<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">

<channel>
	<title>Teknologist</title>
	
	<link>http://teknologist.net</link>
	<description>Cholesterol Free Technology</description>
	<lastBuildDate>Mon, 02 Aug 2010 15:02:46 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" type="application/rss+xml" href="http://feeds.feedburner.com/Teknologist" /><feedburner:info uri="teknologist" /><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com/" /><feedburner:emailServiceId>Teknologist</feedburner:emailServiceId><feedburner:feedburnerHostname>http://feedburner.google.com</feedburner:feedburnerHostname><item>
		<title>Powershell Mailbox Count for Exchange 2007</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/VuDiuaVcuXM/</link>
		<comments>http://teknologist.net/2010/powershell-mailbox-count-for-exchange-2007/#comments</comments>
		<pubDate>Mon, 02 Aug 2010 15:02:46 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Mailbox Server]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[2007]]></category>
		<category><![CDATA[exchange]]></category>
		<category><![CDATA[mailbox]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[query]]></category>
		<category><![CDATA[users]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=196</guid>
		<description><![CDATA[The other day I wanted to get a quick count of how many mailboxes I had in the enterprise.  Of course, I wanted to be able to run a powershell command instead of going into the EMC.  I fooled around with the Get-MailboxStatistics command until I got what I wanted and figured it would be [...]


No related posts.

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<p>The other day I wanted to get a quick count of how many mailboxes I had in the enterprise.  Of course, I wanted to be able to run a powershell command instead of going into the EMC.  I fooled around with the <strong><em>Get-MailboxStatistics</em></strong> command until I got what I wanted and figured it would be a nice little one liner to share:</p>
<pre class="brush: plain;">Get-MailboxStatistics | group MailboxDatabase | format-table count</pre>
<p>This is a very simple command that just outputs the count (number) of mailboxes you have on a given exchange mailbox server.  Of course, if you have more than one server you&#8217;ll need to specificy that inside the command.  Since I only have one, it&#8217;s pretty simple.</p>


<p>No related posts.</p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/VuDiuaVcuXM" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/powershell-mailbox-count-for-exchange-2007/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/powershell-mailbox-count-for-exchange-2007/</feedburner:origLink></item>
		<item>
		<title>Why You Can’t Trust Mobile Device Reports</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/LJu-qZ7Ct0Q/</link>
		<comments>http://teknologist.net/2010/why-you-cant-trust-mobile-device-reports/#comments</comments>
		<pubDate>Fri, 16 Jul 2010 18:19:26 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Client Access Server]]></category>
		<category><![CDATA[Exchange Mobile]]></category>
		<category><![CDATA[2007]]></category>
		<category><![CDATA[activesync]]></category>
		<category><![CDATA[eas]]></category>
		<category><![CDATA[mobile phone]]></category>
		<category><![CDATA[smart phone]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=190</guid>
		<description><![CDATA[The Problem Let&#8217;s say you&#8217;re an exchange administrator and you use EAS (Exchange Active Sync) to plug smart phones into your Exchange environment.  You&#8217;re probably one of the many out there who do this&#8230;I do it in my environment. Then you stumble across a handy powershell script that will allow you to query your environment [...]


Related posts:<ol><li><a href='http://teknologist.net/2010/activesync-device-report/' rel='bookmark' title='Permanent Link: ActiveSync Device Report'>ActiveSync Device Report</a> <small>Brian Desmond&#8217;s blog has an excellent tip on how to...</small></li>
<li><a href='http://teknologist.net/2010/microsoft-please-smarter-not-harder/' rel='bookmark' title='Permanent Link: Microsoft Please, Smarter Not Harder'>Microsoft Please, Smarter Not Harder</a> <small>Join the forum discussion on this post My grandfather always...</small></li>
</ol>

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<h3>The Problem</h3>
<p>Let&#8217;s say you&#8217;re an exchange administrator and you use EAS (Exchange Active Sync) to plug smart phones into your Exchange environment.  You&#8217;re probably one of the many out there who do this&#8230;I do it in my environment.</p>
<p>Then you stumble across a handy powershell script that will allow you to query your environment for mobile phones that have synched on user accounts and report back the last successful synch as well as any phone details that are reported.  I found this one somewhere (can&#8217;t remember):</p>
<pre class="brush: plain;">$devices = @()
$mailboxes = Get-CASMailbox -ResultSize:Unlimited | Where-Object {$_.HasActiveSyncDevicePartnership -eq $true -and $_.ExchangeVersion.ExchangeBuild -ilike &quot;8*&quot;}

foreach ($m in $mailboxes)
{
$devices += Get-ActiveSyncDeviceStatistics -Mailbox $m.Identity
}

$devices | Export-Csv DeviceStats.csv</pre>
<p>You get a nice little list of stuff right?  This <em>should </em>be every single EAS enabled account that has a phone synching with Exchange right?  <strong>Wrong.</strong> It absolutely is NOT an accurate list of phones that have synched with your Exchange server.</p>
<p>When I executed that powershell scriptlet above on my system it reported back quite a few phones&#8230;but my phone, a HTC Evo, was not on the list.  In fact, my account wasn&#8217;t reported on the list.  This despite my device synching just fine every 15 minutes.  The integrity of this &#8216;report&#8217; has been challenged.  So what&#8217;s the deal?</p>
<h3>Workaround Solution</h3>
<p>A quick investigatory glancing at google brings little results&#8230;However, I did notice when using the EMC to highlight my account and going to &#8216;Manage mobile device&#8221; I was in for a suprise&#8230;.because that link wasn&#8217;t there on my account.  That&#8217;s right, &#8220;manage mobile device&#8221; is missing on my account.  This despite having Active Synch enabled under the &#8216;mailbox features&#8217; tab on my account and despite having my device pair up with Exchange in 15 minute intervals.</p>
<p>Searching google for this problem <a title="yeilds much better results" href="http://forums.msexchange.org/m_1800469919/mpage_1/key_/tm.htm#1800469919" target="_blank">yeilds much better results</a>.  It seems that a flag embedded for a value in Active Directory doesn&#8217;t toggle correctly OR isn&#8217;t added into AD at all (perhaps bad replication).  Either way, it means you&#8217;ll be whipping out trusty adsiedit.msc (per the forum thread linked to above).  The setting that needs toggled is &#8220;msExchMobileMailboxFlags&#8221; which should be set to 1.  After setting this, you&#8217;ll be able to manage the mobile device AND your synch will be picked up by the powershell report above.</p>
<h3>The Real Crux</h3>
<p>The real crux of the matter is that this toggle shouldn&#8217;t have to be set at all and regardless if it is set or not, powershell should be able to report if a device is synching with Exchange.  There is a reason why RIM is #1 when it comes to businesses and smartphones&#8230;it&#8217;s because you can have 100% accountability for what is on your network at any given time.  With Exchange 2007 and above, it is unfortunately, much like a ring toss at a circus&#8230;sometimes you get a ring on that bottle and win a stuffed giraffe but other times you&#8217;re going home without plush pals.</p>
<p>Microsoft has a problem here because you can&#8217;t trust your own powershell queries.  If it doesn&#8217;t work for this individual area (phones, EAS) then what else doesn&#8217;t work?  Do we call into question the entire integrity of all powershell commands and commandlets?  What do you think?  I know this workaround is pretty silly on a huge environment with multiple user containers in AD or even mutlipe forests.  Is the workaround something that is tolerable or should Microsoft do more to fix this broken part of their product?</p>


<p>Related posts:<ol><li><a href='http://teknologist.net/2010/activesync-device-report/' rel='bookmark' title='Permanent Link: ActiveSync Device Report'>ActiveSync Device Report</a> <small>Brian Desmond&#8217;s blog has an excellent tip on how to...</small></li>
<li><a href='http://teknologist.net/2010/microsoft-please-smarter-not-harder/' rel='bookmark' title='Permanent Link: Microsoft Please, Smarter Not Harder'>Microsoft Please, Smarter Not Harder</a> <small>Join the forum discussion on this post My grandfather always...</small></li>
</ol></p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/LJu-qZ7Ct0Q" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/why-you-cant-trust-mobile-device-reports/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/why-you-cant-trust-mobile-device-reports/</feedburner:origLink></item>
		<item>
		<title>Exchange 2003 to 2007 Global &amp; Universal Groups</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/JPbx3CC8CCQ/</link>
		<comments>http://teknologist.net/2010/exchange-2003-to-2007-global-universal-groups/#comments</comments>
		<pubDate>Fri, 25 Jun 2010 13:03:02 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Exchange General]]></category>
		<category><![CDATA[2003]]></category>
		<category><![CDATA[2007]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[exchange]]></category>
		<category><![CDATA[global]]></category>
		<category><![CDATA[groups]]></category>
		<category><![CDATA[query]]></category>
		<category><![CDATA[universal]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=180</guid>
		<description><![CDATA[I hit a snag that was a result of my conversion from Exchange 2003 to Exchange 2007.  The snag was with global groups.  The problem is that global groups cannot be expanded by Exchange&#8230;so if you have a distribution list that is a member of a global group it will be grayed out in the [...]


Related posts:<ol><li><a href='http://teknologist.net/2010/list-delegates-in-exchange-2007/' rel='bookmark' title='Permanent Link: List Delegates in Exchange 2007'>List Delegates in Exchange 2007</a> <small>Join the forum discussion on this post The Problem of...</small></li>
<li><a href='http://teknologist.net/2009/moving-mailboxes-exchange-2003-to-exchange-2007/' rel='bookmark' title='Permanent Link: Moving Mailboxes from Exchange 2003 to Exchange 2007'>Moving Mailboxes from Exchange 2003 to Exchange 2007</a> <small>During a migration from Exchange 2003 to Exchange 2007 many...</small></li>
<li><a href='http://teknologist.net/2010/user-not-appearing-in-gal-2007-fix/' rel='bookmark' title='Permanent Link: User Not Appearing in GAL 2007 Fix'>User Not Appearing in GAL 2007 Fix</a> <small>Join the forum discussion on this post I had a...</small></li>
</ol>

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<p>I hit a snag that was a result of my conversion from Exchange 2003 to Exchange 2007.  The snag was with global groups.  The problem is that global groups cannot be expanded by Exchange&#8230;so if you have a distribution list that is a member of a global group it will be grayed out in the Exchange Management Console and you will not be able to edit it.  You also won&#8217;t be able to right click and convert it to universal because it will give you the error of:</p>
<blockquote><p>A global group cannot have a universal group as its member</p></blockquote>
<p>So what to do?  How does one convert this group to a universal one?  The problem doesn&#8217;t lie with the group  itself but with the membership of the groups.  In order to convert one, you have to convert them all.</p>
<p>The EXPTA blog has an excellent post regarding what is going on with solutions to boot:</p>
<blockquote><p>As you may know, Exchange Server 2007 and Exchange Server 2010 force you to create all new distribution groups as universal distribution groups.<br />
The reason for this is that Exchange 2007/2010 requires a local Global Catalog (GC) server in the Active Directory site where Exchange resides to query for group expansion. A GC can expand domain local, global, and universal groups. However, domain local groups (and sometimes global groups) can only be expanded within the domain local scope. If the GC is a member of the companyabc.com domain, it will be unable to expand a domain local group in the sales.companyabc.com subdomain.</p></blockquote>
<p>I&#8217;m going to be posting how they solved their problem for posterity but <a title="the EXPTA blog" href="http://www.expta.com/2009/10/how-to-convert-local-and-global-groups.html" target="_blank">you can head over to the EXPTA blog for the full post</a> which contains much more meat than this post will.</p>
<p>To solve the problem, query the groups and look at how many you have that are global.  Just open up a command window on a domain administrator account and remember that this command may take a while on a large enterprise:</p>
<pre class="brush: plain;">dsquery group -limit 0 | dsget group -samid -scope -secgrp &gt; Groups.txt</pre>
<p>Next run the command to convert the global groups to universal.  There are no adverse problems that will result from this&#8230;the conversion doesn&#8217;t mess with permissions.</p>
<pre class="brush: plain;">dsquery group -limit 0 | dsmod group -c -q -scope u</pre>
<p>You WILL have to run this 2nd command many, many times.  See, each time it cycles through the groups it finds the top level one it has not converted and converts it to universal&#8230;there may be 3 more subgroups that need converted but it won&#8217;t convert them until the parent is a universal.</p>
<p>For more explanation, see the EXPTA blog link above and hopefully this helps someone out!</p>


<p>Related posts:<ol><li><a href='http://teknologist.net/2010/list-delegates-in-exchange-2007/' rel='bookmark' title='Permanent Link: List Delegates in Exchange 2007'>List Delegates in Exchange 2007</a> <small>Join the forum discussion on this post The Problem of...</small></li>
<li><a href='http://teknologist.net/2009/moving-mailboxes-exchange-2003-to-exchange-2007/' rel='bookmark' title='Permanent Link: Moving Mailboxes from Exchange 2003 to Exchange 2007'>Moving Mailboxes from Exchange 2003 to Exchange 2007</a> <small>During a migration from Exchange 2003 to Exchange 2007 many...</small></li>
<li><a href='http://teknologist.net/2010/user-not-appearing-in-gal-2007-fix/' rel='bookmark' title='Permanent Link: User Not Appearing in GAL 2007 Fix'>User Not Appearing in GAL 2007 Fix</a> <small>Join the forum discussion on this post I had a...</small></li>
</ol></p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/JPbx3CC8CCQ" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/exchange-2003-to-2007-global-universal-groups/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/exchange-2003-to-2007-global-universal-groups/</feedburner:origLink></item>
		<item>
		<title>List Delegates in Exchange 2007</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/S_80JB3LRTM/</link>
		<comments>http://teknologist.net/2010/list-delegates-in-exchange-2007/#comments</comments>
		<pubDate>Wed, 23 Jun 2010 15:09:31 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Exchange General]]></category>
		<category><![CDATA[2003]]></category>
		<category><![CDATA[2007]]></category>
		<category><![CDATA[delegates]]></category>
		<category><![CDATA[exchange]]></category>
		<category><![CDATA[ghost]]></category>
		<category><![CDATA[ldap]]></category>
		<category><![CDATA[list]]></category>
		<category><![CDATA[phantom]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[query]]></category>
		<category><![CDATA[send on behalf of]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=143</guid>
		<description><![CDATA[Join the forum discussion on this post The Problem of Ghost Delegates There is a problem with Microsoft Exchange 2003 and delegates.  When users are deleted, their delegate or send on behalf attributes are not deleted with them. This problem has been around since Exchange 5.5 and possibly before and it&#8217;s REALLY annoying.  Microsoft has [...]


