Exchange Server Pro

What’s New at Exchange Server Pro

Paul Cunningham — Fri, 30 Jul 2010 05:00:29 +0000

There has been a few changes lately for this site and for myself.

Firstly, I am no longer a contributor to the All Spammed Up and The Email Admin blogs. After about 18 months of writing weekly articles for those sites I decided to bring it to an end and put some of that time back towards my own projects such as this site.

All up I wrote 82 articles for All Spammed Up and 65 articles for The Email Admin and I enjoyed it immensely. Hopefully getting back that time can help me build more value into this site for IT pros working with Exchange Server which is my long term goal.

Secondly, this site has had a minor overhaul in design and layout to structure the content better and make it easier to find. I’m still working on adding in some of the new design elements but all of the content is there for you to enjoy. If you do spot any major bugs please drop me a line to let me know.

Finally I’ve changed the way that email subscribers receive updates from the site. Instead of emails going out at random intervals they will now go out on Mondays with a summary of the previous week’s new posts. I chose Monday because according to my email stats more of you open the email on Monday than any other day.

If you’re not already a subscriber you can sign up using the form at the top right of this page or click here to sign up instead.

Besides receiving regular updates subscribers will also get access to some special bonus content that I am working on, similar to the Exchange 2007 Transition Guide that many of you signed up to receive.

Thanks to all of my subscribers and visitors for your ongoing support.

Image Credit: Flickr

Exchange 2010 Certificate Revocation Checks and Proxy Settings

Paul Cunningham — Thu, 29 Jul 2010 09:00:27 +0000

The Microsoft Exchange Team blog posted about an issue people are experiencing in the field in which certificate revocation status check failures prevent you from assigning a certificate to any Exchange services.

If Exchange can’t access the CRL, the certificate status is returned as RevocationCheckFailure by the shell. In EMC this is displayed as The certificate status could not be determined because the revocation check failed.

When a certificate fails a revocation check due to any of the above reasons, the EMC prevents you from assigning the certificate to any Exchange service. Note, this does not impact certificates that have already been assigned to Exchange services. The services will continue to function.

- Source

Two of the causes of this are listed as:

# Network or proxy misconfiguration, or a firewall rule preventing Internet access

# Intentional blocking of Internet connectivity from the server

In a comment on the post I mention using proxy settings to work around the issue. In other words, if you can use a proxy in Internet Explorer to browse the web when you’re logged onto the server, then you can use this workaround. However, you need to proceed with caution or you may inadvertently break your management connection to the Exchange server.

Firstly, you can check the server’s proxy settings using the netsh command (proxycfg is no longer available in Windows Server 2008 R2).

C:\>netsh winhttp show proxy

Current WinHTTP proxy settings:

    Direct access (no proxy server).

Note: if you can resolve the direct access issue at your proxy/firewall then that is going to be easier than using this procedure. Otherwise, read on.

If you have the correct proxy settings configure in Internet Explorer then netsh lets you import that configuration to the server.

C:\>netsh winhttp import proxy ie

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  (none)

Depending on your environment you may find that this breaks you connection to the Exchange server using either the Exchange Management Console or Exchange Management Shell.

VERBOSE: Connecting to ex1.exchangeserverpro.local
[ex1.exchangeserverpro.local] Connecting to remote server failed with the following error message : The client cannot c
onnect to the destination specified in the request. Verify that the service on the destination is running and is accept
ing requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonl
y IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and co
nfigure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportExc
   eption
    + FullyQualifiedErrorId : PSSessionOpenFailed

The reason for this is that the Exchange Management Shell is trying to make a remote connection to the server, even when you are logged on to the server that you want to manage. This is known as Remote Shell and you can read more about it here.

You can see here that when I launch the Exchange Management Shell on my lab server there are corresponding entries in the IIS log files for the connection that I just made to the /powershell virtual directory.

So why this breaks your management connectivity to the server is if the proxy you are using is not correctly configured to let you access local websites. Fortunately you can resolve this by using proxy exceptions on your local Internet Explorer settings.

If I configure Internet Explorer to automatically bypass for local sites, and then re-import the settings to the server with netsh, I see different output.

C:\>netsh winhttp import proxy ie

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  < local >

In some cases this still might not work if Internet Explorer is not correctly detecting local sites and bypassing the configured proxy. In that case you can manually specify the proxy exceptions in Internet Explorer.

Again when you re-import using netsh you see a different result.

C:\>netsh winhttp import proxy ie

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  *.exchangeserverpro.local;< local >

Alternatively, you can set a proxy configuration for the server that is different to that of your own Internet Explorer settings.

C:\>netsh winhttp set proxy proxy-server="http=10.10.10.10:80" bypass-list="*.exchangeserverpro.local"

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  *.exchangeserverpro.local

Again you need to make sure you set the correct exceptions so that management connectivity to the server isn’t broken in the process.

If you can get the proxy settings configured with the right proxy and exceptions you should be able to connect to the server with the console and shell, and also have the server successfully perform CRL checks for your SSL certificates.

COM Class Factory Error 8007007E Moving Mailboxes in Exchange Server 2007

Paul Cunningham — Wed, 28 Jul 2010 09:00:04 +0000

On an Exchange Server 2007 an error may occur when attempting to use the Mailbox Move Wizard or the Move-Mailbox cmdlet to move a user mailbox.

Retrieving the COM class factory for component with CLSID {08D1AA55-704E-4397-AB29-55D2A3972BCB} failed due to the following error: 8007007e.

The Application event log will contain a corresponding log entry.

Event Type: Error
Event Source: MSExchange Common
Event Category: General
Event ID: 4999
Date: 21/07/2010
Time: 4:07:01 PM
User: N/A
Computer: SERVER
Description:
Watson report about to be sent to dw20.exe for process id: 5312, with parameters: E12, c-RTL-AMD64, 08.02.0176.002, mmc, M.E.Management, M.E.M.R.MoveMailbox.CreateMigrationComObject, S.IO.FileNotFoundException, 911d, 08.02.0176.002. ErrorReportingEnabled: False

Notice the S.IO.FileNotFoundException part of the event log entry. This is a clue that there is a file missing. The question is, which file?

The answer is in the CLSID from the error message. By searching the registry for the CLSID we find the following entry.

The CLSID corresponds with the migbase.dll file in the Exchange Server binaries folder. On the server that was having this error the file was missing entirely, for reasons unknown.

There are three ways to recover the file:

Restoring from backup (may be difficult if you don’t know when it went missing)
Copying from another server (make sure you choose a server of the same Service Pack and Update Rollup version)
Applying/re-applying the latest Service Pack

How to Remove Mail Users from the Global Address List

Paul Cunningham — Tue, 27 Jul 2010 09:00:47 +0000

The default Global Address List in an Exchange 2007 or Exchange 2010 organization includes all mail-enabled objects. It does this using the following recipient filter:

((Alias -ne $null -and RecipientType -ne 'MailUser') -and ((((ObjectClass -eq 'user' -or ObjectClass
-eq 'Contact' -or ObjectClass -eq 'msExchSystemMailbox') -or ObjectClass -eq 'msExchDynamicDistributi
onList') -or ObjectClass -eq 'group') -or ObjectClass -eq 'publicFolder'))

You can see that the following object classes are included:

User
Contact
System Mailbox
Dynamic Distribution Group
Group
Public Folder

In some environments it may be desirable to exclude Mail Users. Mail Users are similar to Contacts in that they do not have a mailbox in the local Exchange organization, however unlike Contacts they do have a user account in Active Directory.

In other words, Mail Users are mail-enabled user objects that use an external email service.

Mail Users are displayed in the same area of the Exchange Management Console as regular Contacts, which may lead you to think that excluding them from the Global Address List is as simple as removing this part of the recipient filter:

-or ObjectClass -eq ‘Contact’

However that is not correct, and will not remove Mail Users from the Global Address List. To understand how to actually do this take a closer look at the attributes of a Mailbox User and a Mail User.

