• Determine how content conversion modifies a message in transit
• View how a message entered Exchange, and how it exits exchange to determine who is wrong with formatting
• Troubleshoot disclaimer issues ( being applied, not being applied, not looking right)
• Troubleshoot rules being applied, or not being applied to messages
• Determine why messages are not being properly journaled

For more information see the following link; http://technet.microsoft.com/en-us/library/aa996349.aspx

Note | the big note / disclaimer here, entire email messages will be saved in plain text format on the Exchange server when you enable tracing. Think possible Security issue. Also every message sent from the SENDER through the configured server will be captured and stored 17 or more times, think, this could consume excessive space on a server; make sure you turn it off when you are done.

Pipe Line Tracing Configuration

Pipe Line tracing by default is disabled on Exchange Transport servers. You have to enable it on the transport server you will be working with. Then you have to configure it to capture email for a specific user. You’re only able to configure tracing to trace for a single SENDER. There are three settings you can configure for tracing using the set-transportserver command. The commands are as follows:

• PipelineTracingEnabled |Pretty simple, you can set it to True or False, False is default. You need to set it to true before the feature will work. You don’t need to cycle transport to have the settings take effect, but you might need to wait for AD replication
• PipelineTracingPath| The default path is C:\<exchange install path>\TransportRoles\Logs\PipelineTracing I’ve never seen much reason to change the path, but you can if you want to.
• PipelineTracingSenderAddress | Set the email address of the SENDER you want to enable tracing for here. You can only trace for a single sender at a time.

You can run get-transportsever | fl *pipe* to see the current settings

Enable Pipe Line Tracing

The following example commands assume your environment has more than one transport server and it assumes you want to enable pipe line tracing on all transport servers. The following commands can be run to enabled pipe line tracing:

• Enabled tracing run | Get-transportserver | set-transportserver – PipelineTracingEnabled $true
• Set the SENDER address | Get-Transportserver | set-transportserver – PipelineTracingSenderAddress mainer@contoso.com
• Configure the path | Get-Transportserver | set-transportserver – PipelineTracingpath “c:\bob\pipelinetracing” – You don’t need to change this setting.

Reviewing the Pipe Line Tracing logs

The pipe line tracking logs are *.eml text files stored in the PipelineTracingpath on each Exchange transport server. You can open the files in Notepad, or your email client of choice. For the purpose of reviewing the data I suggest you use notepad so you can see the RAW format / data of the email message. When you find the folder you will see something like the below image.

Each Routing000X.eml file corresponds to a step in the transport pipe line. You can view what your pipe line process looks like by running get-transportpipeline – When you run the command you will see something like the below image. For more information about what happens at each step of the pipeline view the following link; http://technet.microsoft.com/en-us/library/aa996349.aspx

When you open a message near the top of the message the X-MessageSnapshot-Source: tag will tell you what step you’re looking at in the pipeline and or what process / transport agent is toucing the message in this step.

Armed with the entire message, and the steps in the pipe line you should be able to work out where your message is not properly being handeled and trouble shoot futher.

Disabled Pipe Line Tracing

When you’ve captured enough messages to trouble shoot your issue, or you’ve solved your issue you should turn the tracking off. The following example commands assume your environment has more than one transport server and it assumes you want to enable pipe line tracing on all transport servers. The following commands can be run to enabled pipe line tracing:

• Disabled tracing run | Get-transportserver | set-transportserver – PipelineTracingEnabled $fase
• Set the SENDER address | Get-Transportserver | set-transportserver – PipelineTracingSenderAddress

Import-module ServerManager

Add-WindowsFeature MSMQ-Server, NET-Framework-Core, Web-Server, Web-Static-Content, Web-Default-Doc, Web-Dir-Browsing, Web-Http-Errors, Web-Http-Redirect, Web-Asp-Net, Web-NET-Ext, Web-ASP, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Http-Logging, Web-Log-Libraries, Web-Request-Monitor, Web-Http-Tracing, Web-Basic-Auth, Web-Windows-Auth, Web-Filtering, Web-IP-Security, Web-Stat-Compression, Web-Mgmt-Console, Web-Scripting-Tools, Web-Mgmt-Service, Web-Metabase, Web-WMI, Web-Lgcy-Scripting, Web-Lgcy-Mgmt-Console, RSAT-Web-Server

$mailboxes = get-mailbox

foreach ($mailbox in $mailboxes) {

new-mailboxexportrequest -mailbox $mailbox -FilePath \\server\c$\$mailbox.pst

}

Obviously you’re going to want to change the FilePath but keep in mind you must point it towards a UNC path, not a drive letter. To see the status of the exports you can run the below command.

Get-MailboxExportRequest | Get-MailboxExportRequestStatistics

Creating Distribution Groups Overriding Naming Policy
Distribution Group Naming Policy is a template that, we as Exchange admins, apply to all newly created distribution groups. [...] There will be times in which you want to cerate a distribution group with a particular name, without getting the standard policy applied. You can create new groups or modify existing ones, ignoring the naming policy been configured. Read More @ How Exchange Works

The Conversation Action Settings Folder
If you’re used to using Outlook on Windows, you may never have seen this folder. In fact, you might not have seen it if you are a Win Outlook user, because it’s only present on Exchange 2010 mailboxes. Read More @ Paul’s Down Home Page

Using Room List Distribution Group in Exchange 2010
As the name suggests, “Room List Distribution Group” is a distribution group which has a list of room mailboxes as its members. Why do we need one of these groups, you might ask. In earlier versions of Outlook, if you wanted to search for a room’s availability while setting up a meeting, you needed to add all possible rooms to the meeting request and then use the Scheduling Assistant to view available rooms. [...] In Exchange 2010, if a room list distribution group has been configured, an end user can add just the distribution group, which will list all the meeting rooms and the availability automatically. Read More @ How Exchange Works

Exchange Server 2010 Native Data Protection – Part 1
Exchange Server 2010 brings new features that allow companies to protect their emails without performing any backups. These features introduce the concept known as Exchange Native Data Protection, formerly known as Backup-less Exchange Organization. Read More @ ExchangeInbox.com

NOTE || According to the Microsoft KB (\s|.|-) should block Space, Period, and Hyphen. In real life the \s seems to block anything, resulting in an SSN number blocking expression that blocks phone numbers. I am looking into why this is happening. Until I update this again please remove the \s| from all expressions before implementing the rules

Blocking without blobs

The rules below will not block 16,15,and 9 digit number blobs – Meaning, someone could send 123234355 as their SOC and it would go through. Additionally they only block the numbers grouped with a space, period, or hyphen/dash between the number groupings (\s|.|-)

Block SSN numbers

New-TransportRule -Name “Social Security Number Block Rule” -SubjectOrBodyMatchesPatterns “\d\d\d(\s|.|-)\d\d(\s|.|-)\d\d\d\d” -RejectMessageEnhancedStatusCode “5.7.1″ -RejectMessageReasonText “This message has been rejected because of content restrictions”

Block Credit Card numbers

New-TransportRule -Name “Visa_Mastercard_Discover_Block Rule” -SubjectOrBodyMatchesPatterns

“\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d” -RejectMessageEnhancedStatusCode “5.7.1″ -RejectMessageReasonText “This message has been rejected because of content restrictions”

Block Amex Numbers

New-TransportRule -Name “Amex_Block Rule” -SubjectOrBodyMatchesPatterns”\d\d\d\d(\s|.|-)\d\d\d\d\d\d(\s|.|-)\d\d\d\d\d” -RejectMessageEnhancedStatusCode “5.7.1″ -RejectMessageReasonText “This message has been rejected because of content restrictions”

Blocking with blobs

The rules below will  block 16 and 15 digit blobs of numbers that start with 3, 4, 5, and 6011 as is apprriate for card format. The rules will also block 9 digit blobs to block SSN numbers with out number breaks.  Additionally they block the numbers grouped with a space, period, or hyphen/dash between the number groupings (\s|.|-)

Block SSN numbers

New-TransportRule -Name “Social Security Number Block Rule” -SubjectOrBodyMatchesPatterns “\d\d\d(\s|.|-)\d\d(\s|.|-)\d\d\d\d\s”,“\d\d\d\d\d\d\d\d\d\s” -RejectMessageEnhancedStatusCode “5.7.1″ -RejectMessageReasonText “This message has been rejected because of content restrictions”

Block Credit Card numbers

New-TransportRule -Name “Visa_Mastercard_Discover_Block Rule” -SubjectOrBodyMatchesPatterns

“\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d”,”4\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\s”,”5\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\s”,”6011\d\d\d\d\d\d\d\d\d\d\d\d(\s” -RejectMessageEnhancedStatusCode “5.7.1″ -RejectMessageReasonText “This message has been rejected because of content restrictions”

Block Amex Numbers

New-TransportRule -Name “Amex_Block Rule” -SubjectOrBodyMatchesPatterns”\d\d\d\d(\s|.|-)\d\d\d\d\d\d(\s|.|-)\d\d\d\d\d”,”3\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\s” -RejectMessageEnhancedStatusCode “5.7.1″ -RejectMessageReasonText “This message has been rejected because of content restrictions”

Number formatting notes

Social Security number is a 9 digits long. Examples include:

• 123-23-7788 ” \d\d\d(\s|.|-)\d\d(\s|.|-)\d\d\d\d”
• 123 23 7788
• 12323788 “\d\d\d\d\d\d\d\d\d\(\s)”

The Visa card format is 16 digits long and starts with a “4″. Examples include:

• 4xxx-xxxx-xxxx-xxxx || “\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d”
• 4xxx xxxx xxxx xxxx
• 4xxxxxxxxxxxxxxx “4\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\s”

The MasterCard format is 16 digits long and starts with a “5″. Examples include:

• 5xxx-xxxx-xxxx-xxxx || “\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d(\s|.|-)\d\d\d\d”
• 5xxx xxxx xxxx xxxx
• 5xxxxxxxxxxxxxxx “5\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\s”

The Discover card format is 16 digits long and starts with “6011″. Examples include:

• 6011-xxxx-xxxx-xxxx || “\d\d\d\d(\s|.|-)\d\d\d\d\d\d(\s|.|-)\d\d\d\d\d”
• 6011 xxxx xxxx xxxx
• 6011xxxxxxxxxxxx “6011\d\d\d\d\d\d\d\d\d\d\d\d(\s”

The American Express card format is 15 digits long and starts with a “3″. Examples include:

• 3xxx-xxxxxx-xxxxx || “\d\d\d\d(\s|.|-)\d\d\d\d\d\d(\s|.|-)\d\d\d\d\d”
• 3xxx xxxxxx xxxxx
• 3xxxxxxxxxxxxxx “3\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\s”

See the following link for a transport rule regular expression reference — http://technet.microsoft.com/en-us/library/aa997187.aspx

We have an idea for an Exchange Database, a spare tire of sorts, the idea is as follows:

Create a 5GB empty file on every Exchange database volume you can delete in case the database grows too large,  fills up the volume, and dismounts. You can then quickly delete the file and remount the databases while we work out the size issue. We don’t have to ask the SAN team for more size. We are back up and running super fast

Creating the 5GB spare tire file for your Exchange database is a simple task. It can be done with one line command using a built in Windows command.  Run the following command to create your own 5GB spare tire files on your DB volumes

fsutil.exe file createnew c:\Spare.Tire 536870912

And that boys and girls is a quick way to build an inexpensive spare tire to use in case your databases get too big.

The qualification program for load balancers ensures that customers have seamless experiences with setup, support, and use of qualified load balancers with Microsoft’s Exchange Server 2010. Only products that meet Exchange Server 2010 requirements will be listed.

We’re both a reseller partner of KEMP and use an LM-2200 ourselves, so I’m happy to see they are now a qualified solution for Exchange 2010. You can visit the Microsoft Exchange 2010 Load Balancer Deployment page here for a full list of approved load balancers.

After about an hour of messing around my phone I was able to make it work. Below is a run down of my issue and how I fixed it.

Error || The error on the phone was “there is an error with the certificate for the mail.cohesivelogic.net” Error code 80072F0d“

Solving the issue

Below is an outline of steps I took to work out the issue

• First I used Outlook on my computer to test AutoDiscover ( Hold down CTRL + rRght click the Outlook Icon on the system tray near the time and select Test AutoDiscover ) – I did this because we have .com email addresses and a .net email server and I wanted to be sure everything was correct
• After messing with the server settings a bit ( swaping .com and .net ) I got the CERT error
• Logged into OWA to check the certificate and make sure it had all of the needed SAN names on it – it did
• So I sat there scratching my head for a bit – then it came to me “ Maybe, Windows Phone 7 does not trust startSSL” – I looked it up http://msdn.microsoft.com/en-us/library/gg521150(VS.92).aspx, and my grabthars hammer startSSL / StartCOM was not listed
• Now I had 2 issues, how to install a Cert on WP7 and where to find the root CA so I could download it to install it.
• I found the root CA here – http://www.startssl.com/certs/ – Hint you need the CA.CER file to add the root to the phone.
• To get the CERT on my phone I downloaded the file to my desktop, Emailed it a working Outlook account on my phone. Then clicked the file on my phone and it allowed me to install the cert. The phone is smart enough to know the file type and know what to do with it.
• After installing the trusted root CA my none working ActiveSync account started working YEAH! more email to read while driving, I mean more email to read on my phone…..

Moral of the story – WP7 only supports a limited number of certs out of the box. It’s pretty simple to add a new cert and be off and moving if you run into a cert issue.

Notes:

First and foremost, this is likely not a Microsoft supported configuration. While we’ve rolled it out in small environments with success, it may not be the best fit for you.

This has only been tested with all roles collocated on a single server. We haven’t tested it in highly available environments because it likely won’t work.

For this example, domain.com is the domain name, mail.domain.com is the URL we’re setting all services to and EXCHANGE is the NetBIOS name of the Exchange server.

To give credit where it’s due: I was not the first to think of doing this but instead used Simon Butler’s excellent article on Exchange 2007 with a Single Name SSL Certificate when working with 2007. It was then a logical leap to try applying a similar configuration to Exchange 2010.

Pre-Requisites

1.) An external DNS provider that supports SRV records. You’ll need to insert an SRV record of _autodiscover._tcp.domain.com in DNS for this to work. We use Zerigo for this ourselves and highly recommend them.

2.) Outlook 2007 with the update rollup released June 27, 2007 (Discussed in this Microsoft KB article) to provide support for Exchange Autodiscover via SRV lookup.

3.) Split-horizon DNS to allow mail.domain.com to resolve to different IPs internally and externally. This requires a working knowledge of DNS.

4.) An SSL certificate for mail.domain.com. While you can use any commercial provider you’d like for this, StartSSL provides free single name SSL certificates.

The Steps

1.) Point external DNS for mail.domain.com to the external IP address of the Exchange server.

2.) Create the SRV record _autodiscover._tcp.domain.com with content of mail.domain.com on port 443. Your DNS provider might also have you enter it like this:

Service: _autodiscover

Protocol: _tcp

Port Number: 443

Host: mail.domain.com

3.) Point internal DNS for mail.domain.com to the internal IP address of the Exchange server.

Note:

These examples can be copied and pasted into the text editor of your choice. Then simply replace mail.domain.com with the correct FQDN of your Exchange server and paste the correct command into a PowerShell session on your Exchange 2010 server.

Get-AutodiscoverVirtualDirectory | Set-AutodiscoverVirtualDirectory –InternalUrl “https://mail.domain.com/Autodiscover/Autodiscover.xml”

Get-ClientAccessServer | Set-ClientAccessServer –AutodiscoverServiceInternalUri “https://mail.domain.com/Autodiscover/Autodiscover.xml”

Get-WebservicesVirtualDirectory | Set-WebservicesVirtualDirectory –InternalUrl “https://mail.domain.com/Ews/Exchange.asmx”

Get-OabVirtualDirectory | Set-OabVirtualDirectory –InternalUrl “https://mail.domain.com/Oab”

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory –InternalUrl “https://mail.domain.com/Owa”

Get-EcpVirtualDirectory | Set-EcpVirtualDirectory –InternalUrl “https://mail.domain.com/Ecp”

Get-ActiveSyncVirtualDirectory -Server $CASserver | Set-ActiveSyncVirtualDirectory -InternalUrl “https://mail.domain.com/Microsoft-Server-ActiveSync”

Get-AutodiscoverVirtualDirectory | Set-AutodiscoverVirtualDirectory –ExternalUrl “https://mail.domain.com/Autodiscover/Autodiscover.xml”

Get-webservicesVirtualDirectory | Set-webservicesVirtualDirectory –ExternalUrl “https://mail.domain.com/Ews/Exchange.asmx”

Get-OabVirtualDirectory | Set-OabVirtualDirectory –ExternalUrl “https://mail.domain.com/Oab”

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory –ExternalUrl “https://mail.domain.com/Owa”

Get-EcpVirtualDirectory | Set-EcpVirtualDirectory –ExternalUrl “https://mail.domain.com/Ecp”

Get-ActiveSyncVirtualDirectory | Set-ActiveSyncVirtualDirectory -ExternalUrl “https://mail.domain.com/Microsoft-Server-ActiveSync”

Get-AutodiscoverVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Get-webservicesVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Get-OabVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Get-OwaVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Get-EcpVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Get-ActiveSyncVirtualDirectory | ft Identity,InternalURL,ExternalUrl

[PS] C:\Windows\system32>Get-AutodiscoverVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Identity                                InternalUrl                             ExternalUrl

——–                                ———–                             ———–

EXCHANGE\Autodiscover (Default Web Site)  https://mail.domain.com/autod… https://mail.domain.com/autod…

[PS] C:\Windows\system32>Get-webservicesVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Identity                                InternalUrl                             ExternalUrl

——–                                ———–                             ———–

EXCHANGE\EWS (Default Web Site)           https://mail.domain.com/ews/e… https://mail.domain.com/ews/e…

[PS] C:\Windows\system32>Get-OabVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Identity                                InternalUrl                             ExternalUrl

——–                                ———–                             ———–

EXCHANGE\OAB (Default Web Site)           http://mail.domain.com/OAB       https://mail.domain.com/OAB

[PS] C:\Windows\system32>Get-OwaVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Identity                                InternalUrl                             ExternalUrl

——–                                ———–                             ———–

EXCHANGE\owa (Default Web Site)           https://mail.domain.com/owa      https://mail.domain.com/owa

[PS] C:\Windows\system32>Get-EcpVirtualDirectory | ft Identity,InternalURL,ExternalUrl

Identity                                InternalUrl                             ExternalUrl

——–                                ———–                             ———–

EXCHANGE\ecp (Default Web Site)           https://mail.domain.com/ecp      https://mail.domain.com/ecp

7.) You can verify everything is working by using the Exchange Remote Connectivity Analyzer located at https://www.testexchangeconnectivity.com

8.) Don’t forget to monitor your new Exchange server!

Here are some screenshots of what happens along the way: