The Google Enterprise Expert Blog

GAMME and Exchange 2010 Client Throttling Polices

2012-08-04T23:16:00.002+03:00

By Doron Offir - Google Apps Deployment Specialist from DoIT

You are trying to migrate exchange 2010 SP1 using Google Apps Migration for Microsoft Exchange (following as GAMME) and it fails.

The symptoms are: while migrating users (more than ten users, usually) from Microsoft Exchange 2010 SP1 to the Google Apps using GAMME you keep getting authentication failure responses, oddly enough if you take the failed users from the log and run them separably with GAMME it will work with no issues.

After doing research on this problem, the origin seems to be Exchange 2010's feature called Client Throttling Polices.

You can read more about Client Throttling Polices here, and have more detailed information here, and even more in depth overview here. Basically the idea is to allow a better control over client connections made to the Microsoft Exchange 2010 servers.

Since SP1 of Exchange 2010, the default policy is now turned on by default. When we try to migrate (or even estimate) more than 10 users concurrently, the Exchange server will refuse the connection. Mistakenly, Exchange server will think that GAMME violating it's policy.

After some searching and testing, it seems that the problem is mainly due to the RCAMaxConcurrency settings within the default policy.

The setting can be raised until hitting the golden line that will allow migration to run uninterruptedly, but the try-and-error process can be very time consuming. I suggest to set RCAMaxConcurrency to null, at least for the time of the migration. Setting this value to 0 will disable this policy and GAMME will be able to communicate with all the connections it's needing.

To do so please run the following lines in Exchange PowerShell:

Of course, prior to the change, please document the current settings, can be achived by:

>$default = Get-ThrottlingPolicy | where-object {$_.IsDefault -eq $true} > C:\<FileName>.txt

1st line query default policy, 2nd line makes the change:

>$default = Get-ThrottlingPolicy | where-object {$_.IsDefault -eq $true}

>$default | set-throttlingpolicy -RCAMaxConcurrency $null

If this change doesn't help, try to set the rest to Null, as below.

>$default = Get-ThrottlingPolicy | where-object {$_.IsDefault -eq $true}

>$default | set-throttlingpolicy -RCAMaxConcurrency $null -RCAPercentTimeInAD $null -RCAPercentTimeInCAS $null -RCAPercentTimeInMailboxRPC $null

Another hint - I did encounter a situation when the change took affect only after a few minutes, especially after I "violated" the policy with the try-and-error test, so wait a minute or two after committing the change and only then try to run the GAMME again.

A small tip - look at the Exchange logs for the user running the GAMME. Otherwise, you might not find what you're looking for :)

Happy Migrations!

How to setup Calendar Interop for Microsoft Exchange

2012-07-14T23:04:00.003+03:00

By Doron Offir - Google Apps Deployment Specialist

On April 2012, Google released a much awaited Calendar Interop tool allowing to share Free/Busy information between Google Apps and Microsoft Exchange 2007-2010 servers.

The tool was released with fairly good documentation which explains how to deploy the Free/Busy sharing between two systems. However, I found the documentation lacking some basic explanation on how the Calendar Interop tool works and I would like to add some info that might help clarifying it a bit.

Google Apps users querying Exchange's Free/Busy information

The Calender Interop using the Exchange Public Folder Schedule+ Free/Busy to query calendar events in Exchange Server and to provide them to Google Apps's users. This process can take some time (1-3 seconds usually) since for each query the service need to contact Exchange's EWS and ask for Free/Busy status.

Exchange Server querying Google Apps's Free/Busy information

Exchange Server uses a public folder to store the Free/Busy information of users in Google Apps and when the request from Exchange user will arise, the answer will be provided instantaneously simply because it's already resides in Exchange's public folder and there is no need to "travel" to Google Apps to bring the data.

The configuration documentation is pretty straight forward, read the below for the "logic" side and follow that document for the deployment.

You need to make sure you have access to the EWS service:

The EWS service published to the world with a trusted authority certificate, with no warning messages displayed when you accessing it with a browser
The EWS service is accessible to the world, or at least to the Google's IP range.
A user that can read/write to the Public Folders, this will be referred as the Google API user

You will need public folders on the Exchange server, however, since the release of Microsoft Exchange 2007 they are not installed by default anymore, therefore create them if you haven't done it before.

Grant the Google API user owner rights on the public folders, as stated in the configuration documentation - Exchange side section 2.

You'll need to explain the Exchange server where to "look" for the Google Apps. Since the users are residing on a different system, we need to make it transparent to the users:

Exchange needs to know that the user isn't in its domain, that is why we should create an alias domain for Google's side (i.e. gapps.mydomain.com) and creating mail contacts pointing to Google Apps's users (user@mydomain.com in Google Apps will be a user@gapps.mydomain.com contact in the Exchange Server).

As stated in the configuration documentation - Exchange side section 4, we'll use the Add-AvailabilityAddressSpace to "explain" the Exchange Server where to look for information regarding a specific domain (i.e. gapps.mydomain.com). After executing this step, when I'll check availability of users that their SMTP address ends with gapps.mydomain.com the Exchange Server will know to look it up in the public folders.

At the Google Apps side, we need to "teach" Google Apps how to communicate its users to the Exchange Server. This is done at the last section of the configuration documentation - Google Apps side. Basically what is done by those entry is that we connect the attribute exchangeLegacyDN to the Google's user. By this, the Calendar Interop writes entries to the public folders that are connecting its side user@mydomain.com to the user@gapps.mydomain.com contact, which is represented by the exchangeLegacyDN attribute.

Google Apps Calendar Interop tools is a great feature doing large-scale deployments and need a free/busy sharing during rollout. I hope this information was helpful, please if you have any insights, question or even better, something to add, please leave a comment.

Dynamic Navigation in Your Own Search App

2012-06-25T18:24:00.003+03:00

In most of the cases, you will end-up building your own search application for Google Search Appliance. The built-in stylesheet XSLT is nice but typically the front-end requirements are more complicated than the XSLT can accomodate (I am sure that some high-end XSLT experts will not agree with this statement).

So, you can pretty easily develop your own search app, using the Search Protocol API the GSA provides. All you need to do is to POST HTTP request with your query parameters and the GSA will respond with XML output enumerating all your results.

Having said that, the built-in XSLT editor have a very neat feature called Dynamic Navigation. This is Google's version of Parametric Search allowing to run a broad query and then to filter the search results by various parameters (usually metadata).

When building your own search app, you often would like to implement your own "Dynamic Navigation", however the documentation lacking any reference to how to do that... The obvious choice is to send several queries to the GSA, finding out what parameters are available, but this will be very inefficient and require multiple round-trips between your app and the GSA.

Apparently, I've found that in the search result XML, there is a <PARM> section which includes the complete dictionary of Dynamic Navigation for a given search.

Let's look closer into the search result XML, - if you have enabled and configured Dynamic Navigation for your front-end, your XML response will include something similar to this:

<PARM>
<PC>0</PC>
<PMT NM="categoryName" DN="Category" IR="0" T="0">
<PV V="Category 1" L="" H="" C="253"/>
<PV V="Category 2"" H="" C="244"/>
<PV V="Category 3" L="" H="" C="158"/>
<PV V="Category 4" L="" H="" C="91"/>
</PMT>
<PMT NM="Visibility" DN="Access Level" IR="0" T="0">
<PV V="Public" L="" H="" C="931"/>
<PV V="Private" L="" H="" C="390"/>
</PMT>

<PMT NM="views" DN="Popularity" IR="1" T="1">
<PV V="" L="" H="0" C="0"/>
<PV V="" L="1" H="500" C="1256"/>
<PV V="" L="501" H="1000" C="58"/>
<PV V="" L="1001" H="3000" C="5"/>
<PV V="" L="3001" H="5000" C="2"/>
<PV V="" L="5001" H="" C="0"/>
</PMT>
</PARM>

In my Dynamic Navigation configuration, I have three parameters, - "Category" and "Access Level" and "Popularity" based on metadata (from database in my case) of "categoryName", "Visibility" and "Views" accordingly.

Obviously enough, "C" attribute is count (i.e. how many search results have this metadata), "L" is lower-end range definition and "H" is higher-end range definition.

Now, all you need is to load and parse this section of XML and build your own UI around it. Isn't that awesome?

Viewing Google Calendars Side-by-Side

2012-05-08T15:13:00.001+03:00

Often, I am being asked about how you can see multiple calendars in a side-by-side view rather than the overlapping view when all calendars are on the same area and different calendars are marked by different colors. While this model works well for few calendars (up to 3-4 for my humble opinion), it's becoming increasingly complicated when you need to see more calendars. Some administrative assistants can manage 5-10 different calendars and in these cases, it's very hard to efficiently operate with Google Calendar.

If you want to view calendar information side-by-side, you can use the "Find a Time" tab of a calendar event. Just create a calendar event, add the attendees whose calendar information you want to see side-by-side and then select the "Find a Time" tab.

Assign a drive letter to Google Drive

2012-05-06T09:27:00.006+03:00

The recently released Google Drive doesn't have a built-in capability to assign a drive letter (i.e. F:) to it's content, so people will be able to access the Drive using "My Computer" on Windows based machines.

In fact, thanks to old friend - the "substs" command from MS-DOS times, it's very easy to fix. This command-line utility exists since MS-DOS era (20 years ago!) and it's still included and works in Windows XP, Windows Vista and Windows 7 machines.

Syntax:
subst [drive1: Path]

Real-life Windows XP based example:
subst f: "C:\Documents and Settings\Vadim Solovey\My Documents\Google Drive"

That's all it takes, really. Go to your My Computer, you'll see a new drive letter (F: in my example) pointing to your Google Drive's content.

You can run subst command without parameters to see what drive letters are assigned to what paths. As well, the /d parameter deleted a drive letter (it doesn't touch the content of your Google Drive, off course).

If you really hate messing with command line, you can use Visual Subst which does the same thing exactly (actually, it's a GUI which runs the same subst command under the hood).

IMPORTANT - The subst will work until you restart your PC. After the restart, the drive letter will disappear. You'll need to create a .cmd file with your subst command and put it in to the startup folder of your Windows installation to re-create it each time you're restarting.

Auto Forward inbound emails to external address

2011-12-11T17:58:00.001+02:00

This trick I learned few days ago from one my clients. While it's very simple to implement, I wasn't aware of this capability of Google Apps and I am sure it can help others as well.

Sometimes, you'd like to setup an auto-forward of incoming emails to some particular email address to be redirected to another external account. It can be an subcontractor which wants to present your company's email address but actually wants to read it from his own email account or any other similar use-case.

The "standard" way of setting it up is to create a Google Apps user account ($50/user/year) and configure Forwarding from the User's settings (Gear button). However, it requires license, knowing the end-user's password and some tedious process of sending confirmation email and approving it.

The much more convenient (each cheaper) option is to do this nice trick:

Step 1 - Create a Google Apps Group

Create a Google Apps group with email address you'd like, like "joe.doe@mydomain.com"

Step 2 - Add a member

Add a member with the real, external address to whom you'd like emails to be sent like joe.doe@mydomain.com to be delivered (doejoe@company.com in my example).

Step 3 - Verify Group Settings

You'll need to verify that Group's Access Settings include "Anyone Can Post" and "Allow posting from the web" and proper Moderation settings to ensure correct delivery.

That's it. From this moment and on, all emails sent to joe.doe@mydomain.com will be automatically redirected to doejoe@company.com and you've just saved $50/user/year :)

Enjoy!

Google+ Hangout & Google Calendar Integration

2011-10-31T12:05:00.001+02:00

Now, when Google+ for Google Apps is available, the most prominent feature missing is the Google+ Hangout and Google Calendar integration.

Today, Hangouts are ad-hoc process, i.e. you start the hangout and wait until people are get connected. You can not schedule Hangouts to start at particular time/date. Unfortunately, this is not how we use video-conferencing systems, usually.

It would be great of Google will provide the way to schedule Hangouts as simple Calendar meeting request and to provide some sort of "Join Now" button in the event itself when the Hangout is available to join it.

What do you think?

The Value of Postini Split Delivery

2011-10-30T15:42:00.003+02:00

For some reason, people often underestimate the value of Split Delivery feature in Postini. While it's a little more complicated to setup, it offers a really strong value for distributed organizations and Google Apps migrations.

In this post I will cover how Split Delivery helps with Google Apps migrations and makes them more flexible and easier to manage.

First of all, what is Split Delivery? This is basic Postini's feature which allows you to split delivery of inbound mail flow to several email configs (i.e. server mail servers). The mail server can be an Microsoft Exchange server or Google Apps.

Before we start the migration to Google Apps, your mail flow in being handled by some sort of mail security solution, often referenced as mail-relay. In rare cases, it's being routed directly to your mail server. Given the fact that most of the migrations are phased (i.e. not all of your users are being migrated overnight), you'll need a flexibly way to route inbound mail.

By flexible way, I mean that inbound email flow for users who are already migrated to Google Apps will be delivered directly to Google Apps and for the rest of your users it will be delivered to your old mail server.

To start, you will need a Stand-Alone version of Postini. The Integrated version doesn't support multiple email configs, thus is inappropriate for Split Delivery. Your Google Apps for Business already includes a license for Google Message Security and you'll need to contact Google (if you purchased it directly) or to your reseller to ask to reestablish your Postini account as Stand Alone. This process can take few days, depending if your domain was registered with Postini prior to the change or not. See more details on two editions of Postini here.

When your Postini account is ready, you'll need to create two separate email configs. Usually, you'll already have one email config, named [Your Account Name] Email Config 1. You can rename it so something else to better reflect it's purpose under "General Settings" tab in your Postini Console.

The idea is to create two email configs, one for your existing mail server and another one for Google Apps.

Configuration of Email Config 1 (Inbound Servers -> Delivery Manager -> Edit) should contain your existing mail servers, i.e.

The 2nd Email Config (again, Inbound Servers -> Delivery Manager -> Edit) should point to Google Apps:

Before you begin your migration to Google Apps, you should place your users under Email Config 1 and as you go thru your migration, all you'll need to do is to move your migrated users between both Email Configs.

Personally, I like to create a group in Active Directory, - something like YetMigratedUsers and sync users using GADS based on group membership. This way, you'll assign all users to this group and remove their membership as soon as you migrate them to Google Apps. The GADS will do the account move between Email Configs automatically.

Note: You should be aware of "Differing mail hosts" issue when splitting email for a single email domain between several emails configs. See my post on this matter.

Google+ for Google Apps is out!

2011-10-27T19:04:00.002+02:00

Well, it seems like the waiting was long but worth it. Google+ for Google Apps is out now.

Enjoy ;)

My Google+ Profile

Why Data Location Matters (Part 1)

2011-10-25T12:31:00.000+02:00

I was thinking about starting to write a series of posts on comparing Google Apps and Microsoft's rival - Office 365.

I am sure you can find a lot of information doing some basic searching, however, most of it will be pure marketing buzz with few technical details attached to it. In contrast, I was thinking about writing a pure technical articles which will help professional CIO's and CTO's to decide what product better matches their needs.

So, today, I would like to start with elaborating on datacenter location aspect and to see how both products deals with it. Why, data location? Well, that's because this is the top differentiator between Google and Microsoft when it comes to cloud computing.

As a consultant, the question I am being asked all the time when meeting customers on cloud technologies is "Where is my data stored?". This is not by a chance, but because people are not comfortable with the idea that their data is stored outside their control.

Multi-Tenant Design (Google's Approach)

Google basically invented the cloud more than a decade ago. They were the first company who needed to deal with extremely large volume of data that no company has required to do before. I see that as a primary reason that they developed a complete set of technologies which are aimed to be a solid infrastructure for their business.

Within Google's datacenters it's all about Google's technologies. It's Google's servers (did you know that Google is 4th server manufacturer in the world after HP, IBM and Dell?), it's BigTable database, it's their own storage technology, security software and so on. Google has to develop those technologies because there was nothing available off-the-shelf at that time (even today there are very few companies who have built something similar, take Facebook as one of few examples) to support such a big volume of processing and data.

So how it really works? Each piece of data that you're storing on Google's infrastructure (it can be an email, file, calendar entry or whatever) is being split into small chunks of data and being distributed over large amount of servers spreading multiple datacenters. Why? Data security..

Let's take as a axiom that everything can be hacked (and there were many examples of that in the past like Pentagon, NASA and other highly secured premises). So, Google is also can be hacked (even if it's really hard to achieve given the scale of security operations in Google). In that case, Google need to prevent data leaking even in the case of server or complete datacenter is compromised.

By splitting your data into very small chunks and distributing it's over really large number of servers and datacenters, the potential hacker will only be available to get a small, obfuscated portion of your data. Basically, it's will give the hacker nothing..

In addition to splitting the data, Google replicates it across many additional datacenters to achieve high availability of your data. The data is being replicated across geographically dispersed locations to make it even more secure. After all, Google's effective SLA for 2011 is 99.998%.

So, what do I answer my customers when they ask me about where their's data is stored? My answer - It's stored nowhere and everywhere simultaneously.

Off course, storing the data in that much locations solves many other issues. Take for example the latency issue. Latency is cloud's primary counterargument. As a customers, we all want to access our services and data fast as it is when it's internal in our LAN.

By distributing the data, Google's customers are always working with their closest servers, thus minimizing the latency. Imagine a global company with multiple locations all over the world. They cannot "host" their data in some single location, doesn't matter what it will be. Someone will always suffer.

In Google's cloud, if you're American employee - you will work with Google's datacenter in US. If you're connecting from Europe, well again, - you will be working with European's datacenters. The same is also truth for other continents. So, everyone is getting his lowest possible latency.

Look for my next post on how Microsoft deals with data location. Stay tuned.

How to: Check Postini Operations Status

2011-10-21T02:47:00.001+02:00

If you ever wondered how to check Postini's Operational Status, you can use the following links:

Don't know on what system you're?

Log in to your Administration Console and look at the URL of the page:
In the Administration Console, the URL will begin with "https://ac-sX.postini.com"

The number of the system you're on will appear in place of the X in the example URLs above. Available systems include 5, 6, 7, 8, 9, 10, 20, 200 and 201.

Exchange 2007/2010 Forwarding Rules Not Working

2011-10-21T02:19:00.002+02:00

I never ran into this issue until few days ago. Migrating Microsoft Exchange servers to Google Apps often require definition of forwarding rules. Most often you'll want to auto-forward emails sent to Exchange accounts which were already migrated to Google Apps by people who wasn't migrated yet (co-existence mode).

It seems like Exchange 2007/2010 doesn't allow (by default) setting forwarding rules for external domains (and your Google Apps is considered external domain). I think I never ran into this before, because all of the Microsoft Exchange servers I migrated were upgraded from prior versions (like 2000/2003) rather than fresh/new installs.

Fortunately, there is an easy way to fix it. Go to PowerShell and type this command:

set-remotedomain -identity Default -AutoForwardEnabled $true

How to: Find Unused Mailing Lists (by Postini)

2011-10-21T01:43:00.000+02:00

Sometimes, mailing list management goes out of control. Years after years people are tending to add more and more mailing lists (also known as Distribution Lists) and almost never delete the old ones. After a few years you will discover that you have more mailing lists than actual people in your organization, just as I did recently when helping a customer with some Postini troubleshooting.

The well-accepted approach for mailing list management in Postini is to add mailing list email address as an alias under some account in (i.e. mailing-list@domain.com). This is correct for both manual management and mailing list syncing via Google Apps Directory Sync for Email Security.

This approach works well, until you want to know which mailing lists are in use and which aren't. Since all of the mailing lists are under the same account in Postini (mailing-list@domain.com) simple use of "Reporting" tab in Postini Console won't reveal the required information.

However, I was able to find a simple workaround which will give you a list of mailing list addresses which were actually and validly used during last 30 days (i.e. received valid email from external recipient).

This is the process:

Select you Postini Account Organization (let's say "CompanyX Account")
Select Log Search and fill it according to this:

Clicking "Export All" will generate a CSV file (it can be quite large, mine was 9MB).

Use your spreadsheet of choice to open the file (I used Google Spreadsheet, but you can do it with Microsoft Excel as well). The export file contains a lot of columns, but we'll need only some of them. Here is the list of the columns we are going to use:

'Direction' | 'To' | 'Disposition' | 'Disposition Filter' | 'Primary Address'

Now, we'll need to filter out some rows to get a list of only valid emails (i.e. not spam messages). Set your filters this way:

Direction = Inbound Only

Disposition Filter != "Blatant Spam Blocking" & Disposition Filter != "Virus Filtering"
Primary Address == mailing-list@domain.com

The last action should be getting rid of duplicate rows (i.e. mailing lists which received an email more than once for last 30 days). Both Microsoft Excel and Google Spreadsheet provide an easy way to do it.

The resulting list is only externally used & valid mailing list addresses. All the rest isn't used anymore and you can act accordingly.

The last thing - what to know how many aliases (i.e. mailing lists) you have under your mailing-list@domain.com Postini account?

Here is the simple batch command to use:

listusers ALL, primaryqs=mailing-list@domain.com, targetOrg=100046262, childorgs=1, aliases=1

The "TargetOrg" is the Postini Account Organization ID. The return values are a comma separated list of aliases for mailing-list@domain.com.

How to: Disable Web Clips for entire (Google Apps) domain

2011-10-21T00:41:00.002+02:00

By default, the Gmail user interface (including Google Apps Business) contains rotating advertisement called “Web Clips”. Web Clips pulls the information from RSS feed and many end-users may consider it as advertisement.

This is how Web Clips looks like:

While it's possible to disable Web Clips, it being done on per user basis, meaning you (or the end-user himself) need to login as a user and disable Web Clips via Settings/Web Clips page. Off course, you can send email to all your users with instructions how to disable it, but I don't like it too much.

The other solution can be to utilize Email Settings API. It will require some basic programming skills, but at least it will automate the task and eliminate the need to login as a end-user.

However, there is a much simpler way to do the job. You will need to contact Google Support and request disabling Web Clips for your entire domain. You only have to do that before you actually creates any users, as it won't affect existing users in your Google Apps domain.

So, while it's probably won't help you with your existing domains, you can include this step in your domain provisioning flow (as I did to mine) and get rid of Web Clips once and for all.

Google Apps Security and Reliability

2011-10-16T22:33:00.003+02:00

Google published on Youtube nice webinar on Google Apps Security and Reliability subject. Adam Swidler, Sr. Manager from Google provides great overview of security and resiliency features built-in in Google Apps.

While it's almost 55 mins of video, it's definitely worth spending time on it.

Solving "Differing mail hosts" error

2011-10-16T21:26:00.000+02:00

Maybe, when reading Postini documentation you've come across something called "wide_account" flag. However, it's hidden so deep in the documentation hierarchy that most of the people never see it, unless they are specifically digging for it.

Or, maybe, you're syncing your LDAP with Postini and receiving "Differing mail hosts" and you're trying to solve the problem. The other error you're receiving might be "Error 451 Recipients not all at same mail host - psmtp". This way or the other, it might be a good time to learn what is "Wide_Account" flag, when (and how) it should be used?

Well, in some scenarios, you Postini account can (or should) look like this:

Email Config 1 (London)

London Users Org

user1@domain.com

Email Config 2 (New York)

New York Users Org

user2@domain.com

Email Config 3 (Singapore)

Singapore Users Org

user3@domain.com

What is special in this configuration is that users from the same email domain are distributed over multiple email configs. When this kind of configuration can be applicable? Well, in many scenarios, really.

Imagine, that you are running Microsoft Exchange environment for multi-national company. You have several Microsoft Exchange servers running, let's say, in London, New-York and Singapore. However, all email addresses are unified to the same email domain (domain.com in our example).

So, you've setup the above structure in your Postini account. Now, you need to add users, right? You can do it either via Google Apps Sync for Email Security (look for my post on tips-and-tricks for GADS) or via simple Postini batch command from CSV file.

Either way, you're going to receive "Differing mail hosts" error when trying to add users with the same email domain to any additional email config to the first one (usually the default email config org). This is happening due to some nuances of how Postini's Delivery Manager works and it's beyond the scope of this article (I'll write a separate post on logic of Delivery Manager as it also hides many pitfalls and gems as well).

To get rid of the error (and to allow the distribution of users across multiple email configs), you'll need to contact Postini support and ask them to "enable Wide Account flag" for your organization. It almost sounds as a secret code, isn't it? ;)

It takes seconds after support will provision the flag for you and - 'voilà', - your configurations starts to work just as you expected.

However, there is one thing you should be aware of: your backend configuration must allow internal routing between your email servers.

This is because if a single email will be sent from outside to both user1@domain.com and user2@domain.com (while those users belong to different email configs) and the Email Config 1 (London) will be unable to deliver the email to user2@domain.com you're going to experience another kind of error "Recipients not all at same mail host - psmtp", - but this is a good reason for another post ;)

Reference information for this post can be found here. Thanks to FrankM for pointing me out to this.

How to: Logical Expression in Filters

2011-10-16T20:11:00.001+02:00

Sometimes, it's not obvious that setting a filter can include a logical expression (or boolean operator, in other words) more than one value in each of the fields, like "From:", "To:", "Has the words:" or "Doesn't have:"

For example, if you want to check whether specific email is designated to either one of two email addresses (or nicknames) you own, you can put in "To:" field something like: e1@domain.com OR e2@domain.com.

So, what if you'd like to create a filter which stars all emails sent to you directly (in to: field) but not when you're in cc: or bcc:?

In that case, your filter will look like this:

In "To:" field put "to:me" and set "doesn't have" field to "cc:me OR bcc:me". In addition to "OR" you can also use operator "AND" and operator "NOT" (which you can also reference to as "-", i.e. minus).

See Google's guide for Boolean operators in searches and filters here.

As a reminded what each boolean operator do, you can use the famous Venn diagram:

Do you know additional useful logical expressions which can be used in search and filters for Gmail? You're welcome to share it here..

Installing Google Message Continuity for Exchange 2010

2011-10-11T18:00:00.001+02:00

If you ever tried to install Google Message Continuity (following as GMC) in Microsoft Exchange 2010 environment, you would notice that there are no clear instructions on how to configure permissions for GMC's account to access your user's mailboxes.

The Installation Guide tells something extremely general (as I think they mostly tested GMC with Exchange 2003/2007). This is what the installation guide tells:

Give Exchange administrative role permissions (including 'Receive As') to that Windows account (http://support.microsoft.com/kb/823018). This account must have both read and write privileges on all accounts to be synched.

Given the fact that permission module was completely redesigned with Exchange 2010, the above isn't enough at all to complete the GMC setup.

After investigating and many trial-and-errors I did earlier this week, I was able to successfully setup GMC in Exchange 2010 environment.

Here is the step-by-step instructions how to setup permissions on Exchange 2010 server:

Remark: All of my examples are referencing to user account for GMC Server as "GMCAdmin"

Configure Microsoft Exchange 2010 permissions for the Windows account

Open the Microsoft Exchange Management Shell.

Type: Get-MailboxDatabase | Add-ADPermission -User "GMCAdmin" -AccessRights ExtendedRight -ExtendedRights Receive-As, ms-Exch-Store-Admin

Type: Add-RoleGroupMember "View-Only Organization Management" -Member "GMCAdmin"

Type: Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "GMCAdmin" -Identity "OU=<organizational_unit>,DC=<domain_1>"

Increase the maximum number of connections to the Address Book in Microsoft Exchange 2010
By default, Microsoft® Exchange 2010 limits the maximum number of connections from the to the Address Book service to 50. To permit the GMC Server to run, you must increase the number of permitted connections to a larger value

On the computer that hosts the Microsoft Exchange CAS server, in

<drive>:\Program Files\Microsoft\Exchange Server\V14\Bin

Using a text editor, open themicrosoft.exchange.addressbook.service.exe.config file
Change the value of the MaxSessionsPerUser key to 10000
Save and close the file
Restart the Address Book service

Turn off client throttling in Microsoft Exchange 2010

By default, Microsoft Exchange 2010 uses client throttling policies to track the bandwidth that each Microsoft Exchange user consumes and enforce bandwidth limits as necessary. The policies affect the performance of the GMC Server, so you should turn off client throttling for the "GMCAdmin" account that has a Microsoft Exchange mailbox.

On a computer that hosts the Microsoft Exchange Management Shell, open the Microsoft Exchange Management Shell.

Type New-ThrottlingPolicy GMCPolicy

Type the following command: Set-ThrottlingPolicy GMCPolicy -RCAMaxConcurrency $null -RCAPercentTimeInAD $null -RCAPercentTimeInCAS $null -RCAPercentTimeInMailboxRPC $null -EWSMaxConcurrency $null -EWSPercentTimeInAD $null -EWSPercentTimeInCAS $null -EWSPercentTimeInMailboxRPC $null -EWSMaxSubscriptions $null -EWSFastSearchTimeoutInSeconds $null -EWSFindCountLimit $null

Type Set-Mailbox "GMCAdmin" -ThrottlingPolicy GMCPolicy

When you're done, make sure you have configured the GMC service to run with "GMCAdmin" account and being logged-in to the server which runs this service as "GMCAdmin" as well.

Google Message Continuity in Multi-Domain environment

2011-10-11T17:58:00.001+02:00

If you ever asked yourself how to setup Google Message Continuity (following as 'GMC') in a multi-domain environment, I am sure you were scratching your head (like I did) looking into installation guide and asking yourself - 'hmm, how do I do that?'.

Unfortunately, the documentation is silent on this matter and when I was trying to discuss this issue with the support, I was advised to setup 4 different GMC servers. Since this sounded as serious overhead for my needs, I decided to look into it and try to find more convenient path.

Let's suppose you have the following situation (like I did):

4 email domains (domain1.com, domain2.com, domain3.com and domain4.com)

User's accounts with multiple primary email addresses (i.e. some have their primary email set to user@domain1.com and others as user@domain2 or user@domain3 etc)

Single Microsoft Exchange 2003-2010 organization with several mailbox servers

Google Message Security (Postini) as your mail gateway (GMC's prerequisite)

Google Apps domain (another GMC's prerequisite)

First question you'll ask yourself, is what domain name you should use for Google Apps. From what I found, it doesn't really matters.. I chose the domain which had the most users set as primary email address but in reality it not that matters.

After your Google Apps domain will be provisioned by Google (the registration process for GMC require you to sign-up for Google Apps Standard domain and afterwords Google will 'upgrade' your account to have necessary features for GMC) you'll need to add additional domains to it.

Login to your Google Apps account via http://www.google.com/a/domain1.com (replace domain1.com to your real domain name which you have used to sign-up for Google Apps).

Go to 'Domain Settings', then 'Domain Names' and click on 'Add a domain or a domain alias'. Make sure you chose 'Add another domain' (and not 'Add a domain alias') and put your additional domains name (one-by-one).

You'll need to verify these domains using various methods Google offers. After successful verification you will be able to provision your users in Google Apps.

Usually, I am using GADS (Google Apps Directory Sync) which I did in this case as well. The result of this will be user accounts created in Google Apps according to their primary email address (such as user1@domain2.com, user2@domain3.com, user3@domain1.com etc). It's important not to forget to sync also user's aliases (proxyAddresses attribute in Active Directory) so you users will have all their aliases available in Google Apps as well.

Another catch is that GMC is only capable to work with a one Exchange Server. In my case, I had a single Microsoft Exchange 2010 organization with multiple mailbox servers within it. I found that if I configure GMC Server to work with one of them (doesn't really matter which one) it will be able successfully open mailboxes on other Exchange servers and retrieve the necessary data from there.

If your Microsoft Exchange environment consists of more than one organization, I guess you're out of luck and then the only workaround is to really install several instances of GMC Server. One more option which you can research is to use Application Virtualization. While I never tried it myself with GMC, tools such as VMware ThinApp or Spoon Studio should be able to package GMC Server and allow several instances to run on the same physical (or virtual) machine.

What makes Steve Jobs special (for me)

2011-10-09T23:03:00.000+02:00

Countless articles were written about Steve Jobs during several last days since he passed away. For me, Steve was and remains special because of 3 main reasons:

1. Personal Expertise

He belong to this rare kind of people who have both extensive technical background and great sales skills. Steve was able to demonstrate each and every Apple's product. Try to ask Steve Ballmer or Sam Palmisano to demonstrate few products that their companies produce. While I didn't try, I suspect it will not be a hit.

2. Personal involvement

Steve was personally involved in development of all Apple's products. While this can be a real headache for product managers and other people at Apple, to my belief this is the only way to achieve great results. Without personal involvement, without a passion it's impossible to motivate other people in your team.

3. Bringing Great People onboard

Most managers believe that their team members should be at their quality level or less. Steve believed that A players have to bring A+ players and that what makes a good manager a great one.

Who's SLA is bigger (better?!)

2011-10-09T19:17:00.001+02:00

Few days ago I ran into fascinating article by Tony Redmond in the Windows IT Pro Maganize. Tony is HP's veteran and Microsoft MVP for Exchange Server and his opinion matters for a bit or two..

In his article, Tony compares Google Apps SLA with Microsoft Office 365 SLA and here is the quote:

"Gmail isn’t perfect and it has its ups and downs too. The disappearing inbox syndrome suffered by some 20,000 users on 28 February 2011 (a software update was later blamed) is an example of where Google has run into choppy waters. However, you can’t argue that Google has set the pace for SLA delivery for cloud email and application suite services and that Office 365 has work to do to get close to Google’s record."

Here are few more quotes:

"In terms of 2011 performance, in a September 27 article about their new status dashboard for Google Apps, Google state that they achieved an SLA of 99.99% for Gmail in the first six months of the year, or about five minutes downtime per month. I assume that this is measured against their new SLA calculation including scheduled downtime so this is really a terrific performance."

"Comparable data for Microsoft is unavailable, though their service notifications show 113 incidents in 2010: 74 unplanned outages, and 33 days with planned downtime."

You can find a full article here.

Going beyond 25GB of Google Apps mailbox

2011-10-09T18:47:00.000+02:00

Unfortunately, up to date Google doesn't allow purchasing additional storage capacity for your GMail Google Apps Business account.

While you can buy additional storage for Google Docs/Sites and even purchase more capacity for your private GMail account - it remains unclear to me why Google doesn't allow purchasing more capacity to your business accounts...

At the beginning I wasn't thinking about it as a serious issue, as 25GB mailbox is a really big (my own mailbox is consuming only 12% of my capacity - after almost 3 years of use), but recently I encountered into some customers who have employees with 90% and even more used capacity and are unwilling (or unable, - keep reading) to delete old/unnecessary emails.

How this can be solved? Personally, I have used several approaches which can be used separately or as a combination:

Approach 1 - Use Google Archiving & Discovery (GMD, former Postini)

Google offers additional product which works integrated with your Google Apps and allows you to store every incoming and outgoing emails in a personal archive (this is not related to 'Archive" button which you have in your GMail UI'). That archive isn't limited by storage rather by retention period which can be 1 year or 10 years.

That essentially mean that every of your email will be stored for a long period of time even if you delete it from your mailbox. Given the low cost of this solution ($33 per user per year for 10 years retention) makes this almost perfect solution.

Why almost? Well, it has few drawbacks:

The archive only starts to collect data from the moment you activated (purchased & configured) the service
Your users will need to use separate user interface to retrieve archived messages

While Google is actively working to merge Archiving functionality into Google Apps UI (should happen later this year) to provide it's clients with consistent UI across all Google products, and the ability to re-inject historical emails into archives - eventually this approach will become a best one as per my opinion.

Approach 2 - Additional Mailbox with Delegated Access

This approach seems to be a most simple and effective. You'll need to add (buy) additional mailbox and add it as a delegated mailbox to the primary one.

For example, let's imagine we have John Smith (jsmith@ourdomain.com) which is now screaming for more storage as his mailbox rapidly approaching towards 99% of the 25GB.

We'll need to create additional mailbox (let's name it as jsmith-arch@ourdomain.com) and add a delegated access from jsmith-arch@ to jsmith@).

Now, we have two mailboxes - jsmith@ (with almost no space left) and jsmith-arch@ as empty one. We'll need to migrate (move) some of the history from primary mailbox to the additional one to free-up some space. How do we do that?

Well, surprisingly I found that the most efficient way to do that is by using Outlook (!) While you can migrate emails via Google Apps Migration for Microsoft Exchange (GAMME) and additional tools, Outlook is the most efficient and fastest way to achieve this.

Install Outlook (versions 2003-2010), then install Google Apps Sync for Outlook. It has to be at least version 2.4.129.704 as it the first version to support "email copy between different message stores".

When you configure Google Apps Sync for Outlook, configure it for your primary account, i.e. jsmith@. Then, add a secondary account by launching "Add Delegated Access" from your Start/Programs menu under Google Apps Sync and specify a secondary address (jsmith-arch@).

Switch your Outlook view to "Folder List" and you'll see both accounts under the same outlook profile. Now, you can move old/large emails from primary account to the secondary account and the user still will have access to both of them. All new emails will continue to arrive to the primary account and the secondary account will act as a personal archive repository.

If you need even more storage, you can create additional accounts and add them as delegated mailboxes as well, going up to 250GB of space in total.

Approach 3 - Find and delete emails with large attachments

While it's not a direct resolution for the problem, you still can find it useful with some accounts. While Google doesn't provide "sort by size" functionality via GMail (you can still do it thru Outlook), there is a simple way to find large messages in your mailbox.

You can use this simple script which will run and add a label to your messages (in addition to existing labels which you might already have) which have attachments of 1, 5, 10, 20 or 50MB. Off course you can customize the script to allow additional/different capacities.

********************************************************

var sizes = [1, 5, 10, 20, 50];

// The number of threads to process in a single pass

var MAX_RECORDS = 250;

function getAttachmentsSize(attachments) {

// Get the size of all attachments of the message

var byteCount = 0;

for (var i = 0; i < attachments.length; ++i) {

byteCount += attachments[i].getBytes().length;

}

return byteCount;

}

function getThreadSize(thread) {

// Get the size of the bodies and all attachments for the thread

var byteCount = 0;

var msgs = thread.getMessages();

for (var i = 0; i < msgs.length; ++i) {

byteCount += msgs[i].getBody().length + getAttachmentsSize(msgs[i].getAttachments());

}

return byteCount;

}

function getLabel(labelName) {

// Get the label if exist and create it if it does not

var label = GmailApp.getUserLabelByName(labelName);

if (!label)

label = GmailApp.createLabel(labelName);

return label;

}

function getSearchString() {

// Build the search string

var searchString = "has:attachment -label:Attach";

for (var i = 0; i < sizes.length; ++i) {

searchString += " -label:Attach-" + sizes[i] + "MB";

}

return searchString;

}

function labelAttachments() {

// Search for all threads with attachments that are not yet labeled

var searchThreads = GmailApp.search(getSearchString(), 0, MAX_RECORDS);

for (var i = 0; i < searchThreads.length; ++i) {

var threadSizeMB = getThreadSize(searchThreads[i]) / 1048576.0;

if (threadSizeMB < sizes[0])

searchThreads[i].addLabel(getLabel("Attach"));

else {

for (var j = sizes.length - 1; j >= 0; --j) {

if (threadSizeMB >= sizes[j]) {

searchThreads[i].addLabel(getLabel("Attach/" + sizes[j] + "MB"));

break;

}

********************************************************

To install the script, copy/paste it (don't, however, copy asterisks in the beginning and the end of the script) to Script Editor in Google Spreadsheet (I named mine as TagBySize) and run function "labelAttachments". The script will run and tag your emails according to sizes allowing you easy access to them and making appropriate action (such as delete..)

Summary

Ideally, Google could provide us with the ability to purchase additional capacity for Google Apps Business customers. While I do believe this functionality will be available one day (as it happened with Docs/Sites capacities earlier this year) you can use the above workarounds until Google will provide the upgrade.

Do you have additional ways to overcome 25GB limitation? I'd love to know how you resolved this!

Google Apps Directory Sync Tips & Tricks

2011-10-07T00:12:00.001+02:00

Last Updated: Oct 6th, 2011

I am planning to extend this article to more tips and tricks as I have more time and discover more, so feel free to bookmark this page (permalink) and visit from time to time to see if there is new information. I am putting last updated mark on the top of this page for your easy tracking.

As anyone, who is constantly deploying Google Apps Business for customers in Israel and abroad, I am using Google Apps Directory Sync (GADS) on a daily basis.

While GADS is relatively not complex tool, it has it's hidden gems which are worth discovering for any Google Apps admin.

Before we start, I'll mention that GADS only works with Google Apps Business edition, Education Edition and Non-Profit Edition. Standard Edition (free version which is now limited to 10 users) isn't supported due to lack of API access which GADS require.

Tip 1 - How to use both GADS and GADS for Email Security

Well, maybe not really a tip, but good-to-know thing. As you probably know, GADS comes in two versions, - for Google Apps (called Google Apps Sync for Directory Sync) and another version, - Google Apps Directory Sync for Email Security (pretty long name, right?).

While the first product is known and doesn't require further introduction (hey, if you're reading GADS's Tips and Tricks - you already know what it does, right?). GADS for Email Security is used to sync Users and Mailing Lists from LDAP servers (like Microsoft Active Directory) with Postini products, like Google Message Security or Google Message Discovery.

Both tools are based on the same technology but are not interchangeable, i.e. each one can only be used for it's own purpose. What do you do if you have both Google Apps & Postini (a stand-alone version of Postini to be more specific, since integrated version has it's own syncing mechanism)?

Well, you need to use both tools. Luckily for us, both can be installed on the same machine. However, there is a catch. You cannot have both tools running simultaneously. Both tools require you to configure a scheduled task (using Windows Scheduler or similar tool) which will run "sync-cmd.exe" with certain parameters.

So, you'll need to configure both tasks to run at a different time as running both tasks at the same time will cause a Java error and both tasks will fail to complete. I am usually setting first task to start at 12:00 and run each 30 mins, while 2nd task is set to start at 12:10 and again to repeat each 30 mins.

Tip 2 - The Magic of (memberof=)

Everyone who learned to use GADS knows how to setup LDAP queries (also known as "Rules") which look at certain OU's in LDAP server and selected certain accounts for syncing.

But working with OU isn't always very efficient as sometimes your Active Directory structure doesn't really fit well with your Google Apps users. More, using OU's to select users for synching is pretty limiting and will make changing OU structure risky as it will ruin the syncing with Google Apps.

Wouldn't it be much easier to use groups? Just create a group in Active Directory (can be either Security or Distribution, it doesn't matter for our task) and assign it a set of users you'd like to sync with Google Apps.

Once you're done, use this LDAP Rule notation in GADS to select user accounts:

(objectclass=user)(&(memberof=CN=AppsUsers,OU=Groups,DC=enterprise-expert,DC=com))

Much more flexible, isn't it?

Tip 3 - Email Notifications

For some unclear reason, you have to configure Notifications in GADS to receive sync logs, including errors and warnings (if there are any). If you don't configure Notifications - GADS won't give you an option to continue until you do.. Weird..

But, ok - let's configure it. If you're using GADS, you're are probably a Google Apps customer, right? However, the documentation of GADS suggest you to setup an SMTP server in your IT environment and have it relay notifications to your Google Apps email account. Yeah, you've heard me right..

Since all of us are trying to get rid of as many servers/services as we can (by moving to cloud for instance), I don't like setting new servers/services.

Easy workaround - use Google Apps's own SMTP host to relay those messages to your inbox. Use ASPMX.L.GOOGLE.COM as SMTP host in GADS. You don't need username/password as this SMTP host accepting anonymous and unencrypted connections which is exactly what we need.

The only thing you should know, - if your notification destination address isn't hosted on Google Apps (like you want to receive those notifications in your Yahoo's email), this trick won't work. The ASPMX.L.GOOGLE.COM only relays to Google Apps accounts ;(

How to sync Active Directory passwords with Google Apps

2011-10-06T20:16:00.000+02:00

Before we start talking about password synchronization, I would like to make sure you're aware of SSO capability Google Apps Business has which allows you (among many other things) to login your users based on the credentials they used when they logged-in to authorization authority such as Microsoft Active Directory.
While there is a lot of information on the subject, I couldn't find a single place where you can get a clear guide on how to synchronize user account's passwords between Active Directory and Google Apps.

There is a lot of confusion out there about this specific issue and I wanted to set a clear perspective on how to achieve password synchronization in literally few hours.

You'll need a server (can be Virtual Machine too, off course) to install the Google Apps Directory Sync. While Google suggest using Windows XP or Vista, I successfully was able to use Windows 7, Windows 2003 Server, Windows 2008 Server, including the R2 edition.

Step 1

Prerequisites to complete this exercise:

Active Directory domain (can be based on Windows 2003, 2008 or 2008 R2 version)

Google Apps Business Edition (Standard Edition doesn't have API, meaning you can't run Google Apps Directory Sync)

Google Apps Directory Sync configured to sync user accounts between Active Directory to Google Apps (GADS)

If you never done installation and configuration of GADS, I recommend first watching excellent Barry Schmell's video tutorial.

As well you can review my post on this blog - "GADS Tips & Tricks" for more in-depth from-the-field information on configuring Google Apps Directory Sync tool. Please note that I am constantly updating this post with new information, so please bookmark this (permalink) and re-visit from time to time..

To make this approach work, you'll need to enable "store passwords using reversible encryption" for all of your users (or at least those for which you're planning to sync passwords). This can be done either manually or using Group Policies (GPO).

You can see more information on this mechanism at this excellent article. Personally, I don't think it's such a big deal as sometimes people tend to think, as most domain controllers are set behind firewalls and multiple layers of security but still you should be aware of it.

Step 2

Once you've got everything in place, you can continue to the next step. It would be setting a password filter (in a form of DLL file) on all of your domain controllers in the Active Directory forest. The purpose of password filter is to catch password's changes by users (or when administrator resets them).

You should download the filter from sha1hexfltr project of Anderson Randel. You'll see there both 32-bit and 64-bit versions. If you using Windows 2003 32-bit or 64-bit you should use sha1hexfltr.dll_32bit_win2k3 and sha1hexfltr.dll_64bit_win2k3 from Jan 2010 accordingly.

But, if you're using Windows 2008 or Windows 2008 R2, the latest version won't work. You'll need to use previous version from Oct 2009, which is completely fine. I never ran into any issue with it. If you're not planning to debug Randel's code, you can safely skip DEBUG versions ;)

To install the filter, use those instructions:

On Windows 2003/2008 32-bit based domain controllers, put the dll file (make sure you correctly renamed the file to have dll extension) into your windows\system32 directory and register the file using regedit.exe and go to:

HKEY_LOCAL_MACHINE -> SYSTEM -> CurrentControlSet -> Control -> Lsa

Modify 'Notification Packages' by adding sha1hexfltr to the end of the list (Do not include the '.dll' part.)

You'll need to restart the domain controller to have the dll being loaded into the memory of your server. To test that you've did everything correctly, go to command line (cmd.exe) and write:

rundll32.exe sha1hexfltr.dll,about

You should see a popup window with "test this" message.

On Windows 2008/R2 64-bit based domain controllers, you"ll need to put the dll file (again, after you correctly renamed the file to have dll extension) into your windows\system32 and windows\SysWow64 directories and register the file using regedit.exe and go to:

HKEY_LOCAL_MACHINE -> SYSTEM -> CurrentControlSet -> Control -> Lsa

Modify 'Notification Packages' by adding sha1hexfltr to the end of the list (Do not include the '.dll' part.)

Please note, certain files on 64-bit version of O/S will be "blocked" by the operating system. To unblock, please right click the file (in both system32 and SysWow64 folders), choose "Properties" and then "Unblock".

You'll need to restart the domain controller to have the dll being loaded into the memory of your server. To test that you've did everything correctly, go to command line (cmd.exe) and write:

%SystemRoot%\SysWOW64\rundll32.exe sha1hexfltr.dll,about

This is because Windows 2008/R2 64-bit have two versions of rundll32.exe and only 32-bit version is in system path, so you'll need to explicitly call 64-bit version to check the installation.

Step 3

When you're done with password filter installation, each time user changes it's password or administrator resets the password, the password filter will update division attribute of that specific user in the Active Directory with a hash of the password. A division attribute isn't used by default, thus you wont have a problem with using it.

Now, what is left is to sync division attribute with Google Apps's password (for each user) and this is being done by configuring "Extended Attributes" page (under Users section) in Google Apps Directory Sync configuration.

Click to enlarge

On the "User Password Sync" screen, select synchronize password "For new and existing users". For Password Attribute use "division" (without quotation marks). Password Encryption Method should be on "SHA1". All the rest is irrelevant for our task.

Run the synchronization task as you usually do (sync-cmd.exe) with correct configuration file (-c parameter) and in "apply mode" (-a parameter).

You should have now passwords being synched between Active Directory and Google Apps!

If something isn't perfectly clear, please don't hesitate to provide feedback using comments or by writing me to vadim AT enterprise-expert DOT com.

Guido Daniele's Art

2011-10-01T13:18:00.000+03:00

While it's not directly related to Google technologies, I couldn't skip it. This is really a good example of modern, different and genuine art.

I'll give you the chance to realize yourself what is that you're seeing here:

If you like it like I do, you can find more here - www.guidodaniele.com