RetroHack

howto://dump a list of users with email address and upn

Ed Fisher — Thu, 09 May 2013 01:00:00 +0000

I needed to dump a list of all users in a forest so that I could compare their UPN to their email address. I came up with this PS command that will connect to a GC, enumerate all users in the forest, and output a CSV that lists their displayname, emailAddress, and UPN. It will skip users with blank email or display, or accounts that are disabled.

The scriptlet assumes whoever runs it has administrative rights, and has the RSAT tools for AD installed on the machine they are using so the AD module exists. It doesn’t require anything else.

import-module activedirectory

get-aduser -filter {(EmailAddress -like "*") -and (DisplayName -like "*") -and (Enabled "True")} -searchscope subtree -searchbase ‘dc=yourdomain,dc=tld‘ -properties DisplayName, EmailAddress, UserPrincipalName, proxyAddresses -server yourgc.yourdomain.tld:3268 | select-object displayname, emailaddress, userprincipalname | export-csv c:\scratch\users.csv

Make sure you change the variables in italics to match your environment. Hope this helps someone out. If it does, consider a shoutout in the comments, or a follow on Twitter as a great way to say thanks!

howto://fix diablo 3’s “click to retry creating d3d device”

Ed Fisher — Mon, 21 Jan 2013 18:41:53 +0000

So I got Diablo 3 for Christmas, and have been really enjoying it on my underpowered Acer Aspire 1830 laptop (underpowered for this game…it’s a great laptop for what I need.) But with more travel on my horizon, I wanted to install it on my Dell 6220, which is my travel kit. Unfortunately, each time I tried to run Diablo 3, it would bomb out, displaying an error that, if you’re reading this, you are probably all to familiar with.

“Graphics Error-Click to retry creating D3D device.” You can click retry four time before it finally gives you the option to cancel, and you’re sitting there dead in the water. Many posts talk about how your hardware must suck, and that you are SOL, but here is what worked for me.

If you are running Windows 7 or Windows 8, first, set Diablo 3 to run in compatibility mode for XP SP3. That alone should be all you need to do in order to launch the game. If you like playing in full screen mode, you’re done. If you prefer windowed mode, you now can access options and put the game into windowed mode, and once you do, you don’t even have to run in compatibility mode anymore. Windowed mode works far better on machines that don’t have $200 graphics cards…you know, the ones you do actual work on, as opposed to those we call “gaming rigs.”

I hope this helps some of you out. Here’s something else that might help you out. Diablo 3 seems to offer less to the casual gamer than did Diablo 2, and expects far more from the hardcore gamer. I’m not a hardcore gamer, I have a life, a wife, children and a job. Diablo 2 could be an amusing distraction for 30 minutes at a time, once or twice a week. Diablo 3 actually has a “real money” auction where you can go spend actual cash to get ahead in the game. Screw that. If it requires the kind of time investment that only college students and guys living in their parents’ basements can invest, with nightly play sessions lasting until 2AM, and the expectation that you need to spend more cash to advance, this will be my last Blizzard purchase. And this is for those guys living in their parents’ basements. GET OUT!!! GET A JOB!!! GET A GIRLFRIEND!!! Don’t be this guy!

Direct link for RSS and email subscribers…http://youtu.be/I43GUnZN_s4

If you found this post useful, please consider following us on twitter. You’ll be the first to learn about new posts, and, rarely, we’ll share a comedic or witty tweet. Of course, you can also leave a comment below to let us know we hooked you up, or share the love and tell your friends about us.

Keep Calm and Carry On

Ed Fisher — Fri, 04 Jan 2013 18:09:02 +0000

Please check out the video below, and then visit http://keepcalmcampaign.co.uk/ to sign an e-petition against a truly egregious attempt to abuse trademarks and copyright laws.

Direct link for RSS and email subscribers…http://youtu.be/FrHkKXFRbCI

howto://customise Lync 2013 status messages

Ed Fisher — Mon, 17 Dec 2012 21:28:00 +0000

Victory is mine! I have figured out how to customise Lync 2013 status messages in much the same way that I previously used to customise Lync 2010. If you have recently upgraded to Office 2013, and I can tell which of you did by the big smiles, then this post’s for you!

