A Collection of Random Thoughts

My blog will be moving

2006-10-23T14:41:00.000-05:00

With the recent issues I've encountered here at Blogger since moving to the Beta service (the inability to publish from Live Writer or Word is a big one), and since my joining Microsoft, I've decided to move my blog over to Technet blogs. There may be occassional posts here in the future, but most of my content will be published to my new blog. You can find my new blog at:

http://blogs.technet.com/benw/

Make sure to update your bookmarks and your RSS subscriptions.

I've already got one post up there - let me know what you think of it, and also if you have any ideas for future topics.

Three items of note in the Sports world

2006-10-17T08:21:00.000-05:00

First, the Bears offense didn't deserve to win last night against the Arizona Cardinals. Rex Grossman was terrible. 4 interceptions, and 2 lost fumbles. That's almost unheard of. However, give credit to the Bears defense. After being down 20-0 at the half, they came back to life, and literally got their team back in the game. They forced 2 fumbles that were returned for touchdowns, and with a punt return for a touchdown and a lone field goal earlier in the game, that's all Chicago needed. We'll see how they rebound from this dismal performance, but they certainly didn't look like a potential 16-0 team last night.

Second, I am absolutely disgusted at the brawl that occurred during the Miami - Florida International game this past Saturday. It was a debacle. It was an embarrassment to both schools. At least one of them seems to be taking it somewhat seriously. Unfortunately, it isn't Miami. Florida International dismissed 2 players, and extended the suspensions of 16 others to indefinite suspensions. Miami, on the other hand, has suspended one player indefinitely (the one that was swinging his helmet at other players), but 13 other players only received a 1-game suspension (including a player that was visually observed to be "stomping" on other players legs. You gotta be kidding me. Mike and Mike (on ESPN radio) are spot-on when they said that the players involved (or at least those that committed the more serious acts) should be kicked off their respective teams, and should then be banned from football for life (including the NFL). The piddly 1-game suspensions dished out by the conference (ACC and Sunbelt) and by Miami are nothing more than token penalties. ACC commissioner John Swofford says "These suspensions send a clear and definitive message that this type of behavior will not be tolerated," - yeah right. Gimme a break. At least FIU had the guts to make a strong statement by indefinitely suspending many of the players involved.

Third, I Believe! Actually, I guess I should say I'm a fair weather fan. Let me explain. I grew up near Ann Arbor, MI. We'd usually go to a few Detroit Tigers games per year, though I don't remember going to any games until after they won the 1984 World Series. I remember players like Chet Lemon, Alan Trammel, and Jack Morris. I remember the old Tiger Stadium. I remember that most years, the Tigers stunk, and didn't make it to the playoffs. In fact, they haven't been in the playoffs since 1987. I suppose it's no wonder, then, that I never declared myself a true fan. So when they squeaked into the playoffs this year (after blowing a rather large lead towards the end of the season) and were matched up against the New York Yankees, I didn't give them much chance of advancing. But they did! Then, they swept (yes, swept) the Oakland A's by winning 4 games in a row, and advanced to the World Series, where they await the winner of the NY Mets and St. Louis Cardinals. Could this be their year? I mentioned to my wife the other day that I hadn't heard of the names of any of the players, and her comment was that meant that they were a true team, with no real standout players. I think that's pretty accurate. Go Tigers!

Outlook Delegates issues

2006-10-04T15:34:00.000-05:00

If you aren't familiar with the Outlook Delegates functionality, it provides you with the ability to specify a Delegate for your Mailbox. Delegates can perform items such as sending items on your behalf, and responding the meeting requests, etc. When you add a delegate, you can specify that they receive copies of your meeting requests, which is quite typical.

Now, say you have a few delegates, and one of them leaves the company. Your IT staff diligently deletes the account (and mailbox). However, all of a sudden, meeting requests to you now generate an NDR. The cause? Delegates. For whatever reason, Outlook stores delegates separately (they are actually stored as a hidden rule on your mailbox), so that if you delete a user account that was set as a delegate, Outlook doesn't automatically remove that delegate. Ok - this is easily fixed. You need to go into Outlook, Tools, Options, Delegates, and remove the non-existent user.

