Persistent Cerebro

Exchange 2016 - Remove Default Database...Audit Log mailbox?

noreply@blogger.com (Unknown) — Fri, 31 Jul 2015 14:17:00 +0000

As you have seen with Exchange 2013 when you try to remove the default Exchange database that is created when installing Exchange you are greeted with this lovely error message:

This Mailbox database contains one or more mailboxes, mailbox plans, archive mailboxes, public folder mailboxes or arbitration mailboxes. ...

With Exchange 2013 you were able to remove the database after moving any regular user mailboxes

Get-Mailbox -Database <dbname> | New-MoveRequest –TargetDatabase <dbname>

then moving the arbitration mailbox

Get-Mailbox -Database <dbname> -Arbitration | New-MoveRequest –TargetDatabase <dbname>

but now with Exchange 2016 there is a new type of mailbox know as the "AuditLog" mailbox. This is a change in the architecture of mailbox auditing which no longer stores audit data on the individual mailboxes but rather stores the data in central audit mailboxes. This provides better long term storage as well as better reporting and exporting of data. The structure matches that of Office 365 to also help keep things consistent with hybrid environments. So to remove that AuditLog mailbox just use the new switch to move the mailbox:

Get-Mailbox -Database <dbname> -AuditLog | New-MoveRequest –TargetDatabase <dbname>

Once all the mailboxes have been moved off you should now be able to remove the default database.

-

mbpW
o
GnW

O.oy.d#in
dToéd.
ináw

6dra AMO
glpWKWinn
O

p

This text was recognized by the built-in Ocrad engine. A better transcription may be attained by right clicking on the selection and changing the OCR engine to "Tesseract" (under the "Language" menu). This message can be removed in the future by unchecking "OCR Disclaimer" (under the Options menu). More info: http://projectnaptha.com/ocrad

Microsoft Ignite Recap

noreply@blogger.com (Unknown) — Mon, 11 May 2015 13:48:00 +0000

Now that the biggest Microsoft conference of the year is over, its time to reflect on things that went good and things that went bad. I have been lucky enough to be able to attend a number of Microsoft and non-Microsoft conferences over the years so I have seen the ups and downs. Below are my observations, in no particular order.

Sessions

Content

The overall content of the sessions was pretty good. Since the Ignite conference was a combination of many smaller dedicated product conferences there was a very wide array of topics and discussions going on throughout the conference. Of course, there were sessions that were more product fluff then deep content but there were also many sessions that got deeper. I never look for a session to be completely new to me, if that were the case then I wouldn't be doing my job of learning. Which brings me to the point of the ‘Experts Unplugged’ sessions. Many, many, many of the questions that were asked during the Exchange Unplugged sessions were answered previously in blog articles written by the Exchange team on the Exchange team blog. I can’t tell you how many times this has happened, in this conference and previous ones.

Speakers

The speaker selection process was very different from previous conferences. Instead of speakers submitting sessions that they wish to give, individuals were required to submit their names and area of expertise then they would be assigned sessions to speak about. The end result seemed to be numerous product managers from Microsoft that seemed to have little public speaking practice. Many sessions had the word "um" muttered many times. There was also very little sessions given by MVPs. Although the MVP community was definitely present in the sessions, the expo and all over twitter. But it’s always good to have an independent voice that also gives some details from the trenches.

Logistics

Wow, were there a lot of people at this conference. Around 23,000 attendees in all graced the halls of Ignite. As you can imagine there were problems with that amount of people. There was a large number of hotels that’s supported all these people and good thing for us is that there was shuttles running from them. Some hotels had longer waits and more packed buses than others, but overall it seemed to work out well. The one complaint that I heard from many people is that the shuttles didn't start running until roughly the same time as the last session was ending. So the individuals who were trying to leave early were stranded or had to wait in a cab line that was very long.

Theater Sessions

The theater sessions were something I had not seen done before at previous conferences. The sessions were giving to smaller groups with a 20-minute time limit in the Expo hall. For these sessions, speakers were able to submit proposals to the Ignite staff for consideration. I was one of the people to be a speaker in the theater sessions. It was a great experience, that was enhanced by the Ignite staff helping speakers. They quickly gave a run-down of the computer and audio equipment and even threw in some encouraging words before going on stage. Big kudos to those guys. I hope this continues in future conferences.

Location

Chicago

I, like most people that I talked to at the conference, had been through Chicago airports many of times but never beyond the security checkpoints. The city was great a great place for a conference. There was a lot of nightlife and an abundance of excellent food choices to choose from. I was able to do quite a lot of walking around downtown Chicago as well as "Tilt" out from the John Hancock building at 94 stories in the sky.

McCormick Center

This place was HUGE!!! My pedometer on my phone counted 3,000 steps from the breakfast area to one of my session rooms. Coupled with all the people caused getting to sessions at a time when the room was already at max capacity. Maybe keeping product sessions in a single area of the center would have been better although I know room sizes might make that a logistical nightmare. Either way, there were many comparisons to herding cattle, herding sheep and/or salmon swimming up stream when it came to describing the packed halls between sessions.

Misc

Food

Typically conference food is not very good. But during Ignite it reached a new low. Now I know it can be a big pain to prepare food for so many people but as the week grew on, the lines at McDonald’s and the other restaurants inside the McCormick Center got longer and longer as people avoided the given conference food. It seemed like maybe they were trying to get too fancy with the food when just some good ol' burgers and hot dogs would have been better. Another point I would like to add is the lack of bottled water. Sure they had an endless supply of soda and small cups to pour some water into but PLEASE give me some bottled water I can take around sessions.

Expo

The Expo floor was another thing that was huge. The one thing I did like from previous conferences is not only was there many booth from vendors and sponsors. There were many Microsoft booths and areas available as well. Just about every Microsoft product had a booth where product experts were standing guard to answer questions. It was a good place to meet members of the product team as well as MVPs of the products to engage in questions.

Wi-Fi

Not too much to say about the Wi-Fi, except it was very spotty. Although it was not due to a lack of access points. They were literally stationed all over the place. You couldn't walk 10 yards without seeing one. But once again, due to the amount of people at the conference and many of them connecting more than 1 device, there was issues.

Attendee Party

There is a growing theme in this post about lines at Ignite and the attendee party was no exception. Microsoft brought in 30 different restaurants to hand out different types of food out to everyone. The food they were handing out were small finger food size portions. So not only did you have to wait in long lines to try something, when you got the food, you were done with it in about two bites. The hot dog line was the one exception to the amount of food, as they gave you a full hot dog and allowed you to grab as many as you wanted, although I waited one full hour for the pleasure of a full serving of food. There was a couple of different bands playing and many over-sized games, such as Operation, checkers and Jenga for everyone to enjoy, while you were waiting in those lines. The headline of the party was a hour long concert by Fall Out Boy. They had the best quote of "We're Fall Out Boy, take lots of pictures because if you don't know who we are then your kids do."

“Purple Shirts”

The “Purple Shirts” as many people called them were Ignite staff that were ALL over the place. From stationed outside every session room to check people in, to in the lunch room clicking with a counter, and even at the hotels to help direct people to the shuttles. These individuals were very knowledgeable in locations of classes in the GIANT McCormick center and also in the times of various functions. Even when they didn't know the answer to a question, they knew who to ask to get the answer.

Summary

In summary, it was a great conference and a great experience. Yes there are many things to work on and many of those got better as the week grew on, such as security yelling at everyone, and people getting lost due to the size of the center. But all in all I can't wait to come back next year, I just may need to pack a lunch.

Ignite Session

noreply@blogger.com (Unknown) — Thu, 07 May 2015 04:20:00 +0000

Exchange 2013 Management Pack Update

noreply@blogger.com (Unknown) — Wed, 29 Oct 2014 20:47:00 +0000

Microsoft has released an update to the Exchange 2013 Management Pack for SCOM. The update added nice Dashboards to give you a better overall view of the health of your environment.

It also added additional reports and views. The updated management pack version 15.0.652.19 can be downloaded here: http://www.microsoft.com/en-us/download/details.aspx?id=39039

For detailed information on how to update and use the management pack look here http://technet.microsoft.com/en-us/library/ee758046(v=exchg.150).aspx

You can view additional screenshots on the SCOM blog page here http://blogs.technet.com/b/momteam/archive/2014/10/29/exchange-server-2013-management-pack-update.aspx

Get-MailboxQuarantine

noreply@blogger.com (Unknown) — Mon, 27 Oct 2014 16:41:00 +0000

I previously wrote about poison mailbox detection in Exchange 2010 and how to find mailboxes that have been quarantined. In Exchange 2013 there are 2 additional cmdlets to assist with troubleshooting mailboxes. The new cmdlets that were added were Enable-MailboxQuarantine and Disable-MailboxQuarantine. With Enable-MailboxQuarantine it gives you the ability to manually quarantine a mailbox at your discretion. This can be useful for testing the functionality of quarantining a mailbox or, more importantly, quarantining a mailbox that is causing issues issues on a server.

As great as the new cmdlets are, there is still a hole that needs to be filled. There is no Get-MailboxQuarantine cmdlet to check/verify if a mailbox has been quarantined. We still have to resort to digging through event logs or registry keys. So I wrote a script to do just that.

Currently version 1 of the script just searches the event logs for users that have been quarantined. The script has a one optional parameter where you can specify a specific server if you wish. I plan on updating the script to search through the registry as well in the event that your environment has many event logs that would remove the quarantine event log. I will update this blog when that happens.

The download for the script is

https://gallery.technet.microsoft.com/office/Find-Poison-Exchange-6e7cc945

You can read more about the new cmdlets in 2013 at the link below:

http://blogs.technet.com/b/rmilne/archive/2014/01/13/how-to-set-mailbox-quarantine-in-exchange.aspx

Exchange 2013 DSC Module

noreply@blogger.com (Unknown) — Wed, 22 Oct 2014 14:38:00 +0000

Yes!!! Microsoft has completed work on a DSC (Desired State Configuration) module for Exchange 2013. This beauty has 24 resources in the module to setup and configure Exchange 2013. I plan on getting knees deep in this one and blogging more as I start playing with everything. You can find the module here. For a series of blogs explaining the module, check here.

Windows 10 won't start on Hyper V

noreply@blogger.com (Unknown) — Wed, 01 Oct 2014 17:53:00 +0000

So you're like a kid on Christmas signing up for the Windows 10 technical preview. You download the iso (zzzzzzzz), load up Hyper-V and create a new VM off of the ISO. As soon as you start the VM you're hit with this error:

Fortunately, I have only seen this issue with the Enterprise version of Windows 10 and the Server technical preview but there is a quick fix. When creating the VM, you need to make it a 'Generation 1' machine instead of 'Generation 2'.

Of course, you cannot change the generation after the machine is created so you will need to delete and recreate the VM. Party on!

ADMT Server 2012

noreply@blogger.com (Unknown) — Mon, 23 Jun 2014 15:30:00 +0000

Microsoft has finally released a version of ADMT that can be installed on Server 2012 & Server 2012 R2. Details from the ADMT migration guide:

ADMT v3.2 has recently been updated and re-released. The version remains v3.2 because it’s functionally the same as its predecessor (that is, there are no new features). This final release includes various bug fixes and can be used with all supported Windows operating systems and versions of Windows Server Active Directory:

The server where you install ADMT can run any supported version of Windows Server, including Windows Server 2012 R2 and Windows Server 2012.
The source and target domain controllers must be writeable, but they can run any supported version of Windows Server with a user interface (not Server Core), including Windows Server 2012 R2 and Windows Server 2012.
The source and target domains must be at Windows Server 2003 domain functional level or higher.
The computers that can be migrated can run any supported version of Windows, including Windows 8.1.
You can use any version of SQL Server for the ADMT database.

You can download the new version on the Connect site. The updated migration guide is also available here.

PowerShell Summit NA Recap

noreply@blogger.com (Unknown) — Thu, 08 May 2014 00:30:00 +0000

The 2014 PowerShell summit has now come and gone. This was my first time attending the PowerShell summit, or any PowerShell specific conference, and it has shot up the list as my favorite conferences to attend. It is definitely one of the smaller conferences out there (about 200-250 attendees), but the content and the knowledge gathered is second to none.

Sunday, there was a Pre-Conference mixer at the Blue Martini that was basically a laid back meet and greet. It was nice to see and be able to talk to so many people that I follow on blogs and twitter. Everyone was open to any conversation including the "Godfather" himself Jeffrey Snover. The perfect networking event.

The conference officially kicked of with Don Jones and Jeffrey Snover giving welcome and brief house keeping talk over breakfast. Which was some of the best food I have ever had at a conference. I usually wondering off site to the nearest restaurant to get some decent food. The first session of the day for most people was a talk by Jeffrey Snover about JEA or Just Enough Admin. The presentation centered around dropping the old convention of granting someone "keys to the castle" to perform 1 specific tasks. If you are familiar with Exchange server 2007 and higher, it similar to Roles Based Access Control or RBAC. Although it is far more extensible as you can limit a user access to specific servers and command as well as limit the amount of time the access is granted. He will be speaking more about it during TechEd 2014.

For me, day 1 included a lot of talk on Desired State Configuration (DSC). Let me just say that was the recurring theme throughout the conference as it is Microsoft's main focus for PowerShell. So if you don't know about DSC yet then put high on your priority lists of things to learn as you will only see and hear more about it. The sessions were given by the current king of DSC Steven Murawski. He walked through a number of DSC scenarios as well as dropped those little nuggets of information that you won't find on TechNet but only by trial and error.

To end day 1, was the Iron Scripter challenge. It involved 3 challenges in the theme of a chef making a 3 course meal. There was a appetizer task which involved getting BIOS and OS information from a computer in a specific format while keeping it to the shortest one-liner possible. The Main course, was a task of creating a full script to also gather computer information while yielding specific results with proper error handling. The last "dessert" task was a good debugging a already written script to make sure it runs correctly.

The highlights of Day 2 for me involved a session by GoateePFE about AD recovery. It takes a different twist on recovery than what you normally know about recovery. Using AD snapshots to do attribute level restores, yep attribute level. Read more about it at aka.ms/ADSnapshot.

The day ended with a series of lightning demos by members of the PowerShell development team. Just about all of the individuals that were present worked/are working on DSC. Once again, I can't stress enough how much attention DSC is getting. They included demos showing debugging in DSC, DSC to build Azure VMs, and using DSC against Linux boxes. Yep managing Linux from Windows via DSC!

Day 3 was cut a little short for me because of travel plans but the session on using web services in PowerShell given by Trond Hindenes was awesome. I code against internal web services at work for many different things and the session was able to break down different methods of connecting to web services whether they be SOAP based or RestApi's. Check out his slides for more details.

Quotes of Note
"Invoke-Expression is the path to hell" -Jeffrey Snover
"It is inevitable that we will open source PowerShell" -Jeffrey Snover
"Put a pager on a developers belt and you get better code" -Jeffrey Snover
"Q:What do you call a group of developers? - A: A merge conflict!" -Jim Christopher

If you use PowerShell in your job, you NEED to make plans to attend the next PowerShell Summit (in Charlotte, NC) or the Summit Europe. There is no conference that you will get this amount of content with such a dedicated group of individuals. See ya next year!

PowerShell Summit NA

noreply@blogger.com (Unknown) — Sun, 27 Apr 2014 23:42:00 +0000

I am here in Seattle for the 2014 PowerShell summit. I will be attending all the sessions on Desired State Configuration (DSC) and a few others to help sharpen my PowerShell toolkit. Below is my tentative schedule of sessions I will be going to.

