Jim McBee's Mostly Exchange Web Log

Amtrak adventures

2019-07-21T17:07:00.004-10:00

It is no secret; I’m a big time train geek. My European friends are amazed at the state of railroads in the US. Yes, friends, railroads in the US are mostly for hauling freight. There are some good commuter trains in larger cities and metro areas. And, many cities have good subway and light rail systems. But, medium-to-long distance passenger service? Not so much.

But, we do have Amtrak. Surprisingly, I have never set foot on an Amtrak train (commuter or otherwise.) Recently, I had a meeting to attend in California and decided to take Amtrak. I took the California Zephyr from Denver to Sacramento. I sprung for the big bucks and booked a Superliner bedroom rather than just a seat or a roomette.

Amtrak GE Genesis Locomotive

The room can comfortably *seat* 3 or 4 people during the day if you want to have your friends stop by. It has nice big windows, a private bathroom / shower, and was comfortable. The views through the Rocky Mountains and the Sierra Nevada Mountains were spectacular.

Our car attendant was friendly and helpful. The couch folds down in to a bed and there is an upper bunk that folds down. The room can sleep 2 adults comfortably and you might be able to have a small child sleep with an adult in the lower bunk. The folks in the room next door did have 2 adults and a teenager in their room and they seemed to be okay. (They do have “family” bedrooms which are a tiny bit bigger. And, they can combine 2 bedrooms together through a common door between the two rooms.)

The meals in the dining car were decent but not spectacular. The lounge / observation car offered great views and was very popular.

The Superliners do have cheaper Superliner roomettes, quite a bit smaller, intended for up to 2 people. Smaller beds and common area shared bathrooms and showers. The Superliners have both an upstairs and a downstairs.

Superliner car

Observation car

If you are planning a trip cross country and time is not a factor, this is a great way to travel. No snippy flight attendants, no “sit down and buckle your seatbelt” turbulence, no haughty TSA agents, no airport lines, no body scanners.

I figured I would share a few observations and tips.

Amtrak in the ancient Latin means “late”. Get used to it. In their defense, they share track with freight trains and freight trains, by law, get priority. But, we are not in a hurry, right?
You will meet some very nice people. I had many great conversations with people in the dining car and lounge car.
The top speed I have measured is about 79 MPH. This ain’t Europe or Japan.
Bring a small power strip. There will probably not be enough power outlets for all of your devices.
Some of the mainline track in the US is, well, how should I put this.... horrendous. The train ride is not always smooth as silk.
Bring some cash. Tip your car attendant. They work long hours. Usually at least $10 per person per night. Meals for sleeper car passengers are included but do tip your waiters in the dining car.
The Amtrak Superliner equipment is old. Like 1970’s. They have refurbished them and they are not bad. But, they are rough around the edges.
Amtrak has some bus services to cities they do not serve or to connect between cities.
At some stops, they allow people to get off the train to stretch their legs or for a smoke break. Do *not* go far. The train *will* leave without you.
Sleeping on a train, much like sleeping on an airplane, is not something everyone can do. I was out like a light when my head hit the pillow, but my spouse said it took a while.
Bedrooms and roomettes fill up fast during busy seasons. Try to book plenty of time in advance.

PowerShell Manual of Style and Best Practices

2019-05-13T20:13:00.000-10:00

Just like writing a book or a complex C++ program, using consistent styles and formatting will help make sure your PowerShell script is both readable, efficient, and easy to debug.

I strongly recommend that new scripters and experienced PowerShell gurus take a look at The PowerShell Manual of Style.

Luke: My best friend at 9 1/2

2019-04-09T17:02:00.000-10:00

9 1/2 years ago, this awesome creature came home with me. Since the time he was a puppy, I look in to his eyes and see an old soul. Smart, intuitive, independent, and stubborn, I can't imagine my life without him. He has been with me almost 10 years and across thousands of miles. He takes it all in stride. He loves trips to the mountains, hanging out in my office, or just chilling someplace remote that we have hiked to. His coat is a bite lighter now and he is a bit more grumpy in the morning, but he is still that independent minded puppy I meet at 4 weeks old.

#siberianHusky #lifeWithLuke #bestFriend

They are like potato chips - Happy Birthday, Broker!

2019-03-20T17:04:00.000-10:00

People in the know say that Siberian Huskies are like potato chips... you can't have just one. That is sure true. After a year and a half with Luke, I had to have another. And along came my Broker-boy.

Broker is the anti-Luke. He is always in a good mood and he always wants attention. He does not like children or other dogs. But, he is the sweetest dog alive if he likes you.

He has been with me now for almost 8 years and across thousands of miles. So happy to have my Broker-boy chilling next to me.

PowerShell and file hashes

2018-12-17T18:30:00.000-10:00

Microsoft introduced a handy security cmdlet in PowerShell 4; the Get-FileHash cmdlet is very useful for validating the integrity of a file provided you know the hash value of the ‘known good’ version. A hash is essentially a sequence numbers and letters that are calculated using a function, such as SHA256 or SHA384 using (in this case) a file as input.

As an example, let’s say that I build a software application, widget.exe. I run the SHA384 hashing function on it and come up with 38A519CE7. (A real value would be much longer.) If even a single bit changes in widget.exe, the hash value would change the next time the was calculated. I post my widget.exe program on my web site and I also include a note saying that the SHA384 has is 38A519CE7.

Assuming you trust me as a source for software, you download my program and compute the hash value of widget.exe using the SHA384 algorithm. If the value you calculated is not 38A519CE7, then something is amiss. Maybe I posted a new build of widget.exe and did not update the new hash value. Maybe it was corrupted during download. Or, maybe someone modified my program and included hostile code.

Calculating a hash value and checking it against a known-good value is a simple, easy way to verify the integrity of a file, whether the file is a simple text file, spreadsheet, script, executable, or binary. By themselves, security experts will tell you that they are not a 100% perfectly secure solution. After all, if I can modify your software, I can also try and find where you keep your ‘known good’ hashes, recalculate the hash value, and modify your list of known good hashes.

Is the Get-FileHash command available to you? Using the $PSVersionTable variable in PowerShell and make sure you are running at least v4.0. A word of caution, though, you may have scripts written that will only work with earlier versions of PowerShell, so do your homework before updating to new versions of PowerShell.

Let’s go through an example. I have a file in the c:\temp folder called Get-IthicosSystemInfo.PS1. I want be able to detect if changes have occurred that I did not make. I’m going to use the SHA384 hash algorithm since it is a newer, modern, and more secure algorithm. If you do not specify the -algorithm option, then Get-FileHash will use SHA256. If the file hash will be calculated on other operating system platforms, make sure that the other platforms support the hash you will choose. I would type this command at the PowerShell command prompt:

Get-FileHash .\Get-IthicosSystemInfo.ps1 -Algorithm sha384

The Get-FileHash cmdlet will return the hash algorithm used, hash calculated, and the file path. The hash value is actually too wide, so I’ll do a little bit of PowerShell magic to set the hash information as a variable:

$filehash = Get-FileHash .\Get-IthicosSystemInfo.ps1 -Algorithm sha384

Then I can just type $filehash.hash, like so:

PS C:\temp> $filehash.hash

6D5F36A23562A304C8FFFFB5E4B0F829C64DDABD61ADEFE938BD25C250362CEA8C3352A6360457FFAA1BD594D7CE852E

Awesome! I’m almost done. Now, I’ll take that hash code, copy it and paste it in to a JimsHashCodeKnownGoodValues.txt file and save it to the C:\temp folder with the script. Hurray! My script is protected and I can sleep well at night.

Some of you are probably saying to yourself, “Self, if an intruder can get to the temp folder and modify the script, well, the ‘known-good’ values file is right there next to the script...” You would be correct. I should store my known-good hash values in a different place. Of course, I need to apply restrictive NTFS permissions on to my script so that only a small group of trusted admins can edit it. And, if the script is edited, a new hash value needs to be calculated.

At some point in the future, if I want to validate that they script has not been modified, I’ll simply run the Get-FileHash command again using the same hashing algorithm. If the hash value is the same, the file has not been modified.

Using hashes to verify file integrity should never be the only security tool in your arsenal but they can provide you with an additional layer of security for validating file integrity. In another article, I’ll discuss digitally signing code and how that can provide you with a higher level of assurance.

GALSync on a budget

2014-12-15T17:57:00.000-10:00

It seems harder and harder to sync two different AD forests. First, we had the "almost free" Microsoft IIFP which worked remarkably well. Then Quest released a series of free PowerShell scripts that would do the same thing. Unfortunately, when they got Dell'ed, those scripts are no longer free.

A customer recommended this jewel, though. I need to give it a test drive sometime, but wanted to share.

A GALSync powershell script

Amazon EC2 instance problem: not accessible from the network

2014-11-11T16:05:00.003-10:00

I had my first issue with Amazon EC2 this week. I rebooted a Windows Server EC2 micro instance and when it came back up, it was no longer accessible via RDP. I tried stopping it and starting it several times with no success. I found these instructions to fix the problem.

1. Stop your instance through the AWS console

2. Create an AMI copy from the AWS console: http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Creating_EBSbacked_WinAMI.html

3. Right click the instance in the management console, select change instance type such as C3.*, R3.*, or I2.* (This upgrades the instance to a different network platform. The public IP address will probably also change.)

4. Start the instance.

5. When the instance passes health check, RDP to the instance.

6. Download and run the following script: http://ec2-downloads-windows.s3.amazonaws.com/Scripts/RemediateDriverIssue.zip

7. Uninstall the AWS PV Driver Version 7.2.0 via "Programs and Features.”

8. Reboot the machine when prompted by the uninstaller.

9. Download and install the AWS PV Driver Installer from: https://s3.amazonaws.com/ec2-windows-drivers/AWS+PV+7.2.0/MicrosoftSigned/Installer/AWSPVDriverPackager.exe

10. Reboot when prompted by the installer.

11. Run the script from step 6 again. This will ensure that this issue is corrected ongoing.

12. Stop the instance and change the instance type to your previous instance.

So long, little MEC v2, we hardly knew ye

2014-07-21T12:45:00.002-10:00

To the excitement of many, two years ago Microsoft resurrected the Microsoft Exchange Conference. To many in the Exchange server community, this represented a renewed focus on Microsoft's part towards providing top-notch information to the Exchange community. Though I found the timing to be a bit suspect (after all, MEC had been gone for 10 years), it was a welcome resurrection even though, at the time, I was the speaker chair for the Penton Media Exchange Connections Conference.

Alas, nothing lasts forever and apparently MEC v2 is already being canned in favor of a bigger, better, more stupendous TechEd. The new event, now called Unified Microsoft Commercial Technology Event, will roll TechEd, MEC, the SharePoint, and the Lync conference.

I am disappointed in this latest devolution of Microsoft's conferencing strategy. Unfortunately, large conferences tend to have to their sessions dumbed down a bit to a lower common denominator. Smaller conferences, like MEC or Connections, does allow for more detailed and specialized sessions. And, it does allow for more interaction with the presenters and vendor subject matter experts.

#IWasMEC

Change Auditor installation broke Exchange 2010 scripting

2014-07-20T17:54:00.001-10:00

Last week, we finally got around to starting our Change Auditor for Exchange installation. We had tested this pretty thoroughly in the lab, but had not yet put it in to production. So, we picked an unused public folder server in our Disaster Recovery site.

We did not realize that the first Change Auditor for Exchange agent that gets installed also enables a global setting that enables the Scripting Agent. Once enabled, admin scripts and SCOM scripts could no longer run. And, we use a lot of scripts for admin tasks.

If we had gone ahead and completed the Change Auditor agent installation on all servers, the problem would have been resolved. But, since something was "broke" we halted the installation until we could figure out what had happened.

As a work around, we changed the ScriptingAgentConfig.XML file (see the above link) and disabled it on all other E2K10 servers.

Mailbox storage: If you really don't like your users... give them what they ask for...

2014-07-06T12:34:00.000-10:00

Mailbox storage is always been a sore spot with me. Regardless of how often you remind users to manage their mailbox, they want to hold on to almost everything. But, I get this... I often refer back to email conversations that I had 2 or 3 years ago. Email is an extension of my brain/memory.

In my user community, we have users that regularly receive 1.0GB of email per month. PPTs, PDFs, documents, spreadsheets, images, audio, newsfeeds, you name it, they get it. And, they keep it.

Years ago, our users complained loudly that they did not like having mailbox storage limits. Management heard their screams and told us to raise the storage limits so we adopted Enterprise Vault and essentially give our users a "bottomless mailbox." Vault comes through and archives anything older than 30 days.

Normally, they don't let me anywhere near end users because I don't have a filter.... but over the past 2 years I have spoken to a lot of our user community. And, they have resoundingly said "we hate Enterprise Vault" and "give us a larger mailbox and then just let *us* decide when we delete something or if we keep it."

So, our newest email platform now provides each user with a 2GB mailbox and a 10GB personal archive. Within 6 months, some of our users had already exceeded these limits and more exceed them every day.

And, you guessed it... they want a way for "the vault to archive their older stuff".

:-)

OWA for Android App

2014-06-11T14:30:00.001-10:00

Very cool! Microsoft released today an OWA for Android app. It is still in pre-release, but so all of you early adopters out there can expect few bugs. And, of course, if you have been following the OWA apps for mobile devices, there is the caveat that it is only available for Office 365 for Business customers. ;-( So, more bait to get people to move to Office 365.

Show pictures the Exchange 2010 OWA GAL

2014-06-10T15:46:00.003-10:00

Thanks again to Lee Derbyshire

How To Show GAL Pictures For Internal Emails In Exchange 2010 Outlook Web App

Moving Exchange database or defrag'ing Exchange database

2014-06-10T13:35:00.001-10:00

I still see these questions asked pretty frequently:

1) I need to defrag/compact my Exchange 2007 / 2010 / 2013 database? What is the best way to do that?
(or)
2) I need to move my databases to a new disk. What is the best way to do that?

If you have the free disk space, by and large the best way to defrag or move data is to just create a new database on the new disk. Then, use the New-MoveRequest option to move the mailboxes over. This takes a bit longer but it also minimizes downtime and customer annoyances. And, in the case of a defrag, it minimizes risk to the database file.

Automated user provisioning - Savior or Satan?

2014-06-10T12:19:00.000-10:00

Over the past 10 years, more and more medium and large corporates have embraced user account and group provision systems as part of their identity management strategy. In this article, Why Provisioning Should Move Away from IT, Dell/Quest advocates moving the provisioning process away from IT entirely. (Well, that would be almost impossible, but at least get the "process" if not the technology away from IT.)

My own organization embraced a fairly customized version of Microsoft's Forefront Identity Manager (FIM) as our provision system. It integrates with our PeopleSoft system as well as a number of other databases to provide a unified identity picture.

We have about 1 1/4 full time Microsoft Consulting Services employees on staff that help us maintain this behemoth, another almost full-time contractor, and another almost full-time employee that helps operate the system. For 45,000 user objects, I'd estimate we spend about $750,000 per year in labor to maintain this.

The system is always a few generations behind where we need it to be. Feature requests are generally a year to three years behind in integration and implementation. (Part of this is due to some... "mishaps" our management is so gun-shy about anything to do with this platform that doing nothing is their IM strategy.

Meanwhile, the system works partially well for only about 75% of our employees/contractors since our PeopleSoft system maintains data for only employees not a lot of contractors. So, our help desk still manually provisions many user accounts and groups. And, our PeopleSoft system often spits out phone numbers in formats that are not usable by UC "dialer" links or software. So, dial links in Lync are useless. And, our HR department refuses to update their system to accommodate us.

I'd guess that this platform actually costs us *more* than a manual provisioning system. Sometimes, there is a reason why there is "no school like the old school."

If you are considering an automated user provisioning system, I strongly recommend going through as many different use cases as possible. Not just your full time employees, but look at temps, short term contractors, long term contractors, VIPs, etc... Go through your proposed IM system and look at all of these use cases and determine if the work flows are going to accommodate these. And, if now, how many users fall outside of the "automated" boundary and how are you going to take care of them?

AssociatedItemCount versus ItemCount

2014-06-09T09:26:00.002-10:00

Recently, one of my "Yes, but show me the TechNet article to prove it" co-workers asked me about the different between AssociatedItemCount and ItemCount properties in Exchange 2010 (and, of course 2007 and 2013) when looking at mailbox and public folder statistics. (We all have one of these co-workers, don't we?)

ItemCount reflects the total number of actual, viewable mail/calendar/contact/etc... items in the folder. Anything the user sees in the folder or mailbox.

AssociatedItemCount are the "hidden" objects associated with a folder or mailbox including rules, forms, form-type, Admin info, moderation information, views, auto-complete items, categories, etc...

Here are the relevant passages in the scripture.
MSDN Folder Associated Information
MSDN Content Tables
MSDN Folder-Associated Information Tables

Goodbye Sitemeter

2014-06-07T13:04:00.001-10:00

I have been using Sitemeter for years to provide a simple visit counter and reports for some of my web sites. Recently, I noticed that sometimes my Ithicos site was loading slowly sometimes and the browser was going to a lot of sites that I *know* I don't have links to.

This includes:
adjuggler.net
demdex.net
neac.com
scorecardresearch.com
vindicosuite.com
ads.yahoo.com

Apparently, Sitemeter has been bought by the same ad-ware intensive company that bought MySpace. And, now the script that you embed on your web site for the Sitemeter is also going out and establishing connections and setting cookies for all of these other sites.

I not only found it is setting this cookies and establishing these connections, but it is also REDIRECTING my site to an "ad" page and my site visitor has to click "Return to Original Site" link.

Goodbye Sitemeter!

Marriott Destinations Club Members

2014-06-03T18:46:00.000-10:00

If you are a Marriott Destinations Club member, I just found a cool trick. If you are short on points for the year, you can Buy or Rent Marriott Destinations Points. Technically, this is called "renting" because you only get the "one time" use of the points for a particular, but it is very cool. It allows a lot of flexibility for those that want to add some points some years to their portfolio without going back and purchasing permanent points. The site lets you find DC owners that have extra points and want to "sell" them. They usually sell for about $0.45 to $0.60 per point.

Outlook 2007: Are you longing for a way to see GAL photos?

2014-05-21T21:30:00.000-10:00

I think showing people's photos in the Global Address List is a great way to improve collaboration between employees. Especially in medium or large businesses or in businesses that are geographically dispersed. It adds a nice, friendly, personal touch to email.

If you are still stuck on Outlook 2007, good news! There is an Outlook 2007 Social Connector add-on.

Easiest thing I have done this spring.... Kemp Load Balancer

2014-05-05T11:59:00.000-10:00

I have to say, setting up a Kemp Load Balancer to front-end 2 Exchange 2010 servers was just about the easiest thing I have done this year. Set up the hardware, registered the device with Kemp, loaded up an Exchange 2010 template, and configured the two virtual servers. First time I had done this. It took a a bit more than hour from the time we pulled it out of the box until the it was done. Nice!

Usage of higher MX records

2014-04-08T10:03:00.000-10:00

I recently noticed something that at first seemed a bit weird.   A company had transitioned to an external email hygiene service but left their old MX record in place with a higher cost value, so their MX records looked like this (I shortened the text a bit)

company.com     MX=10     hygiene1.serviceplace.org
company.com     MX=10     hygiene2.serviceplace.org
company.com     MX=20    oldserver.company.com

We noticed that a lot of email was still coming directly in to oldserver.company.com (their old gateway).

According to the RFCs, the SMTP transport is supposed to always pick the lowest MX record first and only move to a higher one if the lower ones fail. But, we were seeing a different behavior.

After some additional analysis, we found that only spam and malware were coming in to the MX record of 20.   After some discussion with some colleagues, I found out that spammers will intentionally do this in hopes of finding backdoors or SMTP paths in to your system will less security or message hygiene in place.

Ideally, once you start using an external provider, you should remove your old MX records, get their IP addresses from which they send, and block everyone else's TCP port 25 at your firewall so that spammers can't find you by port scans.

Forms based authentication and anonymous folders

2014-03-31T20:08:00.003-10:00

Sometimes I have seen some weird issues with some forms based authentication. On the logon form, the images do not show up and the text and other information does not line up correctly. The images are in the .\images folder and the style sheet is in the .\styles folder.

Turns out, this is by design because forms-based authentication is enabled and the authorization section specifies that anonymous users are denied access (in the <authorization> tag.

    <authorization>
      <deny users="?" />
      <allow users="*" />
    </authorization>

I found a lot of discussion threads indicating that the <location> could be used with the path option to specify a path that could be accessed anonymously. But, I found conflicting information. One poster said you could only have ONE <location> tag. However, upon testing it, I found that you can indeed have 2 different <location> tags. See below.

    
     <location path="styles">
      <system.web>
         <authorization>
            <allow users="*"/>
         </authorization>
      </system.web>
   </location>
     <location path="images">
      <system.web>
         <authorization>
            <allow users="*"/>
         </authorization>
      </system.web>
   </location>

I put these inside the <configuration> tag of the web.config file near the bottom. This seems to clear up the issues.

Exchange 2013 Architecture Poster

2014-02-01T18:23:00.003-10:00

Microsoft just released a PDF version of their Exchange Server 2013 Architecture Poster. Free to download.

Convert OST file to PST file

2013-12-17T09:51:00.001-10:00

I still see questions in the forums from time to time where someone is asking if it is possible to convert an OST file to a PST file. This is usually due to a mailbox being deleted, but the OST file remains.

Microsoft does not provide any mechanism to convert an OST file to a PST file. However, if you can open up the OST file when you open Outlook, you can create a new PST file and just export email to it or drag-and-drop items in to the PST file.

There are a few third party tools that will do this, but I have not tested any of them.

http://www.convertost.com/
http://www.brothersoft.com/convert-ost-to-pst-68529.html
http://www.windowsreference.com/ms-exchange-server/how-to-convert-ost-to-pst-format-for-outlook/

.NET Framework 4 application issues on fresh Windows 2008 R2 installation

2013-12-15T12:55:00.002-10:00

A bit of frustration with Windows Server 2008 R2 and the .NET Framework 4.0. Just because you use the Add-WindowsFeature Application-Server option to add the .NET Framework, the 4.0 Framework may not be properly registered with IIS. This seems to be true when you install the 4.0 Framework first and then later add Web-Server and Application-Server options to Windows later.

I installed the prerequisites, then installed my 4.0 Framework application and got this error:

HTTP Error 500.21 - Internal Server Error

Handler "PageHandlerFactory-Integrated" has a bad module "ManagedPipelineHandler" in its module list

This implies that the ASP.NET managed handler is incorrect, but in reality the 4.0 Framework is not properly registered.

Open up a command prompt as an administrator, then change to this folder:
C:\Windows\Microsoft.NET\Framework\v4.0.30319

Run this command:
aspnet_regiis.exe -iru

There are a couple of different installation/registration options for aspnet_regiis.exe, but the -iru option is the safest since it only registers the 4.0 Framework and does not change/update any existing applications or web sites. That is helpful if you have web applications that are still using the 2.0 Framework.

Ithicos Solutions Customer Survey

2013-12-08T21:49:00.003-10:00

If you are a customer of Ithicos Solutions and use our Active Directory self service tools such as Directory Update, Directory Manager, Directory Search, and/or Directory Password products, we would like your feedback:

Ithicos Solutions survey

This survey should take no more than 5 minutes to complete and will help us determine better ways to support you in the future. The survey is completely anonymous, but if you can leave your email at the end for a chance to win an Amazon gift card.