No related posts.

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<span class="sfforumlink"><a href="http://teknologist.net/forum/cas/list-delegates-in-exchange-2007/"><p><img src="http://teknologist.net/wp-content/plugins/simple-forum/styles/icons/three-en/bloglink.png" alt="" /> Join the forum discussion on this post</p>
</a></span><h2>The Problem of Ghost Delegates</h2>
<p>There is a problem with Microsoft Exchange 2003 and delegates.  When users are deleted, their delegate or send on behalf attributes are not deleted with them.</p>
<p>This problem has <a title="been around" href="http://hellomate.typepad.com/exchange/2004/09/listing_which_e.html" target="_blank">been around</a> <a title="since" href="http://winzenz.blogspot.com/2006/10/outlook-delegates-issues.html" target="_blank">since</a> Exchange 5.5 and possibly before and it&#8217;s REALLY annoying.  Microsoft has a hotfix available for Exchange 2003&#8230;but the problem is, you have to know WHICH mailboxes the fix needs to be run on.  <strong>Top that off with my environment actually being Exchange 2007 and NOT 2003 and one might discover an even larger problem.</strong></p>
<p>Let&#8217;s backtrack and define the problem with a little story:</p>
<p>Say you work for Acme Corp which has 1500 employees in a single forest environment running Exchange 2007.  John Smith, an employee of 10 years at your corporation has left for greener pastures over at Emca Corp.  John was a delegate with send rights on Frank Doe&#8217;s mailbox as he was Frank Doe executive assistant for almost all of those years.</p>
<p>When HR notified your Active Directory administrator that John Smith had left, they promptly disabled and later deleted the user&#8230;this may have happened while you were still using Exchange 2003.</p>
<p>Now you have a problem&#8230;John Smith has left the company and was a delegate on Frank Doe&#8217;s mailbox.  When someone sends an invitation to a meeting with Frank Doe or mail to a group that Frank Doe is a part of&#8230;they may get an Non Delivery Notice (NDR) similar to the following:</p>
<blockquote><p>Smith, John<br />
The recipient&#8217;s e-mail address was not found in the recipient&#8217;s e-mail system. Microsoft Exchange will not try to redeliver this message for you. Please check the e-mail address and try resending this message, or provide the following diagnostic text to your system administrator.</p>
<p>_____</p>
<p>Sent by Microsoft Exchange Server 2007</p></blockquote>
<p>This glitch is EXCELLENT for annoying users everywhere!  It&#8217;s also a potential problem as someone could mass email Frank Doe and potential generate a NDR in addition to each email they send.  If they were to identify a few more people who may have had this problem, the possibility of having twice the amount of email generated and thus, twice the amount of email traffic, is something that large corporations may not want to have in their existing Exchange environments.</p>
<p>Microsoft realized that they had a problem on their hands and released a fix that you apply to mailboxes that suffer from the &#8216;ghost delegate&#8217; &#8220;feature&#8221;.  Great right?  This fix is of course for Exchange 2003&#8230;so if you&#8217;re using that, you&#8217;re set.  You still will need to know a major detail before proceeding though:</p>
<ol>
<li>How many mailboxes have this problem? (<a title="usual response" href="http://instantcrickets.com" target="_blank">usual response</a>)</li>
</ol>
<p>Therein lies the major problem.  How do you identify which mailboxes have old ghost delegate cruft still floating around generating NDR&#8217;s all over the place?  Especially in smaller environments where EVERYONE was a delegate of everyone else?</p>
<p>It&#8217;s impossible.</p>
<p>You can try to identify which mailbox has the problem but you would have to use the process of elimination&#8230;not a very time saving process and definitely not something I want to do (imagine visiting 50+ users!).  Instead,  I elected to identify all current users with delegates on their mailbox because chances are that the ghost delegate was once a delegate of these identified users.  I plan on cross referencing these users with a distribution list that is generating the NDR to properly identify the problem.  So, onward with how to identify the potential problem with a powershell query.</p>
<h2>Identifying Problem Mailboxes with Powershell</h2>
<p>Search the web, I&#8217;ve found many different &#8216;solutions&#8217; to this problem with none of them getting things exactly how I needed them to be.  Some of the solutions would run a query and return information that was valuable&#8230;but not valuable enough.  Other queries <em>should</em> have worked but didn&#8217;t.</p>
<p>I&#8217;m by no means a powershell expert so I&#8217;m absolutely sure this little scriptlet can be improved.  It does the job though by returning anyone who has a delegate and listing who each delegate is.  So without further fanfare, the powershell command:</p>
<pre class="brush: plain;">Get-Mailbox -resultsize unlimited | Where {$_.GrantSendOnBehalfTo -ne $null} | select Name, @{Name='GrantSendOnBehalfTo';Expression={[string]::join(&quot;;&quot;, ($_.GrantSendOnBehalfTo))}} | Export-CSV C:\SendOnBehalfTo.csv -noTypeInformation</pre>
<p>Let&#8217;s break this command down.  The first portion <em>Get-Mailbox -resultsize unlimited</em> retrieves all user mailboxes and doesn&#8217;t limit to 1000 as is default with Exchange 2007.  We pipe this command into the next one with the &#8216;|&#8217; symbol.  Here we use a conditional <em>Where</em> and select the attribute <em>GrantSendOnBehalfTo</em> returning only mailboxes from the first part of the command where said attribute is NOT <em>null</em> or empty.</p>
<p>Next, out of these mailboxes that don&#8217;t have the <em>GrantSendOnBehalfTo</em> attribute as empty, we <em>select</em> the Name of the user.  Now we should be able to stop here, however, we&#8217;re working with a string attribute here and returning <em>Name</em> will return a Multivalued property instead of the proper DN or user name we&#8217;re looking for (something like this <strong><span style="font-family: Courier New; color: #5f9ea0; font-size: x-small;"><span style="font-family: Courier New; color: #5f9ea0; font-size: x-small;"><span style="font-family: Courier New; color: #5f9ea0; font-size: x-small;"><span style="font-family: Courier New; font-size: x-small;"><span style="font-family: Courier New; font-size: x-small;">Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.Directory.ADObjectId]</span></span></span></span></span></strong> ).  To get what we need, we have to join the Multivalued property (string) with the results from the first half of the query.  To do this we create a commandlet and use the join command to bind the first part of our command to the multivalued property and translate that property into something readable for us.</p>
<p>It&#8217;s in the string conversion section that most people get frustrated with.  I know I got frustrated with it and used a <a title="forum thread" href="http://www.powergui.org/thread.jspa?messageID=34102" target="_blank">portion of a commandlet for allowing a user or group to only accept messages from certain mailboxes</a>&#8230;I just adapted that string conversion and join for my own purposes.  Like I said, I&#8217;m not extremely fluent in the ways of the powershell script&#8230;I just know that adapting it worked.</p>
<h2>Identifying the Problem Mailboxes with Active Directory Queries</h2>
<p>Of course, after spending 6-8 hours constructing my query in powershell I found a simple little tool from <a title="Joeware.net" href="http://joeware.net" target="_blank">Joeware.net</a> called &#8220;ADFind&#8221; that allowed me to execute a simple AD query and output all of the same information into a much more readable format than my powershell command.  If you&#8217;d like to do the same thing, head over to the <a title="adfind page" href="http://www.joeware.net/freetools/tools/adfind/index.htm" target="_blank">ADFind page</a>, enter your email and download the tool.  Extract it to your desktop and then open a command prompt and change directory to your desktop.  Next, enter a proper AD query with the adfind.exe prepended:</p>
<pre class="brush: plain;">AdFind.exe -default -f &quot;&amp;(homeMDB=*)(publicdelegates=*))&quot; publicdelegates &gt; C:\delegates.txt</pre>
<p>The output from Joe&#8217;s tool is MUCH nicer than what I was able to accomplish using powershell.  I&#8217;m sure someone will be able to take what I did with powershell and improve on it&#8230;but when there are handy tools like joeware provides, what need is there?</p>
<h2>Implementing the Microsoft Fix</h2>
<p>The &#8216;official&#8217; fix from Microsoft is to install a hotfix if you&#8217;re running Exchange 2003.  Supposedly, Exchange 2007 doesn&#8217;t suffer from this problem&#8230;but there is a caveat there.  If, like me, you&#8217;ve upgraded from an Exchange 2003 environment that suffered from this problem&#8230;you migrate the problems with it!  So, I have an Exchange 2007 environment suffering from ghost delegates and NDR&#8217;s.</p>
<p>How to remedy this?  There are 3 directions provided.  The <a title="first from Microsoft" href="http://support.microsoft.com/kb/909638" target="_blank">first from Microsoft</a> is to go inside the tools &gt;&gt; options menu in Outlook and delete the delegate.  The problem with ghost delegates is that they aren&#8217;t there&#8230;which renders this fix completely useless.  The second solution is to launch Outlook with the /cleanrules switch.  The third solution out there is to <a title="Use the MFCMapi Editor" href="http://support.microsoft.com/kb/924297" target="_blank">use the MFCMapi Editor on the user mailbox</a> that has the problem, find the hidden bits, and delete them.  The problem with this solution is most people AREN&#8217;T comfortable with editing the profile inside a snap-in&#8230;it&#8217;s much like using ADSIEdit to edit AD manually and can be overwhelming.</p>
<p>Examining the 3 options, it&#8217;s obvious that /cleanrules switch is probably the easiest to implement.  The problem is that it will delete ALL rules from the mailbox and if you have users who have been around for quite some time it means tons of rules.  The other problem is that it has to be run manually on EACH mailbox.  This of course is bad if you have an elaborate delegate system.</p>
<p>When we identified who has delegates with our queries above, we most likely found a culprit for who is having the problem and generating the NDR.  For me it was rather easy because I cross referenced my list of those with delegates with a distribution list.  When one of the unit secretaries sent email to this distribution group, it would also generate the dreaded NDR.  This means that a member of the distribution group has a ghost delegate.  Cross referencing gave me a list of 6 people to run the /cleanrules switch on versus the over 50 delegate mailboxes from the queries above&#8230;a much smaller number to visit.</p>
<p>I hope my confusing process can help someone out there and please improve on anything you see here&#8230;as I said, I&#8217;m by no means an expert&#8230;I just like to document my learning process to help others and also to remind myself of the fixes I find <img src='http://teknologist.net/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' />   Thanks for reading!</p>
<div id="_mcePaste" style="position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow: hidden;">
<p class="MsoNormal"><span style="font-size: 10pt; font-family: &amp;amp;amp; color: black;"><a href="mailto:IMCEAEX-_O%3DWAYNE%2B20MEMORIAL%2B20HOSPITAL_OU%3DISNT_cn%3DRecipients_cn%3Dcfowler@waynehealth.org"><span style="color: blue;">Fowler, Carol</span></a><br />
The recipient&#8217;s e-mail address was not found in the recipient&#8217;s e-mail system. Microsoft Exchange will not try to redeliver this message for you. Please check the e-mail address and try resending this message, or provide the following diagnostic text to your system administrator.</span><span style="font-size: 12pt; font-family: &amp;amp;amp;"> </span></p>
<p class="MsoNormal"><span style="font-size: 12pt; font-family: &amp;amp;amp;"> </span></p>
<p class="MsoNormal" style="text-align: justify;"><span style="text-decoration: underline;"><span style="font-size: 12pt; font-family: &amp;amp;amp;"> _____<br />
<!--[if !supportLineBreakNewLine]--><br />
<!--[endif]--></span></span></p>
<p><span style="font-size: 8pt; font-family: &amp;amp;amp; color: gray;">Sent by Microsoft Exchange Server 2007</span><span style="font-size: 12pt; font-family: &amp;amp;amp;"> </span></p>
</div>


<p>No related posts.</p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/S_80JB3LRTM" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/list-delegates-in-exchange-2007/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/list-delegates-in-exchange-2007/</feedburner:origLink></item>
		<item>
		<title>Going Green</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/GBh9sb7QJwc/</link>
		<comments>http://teknologist.net/2010/going-green/#comments</comments>
		<pubDate>Mon, 26 Apr 2010 13:12:38 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[blog]]></category>
		<category><![CDATA[blogging]]></category>
		<category><![CDATA[green]]></category>
		<category><![CDATA[ifitsgreen]]></category>
		<category><![CDATA[technology]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=133</guid>
		<description><![CDATA[It&#8217;s always healthy to have hobbies outside of technology.  My day job is being an Exchange Administrator but during my off time I like to read news and tool around with Linux.  Recently though, I&#8217;ve made life changes to reduce my carbon footprint as well as to make my life healthier in many ways.  These [...]


No related posts.

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<p>It&#8217;s always healthy to have hobbies outside of technology.  My day job is being an Exchange Administrator but during my off time I like to read news and tool around with Linux.  Recently though, I&#8217;ve made life changes to reduce my carbon footprint as well as to make my life healthier in many ways.  These changes were initiated by my wife and have spread to myself and my son and even to our immediate family.  Healthy eating and going green is a lifestyle, albeit, one that is not for everyone.  Just the same, I&#8217;ve begun to chronicle my attempts at &#8216;going green&#8217; at a new website called <a title="if it's green" href="http://ifitsgreen.org/" target="_blank"><strong>if it&#8217;s green</strong></a>.  I&#8217;ll be investigating green technology at this blog along with topics like composting, gardening, solar power, generators, and green computing.  If you&#8217;d like to check it out, please do&#8230;the most recent article is about <a title="Corky, a Battery Free Wireless Mouse" href="http://ifitsgreen.org/2010/corky-a-battery-free-wireless-mouse/" target="_blank">Corky, a wireless mouse that doesn&#8217;t require batteries</a>.</p>
<p>Thanks for reading!</p>


<p>No related posts.</p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/GBh9sb7QJwc" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/going-green/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/going-green/</feedburner:origLink></item>
		<item>
		<title>Security Group Membership without Powershell</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/Y1xVmOyOaWk/</link>
		<comments>http://teknologist.net/2010/security-group-membership-without-powershell/#comments</comments>
		<pubDate>Wed, 07 Apr 2010 19:09:12 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Windows General]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[group]]></category>
		<category><![CDATA[microsoft]]></category>
		<category><![CDATA[query]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[windows]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=127</guid>
		<description><![CDATA[I&#8217;m getting pretty used to powershell in my day to day workings with Exchange.  Today however, I was helping a user out on a PC in a different department and I needed to find all of the members of a specific security group.  Sure, I could remote back into my work PC and launch ADUC [...]


No related posts.

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<p>I&#8217;m getting pretty used to powershell in my day to day workings with Exchange.  Today however, I was helping a user out on a PC in a different department and I needed to find all of the members of a specific security group.  Sure, I could remote back into my work PC and launch ADUC but I&#8217;d rather be able to query it with a single query&#8230;all from right there using her computer with the limited user account.</p>
<p>Thanks to powershell, I now think in pipes&#8230;while I&#8217;ve always done this with Linux, I&#8217;ve never had to do so with Windows.  It&#8217;s almost like wearing two caps at the same time.  Nonetheless, I was able to figure out how to do this after 3 or 4 attempts and then output it to a file so I could see members of the security group and I did so without the power of powershell (<a href="http://instantrimshot.com" target="_blank">ba-dum-ching!</a>)</p>
<p>I used <em>dsquery </em>and piped the command using <em>dsget </em>to grab the information I needed and then output that into a text file onto the desktop.  Important to note that you should open the command window using &#8216;run as&#8217;.  So in XP, browse to Start &gt;&gt; Programs &gt;&gt; Accessories and then right click &#8216;command prompt&#8217; and &#8216;run as&#8217; with elevated privileges.  You&#8217;ll need to be able to view the group you&#8217;re querying.  I used my own user since I&#8217;m a domain admin&#8230;you get the idea.  Once you have the command prompt, cd to Desktop so the text file will be easy to find.  Then initiate the following command:</p>
<pre class="brush: plain;">dsquery group -name GroupName |dsget group -members |dsget user -display &gt;memberlist.txt</pre>
<p>Substitute for GroupName and put in the group you&#8217;re looking for.  Hopefully this helps out.</p>


<p>No related posts.</p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/Y1xVmOyOaWk" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/security-group-membership-without-powershell/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/security-group-membership-without-powershell/</feedburner:origLink></item>
		<item>
		<title>User Not Appearing in GAL 2007 Fix</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/AEIJTMP0kik/</link>
		<comments>http://teknologist.net/2010/user-not-appearing-in-gal-2007-fix/#comments</comments>
		<pubDate>Mon, 08 Mar 2010 16:59:47 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Exchange General]]></category>
		<category><![CDATA[Hub/Transport Server]]></category>
		<category><![CDATA[2007]]></category>
		<category><![CDATA[address]]></category>
		<category><![CDATA[exchange]]></category>
		<category><![CDATA[hub]]></category>
		<category><![CDATA[mailboxes]]></category>
		<category><![CDATA[migration]]></category>
		<category><![CDATA[smtp]]></category>
		<category><![CDATA[transport]]></category>
		<category><![CDATA[users]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=113</guid>
		<description><![CDATA[Join the forum discussion on this post I had a problem since our migration from Exchange 2003.  The problem was a handful of users were not appearing on our Global Address List. Tracking down what was going on has taken me quite a long time despite Microsoft KB articles published on the matter.  The solution [...]


Related posts:<ol><li><a href='http://teknologist.net/2010/alloutlookusers-distribution-list/' rel='bookmark' title='Permanent Link: AllOutlookUsers Distribution List'>AllOutlookUsers Distribution List</a> <small>Join the forum discussion on this post One of the...</small></li>
<li><a href='http://teknologist.net/2009/moving-mailboxes-exchange-2003-to-exchange-2007/' rel='bookmark' title='Permanent Link: Moving Mailboxes from Exchange 2003 to Exchange 2007'>Moving Mailboxes from Exchange 2003 to Exchange 2007</a> <small>During a migration from Exchange 2003 to Exchange 2007 many...</small></li>
</ol>

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<span class="sfforumlink"><a href="http://teknologist.net/forum/edge-transport-server/user-not-appearing-in-gal-2007-fix/"><p><img src="http://teknologist.net/wp-content/plugins/simple-forum/styles/icons/three-en/bloglink.png" alt="" /> Join the forum discussion on this post</p>
</a></span><p>I had a problem since our migration from Exchange 2003.  The problem was a handful of users were not appearing on our Global Address List.</p>
<p>Tracking down what was going on has taken me quite a long time despite Microsoft KB articles published on the matter.  The solution posted by Microsoft in this instance just didn&#8217;t work for me.  I ran that powershell command until I was blue in the face and it returned zero results.  To find out how this happened and why they&#8217;re not displaying, I had to dig around for many weeks and create a custom powershell scriptblock until I FINALLY found the answer.  Hopefully, passing on this info here will save readers time and effort in their search for resolution of the same thing.</p>
<h2>Why Is It Happening?</h2>
<p>The reason this is happening is that when you first move from Exchange 2003 to Exchange 2007 or 2010, you have a &#8220;Default Policy&#8221; in Email Address Policy that should be automatically created (expecially if you run in tandem like I did).  This policy is carried over from Exchange 2003.  Microsoft changed the way 2007 filters work&#8230;they no longer use LDAP as they did with Exchange 2003, they now use OPATH.  For a more detailed explanation on this, <a title="see this blog post" href="http://msexchangeteam.com/archive/2007/01/11/432158.aspx" target="_blank">see this blog post</a>.  This default policy can be found in the <strong>Exchange Management Console &gt;&gt; Organization Configuration &gt;&gt; Hub Transport</strong>.  The default policy will place the &#8216;user alias&#8217; in front of the domain that you have set for your receive connector.  When you first apply the policy, it appears like this:</p>
<div id="attachment_114" class="wp-caption alignleft" style="width: 317px"><a href="http://teknologist.net/wp-content/uploads/2010/03/defaultpolicy.png"><img class="size-full wp-image-114" style="margin-left: 10px; margin-right: 10px;" title="defaultpolicy" src="http://teknologist.net/wp-content/uploads/2010/03/defaultpolicy.png" alt="" width="307" height="287" /></a><p class="wp-caption-text">default policy</p></div>
<p>Where can you view the screen pictured?  You can click edit on the default policy found in the location above and press next a couple of times and then cancel out  (you don&#8217;t want to apply the policy another time do you?).</p>
<p>This information lets us know that the default policy sets up our domain (edited to show domain.com in the picture) with the user network name, aka alias, so that users can immediately send and receive based on login names.  Often times, if you are in a small organization, users may login with firstname.lastname or firstinitial.lastname and this may be their email address as well.  In this case, you wouldn&#8217;t implement a secondary email address policy like I had to do.</p>
<p>Our organization wanted to receive email with firstname.lastname.  They&#8217;ve implemented a network name (aka alias) policy of first two initials of first and last name followed by last three of employee number.  So if my name were John Smith and my employee number were 12345, the network name would become josm345.  This is great for not having repeat names on our network but it&#8217;s bad for emailing people.  Enter my secondary email policy.</p>
<div id="attachment_115" class="wp-caption alignright" style="width: 317px"><a href="http://teknologist.net/wp-content/uploads/2010/03/newpolicy.png"><img class="size-full wp-image-115" title="newpolicy" src="http://teknologist.net/wp-content/uploads/2010/03/newpolicy.png" alt="" width="307" height="285" /></a><p class="wp-caption-text">secondary policy</p></div>
<p>The secondary email address policy I created after we switched off Exchange 2003 set up the domain to be able to send and receive with<em> firstname.lastname@domain.com</em>.  I then applied this secondary policy and the SMTP address it created as the primary SMTP address for all users and gave this policy a higher priority over the default policy noted above.  You can see from the picture the policy takes firstname and lastname in front of the domain.</p>
<p>I also had to update all address lists as shown in <a title="this helpful blog post" href="http://msexchangeteam.com/archive/2007/01/11/432158.aspx" target="_blank">this helpful blog post</a> at MXExchangeteam.com.  After this, I updated the offline address book by going to <strong><em>Organization Configuration &gt;&gt; Mailbox &gt;&gt; Offline Address Book &gt;&gt; Right-click Update</em></strong>.  If you need to create a new global address list, you can&#8217;t do it from the EMC, you have to <a title="Exchange Management Shell" href="http://technet.microsoft.com/en-us/library/bb123785%28EXCHG.80%29.aspx" target="_blank">do it via Exchange Management Shell</a>.</p>
<p>It&#8217;s a long process, but once you know that you have TWO email address policies that are applied, it makes sense that if a user doesn&#8217;t have both of the criteria to match these policies they will not appear on the Global Address List nor the Offline Address Book.  So now we have found out who this has happened to and then we&#8217;ll know why users are not showing up in these lists.  We also need to know what we need to do in order to fix it.</p>
<h2>Finding Users <span style="text-decoration: underline;">Without </span>Both SMTP Addresses</h2>
<p>If we find users without both SMTP Addresses present on their mailbox, we will find the users who are NOT appearing in our Global Address List.  These users either didn&#8217;t have both email address policies applied to them or they had one SMTP address deleted.  Either way, if both policies (and thus both SMTP addresses) were not applied to them they will not be included.  You can fix this by adding in the SMTP address that is lacking making sure to appropriately set the one you want to be default.</p>
<p>I tried to use <a title="Microsoft's KB article" href="http://support.microsoft.com/kb/936197" target="_blank">Microsoft&#8217;s KB article</a> to find the users without both addresses but the query they wanted me to run via Exchange Management Shell returned <strong>nothing </strong>back for me.  I looked up what the query was doing and rewrote it how I thought it should be written.  Here&#8217;s the finished product and I&#8217;ll go through what it&#8217;s doing below:</p>
<pre class="brush: plain;">Get-Mailbox -ResultSize Unlimited |Select-Object DisplayName,PrimarySmtpAddress, @{Name=“EmailAddresses”;Expression={$_.EmailAddresses |Where-Object {$_.PrefixString -ceq “smtp”} | ForEach-Object {$_.SmtpAddress}}} | export-csv c:\export.csv –NoTypeInformation</pre>
<p>First, with &#8216;Get-Mailbox -ResultSize Unlimited&#8217; we are getting ALL mailboxes in the enterprise.  We&#8217;re piping the results using the &#8216;|&#8217; and then selecting an object based on criteria.  The object criteria we are selecting:  DisplayName so we can tell who the person is, Primary SMTP address and then we&#8217;re creating something called a scriptblock with the third &#8216;Select-Object&#8217; criteria&#8230;I&#8217;ve taken it out of the command above to help explain it below:</p>
<pre class="brush: plain;">@{Name=“EmailAddresses”;Expression={$_.EmailAddresses |Where-Object {$_.PrefixString -ceq “smtp”} | ForEach-Object {$_.SmtpAddress}}} | export-csv c:\export.csv –NoTypeInformation</pre>
<p>This command grabs the email address and matches it to the DisplayName we selected previously.  It then searches through each Object and &#8216;Where-Object&#8217; matches the string &#8220;smtp&#8221; it displays that information.  Notice it is in lowercase.  The primary SMTP address are stored in AD as capital letters and the secondary SMTP address (or third or fourth, etc) are stored in lower case&#8230;so we&#8217;re matching ANY other SMTP address (lowercase) that appears for DisplayName.  The results should display similar to the following:</p>
<blockquote>
<pre>DisplayName    ServerName    PrimarySmtpAddress                EmailAddresses
Nologist, Tek  ExchServer    tekn.nologist@teknologist.net     teno321@teknologist.net</pre>
</blockquote>
<p>The last portion of the code, &#8216;<em>export-csv c:\export.csv</em>&#8216;, exports the report to the C: drive as a CSV so we can manipulate it in Excel.  The <em>-NoTypeInformation</em> removes the type information line from the top of our results&#8230;mainly because it&#8217;s not needed.</p>
<p>Using this query to find the users that are not appearing on your GAL is now as easy as finding blank entries in a CSV <img src='http://teknologist.net/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' />   Scan that CSV and where an SMTP address cell is missing (primary as noted in &#8216;PrimarySmtpAddrss&#8217; or secondary as noted under &#8216;EmailAddresses&#8217;) you can note the DisplayName as a user who is not appearing in the GAL.</p>
<p><a href="http://teknologist.net/wp-content/uploads/2010/03/UserAddresses.png"><img class="alignleft size-full wp-image-121" style="margin-left: 10px; margin-right: 10px;" title="UserAddresses" src="http://teknologist.net/wp-content/uploads/2010/03/UserAddresses.png" alt="" width="260" height="298" /></a>After you&#8217;re done with the list, you will need to add in the missing SMTP information on each of the users that you noted.  If you&#8217;re wondering WHERE to add it in, open the <strong><em>Exchange Management Console &gt;&gt;Recipient Configuration &gt;&gt; Mailbox &gt;&gt; Right-click user &gt;&gt; Properties &gt;&gt; Email Addresses Tab</em></strong>.  From there, you should only see one SMTP address&#8230;if you have two policies, you&#8217;ll need to add in another SMTP address that matches said policy.  As you can see displayed in the picture, some of my users had only my secondary policy applied.  So when I went to the Email Addresses Tab, some users appeared to only have <em>firstname.lastname@domain.com</em>.<em> </em>I needed them to also have <em>alias@domain.com</em> to match the default policy I carried over from 2003.  To do this, just click the &#8220;Add&#8221; button and create another SMTP address that matches the user <em>alias@domain.com</em>.  Make sure the checkbox at the bottom is checked so that any lists containing this user are updated.</p>
<p>When I first discovered the solution to this, I thought &#8220;Why do I need that default policy after I&#8217;ve powered down my Exchange 2003 server?&#8221;  Then it hit me!  Users probably still receive mail sent to their alias!  Some of the employees have been here for 30+ years and their alias is still a first initial and last name&#8230;who&#8217;s to say they don&#8217;t still give that out as their email address?  So I had to keep this policy in play whether I wanted to or not.</p>
<p>After you have found all the users that needed another SMTP server added to their Email Addresses area, you&#8217;ll need to go back and update the Offline Address Book again (shown above when I spoke about address lists).  The change should be instantaneous for all your OWA users but Outlook users may have to wait for a day before they appear depending on how you have Outlook 2007 setup.  If you&#8217;d like your Outlook users to immediately have the change, click on the &#8220;Send/Receive&#8221; arrow and choose &#8220;Download address Book&#8221;.  Select the appropriate address book and click &#8220;Ok&#8221;  Allow it to update and then check to make sure the users that did NOT appear before are actually appearing now.  Congratulations!  You&#8217;ve fixed the problem!</p>
<p>I hope that this post does a good job explaining WHY this occurs and how you can find those users and how you can get them to appear in the GAL and OAB again.</p>


<p>Related posts:<ol><li><a href='http://teknologist.net/2010/alloutlookusers-distribution-list/' rel='bookmark' title='Permanent Link: AllOutlookUsers Distribution List'>AllOutlookUsers Distribution List</a> <small>Join the forum discussion on this post One of the...</small></li>
<li><a href='http://teknologist.net/2009/moving-mailboxes-exchange-2003-to-exchange-2007/' rel='bookmark' title='Permanent Link: Moving Mailboxes from Exchange 2003 to Exchange 2007'>Moving Mailboxes from Exchange 2003 to Exchange 2007</a> <small>During a migration from Exchange 2003 to Exchange 2007 many...</small></li>
</ol></p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/AEIJTMP0kik" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/user-not-appearing-in-gal-2007-fix/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/user-not-appearing-in-gal-2007-fix/</feedburner:origLink></item>
		<item>
		<title>ActiveSync Device Report</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/vIh3qd_5psI/</link>
		<comments>http://teknologist.net/2010/activesync-device-report/#comments</comments>
		<pubDate>Fri, 05 Mar 2010 14:25:13 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Exchange Mobile]]></category>
		<category><![CDATA[2007]]></category>
		<category><![CDATA[2010]]></category>
		<category><![CDATA[active sync]]></category>
		<category><![CDATA[exchange]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=109</guid>
		<description><![CDATA[Brian Desmond&#8217;s blog has an excellent tip on how to create an ActiveSync Device Report.  I&#8217;ve been looking for a way to do this and hacked together a long powershell command and then found his tip via my feedreader.  I&#8217;m going to include it here in case the permalink changes but credit goes to Brian [...]


No related posts.

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<p>Brian Desmond&#8217;s blog <a title="Brian Desmond's Tip" href="http://briandesmond.com/blog/how-to-create-an-activesync-device-report" target="_blank">has an excellent tip</a> on how to create an ActiveSync Device Report.  I&#8217;ve been looking for a way to do this and hacked together a long powershell command and then found his tip via my feedreader.  I&#8217;m going to include it here in case the permalink changes but credit goes to Brian Desmond for posting it.  Thanks Brian!</p>
<p>Exchange 2007</p>
<pre class="brush: plain;">$devices = @()
$mailboxes = Get-CASMailbox -ResultSize:Unlimited | Where-Object {$_.HasActiveSyncDevicePartnership -eq $true -and $_.ExchangeVersion.ExchangeBuild -ilike &quot;8*&quot;}

foreach ($m in $mailboxes)
{
 $devices += Get-ActiveSyncDeviceStatistics -Mailbox $m.Identity
}

$devices | Export-Csv DeviceStats.csv</pre>
<p>Exchange 2010</p>
<pre class="brush: plain;">$devices = @()
$mailboxes = Get-CASMailbox -ResultSize:Unlimited | Where-Object {$_.HasActiveSyncDevicePartnership -eq $true -and $_.ExchangeVersion.ExchangeBuild -ilike &quot;14*&quot;}

foreach ($m in $mailboxes)
{
 $devices += Get-ActiveSyncDeviceStatistics -Mailbox $m.Identity
}

$devices | Export-Csv DeviceStats.csv</pre>
<p>To use the above info, copy the code into a text file on one of your exchange servers and rename that file with the .ps1 extension.  Next, open up the Exhcange Management Shell and use the &#8216;cd&#8217; command to change directories until you are in the directory where the .ps1 file is located.  Type ./Filename.ps1 and hit enter to run the script.  The outputted CSV file will be located in the same directory that the file was run from.</p>


<p>No related posts.</p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/vIh3qd_5psI" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/activesync-device-report/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/activesync-device-report/</feedburner:origLink></item>
		<item>
		<title>Microsoft Please, Smarter Not Harder</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/XeDmCB25c8I/</link>
		<comments>http://teknologist.net/2010/microsoft-please-smarter-not-harder/#comments</comments>
		<pubDate>Tue, 23 Feb 2010 14:54:16 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Exchange Mobile]]></category>
		<category><![CDATA[active sync]]></category>
		<category><![CDATA[activesync]]></category>
		<category><![CDATA[cell phone]]></category>
		<category><![CDATA[eas]]></category>
		<category><![CDATA[exchange]]></category>
		<category><![CDATA[microsoft]]></category>
		<category><![CDATA[smart phone]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=105</guid>
		<description><![CDATA[Join the forum discussion on this post My grandfather always says to work &#8220;smarter and not harder&#8221; which is 1930&#8242;s speak for be more efficient. Why couldn&#8217;t Microsoft have listened to him (and all the other grandpa&#8217;s of the world who say the same aphorism)? I had a user come in the other day with [...]


No related posts.

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<span class="sfforumlink"><a href="http://teknologist.net/forum/cas/microsoft-please-smarter-not-harder/"><p><img src="http://teknologist.net/wp-content/plugins/simple-forum/styles/icons/three-en/bloglink.png" alt="" /> Join the forum discussion on this post</p>
</a></span><p>My grandfather always says to work &#8220;smarter and not harder&#8221; which is 1930&#8242;s speak for <strong>be more efficient</strong>.</p>
<p>Why couldn&#8217;t Microsoft have listened to him (and all the other grandpa&#8217;s of the world who say the same aphorism)?</p>
<p>I had a user come in the other day with a Windows Mobile HTC Touch Pro 2.  They wanted to hook up to EAS and have all the whiz bang features that my Palm Pre and all the whiz bang features that iPhones are able to have&#8230;synchronizing calendar, contacts, and email.  This user is by no means very technical.  They need a way to plug in their email address and server name and have it just work&#8230;much in the way that it does for the Palm Pre and iPhone.</p>
<p>The user dropped off the phone to me to handle this for them of course so I entered in all the information and went to connect it.  Promptly, I received the following message:</p>
<blockquote><p>&#8220;your exchange server requires a personal certificate for authorization&#8221;</p></blockquote>
<p>I anticipate this for some phones&#8230;on some phones you have to copy across a root certificate in order to have them connect to a SSL enabled CAS from the internet.  This would be my first phone that I&#8217;ve run across that didn&#8217;t automatically import the certificate.  Now, let me begin by saying this is probably one of the dumbest things I&#8217;ve ever heard of before (not automatically importing the certificate) because if you&#8217;re connecting to the exchange server and authenticating&#8230;you should trust whatever certificate is setup by your administrator automatically.  Locally here on our PC&#8217;s in the enterprise, we&#8217;ve automatically trusted the certificate from servers we can authenticate with passwords to.</p>
<p>As an example, if Microsoft treated their Domain Controllers in an AD Forest the same way&#8230;we&#8217;d be getting pop-ups anytime I regenerated a certificate on a DC.  We don&#8217;t get those because if a computer is authenticated and the server changes, we don&#8217;t want our users getting popups they can&#8217;t explain or understand.  We used group policy to silently negotiate the certificate exchange in the background.  We did the same for OWA when it is accessed internally.</p>
<p>But a smart phone running Windows Mobile?  Heck NO!  You have to manually copy the certificate over and import it manually&#8230;you&#8217;re not given the opportunity to authenticate and import automatically.  Nothing takes place in the background&#8230;even if you are ON THE DOMAIN.  The behavior gives you no other alternative.</p>
<p>I thought this would be fine&#8230;but it&#8217;s not.  There isn&#8217;t a way for me to get access to the filesystem of the phone.  I plug it in via USB.  It can&#8217;t install it because it can&#8217;t find drivers.  I use the software included with the phone and it wants to synchronize locally with Outlook&#8230;but the user that is using this phone DOESN&#8217;T HAVE OUTLOOK nor do they have their own PC, so why would they want to install software just to be able to get files onto their phone?  Why would I?</p>
<p>In this instance, this phone is locked down&#8230;which is fine in a corporate environment.  But this is a personal phone and there is no corporate Windows Mobile plan we have here.  I need it to be as easy as an iPhone.  I need it to be as easy as my Palm Pre.  I need to type in the information and have it connect and start working immediately.  It doesn&#8217;t.  Microsoft needs to work smarter and not harder on this.</p>
<p>I wasted 2 hours yesterday trying to get a certificate copied over to the device and I still can&#8217;t do it.  I pretty much gave up in frustration and figured I&#8217;d file an issue and see what someone can tell me&#8230;there comes a point though where security and usability collide in an awesome display of stupidity&#8230;and I think this is the case here.</p>
<p>I&#8217;m sure everyone is saying &#8220;You&#8217;re a dummy then!  It&#8217;s easy, you just perform action X and they Y and it works!&#8221;  and to that I ask that you leave a comment on how you get it working&#8230;remember, I can&#8217;t copy files to this device&#8230;it won&#8217;t let me.  So tell me how to get it done without copying files to the device or how to hack the device so I can copy files to it and I&#8217;ll agree with you by saying &#8220;yes, I am a dummy&#8221;.  Documentation on this problem and solution are non-existent&#8230;google and live were not my friends on this topic.  So please tell me how wrong I am&#8230;I want to be proved wrong and fix this.</p>
<p>In the meantime, please Microsoft, work smarter and NOT harder.  Making things this difficult to do simple things is dumb.  My boss doesn&#8217;t care about all the technical details.  She just knows that she took her iPhone in and I had it up and running in about 10 minutes.  And now she knows that one of her directors asked for the same functionality in a Windows Mobile phone and 2 hours later I told him I couldn&#8217;t get it to work.  Here it is 2 days later and I still can&#8217;t get it to work.  Making it so competitors systems work better on your own product is comparable to shooting yourself in the foot with a canon.</p>


<p>No related posts.</p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/XeDmCB25c8I" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/microsoft-please-smarter-not-harder/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/microsoft-please-smarter-not-harder/</feedburner:origLink></item>
		<item>
		<title>Migration Tip – XML Logs</title>
		<link>http://feedproxy.google.com/~r/Teknologist/~3/DshtAOb6zEk/</link>
		<comments>http://teknologist.net/2010/migration-tip-xml-logs/#comments</comments>
		<pubDate>Mon, 11 Jan 2010 17:04:58 +0000</pubDate>
		<dc:creator>teknologist</dc:creator>
				<category><![CDATA[Mailbox Server]]></category>
		<category><![CDATA[2003]]></category>
		<category><![CDATA[2007]]></category>
		<category><![CDATA[logs]]></category>
		<category><![CDATA[mailboxes]]></category>
		<category><![CDATA[migration]]></category>

		<guid isPermaLink="false">http://teknologist.net/?p=54</guid>
		<description><![CDATA[Join the forum discussion on this post When migrating from Exchange 2003 to Exchange 2007, I had problems with disk space on one of our network drives.  For the life of me, I couldn&#8217;t figure out what the problem was until we had about 100MB left.  Then I realized that every single mailbox move was [...]


Related posts:<ol><li><a href='http://teknologist.net/2009/moving-mailboxes-exchange-2003-to-exchange-2007/' rel='bookmark' title='Permanent Link: Moving Mailboxes from Exchange 2003 to Exchange 2007'>Moving Mailboxes from Exchange 2003 to Exchange 2007</a> <small>During a migration from Exchange 2003 to Exchange 2007 many...</small></li>
</ol>

Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.]]></description>
			<content:encoded><![CDATA[<span class="sfforumlink"><a href="http://teknologist.net/forum/mailbox-server/migration-tip-xml-logs/"><p><img src="http://teknologist.net/wp-content/plugins/simple-forum/styles/icons/three-en/bloglink.png" alt="" /> Join the forum discussion on this post</p>
</a></span><p>When migrating from Exchange 2003 to Exchange 2007, I had problems with disk space on one of our network drives.  For the life of me, I couldn&#8217;t figure out what the problem was until we had about 100MB left.  Then I realized that every single mailbox move was being logged!  Try running a script that moves hundreds over at a time and then think of the log files!</p>
<p>I ran across a blog post that details just this and what to do about it.  Hopefully you won&#8217;t end up like me finding out after the fact!</p>
<p><a href="http://www.telnetport25.com/component/content/article/11-exchmig/320-exchange-2007-tracking-and-analysing-large-mailbox-move-reports-using-the-exchangemovemailboxtaskviewer-tool.html">http://www.telnetport25.com/component/content/article/11-exchmig/320-exchange-2007-tracking-and-analysing-large-mailbox-move-reports-using-the-exchangemovemailboxtaskviewer-tool.html</a></p>


<p>Related posts:<ol><li><a href='http://teknologist.net/2009/moving-mailboxes-exchange-2003-to-exchange-2007/' rel='bookmark' title='Permanent Link: Moving Mailboxes from Exchange 2003 to Exchange 2007'>Moving Mailboxes from Exchange 2003 to Exchange 2007</a> <small>During a migration from Exchange 2003 to Exchange 2007 many...</small></li>
</ol></p>
<p>Related posts brought to you by <a href='http://mitcho.com/code/yarpp/'>Yet Another Related Posts Plugin</a>.</p><img src="http://feeds.feedburner.com/~r/Teknologist/~4/DshtAOb6zEk" height="1" width="1"/>]]></content:encoded>
			<wfw:commentRss>http://teknologist.net/2010/migration-tip-xml-logs/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		<feedburner:origLink>http://teknologist.net/2010/migration-tip-xml-logs/</feedburner:origLink></item>
	</channel>
</rss>
