Exchange Server Pro

Happy Holidays from Exchange Server Pro

Paul Cunningham — Mon, 19 Dec 2011 10:34:29 +0000

2011 is coming to an end, and Exchange Server Pro will be going quiet for a few weeks while I take a break to enjoy the holidays. I will still be watching for questions in the comments or forums, but won’t be posting new articles until January.

I hope you’ve gotten value from Exchange Server Pro this year, and I look forward to delivering even more useful content in 2012. Thank you to everyone who emailed, commented or tweeted your feedback to me throughout the year.

I also wish you all a safe and happy holiday.

See you next year!

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2010 FAQ: Are Wildcard SSL Certificates Supported?

Paul Cunningham — Mon, 19 Dec 2011 06:36:11 +0000

Question: can I use a wildcard SSL certificate on my Exchange 2010 server?

Answer: Yes, you can.

Often people ask me whether wildcard SSL certificates can be used with Exchange Server 2010, because they have heard that they are either unsupported, not secure, or just not recommended.

What is a wildcard SSL certificate? From Microsoft TechNet:

A wildcard certificate is designed to support a domain and multiple subdomains. For example, configuring a wildcard certificate for *.contoso.com results in a certificate that will work for mail.contoso.com, web.contoso.com, and autodiscover.contoso.com.

The attractiveness of wildcard SSL certificates is that they are usually cheaper than other types of certificates, and they make some Exchange Server configurations easier to manage.

Support for Exchange 2010 and Wildcard SSL Certificates

The support question is a relatively easy one to answer. Yes they are supported from a vendor perspective. One clue for this is that wildcard SSL certificates are an option in the Exchange 2010 new certificate wizard. Microsoft does not make a habit of including options in Exchange Server that will lead you down an unsupported path.

However they are not supported for all scenarios. For example:

wildcard certificates can’t be used in conjunction with OCS 2007 (eg for secure communications for UM/OWA integration)
wildcard certificates are not supported for older mobile devices such as Windows Mobile 5.0

Security Implications for Exchange 2010 and Wildcard SSL Certificates

The security question is also relatively easy to answer. The common assumption is that wildcard SSL certificates are less secure than other SSL certificates.

Microsoft’s own documentation even references “security implications”.

…many customers are uncomfortable with the security implications of maintaining a certificate that can be used for any sub-domain. A more secure alternative is to list each of the required domains as SANs in the certificate. By default, this approach is used when certificate requests are generated by Exchange.

Verisign/Symantec describes some of those implications here:

Security: If one server or sub-domain is compromised, all sub-domains may be compromised.

Management: If the wildcard certificate needs to be revoked, all sub-domains will need a new certificate.

However, put those concerns in the context of your Exchange organization. If you’re using a wildcard SSL certificate to secure a single, internet-facing Client Access server then the above issues do not create much concern.

On the other hand if you’re deploying a large, global Exchange organization with multiple geographic entry points for various services, or those services spread over many services, then those issues are of greater concern.

Summary

So in conclusion, yes Exchange 2010 supports wildcard SSL certificates and no they are not necessarily less secure than other certificates.

However, do your due diligence and make sure that the specific support and security scenarios that do exist will not adversely impact your own Exchange 2010 deployment.

Get more Exchange Server tips at ExchangeServerPro.com

Error: Outlook Was Unable to Recover Some or All of the Items in this Folder

Paul Cunningham — Wed, 14 Dec 2011 10:13:26 +0000

While attempting to restore items from the Outlook recoverable deleted items you may encounter the following error message.

Outlook was unable to recover some or all of the items in this folder. Make sure you have the required permissions to recover items in this folder, and try again. If the problem persists, contact your administrator.

The error may occur when you attempt to recover a folder that contains a large number of sub-folders or mail items in it.

On the Exchange Server you may see a corresponding Application event log entry similar to this:

Log Name:      Application
Source:        MSExchangeIS
Date:          11/14/2011 12:57:59 PM
Event ID:      9646
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exchangeserver.domain.local
Description:
Mapi session "3bbea118-07e3-4746-b7bf-0e5b65e28314" exceeded the maximum of 500 objects of type "objtFolder".

This can occur due to the default limits configured on the Exchange Server for the number of items that can be opened by a single MAPI session. In the example above the MAPI session was trying to open more than the default 500 allowed objects of type “objtFolder” (in other words, Folders).

The solution is provided by Microsoft in this support article, which refers to Exchange Server 2003 but applies to later versions as well.

Open Regedit and navigate to \\HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
If the key “MaxObjsPerMapiSession” does not already exist, right-click on ParametersSystem and create a new key of that name.
Create a new DWORD value with a name matching the object type in the event log error on your server (eg “objtFolder” in this example)
Set the DWORD value to a decimal value higher than the default. For the case above I first tried 1000, then 10000 when that did not work.
Wait 15-30 minutes for the registry change to take effect, then retry the Outlook operation.

You may find that you need to try gradually increasing the value until you can successfully recover the items in Outlook. You may also find that after you’ve removed one limit that another object type’s limit may also suddenly come into play, so always check your event log for new errors identifying additional object types that you may need to add a registry value for.

After you’ve successfully recovered the Outlook items revert the registry keys to their default values (listed in the Microsoft support article above) to prevent issues with server resources in the future.

Get more Exchange Server tips at ExchangeServerPro.com

Upgrading to Exchange Server 2010 Service Pack 2

Paul Cunningham — Tue, 06 Dec 2011 13:25:23 +0000

Microsoft has released Exchange Server 2010 Service Pack 2. Here is how you can deploy it to your existing organization.

Service Pack 2 deployment follows the same installation sequence as the initial Exchange install or any other update.

Client Access servers, starting with the internet-facing ones
Hub Transport and Edge Transport servers
Mailbox servers
Unified Messaging servers

Note: if you are installing to multi-role servers just prioritize based on the same order above.

Upgrading Client Access Servers to Exchange 2010 SP2

When you install Service Pack 2 on Client Access servers you may receive an error message for a missing IIS component. This issue and the solution are described in the following article:

Error Message “The ‘IIS 6 WMI Compatibility’ component is required” During Exchange 2010 SP2 Upgrade

If you’re updating a CAS array of servers in a Windows Network Load Balancing cluster then refer to the following article to learn how to perform the update without disrupting clients:

How to Install Updates on Exchange Server 2010 CAS Arrays

Upgrading Database Availability Groups to Exchange 2010 SP2

If you are updating the members of a DAG to Service Pack 2 then refer to the following article for instructions on how to perform the upgrade without requiring an outage for mailbox users:

How to Install Updates on Exchange Server 2010 Database Availability Groups

Exchange MVP Andy Grogan has already released an updated version of his RUPS Tool for installing Service Pack 2.

Updated version of the RUPS Tool–Installing Service Packs

Upgrading Management Tools to Exchange 2010 SP2

Any management servers or workstations that have the Exchange 2010 Management Tools installed on them will also need to be upgraded to be able to manage some of the new features of Exchange 2010 SP2 and to avoid the initialization error that can occur due to mismatched versions. Simply run the setup wizard to upgrade those computers.

Get more Exchange Server tips at ExchangeServerPro.com

Initialization Failed: The Operation Couldn’t Be Completed Because a Change Occurred in the Remote Forest

Paul Cunningham — Tue, 06 Dec 2011 13:23:53 +0000

When you are launching the Exchange Server 2010 management console you may receive the following error message.

Initialization Failed: The Operation Couldn’t Be Completed Because a Change Occurred in the Remote Forest

Initlalization Failed error message launching Exchange 2010 management console

This error can occur when the server the management console is connecting to has been upgraded to a higher Service Pack or Update Rollup version than the server or workstation that you are launching the management console from.

To resolve the issue upgrade your management server or workstation to the same version as the Exchange servers in your organization.

Get more Exchange Server tips at ExchangeServerPro.com

Error Message “The ‘IIS 6 WMI Compatibility’ component is required” During Exchange 2010 SP2 Upgrade

Paul Cunningham — Tue, 06 Dec 2011 12:40:52 +0000

While attempting to upgrade an Exchange Server 2010 Client Access server to Service Pack 2 you may encounter the following error message.

The ‘IIS 6 WMI Compatibility’ component is required. Install the component via Server Manager.

Error message upgrading Exchange 2010 Client Access server to SP2

This error occurs because a new feature of Exchange 2010 SP2 called Outlook Web App Mini requires that IIS component to be installed on Client Access servers.

You can install the component manually by opening a PowerShell window and running the following commands.

PS C:\> Import-Module servermanager

PS C:\> Add-WindowsFeature Web-WMI

Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
True    No             Success   {IIS 6 WMI Compatibility}

Click Retry on the Readiness Checks dialog box above, or if you’ve already cancelled the installation simply start it again.

You can also avoid the error by installing the Service Pack 2 upgrade from the command line. Open a command prompt and navigate to the folder where the Exchange 2010 SP2 files have been extracted, and run the following command:

C:\Admin\ex2010sp2>setup /mode:upgrade /installwindowscomponents

This will automatically install the required components for you when the upgrade process runs.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server 2010 Service Pack 2

Paul Cunningham — Tue, 06 Dec 2011 12:35:48 +0000

Microsoft has released Service Pack 2 for Exchange Server 2010 for download by customers.

This major update to Exchange 2010 includes the following enhancements.

Hybrid Configuration Wizard - provides customers with a streamlined process to configure a hybrid deployment between on-premises and Office 365 Exchange organizations.
Address Book Policies - determines the global address list (GAL), offline address book (OAB), room list, and address lists that are visible to the mailbox user that is assigned the policy. Address book policies provide a simpler mechanism to accomplish GAL separation for the on-premises organization that needs to run disparate GALs.
Cross-Site Silent Redirection for Outlook Web App - enables a silent redirection when a Client Access server receives a client request that is better serviced by a Client Access server located in another Active Directory site.
Mini Version of Outlook Web App - a lightweight browser-based client, similar to the Outlook Mobile Access client in Exchange 2003.
Mailbox Replication Service - parameters have been added to the New-WebServicesVirtualDirectory and Set-WebServicesVirtualDirectory cmdlets so that you don’t have to perform the manual configuration: MRSProxyEnabled and MaxMRSProxyConnections.
Mailbox Auto-Mapping - administrators can turn off the auto-mapping feature by setting the value of the new Automapping parameter to $false on the Add-MailboxPermission cmdlets.
Multi-Valued Custom Attributes - introduces five new multi-value custom attributes that you can use to store additional information for mail recipient objects.
Litigation Hold - you can’t disable or remove a mailbox that has been placed on litigation hold.

Webinar Invitation: Upgrading to Exchange Server 2010

Paul Cunningham — Mon, 05 Dec 2011 12:10:08 +0000

This week I will be hosting free webinars on the topic of Upgrading to Exchange Server 2010.

This is an introduction to upgrading to Microsoft Exchange Server 2010 including:

Critical planning considerations
Deployment of Exchange Server 2010 into existing organizations
Establishing co-existence
Performing the migration of services and data
Decommission of legacy servers.

The presentation goes for about 1 hour including some Q&A time.

There are two session times to so that as many people in different time zones can attend as possible, up to 100 attendees per session (a limit of the webinar software I am using this time).

Here are the session details and links to the registration pages.

Session 1 – Thursday December 8, 11:30am to 12:30pm AEST (GMT+10)

Session 2 Thursday December 8, 10:30am to 11:30am PST (GMT -8)

I look forward to seeing you there.

Happy Holidays from Exchange Server Pro

Get more Exchange Server tips at ExchangeServerPro.com

Using Test-Mailflow with Exchange 2003 Servers

Paul Cunningham — Sun, 04 Dec 2011 12:32:49 +0000

One of the challenges of managing a large Exchange Server environment is that you often need to support multiple versions of Exchange.

That means that often when you write a PowerShell script you need to account for servers running different versions and adjust accordingly. It can turn a simple scripting exercise into a big task.

Recently I was looking at ways to include our Exchange 2003 servers in some monitoring scripts that are already running for Exchange 2007/2010 servers. I wanted to perform a mail flow test for the Exchange 2003 servers, because that is a test that (if successful) very quickly confirms a lot of the elements involved in email availability are in fact healthy (ie the server is up, reachable, accepting SMTP connections, processing mail queues, the Information Store is running, and more).

For Exchange 2007/2010 the Test-Mailflow cmdlet can be used for these. You can build it into a health check script if you want to. But if you try to run it against an Exchange 2003 server you’ll get an error like this:

[PS] C:\>Test-Mailflow -Identity EX2007SERVER -TargetMailboxServer EX2003SERVER

Test-Mailflow : "EX2003SERVER" is running a previous version of Exchange and does not support this task.
At line:1 char:14
+ Test-Mailflow <<<<  -Identity EX2007SERVER -TargetMailboxServer EX2003SERVER
    + CategoryInfo          : InvalidArgument: (:) [Test-Mailflow], OperationOnOldServerException
    + FullyQualifiedErrorId : 642F2C5C,Microsoft.Exchange.Monitoring.TestMailFlow

However, if the Exchange 2003 server is in the same organization you can use a different parameter with Test-Mailflow to achieve the same result. All you need is an email address for one of the mailboxes on the Exchange 2003 server. You might want to create a mailbox on each of your Exchange 2003 servers (or even each of the databases on those servers) specifically for this purpose.

Then you simply run the Test-Mailflow cmdlet with the -TargetEmailAddress parameter instead of the -TargetMailboxServer parameter.

[PS] C:\>Test-Mailflow -Identity EX2007SERVER -TargetEmailAddress EX2003SERVER_test@domain.com

TestMailflowResult         MessageLatencyTime          IsRemoteTest
------------------         ------------------          ------------
Success                    00:00:19.5014893            True

As you can see this is a nice, simple way to test your Exchange 2003 server health using PowerShell.

Get more Exchange Server tips at ExchangeServerPro.com

How to Health Check an Exchange 2010 Mailbox Server

Paul Cunningham — Mon, 21 Nov 2011 11:51:55 +0000

How many times each day do you get asked, “Is there a problem with the Exchange server?”

If you’re like me then you get asked this question at least once per day. Of course there usually isn’t anything wrong with our Exchange servers but once the question has been asked then you have no choice but to investigate and confirm that everything is okay.

In this article I’m going to demonstrate how you can quickly check the health of your Exchange Server 2010 mailbox servers, and share a script with you that can help to speed up this task.

Exchange Server 2010 has a series of PowerShell cmdlets that make it easy to do a health check of mailbox servers. For example, we can:

Run Test-Servicehealth to check the required services are all running
Run Get-MailboxDatabase to check whether the mailbox databases are mounted
Run Test-MapiConnectivity to verify that the databases are responding to MAPI requests
Run Test-MailFlow to confirm that email is able to pass successfully between two servers
Run Get-MailboxDatabaseCopyStatus for DAG members to check the database copy status, queues, and content indexes

That’s quite a few cmdlets to run, especially if we’ve got more than one mailbox server in the organization. And of course each of those cmdlets needs to run and show you output that you need to interpret.

I like to make life a bit easier and use PowerShell scripts to speed up these types of tasks. So naturally I put together a script for performing all of the above tests (and a few more) on my mailbox servers and display a nice simple colour-coded output so that I can tell at a glance whether there might be a problem.

This isn’t designed to do a diagnosis of any problems, it just checks the fundamentals and gives me a simple pass/fail and a few other indicators that I can then troubleshoot further if necessary.

Download the script file here: Test-MailboxServer.ps1 (downloaded 461 times so far)

Extract Test-MailboxServer.ps1 from the Zip file and run it in your Exchange Management Shell to see output such as this:

If you have any questions or bugs to report please let me know in the comments below.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro

Happy Holidays from Exchange Server Pro

Related posts:

Exchange 2010 FAQ: Are Wildcard SSL Certificates Supported?

Support for Exchange 2010 and Wildcard SSL Certificates

Security Implications for Exchange 2010 and Wildcard SSL Certificates

Summary

Related posts:

Error: Outlook Was Unable to Recover Some or All of the Items in this Folder

Related posts:

Upgrading to Exchange Server 2010 Service Pack 2

Upgrading Client Access Servers to Exchange 2010 SP2

Upgrading Database Availability Groups to Exchange 2010 SP2

Upgrading Management Tools to Exchange 2010 SP2

Related posts:

Initialization Failed: The Operation Couldn’t Be Completed Because a Change Occurred in the Remote Forest

Related posts:

Error Message “The ‘IIS 6 WMI Compatibility’ component is required” During Exchange 2010 SP2 Upgrade

Related posts:

Exchange Server 2010 Service Pack 2

Related posts:

Webinar Invitation: Upgrading to Exchange Server 2010

Related posts:

Using Test-Mailflow with Exchange 2003 Servers

Related posts:

How to Health Check an Exchange 2010 Mailbox Server

Related posts: