messages is not mandatory and is user defined. This means that if some application wants to add functionality to SMTP they can add their own commands with help of the X- header. For more info about X- header see RFC822 and Extension-Field and User-Defined-Field. http://tools.ietf.org/html/rfc822
X- headers cannot only be for additional SMTP verbs but also for transferring information so when Exchange receives a mail with some x- header in it, Exchange will translate this x-header to a named property.
Exchange writes info to application log when there is something added to namedprop table.
Here you see the ‘x-myownheader’ getting added.

EventID: 9873
Source: MSExchangeIS
A named property has been created for the database "/o=Home/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=MB2/cn=Microsoft Private MDB".
ID: 0x8519
Named property GUID: 00020386-0000-0000-c000-000000000046
Named property name/ID: x-myownheader
The following user is attempting to create the named property: "N/A"
Protocol: MAPI
Client type: Transport
Client version: 2049.0.33059.1

This is all good, but there is one problem, you can run out of space in the named properties table and when this happens you’re in deep problem since it will cause mail flow issues.
Here is some more info about named properties http://technet.microsoft.com/en-us/library/bb851495(EXCHG.80).aspx there is also a resolution at the end of the article.
The short version is to move all mailboxes to another database, delete the original database files and move mailboxes back to its original database, nothing you want to do more than necessary.
Here is more info about this problem http://technet.microsoft.com/en-us/library/bb851492(EXCHG.80).aspx

When this table start to get near the quota limit you get warnings in the application eventlog like this.

The number of named properties created for database "SG02\Store02" is close to quota limit.
Current number of named properties: 8172
Quota limit for named properties: 8192
User attempting to create the named property: "MB2$"
Named property GUID: 00020386-0000-0000-c000-000000000046
Named property name/id: "x-myownheader"

There is some tweaking you can do regarding to the cache, but it will probably not help you in the long run since there is a hardcoded upper limit on 32766 ID’s in the table. http://technet.microsoft.com/en-us/library/bb851493(EXCHG.80).aspx

How to stop the named prop table population?
Well you cannot stop the population but you can stop unwanted x- headers to reach Information Store and that will stop most of the population. Most of these x- headers come with mail received from Internet. If you have a gateway that can strip out the x-headers from mail you’re lucky. If you don’t have this functionality in your gateway you can install the HeaderFilterAgent on your Exchange 2007 Edge or Hub server. Download and installation instruction is at http://www.codeplex.com/HeaderFilterAgent

This beautiful small piece of code strips all x- headers from anonymous received mail except from a white list that you can create. By only handle anonymous mail; you will allow mail between Exchange servers flow untouched.
This agent is something that help protect your databases from getting the named properties table full and you into trouble.

But what if you don’t have Exchange 2007?
With Exchange 2003 or Exchange 2000 you should be able to write a SMTP transport sink that does the same thing even though it’s much harder than writing managed code for Exchange 2007.
There is also KB 941060 http://support.microsoft.com/kb/941060 that doesn’t say it handles namedproperties cache but it contains some other handling that decrease the problem a bit.
of course you can also put an Exchange 2007 Edge or Hub server role in front of your Exchange 2000/2003 servers and run HeaderFilterAgent on Exchange 2007

Information about OCS 2007 R2

2008-10-14T23:18:00.000+02:00

Finally Microsoft reveal information about next version of Office Communication Server, OCS 2007 R2 or simply OCS R2 as its sometimes called.
http://www.microsoft.com/presspass/press/2008/oct08/10-14OCSR2PR.mspx and
http://nomorephones.spaces.live.com/

Among the things I like most is SIP trunking, Persistant group chat and Attendant console

There is also info at Office Communication website http://www.microsoft.com/communicationsserver/en/us/default.aspx

Update Rollup 4 for Exchange Server 2007 SP1 (KB 952580)

2008-10-08T08:36:00.001+02:00

Rollup 4 for Exhange Server 2007 SP1 is released.
http://www.microsoft.com/downloads/details.aspx?FamilyId=8B492ED2-EA92-412F-A852-3AA1C58D9499&displaylang=en
This update is marked V2 for it to overwrite the accidental prerelase of RU4 one month ago.