[PS] C:\>get-mailbox "John Smith" | fl objectclass, recipienttype

ObjectClass   : {top, person, organizationalPerson, user}
RecipientType : UserMailbox

[PS] C:\>get-mailuser "Peter Banes" | fl objectclass, recipienttype

ObjectClass   : {top, person, organizationalPerson, user}
RecipientType : MailUser

Notice that both are the same ObjectClass of ‘user’, which would still be included in the recipient filter if you were to simply remove the ‘Contact’ object class.

Instead, to remove Mail Users from the Global Address List you should exclude them by Recipient Type. You can do this by including the following condition in your recipient filter:

RecipientType -ne ‘MailUser’

For example:

Set-GlobalAddressList "Default Global Address List" -RecipientFilter {(Alias -ne $null -and RecipientType -ne 'MailUser' -and (ObjectClass -eq 'user' -or ObjectClass -eq 'Contact' -or ObjectClass -eq 'msExchSystemMailbox' -or ObjectClass -eq 'msExchDynamicDistributionList' -or ObjectClass -eq 'group' -or ObjectClass -eq 'publicFolder'))}

If you’re making this change to the default Global Address List see my previous post with the solution to the error that occurs when modifying the default Global Address List.

Unable to Modify Default Global Address List

Paul Cunningham — Mon, 26 Jul 2010 09:00:21 +0000

If you try to modify the recipient filter of the default Global Address List in Exchange Server 2010 you will receive an error message:

You can’t peform this operation on default global address list “Default Global Address List”.

The recipient filter of the default Global Address List can be modified once during conversion from Exchange 2003 but not after that. If you want to change the default Global Address List recipient filter after that you must either:

Create a new Global Address List with the desired recipient filter
Temporarily modify the Global Address List so that it isn’t the default

For the second option you can refer back to my earlier post on fixing the issue where there is no default Global Address List in the organization. This is determined by the msExchRecipientFilterFlags attribute of the object.

Simply use ADSIEdit.msc to modify the attribute from 3 to 0, apply the change to the Global Address List recipient filter, then return to ADSIEdit.msc and set the flag back to 3. For more detailed instructions check out my previous post.

Exchange Best Practices Analyzer Reports Unrecognized Exchange Signature

Paul Cunningham — Fri, 23 Jul 2010 09:00:17 +0000

After the transition to Exchange Server 2010 the Exchange Best Practices Analyzer will report a critical error of “Unrecognized Exchange signature”.

ExBPA may report the unrecognized signature as 12639. The error may lead you to believe that the Active Directory Schema has not been properly prepared for Exchange Server 2010.

Unfortunately Microsoft Technet has contradictory advice on this error.

The Exchange Server 2010 planning and deployment documentation stats that 12640 is the correct schema version for Exchange 2010 RTM.

The objectVersion property is in the CN=, CN=Microsoft Exchange,CN=Services,CN=Configuration,DC= container. The objectVersion value for Exchange 2010 RTM is 12640.

However the ExBPA documentation says that 12639 is the correct schema version for Exchange 2010 RTM.

For Exchange Server 2010, the objectVersion value is 12639

As it turns out the error is the result of a bug in ExBPA, according to Jetze Mellema (an MVP).

I just received feedback from the ExBPA team, this is a known issue now and will be fixed in SP1 for Exchange 2010.

So the error can be ignored and will be fixed with Service Pack 1. Beta testers of SP1 are already saying that the problem no longer occurs in that build of the ExBPA. It would be useful to backport the fix to the current ExBPA version, and shouldn’t be all that difficult considering the ExBPA has its own builtin update feature, but it seems we just need to wait instead.

Exchange Best Practices Analyzer Reports Default Global Address List Missing

Paul Cunningham — Thu, 22 Jul 2010 09:00:38 +0000

I always run the Exchange Best Practices Analyzer at the end of a transition project to Exchange Server 2007 or 2010, just to catch any issues that still might exist in the organization.

One of the issues I have encounted a few times is that the ExBPA will report the Default Global Address List missing.

This error is confusing if you simply look at your Address Lists in the organization and can clearly see the Default Global Address List is present. However if you dig a little deeper in the Exchange Management Shell you can see the problem:

[PS] C:\Admin>Get-GlobalAddressList | fl

IsDefaultGlobalAddressList   : False
Name                         : Default Global Address List

As you can see the IsDefaultGlobalAddressList attribute is set to false. Unfortunately this is not as simple to fix as just running Set-GlobalAddressList, as there is no argument for that cmdlet to change that attribute.

Instead you must modify the attribute using ADSIEdit.msc. Launch ADSIEdit.msc and connect to the Configuration naming context.

Navigate to the Default Global Address List object. You’ll find it in CN=Configuration,dc=yourdomain/CN=Services/CN=Microsoft Exchange/CN=yourorganization/CN=Address Lists Container/CN=All Global Address Lists. Open the properties of the GAL object.

Find the msExchRecipientFilterFlags attribute in the list.

Edit the attribute value and set it to 3.

Press OK and then apply the changes.

You may need to wait a short time for Active Directory to replicate the change. When you query the Default Global Address List properties now you should see that IsDefaultGlobalAddressList is set to True, and ExBPA will not report this error in future scans.

[PS] C:\Admin>Get-GlobalAddressList | fl

IsDefaultGlobalAddressList   : True
Name                         : Default Global Address List

Public Folders Not Replicating Between Exchange 2007 and 2010

Paul Cunningham — Tue, 06 Jul 2010 05:14:28 +0000

During a migration from Exchange Server 2007 to Exchange Server 2010 you may encounter a problem with the replication of public folders.

In this situation neither the public folder hierarchy or content will replicate from Exchange Server 2007 to a public folder database on Exchange Server 2010. This will usually occur in Exchange organizations that have previously run versions of Exchange Server 2003 or below.

No PF Hierarchy

The Exchange Server 2010 Application Event Log will have this error:

Log Name:      Application
Source:        MSExchange Store Driver
Date:          13/06/2010 2:08:36 PM
Event ID:      1020
Task Category: MSExchangeStoreDriver
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SERVER
Description:
The store driver couldn't deliver the public folder replication message "Status Request (PublicFolders@domain.com)" because the following error occurred: The Active Directory user wasn't found..

The cause of this error is a legacy container in Active Directory for the Exchange 2003 (or earlier) server objects.

Note: this only applies to organizations that no longer run any Exchange 2003 or earlier servers. Do not follow these steps if you still have Exchange 2003 or earlier versions running in your organization.

Launch ADSIEdit.msc and navigate to CN=Configuration , CN=Services, CN=Microsoft Exchange, CN=, CN=Administrative Groups, CN=, CN=Servers.

Navigate to the CN=Servers container

If you no longer operate any Exchange 2003 or earlier servers and the Servers container is empty then you can delete the container.

You should now be able to replicate the public folder hierarchy and content from Exchange Server 2007 to 2010.

Understanding the Exchange Server Spam Confidence Level

Paul Cunningham — Wed, 23 Jun 2010 14:05:47 +0000

If you have looked at Exchange Server’s anti-spam features or taken a peek at the headers of an email sent through an Exchange server you have probably encountered the term SCL before.

SCL stands for Spam Confidence Level. It is the “score” that Exchange Server anti-spam assigns to an email based on the email’s contents. This score is then used to make decisions as to how to handle suspected spam based on the thresholds that the Exchange administrator configures.

Having a detailed understanding of the SCL and how it is used in Exchange Server anti-spam will allow an email administrator to get good performance from their anti-spam deployment.

Review of GFI Backup Business Edition

Paul Cunningham — Mon, 21 Jun 2010 13:09:36 +0000

GFI has recently released two backup products, a free one for home users and a paid product for business users. I downloaded and tested the Business Edition to see if it was as easy to install and use as they claim.

Installation

Installing GFI Business Edition was quite simple following an easy to understand setup wizard. I installed it on a virtualized server running Windows Server 2008 with Service Pack 2.

There are no complex set up requirements such as SQL databases to worry about. GFI Backup installs its own web server and listens on a custom port (you can change the port if you wish) for administration access, as well as ports for communications with remote agents.

Though I found this very easy to install I had to manually open firewall ports on the Windows Server 2008 server to allow remote administration access as they weren’t opened automatically by the installer as with some other applications.

Backing Up Files

Remote agent deployment can be performed using Group Policy or by manually initiating it from the remote server. There is no push option available to roll out remote agents.

The GPO deployment option would be suitable for deploying the remote agents to desktops and laptops but not as convenient for servers. For servers the manual agent deployment is best, though the most effort. If you want to save time you could script the server agent install but whether that saves you time will depend on the size of your environment and your scripting skills.

Backup types are file/folder, or SQL only. There is no option to backup Exchange Server or Active Directory. This would seem to be the greatest weakness of GFI Backup however for small businesses that run in a workgroup configuration without Active Directory, or have their email service hosted in the cloud these aren’t going to present a problem.

The default backup inclusions/exclusions that define a broad range of common productivity file types are useful especially when creating backup jobs for PCs.

The backup destination is quite flexible. Backing up to central location (can be disk or tape) on one main server is available, but each agent can also be configured to backup to its own local drive instead. This is again very useful for PC backups, as they can be configured to backup their most important user files to a second hard drive on the machine without consuming more expensive server disk or tape capacity.

The backup files themselves can optionally be compressed using ZIP compression. In my test this saved about 50% space for the Windows Server 2008 server. The ZIP files can also be password protected and AES encrypted.

Backups can be scheduled and include options for email notifications to backup administrators.

Restoring Files

There are two restore options driven by yet another simple wizard. You can restore either an entire system or perform item-level restores.

Unfortunately there is no bare metal restore capability, but with the speed of modern OS installations (ie Windows 2008 and Windows 7) and alternatives such as Windows Deployment Services it would still be feasible to quickly reinstall an operating system or SOE onto bare metal and then use GFI Backup to recover all of the user data for that system.

Overall Impression

GFI delivers on the ease of use promise with only a few trade offs. I found myself looking for the type of features and settings that I normally see in enterprise class backup products, but quickly realised that the ones that aren’t there are not really necessary for most small to medium businesses anyway.

The lack of support for Exchange and Active Directory backups makes GFI Backup less suited to Windows Small Business Server networks. Theoretically you could use pre and post tasks in GFI Backup to run scripted Windows Backups first, and then backup those files using GFI Backup but that adds a little too much complexity for my liking.

You could also use Windows Backup for those components and GFI Backup for everything else but again that detracts from the ease of use benefits of GFI Backup.

My only other complaint was the lightbox effect in the web administration console, which could perform poorly when remotely supporting clients over low bandwidth connections.

Overall I would consider GFI Backup Business Edition and good backup solution for the small or medium sized business that runs email and other applications in the cloud, and needs a simple backup solution for their Windows PC’s, file servers, and database servers.

Exchange Server Pro

What’s New at Exchange Server Pro

Related posts:

Exchange 2010 Certificate Revocation Checks and Proxy Settings

Related posts:

COM Class Factory Error 8007007E Moving Mailboxes in Exchange Server 2007

Related posts:

How to Remove Mail Users from the Global Address List

Related posts:

Unable to Modify Default Global Address List

Related posts:

Exchange Best Practices Analyzer Reports Unrecognized Exchange Signature

Related posts:

Exchange Best Practices Analyzer Reports Default Global Address List Missing

Related posts:

Public Folders Not Replicating Between Exchange 2007 and 2010

Related posts:

Understanding the Exchange Server Spam Confidence Level

Related posts:

Review of GFI Backup Business Edition

Installation

Backing Up Files

Restoring Files

Overall Impression

Related posts: