How Exchange Works

Digicert Certificate Tester Tool…

2010-07-29T17:52:00.000+01:00

Digicert has an online tool which checks whether you have any issues with the installed certificate. The good thing is that it can be done from anywhere, as it is web based. All you need to do is put your server IP or name and the tool will do the rest. It provides useful information such as the validity, certificate issuer, signature algorithm, key size etc.

The tool works for any SSL certificate (not locked to Digicert ones), which is really good.

Run the tool from here

Check out my previous article to know more about DigiCertUtil, another tool from Digicert.

A sample output is shown below.

Backing Up Exchange 2010 Using Windows 2008 R2 Server Backup…

2010-07-28T06:02:00.000+01:00

I had written about backing up Exchange using Windows 2008 backup in one of my previous article. Now that 2008 R2 and Exchange 2010 has been out for a while, I thought it is a good time to see whether anything has changed and it has.

As it is the case in Windows 2008, backup is not installed by default in 2008 R2 as well. You can install it either using ServerManager or Powershell.
Backups can be stored on a local or network drive.
Only disk backup is available, no option for tape.
During exchange restore, new log files will be replayed & database will be brought to the latest state. You can deselect replay of logs during restore, if you want.

Two things have changed in 2008 R2 Server Backup.

Folder level backups.
Ability to backup passive database copies when servers are member of a DAG.

Let me explain. You can add items/folders that needs to be backed up while choosing the “Custom” backup option in 2008 R2.

When clicking “Add Items”, you can browse through the folder structure. While backing up Exchange databases, select the folder which has the database and log files. The default location is C:\Program Files\Microsoft\Exchange Server\V14\Mailbox.

In 2008 R2, backups can be taken from both active and passive database copies of a DAG. This is a welcome feature as backups can only be taken from the active copy in Windows 2008.

The new features will be a huge relief for small businesses!

Exchange 2010 Error - Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=8000). Topology discovery failed, error 0×80040a02 (DSC_E_NO_SUITABLE_CDC)…

2010-07-27T16:31:00.000+01:00

I was asked to troubleshoot an issue at a customer site where the Exchange 2010 servers stopped working. As usual, everything was working fine the previous evening!

The servers were throwing the following error message.

Source: MSExchange ADAccess
Event ID: 2114
Task Category: Topology
Level: Error
Description:
Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=8000). Topology discovery failed, error 0×80040a02 (DSC_E_NO_SUITABLE_CDC). Look up the Lightweight Directory Access Protocol (LDAP) error code specified in the event description. To do this, use Microsoft Knowledge Base article 218185, “Microsoft LDAP Error Codes.” Use the information in that article to learn more about the cause and resolution to this error. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers.

The KB article mentioned gave outdated information (applicable to Windows 2000) and proved useless.

An information entry was logged in the event viewer just before the error.

Event Type:      Information
Event Source:      MSExchange ADAccess
Event Category:      Topology
Event ID:      2080
User:            N/A
Computer:
Description:
Process MSEXCHANGETOPLOGYSERVICE.EXE (PID=8000). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
(Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version)
In-site:
DC1.FQDN      CDG 1 7 7 1 0 0 1 7 1
DC2.FQDN      CDG 1 7 7 1 0 0 1 7 1

As the SACL Right was showing as zero, I quickly figured out that the exchange servers are not having the correct permissions to access the domain controllers.

Exchange does not use any domain controller that does not have permissions to read the SACL on the nTSecurityDescriptor attribute in the domain controller. You must have at least one server that satisfies each role (C, D, or G) and that shows 1 in the SACL right column.

I quickly checked the "Default Domain Controllers Policy" to see whether exchange servers had permissions on the "Manage Auditing and Security" under User Rights Assignment and that was fine.

I checked the NIC settings to see whether IPv6 was disabled and it was. I checked the registry to see whether it was fully disabled and it wasn't. Hence I enabled IPv6 to be on the safe side. But, that didn't fix the issue.

After looking around for a while, I found the cause of the issue. Someone had actually removed all Exchange servers from the default "Exchange Servers" group as part of AD "cleanup" process. Luckily, the group was still there. I added all the Exchange servers to the group and rebooted them to pick up the changes immediately.

Everything started working once the servers were back online!

DigiCertUtil – The Certificate Management & Troubleshooting Tool…

2010-07-25T20:02:00.001+01:00

I was at a customer site last week, working mainly on SAN certificates on Exchange and TMG servers. Exporting and importing the certificate between servers, making sure root and intermediate certificates are correctly installed etc. I was working with a tool that I have used before and thought of sharing it, as it makes working with certificates much easier.

The tool is DigiCertUtil.exe and is from Digicert. With this tool you can manage, troubleshoot and fix the SSL certificates on your server, all without having to open up a command prompt to run special certutil commands or dig through the MMC Certificate Snap-in.

DigiCertUtil.exe makes it easy to (from Digicert site):

See all the SSL certificates installed on your server.
Easily view details for each certificate.
Fix intermediate certificate problems with one click.
Import and Export your certificates to make a backup or move them between servers.
Test a certificate to verify its private key is functional.
Install a certificate to a pending request.
Repair a certificate whose private key exists on the server but is not correctly associated with the certificate.

Download the tool (.exe) here or the zip file here

The good thing is that you can use the tool to manage certificates issued by any company. A must have tool for Exchange admins!

Error - Rule "Restart Computer" Failed. A Computer Restart Is Required. You Must Restart This Computer Before Installing SQL Server…

2010-07-19T22:25:00.000+01:00

I was playing with TMG & Exchange 2010 publishing and had to delete TMG & associated SQL Express 2008 installation. When I tried deleting SQL Express 2008 from the control panel, I got the error message below.

Rule "Restart Computer" Failed. A Computer Restart Is Required. You Must Restart This Computer Before Installing SQL Server

I am not a SQL expert, but I had to delete the installation to start fresh. The solution was to delete a registry entry and I was able to delete the SQL install.

Launch registry and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager

Delete the key "PendingFileRenameOperations" (Don't restart the server, as it will put the registry key back).

Re-run the setup again and all will be green.

Now that all showed green, I could successfully delete the SQL Express installation.

Download - Best Practice Analyzers For Forefront TMG And UAG…

2010-07-18T16:02:00.000+01:00

Microsoft has released Best Practice Analyzers for Forefront TMG and UAG, in a time where companies have started moving to Exchange 2010 and upgrading ISA.

The Forefront Threat Management Gateway (TMG) Best Practices Analyzer Tool is designed for administrators who want to determine the overall health of their Forefront TMG computers and to diagnose current problems. The tool scans the configuration settings of the local Forefront TMG computer and reports issues that do not conform to the recommended best practices.

Download TMG Best Practice Analyzer Tool here

This BPA Tool is designed to support Forefront TMG only. Download the BPA Tool for Internet Security and Acceleration (ISA) Server from here

The Forefront Unified Access Gateway (UAG) 2010 Best Practices Analyzer Tool is designed for administrators who want to determine the overall health of their Forefront UAG computers and to diagnose current problems. The tool scans the configuration settings of the local Forefront UAG computer and reports issues that do not conform to the recommended best practices.

Download UAG Best Practice Analyzer Tool here

Master Your Messages With Exchange 2010…

2010-07-17T14:59:00.000+01:00

I came across three short videos on Microsoft Showcase site and thought of sharing it with my readers. These videos explain the different features in Exchange 2010 which helps you to stay on top of your messages.

Microsoft Exchange 2010: Clean Up Your Inbox

Microsoft Exchange 2010: On the Go Doesn't Mean Out of Touch

Microsoft Exchange 2010: One Stop Messaging

Publishing Exchange 2010 With Forefront TMG And UAG – Whitepaper…

2010-07-16T22:20:00.000+01:00

Microsoft has published a whitepaper on publishing Exchange 2010 with their latest products, Forefront TMG and UAG. The whitepaper walks you through the entire process of using either Forefront TMG or UAG to publish Exchange 2010.

It starts by helping you decide whether to use Forefront TMG or UAG, makes sure you get the terminology understood, then provides step by step instructions to configure the environment. A “must read” document if you are thinking of using the latest Forefront products for publishing Exchange 2010.

Download the whitepaper here

There is no available Hub Transport Server in the local site. Event ID: 1008…

2010-07-15T06:05:00.000+01:00

I was at a customer site when I came across this error message in the event viewer.

“There is no available Hub Transport Server in the local site”. Event ID: 1008

The environment had both Exchange 2007 and 2010. Any emails sent from or sent to a 2007 mailbox doesn't get delivered. I quickly checked the Exchange topology and found out that there were no Exchange 2007 HUB servers. Multiple 2010 HUB servers were present though and all servers were in the same AD site.

The reason for the error is that, when Exchange 2010 & 2007 co-exist, every mailbox server needs a hub transport server with a matching Exchange version in the same AD site. Due to the changes made in 2010, Exchange 2010 hub transport servers can't pick up messages from and deliver messages to Exchange 2007 mailbox servers. Similarly, Exchange 2007 hub transport servers can't communicate with 2010 mailbox servers. Therefore, you need to maintain your Exchange 2007 hub transport servers in an AD site until all Exchange 2007 mailbox servers are removed from that site.

Next time you are thinking about 2007 - 2010 coexistence, keep in mind that you need 2007 hub servers as well. Initial feeling will be that the latest version of hub server should be able to serve the previous versions, but NO!

How Microsoft IT Upgraded To Exchange 2010 - Technical White Paper…

2010-07-14T06:07:00.000+01:00

Microsoft has released a technical whitepaper detailing as to how MS IT migrated their internal Exchange environment to 2010. Microsoft IT maintains a complex Exchange environment that consists of several geographic locations and multiple Active Directory forests. There are 16 data centers, four of which host Exchange servers, to support more than 515 office locations in 102 countries with more than 180,000 users.

This technical white paper discusses the Exchange Server 2010 architecture, design and technologies that Microsoft IT chose for the corporate environment. This paper also discusses the strategies, procedures, successes and practical experiences that Microsoft IT gained during the planning and design phase.

Download the whitepaper here

Exchange ActiveSync Client Comparison Table…

2010-07-13T13:42:00.000+01:00

I came across this Exchange Wiki page that contains information about which Exchange ActiveSync (EAS) features are available in each Exchange Server version as well as which of these features are supported by Windows Mobile and other devices in the market.

Worth having a look and keep the link for reference.

Access the comparison table here

Mailbox Move Request Details Exposed In Exchange 2010 SP1 Beta Console…

2010-07-12T05:55:00.000+01:00

The new 2010 SP1 Beta Console brings in more useful information (compared to 2010 RTM) for an administrator regarding a mailbox move request. In Exchange 2010, once a mailbox move request is initiated, the progress can be checked in “Recipient Configuration –> Move Request”.

2010 RTM only exposes few details regarding the mailbox move request.

In 2010 SP1 Beta, the properties of the mailbox move request has two additional tabs and the “General” tab has new information as well.

The “Details” tab exposes information like the server which handled the move, time the mailbox move started, time it finished, queue duration, queue time etc.

The “Log” tab exposes the full log of the mailbox move within the console. You are not given an info as to where the log file is stored, but it exposes the log straightaway which is very easy and useful.

You can copy the full log to a text file as well.

Administrators can now find full information regarding a mailbox move easily and diagnose what went wrong, all from within the console!

Password Reset Feature Available In Exchange 2007 SP3 OWA…

2010-07-07T06:56:00.000+01:00

Exchange admins who have been in the field for a while will have come across the end user difficulties of not being able to change their passwords using OWA when either the password has expired or the admin has forced for a password reset at login. Though there were workarounds in previous versions of Exchange, no work was done by the product group to make it an Exchange feature which can be turned on or off.

Exchange 2007 SP3 brings this feature to the table. The option is disabled by default and can be turned on with a registry edit on the CAS server.

To enable the password reset feature,

Log on to the CAS server with an admin account.
In registry editor, navigate to HLKM\SYSTEM\CurrentControlSet\Services\MSExchange OWA
Create the following DWORD value if it does not already exist. DWORD Name – ChangeExpiredPasswordEnabled, type - REG_DWORD and data set to 1.
If the DWORD already exists, change the value from zero to one.
Reset IIS from command prompt.

Users can now change their expired passwords or forced password reset through OWA. This is a big relief for mobile users. In my opinion, this feature should be enabled by default.

Notes Issue In Outlook Web App (OWA) Continues In 2010 SP1 Beta…

2010-07-06T22:40:00.000+01:00

Most of you are familiar with the fact that creating "notes" in 2010 Outlook Web App (OWA) is not possible. Though "notes" is available, when you click the "New" button to create one, there is no option listed. The only options are to create a new message or meeting request.

As 2010 SP1 Beta is out, I tried the same functionality and the story remains the same.

It looks like Microsoft is not interested in the "not much used" Notes feature! You can of course create “notes” using Outlook.

Seeding And Replication Of Mailbox Database In Exchange 2010…

2010-07-05T06:01:00.000+01:00

There is a common misunderstanding about how seeding and exchange replication happens for a mailbox database copy. As an administrator, you can choose the source from which the seeding or re-seeding of another (or new) mailbox database copy should occur. This information becomes very important if you are involved in Exchange design work, that too using multiple datacenters where the WAN bandwidth becomes very crucial.

A good feature of Exchange 2010 is that the initial seeding or re-seeding of a mailbox database copy can be done either from an active copy or any passive copy of the database. It is recommended to use the passive copy to reduce the load on the active one. But, once the database is seeded, source for the continuous replication will always be the active copy of the database.

The wizard for updating the database copy makes it clear.

In short, seed or re-seed from any copy of your choice, but continuous replication will always be from the active copy of the database.

Forefront Protection 2010 For Exchange Server Videos Available…

2010-07-04T23:16:00.000+01:00

Forefront Team has posted few videos about installing and configuring their new product, Forefront Protection 2010 For Exchange Server. They are short and to the point.

Installing Microsoft Forefront Protection 2010 for Exchange Server

Verifying Your Microsoft Forefront Protection 2010 for Exchange Server Installation

Forefront Protection for Exchange Console Overview Part 1

Forefront Protection for Exchange Console Overview Part 2

Two screencasts about Forefront Online Protection as well.

Screencast – Forefront Online Protection For Exchange 101

Screencast – Forefront Online Protection For Exchange 102

Do check it out!

Turn On Mailbox Quota Information In Outlook 2010…

2010-07-03T22:03:00.000+01:00

One of my previous article explains as to how to find the mailbox quota information from Outlook 2010. Another easier way to find the information is to turn on the "Quota Information" in Outlook 2010.

The quota information shows the amount of free space that is left in your mailbox quota and the number of items you have in each folder, say Inbox, Sent Items etc as you navigate from one folder to the other.

The feature is turned off by default. In order to switch it on, right click anywhere on the bottom Outlook 2010 bar.

Click on the first option "Quota Information" and you will see that it switches to the "On" mode.

You can now see the amount of free space left and the number of items you have in each folder, in the bottom left hand corner.

Useful feature and right in front of you!

Strict Split Permission Security Model In Exchange 2010 SP1 Beta Setup…

2010-07-02T22:16:00.000+01:00

Microsoft has introduced a new option as part of the Exchange 2010 SP1 Beta setup, configuring strict split permission security model. Applying this feature is optional though.

The strict split permission security model is aimed at large organizations, where there are different teams for Active Directory and Exchange. Applying this security model removes the ability for Exchange administrators to create AD objects such as users, groups and contacts. The ability to manage non-Exchange attributes on those objects will also be removed.

You shouldn’t apply this security policy model if you don’t have separate teams or specific requirement to have a split permission model. Large organizations will welcome this option as the AD team will be able to create the AD objects following their naming standards and the Exchange team can configure the mail attributes.

This option is only available for a vanilla installation of Exchange 2010 SP1 Beta (not in 2010 RTM upgrade to SP1 Beta).

ForeFront Threat Management Gateway (TMG) 2010 SP1 And Capacity Planning Tool…

2010-07-01T18:28:00.000+01:00

Microsoft has released Service Pack One (SP1) for TMG 2010. Following are the list of enhancements included in the service pack.

New reports
Support for SharePoint 2010
Enhancements to URL filtering
Enhanced branch office support

Download the SP1 here

TMG 2010 Capacity Planning Tool, a Microsoft Excel spreadsheet with built-in workflow, allows you to calculate the WAN bandwidth and number of users a particular a hardware configuration will support, and can recommend server hardware based on the features, bandwidth and users your deployment needs to support.

Download the Capacity Planning Tool here

Forefront Protection 2010 for Exchange Server Rollup 1 Released…

2010-06-30T20:26:00.000+01:00

Microsoft has released the first rollup for Forefront Protection 2010 for Exchange Server. This article contains information about how to obtain the rollup and issues that are fixed by the hotfix rollup.

Download the rollup from here

Click on “View and Request Hotfix Downloads”.

Accept the terms and conditions.

Select the hotfix, provide an email address and request the hotfix. The download link will be emailed to you.

“An Error Caused A Change In The Current Set Of Domain Controllers” Error While Launching Exchange 2010 Management Console…

2010-06-29T20:27:00.000+01:00

While working with Exchange 2010 at a customer site, I came across the error message below while launching the Exchange 2010 Management Console (EMC) and navigating to Recipient Configuration –> Mailbox.

An error caused a change in the current set of domain controllers. It was running the command “Get-Recipient –PropertySet ConsoleLargeSet –ResultSize ‘1000’ –SortBy DisplayName –RecipientType “UserMailbox”

AD guys confirmed that one or more domain controllers were decommissioned before I tried launching the EMC. Few GCs were online while I received the error as well. After searching on the internet and finding number of “fixes”, the one that worked for me was to delete the “Exchange Management Console” file from my profile.

The file is located in C:\Users\User\AppData\Roaming\Microsoft\MMC

After deleting the file, I was able to work with the EMC without any errors!

Moving All Exchange 2010 SP1 Beta Archive Mailboxes To A Dedicated Database…

2010-06-28T19:43:00.000+01:00

With the release of Exchange 2010 SP1 Beta, archive mailboxes can be moved to different database than the one that hosts the primary mailbox. My previous article explains the process in detail.

As the exchange community has started playing with SP1 Beta in test environment, one question that comes up very often is “an easier way to move all archive mailboxes to a dedicated database/server”. This can easily be done with the help of exchange shell.

Run the following command to move all archive mailboxes hosted on any database in your environment to a dedicated database, say “ArchiveDB”.

Get-Mailbox –Resultsize Unlimited | where { $_.ArchiveDatabase -ne $null } | New-MoveRequest –ArchiveOnly -ArchiveTargetDatabase ArchiveDB

The –archiveonly option makes sure that only the archive mailboxes are selected.

Once the move is complete, clear the request as always. You won’t be able to move the mailboxes again otherwise.

Get-MoveRequest -MoveStatus Completed | Remove-MoveRequest

Mailbox Move Improvements In Exchange 2010 SP1 Beta…

2010-06-27T06:36:00.000+01:00

Microsoft had introduced “Online Mailbox Move” as part of Exchange 2010 RTM. Though it was named "Online Mailbox Move”, end users had to restart outlook after their mailbox got moved from one database to another. But, it is was definitely an improvement compared with the previous versions of Exchange where the user had to close Outlook while their mailbox got moved.

In 2010 SP1 Beta, the feature has improved much more and it truly does what it says – Online Mailbox Move. Users get prompted to restart Outlook in 2010 RTM mailbox move.

This has changed in 2010 SP1 Beta, in that there is no more user prompts. This is only the case as long as the move is between two 2010 SP1 Beta servers. Let me explain by moving my mailbox from one SP1 Beta to another SP1 Beta database.

My account has the primary mailbox on DB3 and archive on DB2.

I am moving the mailbox to DB7 which is in my second 2010 server.

The move completes successfully and the mailbox properties gets updated.

My outlook was still online, no user prompts whatsoever. I did notice that outlook got disconnected for a second after the mailbox move was completed, but got connected to exchange the next second. For an end user, this shouldn’t be an issue at all. Even if they press the “send” button at the very second the mailbox got disconnected, the emails will be stored in the “Outbox” and will be send the next second when the mailbox gets connected.

I did send an email after the mailbox move from my account to administrator with a subject “Email after mailbox move”. Note that I didn’t close or re-launch outlook.

And my administrator did get the email without any delay!

Certainly a big improvement. You can now move your mailboxes in the background without even letting the end user know, as long as it is between two SP1 Beta servers! The feature should be available in SP1 RTM as well.

Export/Import Mailbox Improvements In Exchange 2010 SP1 Beta…

2010-06-26T12:35:00.000+01:00

The export/import mailbox process has undergone a major change in 2010 SP1 Beta compared with the RTM version. Major changes are:

There is no need to use export-mailbox and import-mailbox cmdlets. The new cmdlets to use are New-MailboxExportRequest and New-MailboxImportRequest.
Outlook is no longer required to be installed on the machine from which the cmdlets are run.
Exchange Mailbox Replication service handles the export/import process.

Importing and exporting mailbox data has been improved to allow you to import or export pst files in an asynchronous process. In order to see/run export/import cmdlets in the shell, you should be given explicit permissions. No user is allowed to run the command by default. The user who wants to run the cmdlets should be given “Mailbox Import Export” management role.

Let me explain with an example. I want to give my administrator account the necessary rights to run export/import cmdlets. The cmdlet I need to run is

New-ManagementRoleAssignment –Role “Mailbox Import Export” –User “administrator”

You can also create a group and give the group the necessary access. This way, you only need to add any new users who wants this permission to the correct group using AD Users and Computers (thereby avoiding the shell)!

New-ManagementRoleAssignment –Role “Mailbox Import Export” –SecurityGroup “ImportExportGroup”

Let’s get to business, now that the permissions are in place. In order to export a mailbox to a pst file, the command I need to run is

New-MailboxExportRequest –Mailbox “alias” –Filepath “\\servername\share\file.pst”

Run Get-MailboxExportRequest to find the status of the export process and in my case, it has completed successfully.

I do have the PST file in my C drive!

The file path should be a UNC, otherwise you will get the error below.

Similarly, New-MailboxImportRequest brings the PST file back to exchange. You can import a PST file into the primary mailbox or archive.

I have seen various articles which says that the “export-mailbox” cmdlet is no longer available in SP1 Beta. This is not right. The export-mailbox cmdlet is still available and runs successfully as long as Outlook 2010 X64 is installed. I ran it without any errors in an SP1 Beta server.

You receive the error below if you try running the “export-mailbox” without Outlook 2010 X64 installed.

The export/import process has improved significantly and we no longer need Outlook installed when the new cmdlets are used!