Monday, April 28, 2014

PowerShell Just in Time / Just Enough Admin – Security in a Post-Snowden World Jeffrey Snover

The Life and Times of a DSC Resource Steven Murawski

Building Scalable Configurations Steven Murawski

Patterns for Implementing Configuration with a DSC Pull Server Steven Murawsk

Leverage Multi-Threading for Speeding Up Your Scripts Jason Walker

Advanced PowerShell Eventing Scripting Techniques Matt Graeber

Proper Tooling Through PowerShell Jim Christopher

Tuesday, April 29, 2014

On the Job: Putting PowerShell Scheduled Jobs to Work Jeffery Hicks

PowerShell Active Directory Attribute-level Recovery ... Ashley McGlone

WSMan Cmdlets Richard Siddaway

Windows PowerShell as a Platform Krishna Vutukuri

Kerberos Delegation, CredSSP, and Windows PowerShell Aleksandar Nikolic

Windows Hooking with PowerShell Adam Driscoll

Wednesday, April 30, 2014

Trending and Reporting Don Jones

PowerShell and the Web – Leveraging Web Services with PowerShell Trond Hindenes

Monitoring Using PowerShell Josh Swenson

Cmdlet-ize the Registry Richard Siddaway

Conference Season in Swing

noreply@blogger.com (Unknown) — Sun, 23 Mar 2014 05:18:00 +0000

Its time to knock the dust off this blog and get some content going on here. I will be attending a few noteworthy conferences in the coming weeks so I plan on giving updates, followups and overall reviews on the sessions that I attend and things to look out for.

I will be attending:

MEC (Microsoft Exchange Conference) -- March 31st - April 2nd
PowerShell Summit -- April 28th - April 30th

I will post the sessions I plan on attending in separate posts shortly as I figure all that stuff out. Also be on the lookout for Exchange Saturday, which is an free event coworkers and I are looking at creating soon in Austin, TX.

Simplify the OWA URL

noreply@blogger.com (Unknown) — Fri, 10 Jan 2014 23:03:00 +0000

Below is a quick powershell one-liner to setup your OWA URL to redirect nicely from mail.contoso.com to mail.contoso.com\owa as documented in http://technet.microsoft.com/en-us/library/aa998359(v=exchg.150).aspx

Import-Module WebAdministration
Set-WebConfiguration system.webServer/httpRedirect "IIS:\sites\Default Web Site" -Value @{enabled="true";destination="https://mail.contoso.com/owa";exactDestination="false";httpResponseStatus="Found";childOnly="true"}

or you can do it via the ol' Error Pages with this command

.\appcmd.exe set config -section:system.webServer/httpErrors /+"[statusCode='403',responseMode='Redirect' ,path='https://mail.contoso.com/owa']" /commit:apphost

Lync 2010 Visio Stencil

noreply@blogger.com (Unknown) — Wed, 09 Feb 2011 19:17:00 +0000

Microsoft released the Lync Server 2010 Visio Stencils.

Overview
Creating visual representations of your Microsoft Lync Server 2010 topology is a helpful way to communicate your Lync Server 2010 deployment. Using standard Microsoft Visio stencils helps those in your organization to better understand how you architect your Microsoft Lync 2010 by experiencing your deployment visually. Together, Lync Server and Lync 2010 can be powerfully represented by standard and expressive Visio artwork.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=65b5a396-2c87-445d-be23-d324727d19cb

Poison Mailbox Detection and Correction

noreply@blogger.com (Unknown) — Wed, 03 Nov 2010 05:38:00 +0000

One of the biggest pains I have faced many times in my career has been troubleshooting an Exchange server issue that was caused by a single mailbox or user. From an alert system flooding a mailbox, IMAP user with tons of folders to the lovely iPhone 4.0 release. They have all been problems from one to hurt many.

Well Exchange 2010 has added some preventative measures to stop those rogue users in there tracks. Poison mailbox detection is one of those new measures that is handled by the information store and will stop all access to a mailbox unless the OPEN_AS_ADMIN flag is passed.

Now the who, what, when and where:

A mailbox is considered poison when it is causing a crash/deadlock three times within two hours. The threshold for how many crashes lead to quarantining a mailbox as well as how long a mailbox should stay quarantined are configurable. You can modify the MailboxQuarantineCrashThreshold (Default 3 crashes) and MailboxQuarantineDurationInSeconds (Default six hours) in the following path:

HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\<Server Name>\Private-{db guid}\QuarantinedMailboxes

There are two conditions that the store considers a "poison-able" offense.

if a thread that is doing work for that mailbox crashes

if there are more than 5 threads in that mailbox that have not made progress for a long time

That mailbox is then tagged, along with a count of how many times it has been tagged by a registry key in the following location:

HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\<Server Name>\Private-{db guid}\QuarantinedMailboxes\{mailbox guid}

You will see two keys CrashCount and LastCrashTime.

*An event will also be created on the mailbox server with event id 10018, detailing the user and the time of the quarantine.

During a database mount, the Exchange store will read the time which the mailboxes were identified as potential threats. If more than two hours has elapsed, the registry key for the mailbox will be wiped out.

After you have found the cause of the crashing by the user and rectified the problem you can reset the mailbox by deleting the registry key for the quarantined mailbox. Unfortunately you will need to either remount the database or restart the information store for the reset to take effect.

UPDATE: I posted a new blog that provides a script to find users that have been quarantined. You can find that here.

Exchange 2010 SP1 Hosted Installation Failure

noreply@blogger.com (Unknown) — Fri, 22 Oct 2010 15:41:00 +0000

Those of you have been playing with Exchange 2010 SP1 Hosted version might have run into some issues during the installation process. Having installed different versions Exchange multiple times you could get caught in the repetition trap, where you install Exchange the same way you have for previous versions.

For the Hosted version of Exchange 2010, extra commands are needed for the installation to succeed. To prepare Active Directory for Exchange 2010 hosting, you must run the following command:

Setup.com /PrepareAD /Hosting

If you forget to add that "/Hosting" entry and continue to the server install with the following command:

Setup.com /Mode:install /Roles:m,ca,ht /Hosting /on:Exch2010

You will get the following error:

Active Directory wasn't prepared using hosting mode. To install server roles for hosting mode, you need to clean up Active Directory and prepare it again for hosting mode.

In order to continue with your Hosted Exchange install you must remove a registry key and remove some objects via ADSI Edit. Locate and then select the following subkey in the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\ExchangeServer\V14

Delete the PARTNERHOSTEDMODE registry key.

Then go into ADSI Edit expand Default naming context, find and then delete the following two objects:

Microsoft Exchange Security Groups
Microsoft Exchange System Objects

Next expand the Configuration container and delete the following two objects:

Microsoft Exchange
Microsoft Exchange Autodiscover

Now you can go back, run the PrepareAD command with the Hosting switch and then proceed to run your server install. Now you can explore Hosted Exchange

SharePoint 2010 PowerPack

noreply@blogger.com (Unknown) — Wed, 20 Oct 2010 18:29:00 +0000

Every year Quest Software has a Challenge that allows any member of the general public to create a PowerPack for their application PowerGUI. If you don't know PowerGUI and your in the IT field then you should definitely get acquainted with it. PowerGUI also includes the PowerGUI script editor which is my editor of choice.

Well, back to the subject, after a couple of years of sitting on the sidelines and watching the PowerPack's and contest unfold, I have decided to participate in this years competition. I have created a PowerPack to help administer and view data for SharePoint 2010. It has been uploaded to the PowerGUI website although it is still a work in progress. So please, download it, play with it, break it, and let me know what you like, dis-like or need added to the PowerPack.

You can view and download the pack here

http://www.powergui.org/entry.jspa?externalID=3022&categoryID=389