1. Create an XML file on your desktop using your favourite text editor and call it presence.xml.

2. Paste the following text into that file, making sure you don’t get smart quotes by accident.

< customStates xmlns="http://schemas.microsoft.com/09/2005/communicator/customStates" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation= "http://schemas.microsoft.com/09/2005/communicator/customStates "> < customState ID="1" availability="online"> < activity LCID="1033">Loving my commute < /customState> < customState ID="2" availability="busy"> < activity LCID="1033">Deadline looming, send coffee < /customState> < customState ID="3" availability="busy"> < activity LCID="1033">But not at my PC...call my cell. < /customState> < customState ID="4" availability="do-not-disturb"> < activity LCID="1033">Presenting, so everyone will see < /customState> < /customStates>

Or you can just download my version, found here. Hooray for Dropbox! What??? You don’t have a Dropbox? Inconceivable! Click here my friend for 2GB of free storage!

3. Launch regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\.

4. Create a key structure below that point for Office\15.0\Lync so that you have a full path HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\15.0\Lync

5. Then, you will need to tell Lync it can accept a presence.xml file without using HTTPS. Create a REG_DWORD called EnableSIPHighSecurityMode and set that value to 0.

6. Next, create a REG_SZ (string) called CustomStateURL and give it a value of “file:///C:/Program Files (x86)/Microsoft Lync/presence.xml” if you are running 64bit, or “file:///C:/Program Files/Microsoft Lync/presence.xml” if you are running 32bit. In either case, don’t include the quotes.

7. Then, create a REG_DWORD called EnableAppearOffline and give it a value of 1.

Or, you can just download my reg file and merge it into your registry if you are using 32bit Lync on 64bit Windows 8. Here’s another chance to get that free 2GB of storage!

8. Copy the presence.xml file to whichever path from step 5 is appropriate for you.

9. Exit and relaunch Lync, and see your new status options.

Two more things to keep in mind. First, don’t leave yourself as “Appear Offline” for too long, or folks will think you’re goofing off. Second, federated contacts won’t see your custom messages. That is not necessarily a bad thing, but if you want them to see it to, change their relationship to “colleagues.”

And since I got a song idea from an earlier comment on another post, and am really pleased to finally have this working on Lync 2013, here’s the little ditty I’m currently doing the Snoopy Dance to. Enjoy!

Direct link for RSS and email subscribers…http://youtu.be/ieOwL1UB1V4

howto://activate the wrong version of Windows 8

Ed Fisher — Fri, 09 Nov 2012 00:16:41 +0000

Have you ever gone to MSDN or TechNet, downloaded an operating system ISO, installed it, and then discovered you grabbed the KMS version by mistake, and you don’t have a KMS server? Yeah, I hate it when that happens! Fortunately, you don’t have to flatten your box and start over again. There’s a (somewhat) easy way to add your activation key to an install of Windows 8. Here’s how to do it.

Either open an administrative cmd prompt, or just press Win+R and enter the following command.
slui 3 [enter]
In the window that opens, enter your product key, and click Activate.
Reboot, and you’re good to go.

Instead of a catchy tune, I wanted to share with you an awesome set of videos I recently discovered. Think a rap version of Thunderdome meets Celebrity Deathmatch, MC’d by StrongBad, and you have Epic Rap Battles of History!!!!

Direct link for RSS and email subscribers…http://youtu.be/AeNYDwbm9qw

If this post helped you out at all, how about a shout out with a comment below, or maybe even a follow on Twitter? It’s costs nothing, and shows the love. Retweets are nice too!

howto://create test users with mailboxes and data

Ed Fisher — Tue, 23 Oct 2012 00:00:00 +0000

Today’s post came out of a need to create 500 test users in AD, provision mailboxes for those users in Exchange 2010, and populate the mailboxes with data, all of which will be used to test velocity migrations from the on-prem Exchange 2010 environment to Office 365. As such, this post gets five different tags, which may be a record for me. To accomplish this task, I need three distinct steps to pull it off. I expect that there is an easier way to do it, or to do some of the separate operations in combined steps, but this works for me, so here it is. If you need to create a few hundred users, give them mailboxes, and add data to those mailboxes, you know what to do next.

