Just over a week ago I recorded an interview with Mick and Chris from the Coalface Tech podcast, and they’ve now published the first part online.

In this podcast we talk about some of the rumours around the upcoming Exchange 15, going into a bit more detail about the leaks and observations I published in this recent post.

You can listen to the interview here.

Thanks again to Mick and Chris for having me as a guest, it was a lot of fun.

Related posts:

• Observations: What to Expect from Exchange 15
• I don’t write about Apple products

This article I’m on the Coalface Tech Podcast is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

This information is useful for scenarios such as checking whether your outbound mail may experiencing a high rate of failure, or discovering whether someone is continually trying to relay through your email server (in which case you could then look at the top sender IP addresses to investigate further).

Remember that protocol logging is not enabled by default on Exchange 2010, and must be enabled on a per-connector basis if you want to use it.

For SMTP error statistics we can use Log Parser to check the protocol logs for instances of SMTP status codes starting with “5″ (which are permanent failures). The Log Parser query for this is as follows:

SELECT data as [Status Code],
	Count(*) as Hits
FROM *.log
WHERE data LIKE '5%'
GROUP BY data
ORDER BY Hits DESC

When run from the folder containing the protocol logs it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT data as [Status Code],Count(*) as Hits FROM *.log WHERE data LIKE '5%' GROUP BY data ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

Status Code                                       Hits
------------------------------------------------- ----
500 5.3.3 Unrecognized command                    3632
501 5.1.3 Invalid address                         1411
501 5.1.7 Invalid address                         200
554 5.4.6 Hop count exceeded - possible mail loop 100
503 5.5.2 Send hello first                        20
503 5.5.2 Sender already specified                4
501 5.5.4 Unrecognized parameter                  2
504 5.7.4 Unrecognized authentication type        1

Statistics:
-----------
Elements processed: 13113294
Elements output:    8
Execution time:     150.15 seconds (00:02:30.15)

You can also report on the number of SMTP errors occurring each day to get a baseline, which will help when you need to identify whether a sudden spike in SMTP errors has occurred. This Log Parser query will be as follows:

SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date,
	COUNT(*) AS Hits
FROM *.log
WHERE (data LIKE '5%')
GROUP BY Date
ORDER BY Date ASC

When run from the protocol log directory it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS Hits from *.log where (data LIKE '5%') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -rtp:-1

And of course, provided you have the Office Web Components installed, you can generate a graph of this same data.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS [SMTP Errors] INTO DailySMTPErrors.gif from *.log where (data LIKE '5%') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

Which will give you a graph similar to this:

Related posts:

• Report Top Sender IP’s on Exchange Server 2010 using Log Parser
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with PowerShell

This article Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

There are two different log sets that you can use for this:

• Protocol logs
• Message Tracking logs

One of the best ways to describe the difference between these is that protocol logs will capture SMTP connections that may or may not make it all the way in to the Transport pipeline. For example a connection from a spammer that gets blocked by IP filtering will appear in the protocol logs but not the message tracking logs.

The detail captured in a protocol log will look a lot like what you would see if you were manually testing SMTP via telnet on a server.

Message tracking logs will capture messages that get processed through the Transport pipeline, and capture information such as message submission and delivery rather than the SMTP conversation that protocol logging reflects.

Message tracking is also turned on by default and is set per-server, whereas protocol logging is not turned on by default and is set per-connector.

For this demonstration I’ll be using my Edge Transport server simply because it has slightly more interesting data since it receives a lot of connections from the internet.

Get Top Sender IP’s from Protocol Logs with Log Parser

To get the top sender IP’s from the protocol logs we can use this Log Parser query.

SELECT EXTRACT_PREFIX(remote-endpoint,0,':') as IP,
	REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as Name,
	Count(*) as Hits
FROM *.log
WHERE data LIKE '%EHLO%'
GROUP BY IP
ORDER BY Hits DESC

When run from the folder containing the protocol logs (in this case C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive) it looks like this:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT EXTRACT_PREFIX(remote-endpoint,0,':') as IP,REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as Name,Count(*) as Hits from *.log WHERE data LIKE '%EHLO%' GROUP BY IP ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

IP              Name                                    Hits
--------------- --------------------------------------- ----
83.222.31.220   v8622.vps.masterhost.ru                 52
204.13.248.72   mho-02-ewr.mailhop.org                  12
50.78.250.97    dcmail.designercabinetry.com            9
10.1.1.21       ho-ex2010-mb1.exchangeserverpro.net     8
64.61.92.26     static-64-61-92-26.isp.broadviewnet.net 7
217.108.179.228 mailhost.el-internationale.com          7
69.60.118.117   mail1.ambr.com.br                       4
10.1.1.22       ho-ex2010-mb2.exchangeserverpro.net     4
95.154.196.147  95.154.196.147                          4
118.22.2.202    pc2.land-ho-unet.ocn.ne.jp              3
187.108.193.223 cloud.newmediahost.com.br               2
109.169.77.169  109.169.77.169                          2
59.106.64.208   ns1.uranaikan.info                      2
204.13.248.71   mho-01-ewr.mailhop.org                  2
78.129.222.16   78.129.222.16                           2
199.119.76.15   mail.seoauditions.com                   1

Statistics:
-----------
Elements processed: 3359
Elements output:    16
Execution time:     17.41 seconds

This part of the query string is important to note:

WHERE data LIKE '%EHLO%'

This means that only those log entries where the EHLO occurred will be counted in the stats that Log Parser outputs. If you leave it out you’ll see a “Hit” for every log entry a remote IP generated. Depending on how “chatty” that particular SMTP conversation was it may skew the results a little. However since we’re looking more for indicative numbers rather than precise numbers it doesn’t matter which way you choose to go (at least not to me).

Get Top Sender IP’s from Message Tracking Logs with Log Parser

For message tracking logs the syntax is a little different because the field names in the log files are different.

SELECT client-ip as IP,
	REVERSEDNS(client-ip) as Name,
	Count(*) as Hits
FROM *.log
WHERE (event-id='RECEIVE')
GROUP BY IP
ORDER BY Hits DESC

When run from the folder containing the message tracking logs (in this case C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking) it will look like this:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT client-ip as IP,REVERSEDNS(client-ip) as Name,Count(*) as Hits from *.log WHERE (event-id='RECEIVE') GROUP BY IP ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

If you get too much output you can limit it to the top X results by modifying the query slightly:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TOP 20 client-ip as IP,REVERSEDNS(client-ip) as Name,Count(*) as Hits from *.log WHERE (event-id='RECEIVE') GROUP BY IP ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

IP              Name                                 Hits
--------------- ------------------------------------ ----
204.93.210.179  mariajunco.com                       32
10.1.1.22       ho-ex2010-mb2.exchangeserverpro.net  23
216.151.172.180 hosted.airvm.net                     22
10.1.1.21       ho-ex2010-mb1.exchangeserverpro.net  22
83.142.48.139   83.142.48.139                        17
67.215.235.199  67.215.235.199.static.quadranet.com  13
109.169.76.124  109.169.76.124                       10
109.169.55.146  109.169.55.146                       10
109.169.62.15   109.169.62.15                        10
109.169.60.137  109.169.60.137                       9
173.254.208.113 173.254.208.113.static.quadranet.com 9
59.106.64.208   ns1.uranaikan.info                   8
72.11.150.131   72.11.150.131.static.quadranet.com   7
109.169.73.116  109.169.73.116                       7
109.169.55.135  109.169.55.135                       7
189.39.9.214    mail3.ibcbrasil.com.br               5
204.13.248.72   mho-02-ewr.mailhop.org               5
109.169.87.100  109.169.87.100                       4
109.169.84.105  109.169.84.105                       4
169.232.46.177  out-58.smtp.ucla.edu                 3

Statistics:
-----------
Elements processed: 1018
Elements output:    20
Execution time:     74.03 seconds (00:01:14.03)

You can use this information in a lot of situations such as when investigating load issues, or planning to decommission servers

Related posts:

• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• Avoiding Infinite Loops with Internal Relay Domains in Exchange 2007/2010

This article Report Top Sender IP’s on Exchange Server 2010 using Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Consider the scenario where a room is booked, and perhaps another person wants to contact existing meeting organizers to ask if they can remove a booking to make room for a more important one, but the free/busy information (as seen in the Outlook Scheduling Assistant) doesn’t indicate who made the bookings.

This is caused by the default permissions on the mailbox’s calendar. These default permissions are set to show only the availability information (eg free, busy, tentative) but not any other details.

In the calendar permissions (if you were modifying them via Outlook) it would look like this.

If viewed in the shell it with Get-MailboxFolderPermission it would appear like this.

[PS] C:\>Get-MailboxFolderPermission homeetingroom1:\Calendar

RunspaceId   : 8706cde4-2cb5-4519-9a46-a46fcc0c450c
FolderName   : Calendar
User         : Default
AccessRights : {AvailabilityOnly}
Identity     : Default
IsValid      : True

If you modified the permissions using Outlook the new permission level of Reviewer would allow other users to see more details about existing meetings.

You can apply that same permission in the Exchange Management Shell using the Set-MailboxFolderPermission cmdlet (note: Set-MailboxFolderPermission modifies an existing entry, whereas Add-MailboxFolderPermission would be used to add a new entry to the permissions).

Set-MailboxFolderPermission homeetingroom1:\Calendar -User Default -AccessRights Reviewer

The results can be seen in the Get-MailboxFolderPermission output.

[PS] C:\>Get-MailboxFolderPermission homeetingroom1:\Calendar

RunspaceId   : 8706cde4-2cb5-4519-9a46-a46fcc0c450c
FolderName   : Calendar
User         : Default
AccessRights : {Reviewer}
Identity     : Default
IsValid      : True

RunspaceId   : 8706cde4-2cb5-4519-9a46-a46fcc0c450c
FolderName   : Calendar
User         : Anonymous
AccessRights : {None}
Identity     : Anonymous
IsValid      : True

When creating a new meeting request users are now able to see more details about the meeting organizer.

You can modify all the default permissions on Room mailboxes with the following commands in the Exchange Management Shell.

[PS] C:\>$rooms = Get-Mailbox -RecipientTypeDetails RoomMailbox
[PS] C:\>$rooms | %{Set-MailboxFolderPermission $_":\Calendar" -User Default -AccessRights Reviewer}

Related posts:

• How to Find Available Meeting Rooms
• Exchange Server 2010 Room Mailboxes Step by Step Guide
• Exchange 2007 Room Mailbox Not Automatically Accepting Bookings
• Exchange 2010 Shared Calendar Permissions and Nested Groups
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs

This article Show Full Free/Busy Details for Exchange Server 2010 Room and Resource Mailboxes is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Consider a scenario where the mailbox database is active in a site with a single mailbox server, and has passive copies in a site with two mailbox servers. The two mailbox servers hosting passive copies need reseeding due to some fault that has occurred.

Exchange Server 2010 multi-site DAG

If the reseed was commenced for both servers it would effectively mean the data was replicated across the WAN twice, which may not be ideal depending on the available bandwidth.

Exchange 2010 database reseed from active copy

This is because by default the database copy update operation uses the active copy of the database as the source. This would be the case if you ran the Update-MailboxDatabaseCopy cmdlet with only the mandatory parameters.

However if you use the console wizard to perform the operation you’ll notice an option to choose the source for the reseed.

Choosing a database reseed source in Exchange 2010

This allows you to perform the reseed more efficiently in terms of network bandwidth by reseeding one server first, and then using that passive copy as the source for the second reseed operation.

Exchange 2010 DAG reseed from passive copy

This can also be performed using Update-MailboxDatabaseCopy with the -SourceServer parameter, for example:

Update-MailboxDatabaseCopy MB-HO-01\br-ex2010-mb -SourceServer ho-ex2010-mb2

An alternative would be to reseed one server first, then move the active mailbox database copy to that server before commencing the second database reseed in that site.

Related posts:

• How to Install Updates on Exchange Server 2010 Database Availability Groups
• Exchange 2010: Are Passive Database Copies Included in Backups of DAG Members?
• Exchange Recovery: Failed DAG Member in Exchange Server 2010
• How to Reseed a Failed Mailbox Database Copy in Exchange Server 2010
• Exchange Server 2010 Database Availability Group Installation Step by Step

This article Managing the Replication Source for Exchange Server 2010 Mailbox Database Reseed is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

To be able to identify this type of problem you should first know what your normal email traffic patterns look like. You can find this information by using Log Parser to search through your Exchange server’s message tracking logs.

There are two ways to look at this traffic.

• As a total of the traffic per hour for all days combined
• As the traffic per hour for each separate day

Total Email Traffic Per Hour for All Days Combined

First let’s look at the Log Parser query to calculate the total email traffic per hour for all days combined.

SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour,
	COUNT(*) AS Messages
FROM *.log
WHERE (event-id='RECEIVE')
GROUP BY Hour
ORDER BY Hour ASC

When run from the folder where the message tracking logs are located the full syntax is:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour, COUNT(*) AS Messages from *.log where (event-id='RECEIVE') GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will return results similar to these:

Hour     Messages
-------- --------
00:00:00 408
01:00:00 415
02:00:00 363
03:00:00 347
04:00:00 273
05:00:00 327
06:00:00 403
07:00:00 450
08:00:00 590
09:00:00 574
10:00:00 637
11:00:00 810
12:00:00 612
13:00:00 597
14:00:00 700
15:00:00 789
16:00:00 821
17:00:00 448
18:00:00 396
19:00:00 527
20:00:00 346
21:00:00 476
22:00:00 348
23:00:00 448

Statistics:
-----------
Elements processed: 106823
Elements output:    24
Execution time:     0.58 seconds

You can also generate graphs straight from Log Parser (if you have the required Office Web Components installed) with slightly different syntax like this:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour, COUNT(*) AS [Messages per Hour] INTO HourlyTraffic.gif from *.log where (event-id='RECEIVE') GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

That Log Parser query will generate a column graph for you similar to this.

Total Email Traffic Per Hour for Each Separate Day

If you’d rather see the hourly traffic for each separate day you can use the following Log Parser query that handles the timestamps slightly differently.

SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour,
	COUNT(*) AS Messages
FROM *.log
WHERE event-id='RECEIVE'
GROUP BY Hour
ORDER BY Hour ASC

The full Log Parser command when run from the folder containing the message tracking logs is as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour, COUNT(*) AS Messages from *.log where event-id='RECEIVE' GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will generate a lot of output depending on the amount of log retention you have configured.

Hour                Messages
------------------- --------
2012-04-05 10:00:00 48
2012-04-05 11:00:00 77
2012-04-05 12:00:00 35
2012-04-05 13:00:00 74
2012-04-05 14:00:00 84
2012-04-05 15:00:00 86
2012-04-05 16:00:00 79
2012-04-05 17:00:00 35
2012-04-05 18:00:00 44
2012-04-05 19:00:00 24
2012-04-05 20:00:00 41
2012-04-05 21:00:00 19
2012-04-05 22:00:00 40
2012-04-05 23:00:00 59
2012-04-06 00:00:00 28
2012-04-06 01:00:00 42
2012-04-06 02:00:00 22
2012-04-06 03:00:00 31
2012-04-06 04:00:00 16
2012-04-06 05:00:00 31
2012-04-06 06:00:00 40
2012-04-06 07:00:00 22
2012-04-06 08:00:00 84
2012-04-06 09:00:00 77
2012-04-06 10:00:00 46
2012-04-06 11:00:00 84
....

As with other Log Parser results you can output this one to a graph as well (again, providing that you have the Office Web Components installed).

Because of the amount of data a line graph seems more appropriate than a column graph. The default size of a graph generated by Log Parser is 640×480, but you can use the -groupsize parameter to set a custom width x height that suits the amount of data being included.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour, COUNT(*) AS Messages INTO DailyTrafficPerHour.gif from *.log where event-id='RECEIVE' GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -chartType:Line -groupsize:1024x480

Related posts:

• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with PowerShell

This article Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

• Part 1 – How to Send SMTP Email Using PowerShell
• Part 2 - How to Add a Message Body to Emails Sent from Scripts
• Part 3 - How to Add a HTML Message Body to Emails Sent from Scripts
• Part 4 - How to Create Formatted HTML Output from Scripts

I also shared with you a script that can be used to check Exchange Server 2010 database backups and alert you to any that have not had a recent backup.

Now it’s time to bring all of that information together and demonstrate how you can set up an automated database backup alert email for your Exchange Server 2010 environment.

The two components of this are:

• The PowerShell script itself (we’ll use the one mentioned earlier but with some modifications to email-enable it)
• Task Scheduler for automatically running the script each day

Script for Exchange Server 2010 Database Backup Email Alerts

To email-enable the script I’ve made just a few modifications. The original script used this conditional logic to display the report in the PowerShell window.

#If alert flag is true output the report
if ($alertflag -eq $true )
{
	Write-Host "The following databases have not been backed up in" $threshold "hours."
	$alerts | ft -AutoSize
}
else
{
	Write-Host "No backup alerts required."
}

To change this to send an email alert we can use this code instead:

#If alert flag is true send the email alert
if ($alertflag -eq $true )
{
	#HTML styles for nice formatting
        $style = "<style>BODY{font-family: Arial; font-size: 10pt;}"
	$style = $style + "TABLE{border: 1px solid black; border-collapse: collapse;}"
	$style = $style + "TH{border: 1px solid black; background: #CC0000; padding: 5px; color: #FFFFFF;}"
	$style = $style + "TD{border: 1px solid black; padding: 5px; }"
	$style = $style + "</style>"

        #SMTP options for sending the report email
	$smtpServer = "ho-ex2010-caht1.exchangeserverpro.net"
	$smtpFrom = "reports@exchangeserverpro.net"
	$smtpTo = "administrator@exchangeserverpro.net"
	$messageSubject = "Exchange Backup Alerts"

        $intro = "The following databases have not been backed up in " + $threshold + " hours.<BR><BR>"
	$report = $alerts | ConvertTo-Html -Fragment

	#Get ready to send email message
	$message = New-Object System.Net.Mail.MailMessage $smtpfrom, $smtpto
	$message.Subject = $messageSubject
	$message.IsBodyHTML = $true
	$message.Body = ConvertTo-Html -Body "$intro $report" -Head $style

	#Send email message
	$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
	$smtp.Send($message)

}

If any parts of that don’t make sense just refer to the previous tutorials on sending email with PowerShell.

Download the script file here: Get-DailyBackupAlerts.ps1 (downloaded 176 times so far)

If you’re using this script in your environment you will need to change the SMTP options to suit.

#SMTP options for sending the report email
$smtpServer = "ho-ex2010-caht1.exchangeserverpro.net"
$smtpFrom = "reports@exchangeserverpro.net"
$smtpTo = "administrator@exchangeserverpro.net"
$messageSubject = "Exchange Backup Alerts"

Save the script as Get-DailyBackupAlerts.ps1 in a folder called C:\Scripts on the server where you would like it to run each day. Note that the script depends on the Exchange Server 2010 management tools, so they will also need to be installed.

Using Task Scheduler to Run PowerShell Scripts

Now we need to configure the scheduled task in Task Scheduler. On a Windows Server 2008 server you’ll find this in the Administrative Tools. After you’ve launched Task Scheduler click on Create Task.

Give the task a meaningful name, set it to Run whether user is logged on or not, and also if necessary change the user account that it will run as (you may wish to create a special Exchange administrative account with a strong password for running these types of scripts).

On the Triggers tab click new and add a Weekly trigger for each of your normal business days that you want the script to run (eg Monday – Friday). Set the Start time to suit your normal backups finishing time and your own work schedule.

On the Actions tab click New and add an action of Start a program. Configure the program of powershell.exe and the arguments -command “c:\scripts\get-dailybackupalerts.ps1″

Click OK to finish creating the new task. You will be prompted to enter the credentials for the account that you configured the task to run as.

Now you can test the scheduled task by right-clicking on it in the Task Scheduler Library and choosing Run.

Assuming you have some databases that have not backed up recently you should receive an alert email shortly after running the scheduled task.

Note: if your backups are all up to date you can test the script by changing the $threshold variable to something very low such as 1.

Download the script file here: Get-DailyBackupAlerts.ps1 (downloaded 176 times so far)

Related posts:

• PowerShell Script: Check Exchange 2010 Database Backups
• PowerShell Script: Check Exchange Mailbox Database Last Backup Time
• Avoid Running Out of Transaction Log Disk Space on Exchange Servers
• Using Test-Mailflow with Exchange 2003 Servers
• How to Health Check an Exchange 2010 Mailbox Server

This article How to Set Up an Automated Exchange 2010 Database Backup Alert Email is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

To start with there is the small matter of the name. Some believe Exchange Server 2012 will be the name, while others think that Exchange Server 2013 is more likely. Given that some training companies have started creating their landing pages for Exchange 2013 training there is probably a little more weight on that side (do you think they may have some insider info?).

The Exchange 15 features I describe below should be considered speculation only, as they are all based on either:

• Leaks published by others
• Surveys from Microsoft
• General observations

Outlook Web App Offline Mode

Of the few leaked bits of information is this one reported by Mary Jo Foley at ZDNet, that OWA in Exchange 15 will have an “offline mode” thanks to the capabilities of HTML5.

Exchange MVP and Windows IT Pro columnist Tony Redmond wrote his own thoughts on this feature here.

Team Mailboxes

Another part of Mary Jo’s article referred to a focus on collaboration not communication, with “team mailboxes” that integrate with SharePoint as a new feature.

Although we currently have the ability to share mailboxes in Exchange between multiple people they don’t provide any special functionality. What sort of improvements could Exchange deliver for teams?

Perhaps the SharePoint integration is the key in this. A mailbox that integrates smoothly with SharePoint workflows might be useful. Another possibility is that this will be the stepping stone that customers need to move them away from public folders for team workflows and into SharePoint, a move that Microsoft has been gently encouraging for several years.

Public Folders

Speaking of public folders, it seems they may still exist in Exchange 15, as they are included in a survey from Microsoft that I (and I assume many others) received for the Exchange 15 exam design.

Public folders may have a new twist though, with the exam survey referencing a skill of “Migrate to modern public folders”.

Depending on how you interpret that it could mean that public folders have undergone some improvements (which seems unlikely from what I heard about public folder development attention at Microsoft) or it may refer to a new platform for public folders (such as the team mailbox integration with SharePoint).

Or it could mean nothing at all.

Client Access Front End

The survey also mentions the “Exchange 15 CAS/CAFE”.

CAFE is presumably an acronym for Client Access Front End, which harks back to the Exchange 2003 “Front End server”, but in the context of today’s products, may have some similarities to Lync’s “Front End” server role.

I suspect that the CAFE is a way to formalise the use of CAS arrays, which initially were not promoted as a best practice for all Exchange 2010 deployments (even those without a CAS HA requirement) and only seemed to emerge as one sometime after the SP1 release date (and was recently reinforced here).

I could see CAFE configuration surfacing in the Exchange GUI management tools, or during Client Access server setup, and may include a capability to maintain a consistent configuration (e.g. external URLs and authentication settings on virtual directories) across multiple Client Access servers.

Office 365

There is no doubt that the cloud (and Office 365) is going to be a big part of messaging in the near future. The recent announcement of new cloud certifications from Microsoft is a strong indicator of that, even if you still think the cloud is over-hyped.

Hybrid scenarios are mentioned in the Exchange 15 exam survey so it would appear that Exchange 15 admins will be expected to understand both on-premise and cloud integration scenarios.

There is also the general trend in activity by Exchange Server MVPs. The information that the MVPs have access to is under strict NDA (by the way, I’m not an MVP so none of what I am writing here breaks an NDA) quite a few of them have been pursuing Office 365 certifications recently.

Of course that may simply be the tendency of MVPs to seek certification in the very latest things, or that many MVPs happen to work for companies that keep up with the latest technology.

Data Loss Prevention

The exam survey mentions Data Loss Prevention (DLP) as a feature of Exchange 15. It seems that Exchange 15 may ship with pre-build DLP rules as well as having the ability to configure custom rules and policies.

Exchange Administration Center

There are several mentions of the Exchange Administration Center (EAC). I suspect that this is the evolution of the Exchange Control Panel and may extend into allowing more Exchange administrative tasks to be performed through a web-based administration panel, instead of only having the choice of the slow GUI console or the learning curve of PowerShell.

Interestingly Microsoft asked customers if they would be interested in something similar to this back in 2009.

Other Expectations

Here are a few other brief items.

• Database Availability Groups will remain as the model for mailbox server high availability. The Exchange 15 exam survey doesn’t hint at any significant changes to these.
• Address Book Policies, introduced with Exchange 2010 SP2, are also included in Exchange 15
• Ability to configure Kerberos authentication for CAS is mentioned in the exam survey, suggesting that hardware load-balancing will continue to be a part of Exchange HA
• Workload Management Policies are briefly mentioned and may be an evolution of the client throttling polices in Exchange 2010

As I said this is all my own observations and speculations, not based on any insider information. However if even a few of these turn out to be true it does make me feel excited about getting my hands on Exchange 15 when it reaches public beta.

Related posts:

• I’m on the Coalface Tech Podcast

This article Observations: What to Expect from Exchange 15 is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

If you’re not a Forefront user or you’re otherwise unaware of the situation, the issue is that Forefront Protection for Exchange and update rollups don’t play nicely together. For example during installation the update rollup can hang at stages such as restarting the Exchange services after the update has been applied.

Services not starting after Exchange Server rollup installation

This is why each update rollup release comes with the following instructions:

Note for Forefront Protection for Exchange users For those of you running Forefront Protection for Exchange, be sure you perform these important steps from the command line in the Forefront directory before and after this rollup’s installation process. Without these steps, Exchange services for Information Store and Transport will not start after you apply this update. Before installing the update, disable ForeFront by using this command: fscutility /disable. After installing the update, re-enable ForeFront by running fscutility /enable.

As a result we see comments like these from disgruntled customers.

Note for Forefront Protection for Exchange users: We still don’t care enough about you to add two lines to the setup script. Instead you have to do it manually. Or you can install the update via Microsoft Update and you’ll be in for a funny surprise.

Hey Microsoft…. could you not detect for your own software and automatically run the command fscutility /disable????, Now I cannot even get WUS to do this…. Annoyed! and feeling unappreciated as a FF customer

Microsoft actually has provided a solution for this, back when Exchange Server 2007 SP2 was released, and appears to have carried it forward for Exchange Server 2010 as well. A script named CustomPatchInstallerActions.ps1 can be used to perform pre- and post-installation tasks for update rollups.

I’m not sure why they don’t refer to it with each update rollup release, but as far as I can tell from my own testing it works fine.

Here is what you need to do.

1. In the \Scripts folder of your Exchange 2010 installation find the file named CustomPatchInstallerActions.ps1.template
2. Create a new sub-folder in \Scripts named Customizations
3. Copy the script template into that sub-folder, and remove the .template extension
4. Edit the file with the customizations you want, and the next time you install an update rollup the script will be called automatically

So what kind of customizations should you include? I did a little testing and here is what I suggest as a minimum. You’ll also find Microsoft’s advice here.

First, I ran fscutility /disable (from the C:\Program Files (x86)\Microsoft Forefront Protection for Exchange Server folder) to see what happens. I received the following output.

Error:
  Microsoft Forefront Protection cannot be disabled at this time.  Please stop
  the following services and then rerun this utility.

   FSCController
   MSExchangeTransport
   MSExchangeIS

So clearly some services need to be stopped first. That will need to go in the script.

After disabling those services fscutility /disable works successfully. So that can be run second.

  Removing dependencies...

      dependency on FSCController removed from Microsoft Exchange Information Store
      dependency on FSEIMC removed from Microsoft Exchange Transport Service
      Microsoft Exchange Transport Service Agent registration removed

Status:  Microsoft Forefront Protection NOT Integrated.

In the custom script itself the actions to perform before installing an update rollup go in the PrePatchInstallationActions function.

function PrePatchInstallActions
{
                Log "Running PrePatchInstallActions"

		Log "Stopping services"
		Stop-Service FSCController,MSExchangeTransport,MSExchangeIS -Force

		Log "Disabling Forefront"
		$fscutility = "C:\Program Files (x86)\Microsoft Forefront Protection for Exchange Server\fscutility.exe"
		Invoke-Expression $fscutility /disable

}

Notice I’ve also made use of the Log function that is in the script so that I can see in the log file later that my custom actions were run (or at least attempted to run). The log file is written to C:\ExchangeSetupLogs\CustomPatchInstallActions.log

After the update rollup is finished installing there is a similar process involved to re-enable Forefront. These steps go in the PostPatchInstallActions function.

function PostPatchInstallActions
{
                Log "Running PostPatchInstallActions"

		Log "Stopping services"
		Stop-Service FSCController,MSExchangeTransport,MSExchangeIS -Force

		Log "Enabling Forefront"
		$fscutility = "C:\Program Files (x86)\Microsoft Forefront Protection for Exchange Server\fscutility.exe"
		Invoke-Expression $fscutility /enable

		Log "Starting services"
		Start-Service FSCController,MSExchangeTransport,MSExchangeIS

}

When I upgraded two servers side-by-side, one with the CustomPatchInstallerActions.ps1 and one without, the one with the script updated without any problems and the one without hung while trying to start the services afterwards.

So in my testing this appears to work well, but it is something you should test in your own environment before relying on it too heavily.

Note that this script can be used for all kinds of situations even when Forefront is not installed. If you have any pre- or post-install actions required in your environment (eg running the StartDagServerMaintenance.ps1 script, disabling backups, disabling other antivirus software, sending an email alert to your team) you can include those in this CustomPatchInstallerActions.ps1 script.

Related posts:

• PowerShell Script to Generate Email Traffic in a Test Lab Environment
• How to Health Check an Exchange 2010 Mailbox Server
• How to List all Users Who Have Access to Other Exchange Mailboxes
• How to Generate a HTML Report of Your Exchange 2010 Environment
• PowerShell Script: Check Exchange Mailbox Database Last Backup Time

This article Dealing with Exchange Server Update Rollups and Forefront Protection for Exchange is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

I run this report almost every day (we retain up to 30 days of message tracking logs so running every day is not required) to look for any patterns or trends that may concern us.

The report can be quickly generated using Log Parser. Install it on the server and run the following query from the folder where the message tracking logs are stored.

SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date,
       COUNT(*) AS Hits
from *.log
where (event-id='RECEIVE')
GROUP BY Date
ORDER BY Date ASC

As a single command line it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS Hits from *.log where (event-id='RECEIVE') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

Date       Hits
---------- ----
2012-03-17 5311
2012-03-18 2575
2012-03-19 6296
2012-03-23 283
2012-03-24 1
2012-03-25 1
2012-03-26 5
2012-03-27 1
2012-03-29 635
2012-03-30 255
2012-03-31 883
2012-04-01 856
2012-04-02 1051
2012-04-03 1178
2012-04-04 1145
2012-04-05 1138
2012-04-06 1203
2012-04-07 866
2012-04-08 1016
2012-04-09 1210
2012-04-10 1171
2012-04-11 833
2012-04-12 26
2012-04-14 21
2012-04-15 1

Statistics:
-----------
Elements processed: 106917
Elements output:    25
Execution time:     2.66 seconds

Pretty useful on its own, but if you plan to create graphical reports using this data you can save yourself a bit of time and let Log Parser generate the chart for you, as long as you have Office or the Office Web Components installed on the computer running Log Parser.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS [Daily Email Traffic] INTO DailyTraffic.gif from *.log where (event-id='RECEIVE') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

Related posts:

• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with PowerShell

This article Calculate Daily Email Traffic using Message Tracking Logs and Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com