This is must since it contains a lot on bugfixes. http://support.microsoft.com/?kbid=952580

Reawarded again

2008-10-01T20:24:00.000+02:00

Got a mail this afternoon from Microsoft.

Dear Lasse Pettersson,

Congratulations! We are pleased to .........bla bla bla ..... MVP award.

So this means that I am rewarded again for another year with MVP status.

Powershell scripts at SEForum

2008-09-21T22:43:00.000+02:00

Recently I spoke at Sharepoint and Exchange forum http://www.seforum.se/ One of the session was about powershell scripts.

The two most valuable scripts are Get-ExchangeStoreageInfo.ps1 and Create-User.ps1
Get-ExchangeStorageInfo gather information about your Exchange databases, storagegroups, file and diskutilization. pretty handy to run now and then to monitor your Exchange storage.

The other script Create-User, creates windows accounts with homefolder, mailbox, joining the account to group, setting permission on folders etc. The script itself is not that fancy and could be more straightforward and smarter. Its intention was to show various techniques that can be used from powershell. One popular thing is to show a windowsform for userinput instead of questions in the script itself.

To make this script work there is a bunch of prerequisite, OU structure, variables, fileshare etc. so you will not be able do download it and just make it work, you have to put in some effort yourself.

The script can be downloaded from http://www.seforum.se/Pages/20088115544100.aspx

The Autodiscover song

2008-08-17T11:13:00.000+02:00

If you like Exchange 2007 Autodiscover functionality which you should, you might enjoy the Autodiscover song http://blog.seattlepi.nwsource.com/microsoft/archives/145822.asp

Info about Autodiscover http://technet.microsoft.com/en-us/library/bb124251.aspx and the White paper http://technet.microsoft.com/en-us/library/bb332063.aspx

Exchange Server Remote Connectivity Analyzer

2008-08-14T22:11:00.000+02:00

Have you ever needed to do some testing of your Exchange server from Internet?
Well here is a site that can do some pretty valuable tests of your server.

Exchange Server Remote Connectivity Analyzer https://www.testexchangeconnectivity.com/

Be carefull with the account and password that you submit, they should only be test account and should be deleted afterwards for best security.

Grant permission to change permission on mailboxes

2008-07-25T13:49:00.000+02:00

To change mailbox permission on an Exchange 2003 mailboxes you must have the Exchange Full Administrator right. In many organizations there is just a few people that have this right, but the need to change mailbox permission is quite big, often the need is to give Full mailbox access to a user on a mailbox that is unmonitored.

And there we have a conflict, do we trust helpdesk or a novice Exchange administrator to have the Full Exchange Administrator permission? probably not. So what can be done?

Luckily there is a way to grant the permission to change permission on mailboxes without being the big Exchange administrator, sort of.

Use Exchange Management Console, drill down to a mailbox database, right click and click properties and select the security tab, add the helpdesk group and select Allow only Change Permission and Administer Information Store.
Change Permission will inherit down to mailboxes. The helpdesk group must also have Active Directory permission to manage user account. This is done with normal AD delegation.
Unfortunately helpdesk group must also have Administer Information Store permission to get what we want. With this right they can also dismount and mount that database.

Two links that help you understand things better.
http://support.microsoft.com/kb/329236
http://technet.microsoft.com/en-us/library/bb124053.aspx

This is not the ideal solution, but if there is a need for setting mailbox permission without being Full Exchange Administrator, this solution can help.

Automatic installation of Rollups with Exchange 2007

2008-07-17T22:19:00.000+02:00

Have you ever gotten tired of applying Service Packs or hotfixes after you installed Exchange? With Exchange 2007 you can do this automatically.
Copy complete Exchange DVD to a folder and then copy the rollup fix to the updates folder. Finished result looks like this.

2008-05-02 19:26 DIR scripts
2008-05-02 19:26 DIR Setup
2008-05-02 19:30 DIR Updates
2007-11-27 09:29 21244928 exchangeserver.msi
2007-11-27 09:29 63 autorun.inf
2007-11-27 09:29 361472 setup.com
2007-11-27 09:29 9228 relnotes.htm
2007-11-27 09:29 519296 setup.exe

In the updates folder you have readme.txt plus the rollup patch file.

2008-07-16 18:14 35991040 Exchange2007-KB949870-x64-EN.msp
2007-11-27 09:30 60 readme.txt

so when you run setup and install Exchange, the setup process will automatically apply the patch in the updates folder.
Pretty slick if you ask me

Exchange 2003 and 2007 security patch

2008-07-08T21:24:00.000+02:00

Vulnerabilities in Outlook Web Access for Exchange Server Could Allow Elevation of Privilege (953747) http://www.microsoft.com/technet/security/bulletin/MS08-039.mspx and http://support.microsoft.com/kb/953747

Update Rollup 7 for Exchange 2007 RTM

2008-07-08T21:12:00.000+02:00

For you people that have not installed Exchange 2007 SP1 yet, here is rollup 7 http://www.microsoft.com/downloads/details.aspx?FamilyId=086A2A13-A1DE-4B1D-BD12-B148BFD2DAFA&displaylang=en

It contains the same security enhancment as Rollup 3 for SP1 does http://www.microsoft.com/technet/security/bulletin/MS08-039.mspx

and the KB http://support.microsoft.com/?kbid=953469

Update Rollup 3 for Exchange Server 2007 SP1 (KB 949870)

2008-07-08T21:06:00.000+02:00

Rollup 3 for Exchange 2007 SP1 is live at http://www.microsoft.com/downloads/details.aspx?FamilyId=63E7F26C-92A8-4264-882D-F96B348C96AB&displaylang=en

This update is deffinitvly for everyone since it also contains security enhancment http://www.microsoft.com/technet/security/bulletin/MS08-039.mspx

Description is here http://support.microsoft.com/?kbid=949870

ISA server 2006 SP1 is released

2008-07-03T18:20:00.000+02:00

Finally ISA 2006 SP1 is released to public. It contains many new features such as Diagnistic log viewing, Traffic Simulator, better NLB support, better Kerberos Constrained Delegation support, support for client cert authentication without domain join, Configure Change Tracking log, support for SAN certificates which is a big thing for Exchange 2007 and OCS 2007 servers.
Read these articles before installing http://support.microsoft.com/kb/885957
Here is the update http://www.microsoft.com/downloads/details.aspx?FamilyID=d2feca6d-81d7-430a-9b2d-b070a5f6ae50&DisplayLang=en

Hyper-V is released

2008-06-26T19:24:00.000+02:00

Finally Hyper-V is relased. Download from http://www.microsoft.com/hyper-v.
It should also be available on Microsoft Update on July 8, 2008
More and good info is at http://blogs.technet.com/virtualization/archive/2008/06/26/wu-hoo-only-12-days-to-wu.aspx

Keep an eye open for more info about Exchange and Hyper-V within 60 days from now.

Exchange Web Services Windows Vista Gadget Sample Application

2008-06-21T12:15:00.000+02:00

If you’re in to vista sidebar gadgets or want to know how to use Exchange 2007 Web services, this one is for you.

It’s a vista gadget that retrieves Inbox, Calendar, and Task information from a user's Microsoft Exchange Server 2007 mailbox.
Link for download is here http://www.microsoft.com/downloads/details.aspx?FamilyID=f9a0d33c-c894-4ea1-ad20-4e418c715175&DisplayLang=en

Default installation directory is “C:\Program Files\Microsoft\ExDevCenterDownloads\EWSVistaGadgetSample” and there you will find a document with lots of info about this gadget
Also see “C:\Users\username\AppData\Local\Microsoft\Windows Sidebar\Gadgets\ExchangeWebServices.gadget” directory for the gadget HTML files

Testexchangeconnectivity website open

2008-06-13T04:43:00.000+02:00

Microsoft has built a site for testing some Exchange 2007 functionality.
https://testexchangeconnectivity.com/
Be sure that you use a test account when entering credentials then sit back and enjoy the show.

Backup of Exchange 2007 on Windows 2008

2008-06-11T23:34:00.000+02:00

With Windows 2008 there is no more NTBackup that you can use to backup Exchange 2007 server, and the windows team did not put in support for Exchange streaming backup in the new Windows 2008 backup software.

There is unsupported workarounds with copying DLL’s and use the old NTBackup, but that’s not the recommended way of doing it.

Thankfully Microsoft listened and acted on peoples requests and they will create an addon or whatever its going to be called to the Windows 2008 backup software that can be used for Exchange backups. It will also use the modern way of doing backup with help of the VSS framework.

The sad story is that it’s not downloadable at this moment, but the word is that it will be this summer.

IPV6 on Windows 2008 together with Exchange 2007 SP1

2008-06-11T23:23:00.000+02:00

Exchange 2007 SP1 has support for IPV6 under certain circumstances. http://technet.microsoft.com/en-us/library/bb629624.aspx
Since most people don’t use IPV6 on there’s network I suggest that you disabled it (it cannot be uninstalled). This is done in 3 steps.
· Uncheck the IPV6 checkbox on your NIC settings.
· Edit the hosts file and disable the line “::1 localhost”, that is put a # sign at the front.
· And the last thing is to do is edit a registry value. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents and put in a DWORD with value of 0xffffffff
This will turn off IPV6 for everything except the loopback traffic and Exchange does not have an issue with that. For more ref. see http://support.microsoft.com/kb/929852
You have to reboot your server after editing this registry value.

Doing all this will also resolve some other issues, the most famous one is the problem with RPCProxy component only listening on IPV4 and make Outlook Anywhere work again.

Remove proxyaddresses powershell script

2008-06-07T16:16:00.000+02:00

A friend of mine approached me with a question about email addresses on his Exchange servers the other day. He wanted to remove some old SMTP addresses not used anymore and of course not doing this the manual way by clicking each recipient and remove the address, some sort of script was needed.
He is using Exchange 2007 so I figured a PowerShell script would do it. This is the PowerShell script I created. It can certainly be made more flexible and efficient, but this one still functions well.create a file “remove_proxyaddess.ps1” and edit line 6 and 13 to suit you environment

# Remove proxy addresses
# change the Get-Mailbox statement in line 6 to select only a subset of mailboxes
# change -like paratameter in line 13 to the domain you want to remove

#get mailboxes and iterate through
Get-Mailbox foreach {
# .emailaddresses returns array
# loop each email address
for ($i=0;$i -lt $_.EmailAddresses.Count; $i++)
{
$address = $_.EmailAddresses[$i]
# removes all addresses with test.com domain
if ($address.SmtpAddress -like "*@test.domain" )
{
Write-host("Remove smtp adress: " + $address.AddressString.ToString() )
# remove address in the array
$_.EmailAddresses.RemoveAt($i)
}
}
# save changes
$_ set-mailbox
}

Run script from Exchange Management console. Script will output info to the console so adjusting screen buffer size to a large value is a good thing so you can scroll through output and see what happened when running script.

Update Rollup 2 for Exchange Server 2007 Service Pack 1 (KB948016)

2008-05-08T21:30:00.000+02:00

Download information for Update Rollup 2 for Exchange 2007 SP1 here. http://www.microsoft.com/downloads/details.aspx?FamilyId=99DA32E0-D9E3-4156-AABF-8369BF96E3E7&displaylang=en
It will also be available on Microsoft Update

Diskpart and Windows 2008

2008-05-04T20:32:00.001+02:00

Microsoft claimes that there is no need to use diskpart on a Windows 2008 server with Exchange 2007 SP1. If you have build some larger servers with Exchange in the past this sounds wonderful to skip the diskpart stuff, but if you think about it for a while what exactly has Exchange to do with storage track boundaries. Exchange doesn’t know about this, it simply uses the partition presented by the OS. In my opinion this is simply a Windows 2008 server thing.

Why is Windows 2008 better than previous version of Windows?
When creating partitions with the built in Disk Management tool it created a partition that isn’t always aligned with the underlying disk layout , so sometimes when writing or reading from disk windows was forced to do two read or writes instead of one and that is of course bad for performance.
What Windows 2008 does when creating a partition is to move the starting point forward in the same way you manually did when using diskpart.exe so there should be no misalignment between the physical storage system and the logical partition layout. The storage layout has changed during the years from 32KB chunks to 64 and sometimes 256KB, Windows 2008 set the offset to 1MB to be safe in the future. Do anybody remember ‘no one should ever need more than 640KB memory’.

And yes, every application running on Windows 2008 will benefit from this, not only Exchange.

In case you’re interested in how to how to Align Exchange I/O with Storage Track Boundaries with diskpart.exe, here it is http://technet.microsoft.com/en-us/library/aa998219(EXCHG.80).aspx.
This is a must read if you don’t use Windows 2008

Outlook Safelist aggregation

2008-04-20T08:10:00.000+02:00

You use Exchange 2007 Content Filtering Agent for spam fighting, there is sometimes occasions when it classifies mail as spam even though it’s not. Content Filtering Agent is using a whitelist that is managed from outlook or OWA. This whitelist is by default not propagated to to your Edge servers or hub server if you have installed antispam agents on it. There is two steps to make this happen, first users must enter addresses into the safelist next step is for the administrator to aggregate this information and save it into AD user object.

This list can be edited in outlook by clicking ToolsOptionsJunk E-mail buttonSafe Senders tab. There is also an option here and there in outlook that says “Add Sender to Safe Senders List”. The list itself is stored inside each user mailbox located on the Exchange mailbox server.

Ok, so how can you get Exchange 2007 Edge server or if you have Exchange HUB/Transport server with antispam agents installed to read this info?

It will not happen automatically, the administrator must make this happen. The easiest way is to run Update- Safelist cmdlet on a scheduled basis. What this command does is reading the safelist inside users mailboxes and writes this info to users AD account. Email addresses are hashed before saved into msExchSafeSendersHash attribute so information cannot be read and used in a bad way.

If you’re using Exchange 2007 Edge server, the edge-sync process will synchronize this attribute from Active Directory to ADAM that Edge server leverage each time edge-sync is run.

The complete process is.
· User adds addresses to there’s safelist with help of outlook
· Administrator run the Update-Safelist cmdlet (this should be set up with a scheduled task)
· If you don’t have Edge servers and have antispam agents installed on your HUB/Transport server, you’re done, Content Filtering agent on Edge server have to wait for this info until edge-sync runs.

End users should not expect that there safelist will work at once because the Update-Safelist must be run and also the edge-sync process.

example
· mail from someone@microsoft.com is sent to user1
· user1 has no info in the safelist
· mail gets a high SCL value and is either blocked or rerouted to Junk E-mail folder

But if the user1 has someone@microsoft.com in the safelist and the administrator has run outlook-safelist command, content filter agent will set a SCL value of -1 to the mail and it’s therefore not blocked by content filter agent.

But if someone@microsoft.com is sent the same mail to user2 it will get the high SCL value and either be blocked or rerouted to Junk E-mail folder. You see the safelist is personal to each user.

You can see what mail and why Content Filter agent is blocking mail in the agent log file, default located in C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\AgentLog

There is also a performance counter that is good to look at when dealing with Safe-Senders. Performance Object is “MSExchange Content Filter Agent” and the counter is “Bypassed recipients due to per-recipient Safe-Senders”. This number will tell you how many mail that have bypassed content filter agent because users have added mail addresses to there’s safelist.