This post assumes you have at least Domain Admin and Exchange Org membership, and that your Exchange servers are running at least Exchange 2010 SP2. If they are not, stop, this won’t work for you. It also requires the Quest AD PowerShell snap-in. You can download it from this page and if you are using a 64 bit machine for the AD stuff, you can grab the MSI from ActiveRoles Management Shell for Active Directory 64-bit. In the script below, I am using example.com as my domain, and TestUsers as the OU in that domain. You can adjust your values as necessary.

On a workstation that is domain joined, or on a domain controller, download and install the Quest ActiveRoles Management Shell (link above.)
Open an administrative PowerShell session (not an EMS or remote PS) and run the following command.
```
Add-PSSnapin Quest.ActiveRoles.ADManagement [enter]
```
Now create a PowerShell script to create the users. I borrowed heavily from Austin Osuide’s post at the WinServerTeam.org.uk site to create this one. You can use mine, or Austin’s, or roll your own to fit your needs.
#Create the csv file with headings as shown below. You can add additional headings if you wish, just make sure you populate them and call them later in the script. $outfilename = "out.csv" "samAccountName,userPrincipalName,cn,sn,givenName,displayName,Password" | Out-File $outfilename - encoding ASCII # Now, populate the csv for 500 users. Increase/decrease the 501 as needed for the number of users you want. for ($i = 11; $i -lt 501; $i++){ $samAccountName = "testUser" + "$i" $userPrincipalName = 'testUser' + "$i" + '@example.com' $cn = "test" $sn = 'user' + "$i" $givenName = "test" $displayName = "Test" + " " + "User" + "$i" $password = "Password1" "$samAccountName, $userPrincipalName, $cn, $sn, $givenName, $displayName, $password" | Out-File $outfilename -encoding ASCII -append } # Import the csv entries into AD as user objects Import-Csv out.csv | ForEach-Object { New-QADuser -ParentContainer 'OU=TestUsers,DC=example,DC=com' -Name $_.samAccountName -samAccountName $_.samAccountName - userPrincipalName $_.userPrincipalName -FirstName $_.cn -LastName $_.sn -displayName $_.displayName -password $_.password } # Enable the user objects Get-QADUser -SearchRoot 'OU=TestUsers,DC=example,DC=com' | Set-QADuser -ObjectAttributes @
{userAccountControl='512'} # EASY!
In the same PowerShell session, run the script you just created. Expect it to show out of order numbers as it creates the users. I don’t know why.
Then on the Exchange server, open an Exchange Management Shell and run this command. It’s all one line. I got this from an answer Karl Mitschke submitted to a support forum question.
Get-User -OrganizationalUnit "OU=TestUsers,DC=example,DC=com" -Filter 'RecipientType -eq "user"' | ForEach-Object { $email = $_.FirstName +"."+ $_.LastName +"@example.com"; Enable-Mailbox -Identity $_.SamAccountName -DisplayName $_.DisplayName -Alias $_.SamAccountName -PrimarySmtpAddress $email -Database "Mailbox Database 0500606304"} [enter]

Note, you can omit the –Database “string” if you want to let Exchange create the mailboxes across all available databases.
Now, before you can begin the final stage, you must grant your account permissions to Import and Export mailboxes. If you don’t do this, you won’t even see the command we need later. In the same EMS session, run this command for your user account.

New-ManagementRoleAssignment –Role “Mailbox Import Export” –User AD\efisher [enter]
Log off and back on.
Create a share on the Exchange server (or elsewhere) to store your PST file for import. For the import to work, the PST must be accessed using a UNC path, even if you store it on the Exchange server. We’ll assume you have it on \\FS1\PST
Grant the Exchange Trusted Subsystem Full Control to the Share, and also NTFS permissions.
Now run this command to import the PST to all your test users. Depending on the size of the PST and number of users, expect this to take hours.

get-mailbox –organizationalunit TestUsers | new-mailboximportrequest –filepath \\FS1\PST\data.pst [enter]

And you’re done! Well, you are done. The EMS will need time to churn through all the imports. You can run this command to see how things are progressing.

get-mailboximportrequest | ft mailbox, targetdatabase, status –auto [enter]

Keep an eye on things, and sooner or later, you will have all the test mailboxes you need.

I started my morning looking for a one-stop solution that would do all this for me. I did not find that. But I did find enough pieces and parts across a handfull of posts and forums to cobble this all together, and that is just what I needed. I love the Internet. If you search hard enough, and well enough, there’s always someone out there who will give you just enough to send you on your way.

Direct link for RSS and email subscribers…http://youtu.be/IGMabBGydC0

If this post helped you out at all, how about a shout out with a comment below, or maybe even a follow on Twitter? It’s costs nothing, and shows the love. Retweets are nice too!

10 Best Things about an Email Archiving Solution

Guest Post — Thu, 18 Oct 2012 00:40:40 +0000

Isn’t it funny how a system built around a “best effort” protocol that was specifically designed for delay and latency, is now arguably the most important line of business application in your environment? The same coworkers who were probably using an AOL account only a few years ago now live and breathe email, and businesses have moved from ACID-based transactions to conducting multi-million dollar deals all over email. Orders, verifications, contracts and other important documents all rely upon email daily, and more users rely on the history in their inbox than anyone would care to admit. With email now playing such a mission-critical role in most companies’ business processes, it amazes me the use of email archiving is not as widespread as one would expect.

An email archiving solution is one of the best things you can add to your email infrastructure. It provides so many benefits that it quickly becomes indispensable, both to users and admins, and can greatly extend the useful life of servers too. Here are the 10 best things you can get from an email archiving solution:

1. Unlimited storage

Email archiving solutions can provide virtually unlimited storage to your users. Rather than dealing with quotas and juggling PST files, users can now keep as much mail as they want, including all of it, since you can use cost-effective storage to host your email archives, freeing up space on the premium storage you allocate to Exchange.

2. Redundancy

Email archiving solutions provide redundancy to your admins and your users. Email stored in the archive can be accessed even when Exchange is completely down, providing 24x7x365 access to email even during maintenance windows.

3. Compliance

Email archiving solutions enable companies to comply with audit requirements for both internal policies and external demands from things like HIPPA or Sarbanes-Oxley, as well as PCI and other requirements.

4. Search

The search capabilities in email archiving solutions are significant, and can make it easy for users to search their own content, or administrators/compliance managers to search across multiple mailboxes efficiently.

5. Single-Instance Storage

Email archiving solutions bring back the concept of single-instance storage, so that an email with a 10MB attachment that was sent to 800 of your users can be stored in the archive as a single message, saving space.

6. Boost server performance

Reducing the overall size of mailbox databases relieves overburdened Exchange Servers. They can cache more active mail in RAM when they have less content that’s old to deal with.

7. Shorten backup and restore operations

Larger Exchange databases take longer to back up and, should disaster strike, take longer to restore. By moving older content to the archive, email archiving solutions reduce the total time it will take to back up or restore an Exchange mailbox database.

8. Eliminate PSTs

The number one reason users create PSTs is because they hit their mailbox quota. Users don’t want to delete older messages in case they might need them later, so the email is moved to a PST in case they want to send and receive again. Fast forward weeks or months later and you are now spending time trying to repair corrupt PST files, or restoring older versions of their mailbox from tape because they lost a PST that had critical data. With an email archiving solution in place, there is no more need for PST files.

9. Data mining

There’s much more intellectual property in email than just the mailbox content. Patterns that define how your business communicates, both internally and externally, can be mined to provide valuable insights into how the company actually works. Email archiving solutions that offer advanced insight into email communications can provide a wealth of data to admins and management alike.

10. Easy implementation

The best thing about an email archiving solution is how easy it is to implement. Because it is a separate system, it can be built up alongside your Exchange environment, and a simple change to the SMTP routing is all it takes to start using it. You can easily evaluate the system without any significant changes to your infrastructure, which makes for a risk free trial.

With so many benefits that come with an email archiving solution, how many would you take advantage of? Look at email archiving solutions today as the best single enhancement you can make to your mission-critical messaging infrastructure.

This guest post was provided by Casper Manes on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. Find out how your organization can benefit from having an email archiving solution in place.

All product and company names herein may be trademarks of their respective owners.

Avast ye salty sea dogs! Savvy what day this be?

Ed Fisher — Wed, 19 Sep 2012 12:07:06 +0000

Troubleshooting Exchange Archiving Issues

Guest Post — Fri, 07 Sep 2012 22:13:00 +0000

As mailboxes grow, admins find themselves needing to deploy Exchange archiving to meet the storage demands of their users, while also ensuring continued performance of the overall system. Archive mailboxes are very similar to regular mailboxes, but there are some subtle differences that can make troubleshooting their use challenging. Here’s how to troubleshoot the most common Exchange archiving issues.

I/O load is high on archive database

Exchange archiving creates a second mailbox for users to store content that can be moved to the archive manually by the user, or automatically by rule or retention policy. Because these actions are usually based upon the age of the item, often times we see that admins use the less expensive, slower storage for their archive databases, since the data should be accessed less frequently. It sounds like a good idea, but remember that Outlook does not cache content from archive mailboxes. There’s no OST file on the user’s workstation, so all access to the archive is in “live” mode. This can actually lead to a need for higher performance storage for the archive databases than for the primary mailboxes, so spec out your hardware carefully.

Archive is not available to certain clients

Users can access the archive mailbox using Outlook 2007 and later, or Outlook Web App. And since there is no OST for archive mailboxes, make sure Outlook can connect to Exchange. The archive mailbox is not accessible by other email clients, or any ActiveSync device. If a user complains that their archive mailbox is not available to them, make sure that they are using Outlook or OWA, and are on the network.

You cannot create an archive for a user

Archive mailboxes are relatively new, so if you are dealing with a mixture of Exchange 2003 and later, make sure that the user’s primary mailbox has been moved to an Exchange 2010 Server, and that their MSExchangeVersion attribute in Active Directory shows 44220983382016. Update that value if necessary, as some ways of moving mailboxes may have failed to update the attribute. And remember, Exchange archiving requires an Exchange Enterprise CAL.

The Archive database hosts primary mailboxes

A mailbox database you create to hold archive mailboxes is just another database to Exchange. By default it doesn’t know or care that you only want to host archive mailboxes on it, so use the EMS to exclude the database from automatic provisioning using the command Set-MailboxDatabase name –IsExcludedFromAutoprovisioning $true.

Mailbox databases are getting full

By default, when you enable an archive mailbox it will be placed on the same database as the primary mailbox. That’s not what you want, so make sure you specify the destination database for your archive creation.

Mail is not delivered to the archive

And it won’t be, ever. You can manually move messages to the archive, use a rule or a retention policy to move mail to the archive, but you cannot deliver mail directly to it. If a user wants all mail from sender X or with subject Y to go straight to the archive, create an Outlook rule to move it after it arrives in the inbox.

The archive database fills up quickly

The idea behind archiving is that it is a repository for older mail (which will usually include attachments) and is there so users don’t have to delete things and won’t store important data in PSTs. The default quota for an archive mailbox (Exchange 2010 SP1 and later) is 50GB, and if you created it before you applied SP1, it’s unlimited! You can set lower quotas just like you do on the primary mailbox, or on the database to apply to all users.

Note that the most common troubleshooting tasks related to archiving are more about understanding how archiving works, rather than any particular problems with archiving. Remember, an archive mailbox is just another mailbox (client side differences not withstanding) and a database you create to host archives is just a mailbox database to Exchange. Your care and feeding, and maintenance and troubleshooting, will be just like any other database most of the time.

And while Exchange archiving is very useful, there are a number of great features, and fewer limitations, when you deploy a third party archiving solution. If you want more out of your archiving than you get with Exchange enterprise CALs, look at third party archiving solutions.

This guest post was provided by Casper Manes on behalf of GFI Software Ltd. Read more on how to improve your Exchange archiving.

All product and company names herein may be trademarks of their respective owners.

howto://fix the npf driver isn’t running

Ed Fisher — Wed, 05 Sep 2012 17:00:00 +0000

If you’ve ever launched Wireshark only to encounter an error “the npf driver isn’t running” then you probably have encountered a botched install. Have heart, we can fix this without having to reinstall. Here’s how.

Click to close the error, and then close Wireshark.
Open an administrative cmd prompt.
Run this command
sc start npf [enter]
That should succeed in starting the NPF driver.
Now run this command so that it starts automatically next reboot

sc config npf start= auto [enter]

That’s all you should need to do. Wireshark will run without issue, and the NPF driver will start automatically from now on. Incidentally, it’s not a service like you would find in services.msc, it’s a driver. If you want to view it through the GUI, do this. In Computer Management, access Device Manager, choose View, Show Hidden Devices, and then you will find the “NetGroup Packet Filter Driver” in Non-Plug and Play Drivers.

I love me some Wireshark, but every time I use it, I can’t help but remember this classic SNL skit.

If this post helped you out at all, how about a shout out with a comment below, or maybe even a follow on Twitter? It’s costs nothing, and shows the love.

How to Improve Exchange Server Performance

Guest Post — Thu, 09 Aug 2012 11:48:43 +0000

With tight budgets and Exchange 2013 still a year away, Exchange admins are looking to get just a little more life out of their existing systems. They need to boost Exchange performance any way they can, and even incremental improvements can mean the difference between acceptable responsiveness and a hundred calls to the service desk. Many companies are looking to consolidate servers and will want to put more and more users on the same server. If you are struggling with your Exchange environment and need help, here’s what you can do to improve Exchange performance.

Add RAM

The more memory your Exchange Server has, the happier it will be. RAM prices are significantly lower than they were even two years ago, and you should find this to be an affordable upgrade.
Offload anti-spam

Spam volumes continue to climb, and malware is just as common today as it has ever been. Whether you implement an on-premises mail filtering solution, or go with a cloud provider, take that scanning and filtering workload off your mail servers so they can focus on delivering the good email.
Implement email archiving

Move all that older email off the Exchange Servers, and onto an email archiving system. This will reduce the size of your mailbox databases and can lead to any or all of the following additional benefits:
a. Defrags complete more quickly
b. Backups complete more quickly
c. Restores complete more quickly
d. You can support more users on the same disk space
e. Users get unlimited email storage.

Email archiving also helps to support message retention and compliance efforts, and can also be searched for critical intelligence. You can learn a tremendous amount about how your users actually use the system, and how they interact with your customers, by running analysis of your email archives, and you can also provide another level of fault tolerance by storing the archives separate from the “live” mailboxes.

Three easy steps to boost Exchange performance: more RAM, offload anti-spam and implement email archiving. You’ll breathe new life into your Exchange Servers by doing these three simple things, and none of them will break the bank.

All product and company names herein may be trademarks of their respective owners.

howto://determine your PowerShell version

Ed Fisher — Fri, 27 Jul 2012 16:14:20 +0000

Just a really quick, short post prompted by the fact that I needed to know what version of PowerShell I was running, and drew a complete blank on how to tell that. It’s apparently quite simple.

$Host.Version [enter]

Why Use Anti-Spam together with Exchange Server?

Guest Post — Fri, 13 Jul 2012 19:54:50 +0000

Spam is still one of the biggest problems facing those who are in charge of and manage the company’s email system. Not only do junk mail marketing and ridiculous scams waste resources and clog up valuable storage space, but spam is used to deliver malware and phishing attacks. Both of which can be used to cause some serious damage to a company’s computer resources or financial accounts.

To help combat spam, Microsoft offers a built-in solution for their Exchange Servers. While configuring this feature to fight spam has its benefits, you may want to double check whether Exchange’s anti-spam functionality is really the best you can do to protect your organization’s email system.

You can argue that something is better than nothing or that the built-in spam fighting solution is tailored to work specifically with Exchange; but the reality is that third-party anti-spam solutions generally offer far better protection against email borne attacks.

If you’re not convinced, here are a couple of reasons why you should be using a separate anti-spam solution in tandem with your Exchange Server.

1. Third-party anti-spam solutions offer management consoles that are easy-to-use

Enabling anti-spam functionality on an Edge Transport server requires some basic knowledge of the Shell to run the installation script and set specific parameters. However, fine-tuning your anti-spam filtering will require a higher level of knowledge of how to use the Shell or EMC to configure the different allow or block lists.

Any robust third-party solution will have a management console from where you can configure the various filters. Furthermore, if you make a mistake in the settings on a third-party solution this will not adversely affect the security settings on the mail server itself. Should you make the same mistake using the built-in spam filtering feature of Exchange, you could open up a security hole on the server.

2. Third-party anti-spam solutions offer comprehensive protection

Fighting spam has evolved past allow and deny lists. While these technologies work extremely well if you know exactly who you need to block or what words you need to filter, the technologies and methods used by spammers have long since evolved past the shelf life of simple spam fighting techniques.

To fight spam effectively, a solution needs to deploy techniques such as Bayesian filtering, blocking based on character sets, foreign language filtering and white listing. The solution should support sender policy framework (SPF), DNS block lists and automatically update known spam signatures.

A good anti-spam solution will also be ‘intelligent’ and ‘learn’ as time goes by what is spam and what is not. Users should also be able to review spam and report what is spam and what should be delivered; this helps improve the capture rather of your anti-spam solution and also gives users ‘ownership’ of their email in the process.

While the anti-spam features that Microsoft built into Exchange can stop some spam, can prevent malware from being delivered to inboxes and also some phishing attacks – it does not offer comprehensive protection.

A dedicated anti-spam solution is always the best choice if you want to cut down on junk mail, email-borne threats and subtle phishing attempts.

This guest post was provided by Jeff Orloff on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. Learn more about third party solutions to use together with you Exchange anti-spam.

All product and company names herein may be trademarks of their respective owners.

What to Consider when Setting Up an Email Infrastructure

Guest Post — Thu, 14 Jun 2012 01:40:00 +0000

Today it is pretty easy for an organization to set up a comprehensive and scalable corporate email system. Products such as Microsoft Exchange have made the process relatively easy. However, setting up such a system is just the first step, as you also need to protect it. Having effective antivirus, anti-spam, anti-phishing, backup, archiving and periodic health checks are essential for the effective operation of an Exchange Server, or other mail system.

Every single one of these tasks is a huge subject in itself, and each has many considerations before you can select a specific solution. However, perhaps the most complex solution is anti-spam. There are simply so many different software types out there, with each one having a variety of features. It is no wonder that it can be hard to decide which anti-spam solution is the best fit for your organization.

We can make this process simpler by looking at why we might need a server anti-spam solution.

As its name implies, an anti-spam server solution is meant to stop spam from reaching your users. Spam can be a source of stress for your Exchange Server, and it can also be a time-waster as users sift through useless junk mail until they find the messages that need attention. In addition, spam can also be a security risk as it may contain links to malicious websites, or even be used to distribute malware.

How do you decide if a particular solution is what you’re looking for or not? The problem with stopping spam is that, sometimes, anti-spam software mistakenly identifies a legitimate email as posing a threat and reacts accordingly. Such instances are referred to as false positives. When this happens the email is prevented from reaching its intended recipient, which means the message doesn’t get read, and that can cost you business.

Conversely, another problem is when spam emails are classified as legitimate mail and let through. This is called a false negative. Good anti-spam software attempts to keep false positives and negatives down to a minimum by using multiple detection techniques that help it identify legitimate messages. By understanding what these techniques are, and how many of them are present in the software you’re considering, you can readily determine if the software meets your needs or not.

Server Anti-Spam Techniques:

Greylisting: Greylisting is a technique whereby emails coming from new sources are rejected with a temporary error. Authentic mail servers will resend the failed message later on, at which point it will succeed. Spammer programs that do not use these authentic mail servers will remain rejected as they will not be resent.

SPF (Sender Policy Framework): SPF is a technique that is used to determine whether the origin of the email is genuine and matches the origin that the email appears to have.

Anti Spam Databases: There are various technologies that contain updatable databases of information that are used to identify spam. These databases are periodically updated by the vendor to catch the latest spam trends

DNSBL (DNS Block list): DNSBL is a system which uses a DNS database of known spam sources. Good anti-spam solutions leverage this functionality to identify spam.

Bayesian: Bayesian is a system that can be trained to recognize both legitimate email and spam. This system has to be trained and this can be carried out by either the user or the vendor.

Each of these systems can help to identify and stop spam before it reaches your users. Many good anti-spam solutions for Microsoft Exchange or other mail servers makes use of one, or even multiple, techniques mentioned above. As you might imagine, using a combination of these increases the accuracy of your detection software and by utilizing this knowledge of what each one does, you can be in a better position to decide which solution provides the most value to your anti-spam security.

This guest post was provided by Emmanuel Carabott on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. Learn more about what the right server anti-spam solution for your company should include.

All product and company names herein may be trademarks of their respective owners.

howto://display photos in Office365

Ed Fisher — Tue, 08 May 2012 17:37:00 +0000

One of the most popular features of Outlook 2010 is how it can display GAL photos, the pictures of you and your coworkers. Given the popularity of this feature, it’s nice to know you can do it in Office 365 as well. There are posts online about uploading your image to your SharePoint MySite and then seeing images in OWA, but here we are going to load photos into Active Directory so they will be visible in Outlook 2010 and OWA as well. First we need to get photos we can use, then we need to load them into an attribute in AD, and finally, DirSync will push these up to O365. Sounds easy, right?

Yeah, well, it can be, but then again, if it was that easy there wouldn’t be a need to write a blog post, would there?

Why can’t the users do this?

Well, actually they can, but since when could you trust your users to do anything right? Yeah, that is what I thought. If you want users tending to this themselves, have them log onto OWA, click in the upper right, and click Change Picture.

Okay, show of hands. How many want to leave this to their end users? Okay, you two can skip to the Stones vid at the end. The rest of you, read on.

Image guidelines

Your mileage may vary, but I found the following guidelines to work well for what I needed.

Images should be in JPG format.
96×96 pixels works best.
Try to keep file size below 10KB. AD can go up to 100KB, but in this case smaller is better.
You may want to use headshots or images that are cropped to headshot perspective. At 96×96 it can be hard to recognise people’s faces if the image is wider/further back.
If you want to use a tool to automate loading of images, name the files as firstname.lastname.jpg.

You want to load the images into Active Directory, updating the thumbnailPhoto attribute for each user. You can do this through PowerShell, or with various scripts or third party tools.

PowerShell

If you want to update a single user, or build your own script in PowerShell to update multiple users, you certainly can. Here are enough steps to get you started.

Log onto a PC in the same domain as your users accounts are in.
If this is not a 2008R2 domain controller, you will want to install the AD PowerShell module. Open an administrative PowerShell prompt and run
Then import the AD module for PowerShell using
Change to the directory that contains the images you want to use, and run the following command, substituting the correct values for what is in italics.
$photo = [byte[]](Get-Content C:\Photos\firstname.lastname.jpg -Encoding byte) Set-ADUser username -Replace @{thumbnailPhoto=$photo}
Repeat this process for each user.
Either run a manual DirSync process, or wait for the next scheduled run.

And it’s that last bit that keeps me from saying “Yay PowerShell!” because it’s not really scalable, and scripting it is still a bit beyond me. So, here’s what I would suggest instead.

CodeTwo Active Directory Photos

I found a free tool I really like that automates the process of uploading images to AD. It can also resize or crop images as necessary and even convert PNG/BMP/GIF to JPG automatically if needed. It is called CodeTwo Active Directory Photos. This program makes updating a single user’s thumbnailPhoto almost too easy, and it can also “bulk import” images, based on matching filename to user name or other AD attribute. There is a good video on how to use this program, which you can view here.

Direct link for RSS and email subscribers… http://youtu.be/PkdYmuPYujY.

There is also a pretty useful FAQ if you would like to know more about GAL Photos then you ever did before. Check that out here if you wish.

There is another free tool on Codeplex called AD Imageloader which you can get from this link http://adimageloader.codeplex.com/, but I like CodeTwo’s entry and am sticking with it. I particularly liked the narration in their YouTube video. If you didn’t watch it, you missed the bit at 0:45 regarding getting “blood out of stone.” Go back and watch their video, and then you will understand why I am including this unreleased gem from the Rolling Stones in this post.

Direct link for RSS and email subscribers…http://youtu.be/sXivhZmNKzM