How to schedule the safelist aggregation.

Create a powershell script file ex. “C:\Batch\safelist-aggregation.ps1”
You only need one line of code in that file.
Get-Mailbox where {$_.RecipientType -eq ‘UserMailbox’ } Update-Safelist -Type Both
This will update the safelist from all user mailboxes.
There may be need for filter the Get-Mailbox cmdlet in so you not get all mailboxes in the search but only those located on a specific server or databases.
“Get-Mailbox –Server …”
“Get-Mailbox –Database …”

Create a scheduled task to run the powershell script.
C:\WINDOWS\SYSTEM32\windowspowershell\v1.0\powershell.exe -PSConsoleFile "C:\Program Files\Microsoft\Exchange Server\Bin\ExShell.psc1" -Command C:\batch\safelist-aggregation.ps1

How often the scheduled task is run, is up to the administrator to decide. Factors are Active Directory replication, site layout, number of users to collect safelist from etc.
By enabling safelist aggregation users will be happier since mail from there’s contacts and safelist will not end up as spam in the Junk e-mail folder.

Anonymous submission and relay of SMTP messages in Exchange 2007

2008-04-06T14:43:00.000+02:00

When organizations install Exchange 2007 they often get problems because they have applications and sometimes users sending SMTP mail to there’s mail server. In previous version of Exchange this was not a problem since it allowed receiving of mail without authentication, with Exchange 2007 this is no longer the case. Default setting on the “Default servername” receive connector is not to allow anonymous users.

The easiest thing to do is to check the “Anonymous users”, but are you really sure you want to do this? There is a good reason not to allow anonymous submission of SMTP mail and that’s getting rid of the anonymity on your network. If you really need to accept anonymous submission then I suggest that you create a new receive connector that allow anonymous users and only accept mail from certain IP (look on the network tab and ) that cannot send mail authenticated, this also makes the “Default servername” receive connector have its default settings.A common misunderstanding is that by allowing anonymous users also makes it possible to relay mail, this is not the case. To allow relaying users or the application must authenticate the SMTP session. If mail is destined to internal users then there is no need to allow relaying, it’s only needed when mail is destined to external recipients.Default settings on receive connectors is set to allow “Exchange users” to relay. Exchange users is all users that have a mailbox, so by creating a mailbox for the application and make the application authenticate it will also be allowed to relay. Type of authentication is specified on the “Authentication” tab.

The most common authentication method is “Basic Auth.”. Exchange 2007 settings is to only allow basic auth after that TLS has been started, and that is not so common that applications can do TLS. TLS is similar to SSL and it encrypts the transmission so it’s a good thing if it can be enabled in the application. Integrated Windows Authentication is good to use if your applications can use it.
Another good thing if you can make your application authenticate when sending SMTP mail is they bypass spam checks done by Exchange. You can see this if you run
Get-ADPermission "receive connector name" where {$_.User -like 'NT AUTHORITY\Authenticated Users' -and $_.isinherited -eq $False} ft User, ExtendedRights –autosize

Spam checks are only done if you have installed the antispamagents on your HubTransport server.

If you really want to allow relay without authentication (=anonymous relay) you should read http://msexchangeteam.com/archive/2006/12/28/432013.aspx

Exchange 2003 statistics with Logparser

2008-03-17T13:51:00.000+01:00

Often when I try to get some information about customers current Exchange 2003 system they don’t have a clue how much mail going through the system, other question that is unanswered is size of mail, when is mail delivered. Gathering this type of information is important since it can generate numbers to use as input when sizing your upcoming Exchange 2007 servers.

Activate Message tracking:
In these examples I use Exchange Message Tracking log files to run Logparser against. Other sources of information can be the SMTP protocol log files, but this is another story.
Most Exchange admins have activated Message Tracking but if you don’t, start Exchange System Manager and drill down to the Server object, right click on it and select properties. Select the checkbox “Enable message tracking”. This activation is per server basis and if you have multiple servers it’s a good idea to activate it on all servers. It can be done with System server policy or by manually doing it on all servers. When activated; log files will be created in C:\Program Files\Exchsrvr\.log\ if you have installed Exchange in the default location.

Message tracking format:
When mail is sent in an Exchange server it goes through several steps before it actually arrives at the recipient inbox. Which steps involved also depends on where the message originates from and where it’s sent to. Each event write a line in the message tracking log file and therefore every mail is logged several times with different Event-ID in the file. See Microsoft KB article 821905 for Message tracking event IDs in Exchange Server 2003. As stated in the KB article there is no single event that is logged a single time for each mail but the closest match is Event-ID 1019. Event-ID’s is important depending on what information you want to get from log files.

Logparser:
What is Logparser? It’s a very nice command line tool for parsing log files. Most log files are in some kind of text format such as CSV, W3C but it can also be eventlog and netmon trace files.
Start by download and install logparser from http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&DisplayLang=en. If you want results to be displayed as graphs you also need Office web components http://www.microsoft.com/downloads/details.aspx?FamilyID=7287252C-402E-4F72-97A5-E0FD290D4B76&displaylang=en. They only exists for office 2003 but can be used even if you run office 2007. Logparser is also available as a COM object so it can be used from scripts you write. http://msexchangeteam.com/files/12/attachments/entry445704.aspx
You don’t need to install logparser on your Exchange server, simplest is to run it from your PC as long as you have access to the log files.

Running logparser:
Start by copy those message tracking log files you want to examine from your Exchange server to a local directory on your PC. If you open a log file it will be opened with notepad which not do a great job of formatting it, my suggestion is to use wordpad if you want to open and read message tracking log files manually.
Other important factors are from which server is log files copied, you would get different result if using log files from a mailbox server or from a server acting as a hub, also consider the Event-ID used when parsing log files.

A common request is getting the number of email per day.
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Date as Day,Count(*) as email from *.log where Event-ID = 1019 Group By Day" -i:W3C

Output will look like
Day email
--------- -----
2008-2-29 22869
2008-3-1 8479
2008-3-2 7234
2008-3-3 24290
2008-3-4 25504
2008-3-5 25020
2008-3-6 25096
2008-3-7 23806
2008-3-8 16864
2008-3-9 12754
2008-3-10 26683
2008-3-11 47088
2008-3-12 26132
2008-3-13 28605

What happens is that each logfile in the current directory is examined for rows where ‘Event-ID = 1019’. The Date field is read and summed and then the output is grouped to get number of hits per day. In this example I have logfiles ranging from 29 Feb to 13 of Mar.

You can also output the result to jpg file
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Date as Day,Count(*) as email Into chart.jpg from *.log where Event-ID = 1019 Group By Day" -i:W3C -o:Chart -Charttype:Line -Charttitle:"Number of emails per day" -View:on

or to a little more fancy 3D graph
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Date as Day,Count(*) as email Into chart.jpg From *.log where Event-ID = 1019 Group By Day" -i:W3C -o:Chart -Charttype:Column3D -Charttitle:"Number of emails per day" -View:on

There are many different chart types available. If you run ‘logparser.exe –h –o:Chart’ you get a list of what charttype’s is available.
Line,LineMarkers, LineStacked,LineStackedMarkers, LineStacked100,LineStacked100Markers, Line3D,LineOverlapped3D, LineStacked3D,LineStacked1003D, SmoothLine,SmoothLineMarkers, SmoothLineStacked, SmoothLineStackedMarkers,SmoothLineStacked100, SmoothLineStacked100Markers, BarClustered,BarStacked, BarStacked100, Bar3D,BarClustered3D, BarStacked3D,BarStacked1003D, ColumnClustered,ColumnStacked, ColumnStacked100,Column3D, ColumnClustered3D,ColumnStacked3D, ColumnStacked1003D,Pie, PieExploded, PieStacked, Pie3D,PieExploded3D, ScatterMarkers,ScatterSmoothLine, ScatterSmoothLineMarkers, ScatterLine, ScatterLineMarkers, ScatterLineFilled, Bubble,BubbleLine, Area, AreaStacked,AreaStacked100, Area3D, AreaOverlapped3D, AreaStacked3D, AreaStacked1003D, Doughnut, DoughnutExploded,RadarLine, RadarLineMarkers,RadarLineFilled, RadarSmoothLine,RadarSmoothLineMarkers, StockHLC,StockOHLC, PolarMarkers, PolarLine,PolarLineMarkers, PolarSmoothLine,PolarSmoothLineMarkers

When examining this statistic we can see that there is low volume on 1,2,8,9 of Mars and that should not be a surprise since those days are weekends. On the 11th we can see a higher volume.

Number of emails per hour:
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Quantize(To_Timestamp(To_String(Extract_Prefix(Time,0,' ')),'h:m:s'),3600) as Hour,count(*) as email Into chart.jpg from 20080311.log where Event-ID = 1019 GROUP BY Hour ORDER BY Hour ASC" -i:W3C -o:Chart -Charttype:Line -Charttitle:"Number of emails per hour" -View:on

We can see that there is a high volume of email between 9 and 12 AM.
This logparser command reads the Time field and manipulates it to be in timestamp format in order for the Quantize parameter to work. Result from Quantize parameter is then summarized per hour and displayed in a line graph.

Or by adding all email from all log files per hour.
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Quantize(To_Timestamp(To_String(Extract_Prefix(Time,0,' ')),'h:m:s'),3600) as Hour,count(*) as email Into chart.jpg from *.log where Event-ID = 1019 GROUP BY Hour ORDER BY Hour ASC" -i:W3C -o:Chart -Charttype:Line -Charttitle:"Number of emails per hour" -View:on

Other useful information is who is receiving most mail.
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Top 10 Recipient-Address as Recipient,Count(*) as hits From *.log Where Event-ID = 1019 Group By Recipient Order By hits DESC" -i:W3C

Who is sending most email.
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Top 10 Sender-Address as Sender,Count(*) as hits From *.log Where Event-ID = 1019 Group By Sender Order By hits DESC" -i:W3C

Which domain is receiving most email.
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Top 10 Extract_SUFFIX(Recipient-Address,0,'@') as Recipient,Count(*) as Hits from *.log Where Event-ID = 1019 Group By Recipient Order By Hits DESC" -i:W3C

Avarage size on email per day.
”C:\Program Files\Log Parser 2.2\LogParser.exe" "Select Date,AVG(total-bytes) From *.log Where Event-ID = 1019 Group By Date" -i:W3C

Date AVG(ALL total-bytes)
--------- --------------------
2008-2-29 156344
2008-3-1 53003
2008-3-2 104991
2008-3-3 158491
2008-3-4 190721
2008-3-5 178313
2008-3-6 188157
2008-3-7 168273
2008-3-8 25809
2008-3-9 46874
2008-3-10 170719
2008-3-11 89262
2008-3-12 180671
2008-3-13 181731

Or just the average size of email in all log files.
"C:\Program Files\Log Parser 2.2\LogParser.exe" "Select AVG(total-bytes) From *.log Where Event-ID = 1019 " -i:W3C

AVG(ALL total-bytes)
--------------------
144804

This gives us an average message size of 141KB

The first post

2008-03-06T20:40:00.000+01:00

A couple of people are constantly telling me that I should start a blog about Exchange, and here IT is. So who am I? For starters I am a Microsoft Exchange server MVP and have been for a couple of years. I live in Sweden, just outside of Stockholm in the countryside with my family which include a couple of horses for relaxation from the hectic live of a IT consultant. I probably write most about Exchange but there will be other stuff such as OCS and non IT related.