What if you've already done that, and nothing shows up in the Delegates tab?
http://support.microsoft.com/kb/253557/en-us comes to the rescue. The KB article talks about a little different situation, but one that applies nonetheless. The problem is that this "hidden" rule has become stranded. You can't see it (with Outlook), but it's still there, and still functioning. The solution is to use the Mdbview utility to log on to your mailbox. If you've never used mdbview before, a word of caution is that the output is pretty ugly! Anyways, after logging on to your mailbox, the instructions have you go to your inbox and find the message that has Schedule + EMS Interface in the description, and then delete that message. Normally, this should remove the delegation, but you still want to go back into your Outlook settings and check. In some cases, you may now see an Unknown account in the delegation, at which point you can remove it.

SBS Migration hell

2006-10-04T11:00:00.000-05:00

I recently helped a friend with a swing migration from one (really old) SBS 2003 server to another (new) SBS 2003 server. As there is currently NO process provided by Microsoft to migrate SBS servers (at least none that I am aware of), my friend had purchased the SBS Swing It Kit, provided by Jeff Middleton (SBS MVP) to assist us in this project.

SBS (Small Business Server), if you haven't worked with it before, is designed for small businesses and is also designed to run on 1 server. As such, your 1 SBS server is set up to host many roles on the same box - we're talking Active Directory, Exchange, SQL, Sharepoint, and optionally, ISA and some others. There are license limits in place that only allow you to have a certain number of clients (I want to say 75?), which is why it should only be used for small businesses.

On to our experience. The SBS box in question was just running SBS Standard, which probably made it a "little" bit easier, but not much. A brief overview of the swing migration process is that you have to bring up a temporary DC, transfer everything to that, remove all references to the existing DC, then add your new server (which has the same name as the old server) back in. This by no means details all of the steps involved (which are quite numerous), so I'd encourage you to check out the Swing It kit previously mentioned if you have to go through this process. Anyways - adding the new server didn't pose any problems. AD and DNS replicated with no issues and we were able to do the things we needed. The problems began when we tried to add the new server (with the same name as the old one). We couldn't get AD to replicate. After a few hours of mucking around, we found the issue. Ready? It was the Windows Firewall service! Why on earth the Windows Firewall would decide to prevent Active Directory replication is beyond me, but it did. Once the service was disabled, replication took place within a few minutes and we could then proceed.

Probably the most difficult part about a migration like this is getting the Exchange data transferred. Luckily, as long as the server name (along with a few other things) is the same, you should be able to mount the database from the old server with no issues. I've done this several times for regular Exchange servers, and it's the method that you used to have to follow with Exchange 2000 (build recovery Exchange server in a new forest that has same name, same admin group, same database name, etc.). However, another catch was that there hadn't been a successful full backup in a few weeks, so there were LOTS of log files. To be on the safe side, we brought those over as well, even though the stores were in a clean shutdown state. The biggest nightmare for us was actually getting the stores to mount, though. Let me state for the record here that at 4am in the morning, patience is not my strong suit.

I had applied Exchange 2003 SP2 while I was still copying the databases and log files from the old server to the new one (hooked up old drive via USB 2.0 enclosure), and even though the stores were dismounted when I ran the SP, after it was done, it tried to mount the stores, and replay all the log files. This *obviously* wasn't going to work, as the databases didn't even exist yet! Anyways, to make a long story short, I killed the store.exe process so the SP install would finish. Once that was done, and the stores and logs were transferred, I tried to mount the stores, only to have it fail with some comical error about files not being in the right state, or some such nonsense. I re-transferred the databases and logs again, and verified the databases were still in a clean shutdown state (eseutil /mh), but no dice. Running out of time, I thought I'd try to re-run SP2 and see if something had gotten mucked up the last time. This time, like the last, it replayed all the log files, then it purged them (I don't think I've ever seen an SP purge log files - hehe). With that done, all I had to do was mark the databases as being able to be overwritten, then I was able to mount them successfully.

The other problem we encountered was with the migration of the shares. Because there was a lot of data in the user shares, we decided we didn't have enough time to move the data, so we hooked up the old hard drive into the new server, and re-created the shares. Though I could have sworn that we checked, apparently the new share for the User Shared Files (where My Documents gets redirected to) was set to share perms of Read only. Remember that Windows uses the most restrictive set of permissions when you are accessing a share, so even if you have full control at the NTFS level, if your share permissions are read-only, you aren't going to be writing anything to that share, bucko. That was easy enough to clear up.

Sooo - 12 hours, and a severe case of sleep-deprivation later, migration is done. A few minor problems cropped up later on, but my friend was able to take care of those.

My observations:
1. Why in the world does an SBS migration have to be this difficult?
2. Has anyone at Microsoft tried to migrate SBS servers? If so, do they expect small businesses to ever do this without hiring an sbs expert?
3. I don't like SBS. I really don't. Some people love it. I'm not one of them. It felt like a very dummified [1] version of Windows Server 2003, with wizards galore, and progress bars that leave no indication of what exactly it is doing.

I've promised myself to never touch another SBS server, and above all to never do another SBS migration. I'll leave those to the SBS experts, something which I don't claim to be.

[1] I think I just made up a word.

Status Change for me

2006-10-04T10:56:00.000-05:00

As of Monday, Oct. 2nd, I have now joined Microsoft as an Exchange Support Engineer. I'm not sure yet what that means for this blog, so for the time being, I will continue to post new content here. If the location of my blog changes in the future, I'll be sure to post an update.

UM Kit offer from the Exchange team

2006-09-26T08:23:00.000-05:00

Are you part of the Exchange 2007 Beta, but haven't deployed the Unified Messaging bit because you don't have a VOIP gateway that you can integrate it with? Have no fear. Thanks to the effors of the folks on the Exchange team, for a limited time you can purchase a trial kit for $1000 that includes not only an analog IP Gateway, it also includes a full 2 hours of support to help get it set up and working with Exchange 2007.

One thing to note - the actual hardware costs far less than $1000. You can pick up the same piece of hardware (Audiocodes MediaPack 114 FXO) for ~$450, which means that the phone consultation bit is rather expensive. If you haven't had any experience with VOIP or setting up a VOIP gateway, this still might be a good deal, but if you have experience, I'd recommend just getting the hardware yourself and setting it up. The Exchange help file (and online documentation) is very good when it comes to information about UM. There are lots of places where you can get the VOIP gateway (note that currently, there are only 2 such gateways that are supported as being compatible for testing). Here are some links where you can get the VOIP gateway.
http://voipstore.atacomm.com/Shops/ViewItem.aspx/27934028032-52860297728.htm
http://var.abptech.com/s.nl;jsessionid=ac112b1d1f4359efdc791061472482498084a4762294.e3iKaNePch4Re38LaNuRa38Ka3f0n6jAmljGr5XDqQLvpAe?sc=2&category=5
http://www.voiplink.com/Audiocodes_MP_114_FXO_p/audiocodes-mp-114-fxo.htm
http://www.thevoipconnection.com/store/catalog/product_16313_AudioCodes_MP1144_FXO_4_Line_Gateway.html

Office 2007 Beta2 Tech Refresh is out

2006-09-15T11:25:00.000-05:00

Yesterday, Microsoft released the Beta2 Technical Refresh of Office 2007, and indicated that it would be free to download from the Microsoft Download Center. The main difference is that you must already have Beta2 installed (vs. removing the previous version).

I installed it yesterday afternoon (directly after downloading). Following completion of the install, I was required to reboot my computer. The first thing I noticed? There is a new theme available. Silver. Woohoo! I was sick of using the Slate Gray theme (it makes everything look darker), and couldn't stand the sky blue theme, so this was a welcome change. Also, since I use the Silver theme in XP, it blends right in.

Second, some of the UI has been changed. It seems like the Office button has been resized (smaller - about half the size it used to be). I still have a problem with my Word in that every time I open a new document, it starts with the zoom level at 10%, but I suspect that is more an issue with my computer, as I can't reproduce it on other computers. I'm also bummed that I apparently still have a problem with Outlook unable to act on mailto: links, but again, I think that's a problem with my computer, because it's not reproducible.

Third, icons (and splash screens) have been changed. They now feature a more updated, modern look, though so far I'm not extremely fond of the splash screen (it appears to be the same basic splash screen for ALL products, with just the name of the product being different

I'll be testing this out for the next while, but so far, I like the other UI changes. I haven't noticed much in the way of change in how the product works, but that could be simply because I am dense... :-)

Which gaming console is the best?

2006-09-14T10:07:00.000-05:00

There are lots of varying opinions out there, and each manufacturer states their console is the best (ok, with probably the exception of Nintendo, whom I haven't heard a lot of "smack" from).

The obvious players in the gaming console are the following:

Microsoft Xbox 360
Sony PS3
Nintendo Wii

let's do a quick comparison of the 3 and some of their basic features.

	Xbox 360	PS3	Wii
Price	$299 Core/$399 Premium	$499/$599	$250
CD player	Standard DVD-Rom/HD-DVD optional accessory	Blu-Ray DVD Standard	Standard DVD player
Hard drive?	None/20GB	20GB/60GB	None

At first glance, the PS3 wins out in the features category, but does it justify the $200 premium over the 360, and even more over the Wii? That's for you to decide.

Also, note that I left out the processor/video specs. While there is much hype about the Cell processor in the PS3, I have to date seen nothing that indicates it will soundly trounce everything out there. In fact, it seems like each time there is an update, revised specs are released that show lower capabilities.

As far as availability, the XBox360 has the obvious advantage here. It's already been out for a year, and will have the most games available.

All 3 systems claim to be backwards-compatible with previous games, though the XBox 360 requires the hard drive (or a memory module) in order work with Xbox games, as they store information on the hard drive on the original XBox.

Nintendo clearly has the most innovative design for their controller, but it really remains to be seen if it will be accepted or not. Sony and Microsoft have stayed the conventional route with their controllers.

All 3 systems will be touting online gaming capability, but I'd give the edge to the 360 here as well. XBox Live is a well-established service, and has been around for several years. There is a subscription cost, but at ~$50/year, it's a relative bargain. Last I'd heard, the online gaming from both Sony and Nintendo will be free, but I don't think they really have much choice here. In order to get an online gaming forum up and running, you can't really start charging at the onset, or you won't get near as many people to join.

So - which one would I buy? I certainly won't put out $500 or $600 for the PS3. I paid $150 for my original XBox, and I'm not willing to quadruple the cost of that to satisfy my gaming craves. That leaves the Xbox 360 and the Wii. The 360 has been out longer, and is likely to drop in price sooner (at least I think it will), and since I've already got an XBox, my likely choice will be the 360, though I won't be rushing out tomorrow to get one. Which console others will choose may depend on the current gaming console they own. If you have a PS2, my guess is that you'd be more likely to get a PS3 and be able to play all games from it instead of having 2 separate consoles. However, Sony is going to have a distribution problem with the PS3. The launch date here in the US (and in Japan) is supposed to be mid-November, but reports I've heard indicate they are going to have limited numbers of units available for the US and Japan (Europe's launch date has even been postponed until Spring of 2007). This means the mark-up by retailers could be quite a bit.

Time will tell how this next generation of gaming console wars turns out.

550 relaying denied for local domains

2006-09-08T14:34:00.000-05:00

Have you ever experienced your Exchange server suddenly (or not) rejecting all messages destined for local domains (i.e. the ones listed in your recipient policies)? Here are a couple of things you can check to see what is going on.

First, manually telnet to your Exchange server on port 25, and attempt to send a message. I won't go through all of the commands, but the Rcpt to: command is the most important here. If you are seeing this problem, as soon as you enter the rcpt to: command and enter the e-mail address of a user in that domain, you will see the 550 relaying denied message. A little trick here is that with Exchange 2000 and 2003, you can actually get away with just typing the username. For example, instead of typing

rcpt to: user@domain.com

you would type

rcpt to: user

When you do this, Exchange 2000 and 2003 will automatically append the smtp domain information and convert it to user@domain.com. In this case, performing this action resulted in Exchange returning user@sub.domain.com, which was not a part of recipient policies.

This gave me a clue as to what the problem might be, and leads to the next part.

Open Internet Information Services Manager, and expand your server name and check for the existance of an SMTP Virtual server in there. See, when you install Exchange, it requires SMTP to be installed, but during the installation, it takes over ownership (and managing) of the SMTP bit. In other words, SMTP should not show up in IIS Manager. If it does, then you know that Exchange isn't managing SMTP as it should. Fortunately, the solution to this problem is fairly easy.

If you have uninstalled/reinstalled IIS, then you have to reinstall Exchange. This is done simply by re-running Exchange setup and choosing Reinstall from the drop-down box for the install options. Don't worry - this doesn't touch the databases, it just reinstalls the Exchange binaries (\Exchsrvr\bin). Upon completion of this step, you would then need to reinstall any Exchange service packs and hotfixes.

If you have only uninstalled/reinstalled the SMTP component, then it's even easier. By following the instructions in http://support.microsoft.com/kb/290290/EN-US/, you can run smtpreinstall.exe and fix the relationship between Exchange and SMTP.

As also mentioned in the article, the other clue that will guide you to this conclusion is if there are missing SMTP verbs. When you type the EHLO command into your telnet session, all of the supported SMTP verbs will be listed.

If you don't see the following, then the Exchange verbs are not present, and you need to follow the above instructions to repair it.
250-X-EXPS GSSAPI NTLM LOGIN
250-X-EXPS=LOGIN
250-AUTH GSSAPI NTLM LOGIN
250-AUTH=LOGIN
250-XEXCH50
250-X-LINK2STATE

Fixing Suspect SQL databases

2006-09-07T22:13:00.000-05:00

Disclaimer: This probably should not be done on a production system! I have several SQL servers for use by our Developers, and none of them have any critical data on them. If you have a database that has been marked suspect by SQL, the best course of action that I am aware of is always to restore your data from backup.

I used the instructions provided byPaul Randal, who is a Lead Program Manager for SQL, at http://blogs.msdn.com/sqlserverstorageengine/archive/2006/06/06/619304.aspx

In my case, the problem database was the msdb database. With this db marked as suspect, the SQL Agent service would not start. Checking the SQL Agent log indicated this was the reason. As Paul mentions, since msdb is a system database, you can't repair it like you would others. In order to fix this problem, I had to start SQL by using:

start sqlservr.exe -c -T3608

This starts up SQL in a special mode where it only attaches to the master database. You can then run the instmsdb sql script to reinstall the msdb database. Running this script will first detach, then remove the msdb database files, then re-create and re-populate them. The proceure for doing this is quite simple. From the \sql\install directory, run the following command.

osql -E -S servername -i instmsdb.sql

Note: when you start SQL with this flag, the SQL service itself does not appear started. Instead, a separate cmd window will pop up with the SQL information. When you are ready to exit, you can simply hit Ctrl-C. You will then see a prompt asking you if you want to shut down the SQL server.

Wait a while (it took approx. 5 minutes for mine) and once it completes, stop and restart the SQL service so that it is no longer running in this special mode, and you should be all set. With this procedure completed, we were able to start the SQL agent without problems.

Fixing a cluster that is offline

2006-09-07T20:01:00.000-05:00

What do you do when you have a cluster that is completely offline? Have you ever encountered this problem? If so, you will know that you cannot manage your cluster using Cluster Administrator. In order to do so, Cluster Administrator must make a connection to the cluster - kind of hard if it's offline :-)

So, what to do? Well, you pull out your trusty cluster.exe command-line tool. Using cluster.exe, you can query for the status of the resources in your cluster by simply typing the command:

cluster.exe res

This will enumerate and list all resources as well as their status. From here you can bring an individual resource online (or fail it). For example, if your Cluster Network Name is offline, you can type

cluster.exe res "Cluster Network Name" /online

or

cluster.exe res "Cluster Network Name" /fail

Once the Network Name and IP address resources are online, you can continue by using the Cluster Administrator tool.

A 4 yr old's harcut!

2006-08-22T14:11:00.000-05:00

And now for a post on the Family front.

We don't need to guess where she learned this from - her older sister has attempted to cut her own hair twice now. Pictures posted in order are:

1. Before the cut. Her hair went *almost* down to her waist.

2. The cut

The second picture doesn't really do justice - she also did a hack job on her bangs. After this, my wife had to take her to a real hair stylist to have it fixed. The "After" pictures:

Of course, she's still CUTE! I'm not sure what possessed her to want to cut her hair, but what's done is done. If you're wondering where they get the scissors from, we do have them put away up in a cupboard, but as you know, 4 yr olds and 6 yr olds are resourceful little buggers! :-)

Microsoft UK: Office Clips

2006-08-22T11:16:00.000-05:00

ROFL!

Link to Microsoft UK: Office Clips

I just viewed these, and they are hilarious. Make sure that you watch all the way until the end - there are some funny outtakes included.

Creating a new mailbox using Powershell and specifying the password

2006-08-22T10:57:00.000-05:00

So you want to create a new mailbox with Exchange 2007. No biggie - you can create it either using the Management Console (GUI), or via the Management Shell (Powershell). That's boring, though. What if you want to create it via the Shell AND specify the password? Ok - let's do it.

First, let's take a look at the Help for the new-mailbox command usage.

New-Mailbox -Name <String> -Database <DatabaseIdParameter> -OrganizationalUnit <OrganizationalUnitIdParameter> -Password <SecureString> -UserPrincipalName <String> [-Alias <String>] [-DisplayName <String>] [-DomainController <String>] [-FirstName <String>] [-Initials <String>] [-LastName <String>] [-ManagedFolderMailboxPolicy <MailboxPolicyIdParameter>] [-MobileMailboxPolicy <MailboxPolicyIdParameter>] [-ResetPasswordOnNextLogon <$true | $false>] [-SamAccountName <String>] [-TemplateInstance <MshObject>]

Notice that the -Password option needs to be entered as a Secure String. That means that you cannot enter it as plain text during the command. Now, let's take a look at one of the examples provided in the help.

EXAMPLE

$password = Read-Host "Enter password" -AsSecureString

New-mailbox -UserPrincipalName chris@contoso.com -alias chris -database "Storage Group 1\Mailbox Database 1" -Name ChrisAshton -OrganizationalUnit Users -password $password -FirstName Chris -LastName Ashton -DisplayName "Chris Ashton"

This example shows how to create a new mailbox using the -password option. Note that the password is not actually set to $password. Rather, $password is a variable that has been set by the first command. As I mentioned, when you enter the password, it cannot be in plain text. If you try to, you'll receive the following error.

New-Mailbox : Cannot bind parameter 'Password'. Cannot convert value "password" to type "System.Security.SecureString". Error: "Invalid cast from 'System.String' to 'System.Security.SecureString'."
At line:1 char:70

As indicated in the example, you need to define the $password variable. This is done by using the first string from the example. When you run the command

$password = Read-Host "Enter password" -AsSecureString

you will be presented with a prompt stating

Enter password: ********** (note that the password I entered is entered as a secure string - the text is hidden with asterisks)

Once you've entered this password, it's stored as a secure string. You now just need to specify the password using the $password variable you've defined. The downside to this method is that you would have to use the same password for each user that you created using this variable. Note that the following fields are required when creating a new user account. Also note that if you are creating a linked mailbox, a shared mailbox, or a resource mailbox, a password is not required as the account will be disabled.

Password
Database
UserPrincipalName
Name
OrganizationalUnit

Everything else is optional.

More on Windows Mobile, Certificate Checking and the continual password prompt

2006-08-21T14:01:00.000-05:00

It seems that my post on "Hacking your Windows Mobile 5.0 Registry" gets read a lot. In fact, about 50% of the traffic to my blog comes from visits to that page (most of it from search engine referrals). Based on some comments, though, I feel like I need to clarify something.

The main reason that I blogged about the ability to disable certificate checking in Windows Mobile 5.0 is because I use a Wildcard certificate (*.company.com) at my current company. Unfortunately, wildcard certs are NOT supported in Windows Mobile 5.0. This means that even if the certificate is installed properly, Windows Mobile 5.0 will not properly use it and will instead display an error stating that an invalid certificate is installed. In order to get synchronization working with MY environment, I had to disable certificate checking. This still allows me to use SSL, but it tells Windows Mobile not to check if the certificate is valid (basically, the hostname doesn't have to match).

However, if you are using a self-signed certificate (generated by an internal Certificate Authority), there is NO need to add this registry key. Windows Mobile 5.0 fully supports self-signed certs, and has made it MUCH easier to install your own certificate. An abundance of posts provide helpful information on how to install a certificate on Windows Mobile 5.0 in many different ways, from copying and clicking a .cer file, to installing as a .cab file, to installing using a signed version of the spaddcert.exe tool (Sprint and Verizon). Think of it this way. If you are using a self-signed cert for, say, OWA access, what happens when an external client tries to log in to OWA? Internet Explorer indicates there is a problem with the certificate. How do you get around that certificate error popping up each time you visit the page? You install your certificate into IE's certificate store as a Trusted Root Certificate Authority. The same action is required with Windows Mobile, with the exception that if you want to synchronize at ALL using SSL, you have to install the cert (or disable SSL - not recommended).

What prompted this post? I've had some questions about the original post that indicated folks had disabled certificate checking, only to be continually prompted for a password. That's annoying! (the continual password prompt, not the questions!). The common thread I've seen in each case so far, though, was that the issue was one with the certificate. In at least one case, disabling SSL (as a test) allowed sychronization to work (a sure sign that the issue is with the cert).

What do you do if you are continually being prompted for a password? Here is a list of things to check.

1. Are you sure that you have installed your certificate as a root certificate on your Windows Mobile device? Windows Mobile devices also have a certificate store, which is viewable by the user. Check your device for the exact location (I believe it may display in a different location depending on if you have a PocketPC-based device, or a Smartphone-based device), and make sure that your certificate shows up there.

2. Have you made sure that the server name in the ActiveSync settings *exactly* matches the one that's on the cert? This is what disabling certificate checking is supposed to fix (a wildcard cert won't match exactly), but since disabling cert checking does decrease security, it shouldn't be done unless absolutely necessary.

3. If you disable SSL on your Windows Mobile device, does synchronization work and your password get accepted?

4. Does the name of the server you are entering in ActiveSync exist in external and internal DNS?

5. Have you made sure that your cert is indeed valid, and not expired? IE should show you any issues from this side of things.

If I can think of anything else, I'll edit this post. I've also asked the folks on the Windows Mobile blog to comment on what might cause the looping password.

Accessing another mailbox via OWA – Exchange 2003 vs. Exchange 2007

2006-08-11T10:45:00.000-05:00

No doubt many of you know how to access another user's mailbox via OWA when using Exchange 2003 (or prior).

To refresh your memory, the format that is used in Exchange 2003 is

http(s)://server.domain.com/exchange/aliasofusertoopen

This will result in you being prompted for your credentials, and as long as you have full mailbox rights, you'll be able to open that mailbox. You can also specify to only open a specific folder, for example:

http(s)://server.domain.com/exchange/aliasofusertoopen/calendar

In Exchange 2007, this method of access no longer works. Exchange 2007 changed the OWA interface yet again (but for the better, I promise!), so the method for accessing another mailbox has also changed. The main change here is that you no longer use the /exchange vdir. Instead, there is a new /owa vdir that gives you the new interface. I had previously though that you could still use the old /exchange directory (it still exists!), but it appears that /exchange simply redirects you to the /owa directory. With these changes, you now have 2 options.

First, you can use the slick new interface within OWA to open another mailbox (I've briefly mentioned this in the past. The attached picture shows how you open another mailbox. Note that in OWA, your mailbox name will be displayed in the upper right-hand corner, with a drop-down menu. Clicking on your name will bring up the dialog box as shown in the picture. You simply type in the name of the mailbox you want to open, and then click the Open button. As long as you have rights to the other mailbox (I've already covered how to grant rights to other mailboxes in previous posts), the other mailbox will then open up in another window.

If you don't want to open the entire mailbox, it is still possible to open just a single folder, but the URL structure is different. Thanks to KC Lemson, and Tim McMichael for taking the time to look up this information.

The URL format you would use to open another user's calendar is as follows:

http://server.domain.com/owa/user1@domain.com/?cmd=contents&module=calendar

where user1@domain.com is the other mailbox that you want to open, and module=calendar indicates that you want to open the calendar. Other modules you could specify include inbox, contacts, etc.

After you hit go/enter, you will be prompted for your credentials to log on to user1's calendar. Worth noting here is that in the beta2 build at least, even though I've enabled Forms-based authentication with the ability to log on with only the username, in order to make the above work, I had to either log on using domain\username, or user@domain.com.

Changing DSN and other Quota messages with Exchange 2007

2006-08-01T22:06:00.000-05:00

Many an admin has wondered if DSN (Delivery Status Notifications – Message Delays and NDRs) messages, or Over-the-limit quota messages could be modified. In versions of Exchange prior to Exchange 2007, the answer has always been no, or at least there was no official supported way to do this. I've seen a few utilities to modify the quota messages, but definitely nothing to modify the DSN messages. Thankfully, with Exchange 2007, you now have the ability to add/modify TONS of this information. A few examples.

Modify DSN messages.

Exchange allows you to modify two type of DSN messages. Those associated with 4.x.x error codes (400-level errors codes are transient, retry-able error codes – something like 421 service not available), and those associated with 5.x.x error codes (500-level error codes are permanent fatal errors – like 550 relay denied)

The usage of the MSH command to modify a System DSN is as follows. We'll change the relaying denied message (that's my favorite).

The format of this command is:

New-SystemMessage -DsnCode <EnhancedStatusCode>-Internal <$true | $false> -Language <CultureInfo>-Text String> [-DomainController <String>] [-TemplateInstance <MshObject>]

Following that format, we input the following:

New-SystemMessage -DsnCode 5.7.1 -Language En -Internal $false -Text "Whatever text you want to put in here"

Once you hit Enter, it will now save it as a Custom DSN message for the DSN code that you specified.

If you later want to remove your custom DSN message, you can either issue the command

Set-SystemMessage –identity –original $true, where an example of the identity would be En\External\5.7.1

Modify Quota Messages

Ok – there are several different quota messages that can be configured, including:

* WarningMailboxUnlimitedSize Issued when a mailbox that has no prohibit send quota or prohibit receive quota exceeds the specified mailbox warning limit.* WarningPublicFolderUnlimitedSizeIssued when a public folder that has no prohibit send quota or prohibit receive quota exceeds the specified public folder warning limit.* WarningMailboxIssued when a mailbox that has a prohibit send quota or prohibit receive quota exceeds the specified mailbox warning limit.* WarningPublicFolderIssued when a public folder that has a prohibit send quota or prohibit receive quota exceeds the specified public folder warning limit.* ProhibitSendMailboxIssued when a mailbox that has a prohibit send quota exceeds the specified mailbox size limit.* ProhibitPostPublicFolderIssued when a public folder that has a prohibit send quota exceeds the specified public folder size limit.* ProhibitSendReceiveMailBoxIssued when a mailbox that has prohibit send quota and prohibit receive quota exceeds the specified mailbox send and receive size limit.

The format of the command is:

New-SystemMessage -QuotaMessageType <QuotaMessage> -Language En -Text "Text string"

As an example, if you want to change the quota message that applies to mailboxes that have a limit that prohibits both sending and receiving mail, you would use the following command.

New-SystemMessage –QuotaMessageType ProhibitSendReceiveMailbox –Language En –Text "Put your text in here"

Have fun with these! I for one am glad that this capability will now be present in Exchange.

Replying to posts or messages in Public Folders from OWA

2006-07-31T10:45:00.000-05:00

Do you remember Exchange 5.5? Where messages that were delivered to Public Folders had the same message class (IPM.Note) as messages delivered to mailboxes? Ahhh – that was nice.

How about how Exchange 2000 changed it so that messages from the Internet to mail-enabled Public Folders defaulted to a message class of IPM.Post? I thought I'd blogged about this before, but apparently not. For those not aware of this, a quick overview is that Public Folder functionality changed with Exchange 2000. Messages sent internally to a mail-enabled public folder retained the message class of IPM.Note (standard message class), but any messages sent from an outside source were converted to a message class of IPM.Post (Message Post class), which causes some issues for clients attempting to reply to those messages, especially from OWA (there is no reply functionality). Outlook seems to handle it better (or at least Outlook 2007 does) and still gives you the ability to reply to a post within a public folder.

Microsoft released a KB article that addressed this issue (I think a lot of people complained about it…) in KB 817809, which allows you to basically set a registry value on your server, and change the behavior back to what many people would consider "normal" behavior, by modifying the PR_MESSAGE_CLASS field and changing it back to IPM.Note. This helps Outlook clients (and OWA clients for that matter) in that items now appear as messages instead of posts, but OWA still has a major problem in that you still can't reply or forward those items. The jist of it is that in order to reply or forward items in public folders in Exchange 2003, you need to have a Front-end server deployed. See http://support.microsoft.com/kb/822178 for details on the requirements to use different features in Exchange 2003.

Bottom line here is that if you require the functionality of being able to reply or forward messages (ipm.post or ipm.note) other than "Post reply to this folder", then you unfortunately have to deploy a Front-end server. At least one bit of good news is that with Exchange 2003, you can use Exchange 2003 Standard edition for that Front-end server, instead of having to use Enterprise edition (as Exchange 2000 Front-end servers required).

How to save your cluster from a failed quorum drive

2006-07-25T16:46:00.000-05:00

I first have to add a disclaimer that this cluster was a development system, so the data on it was of relatively little use. I also have to add that the configuration of this system in no way shape or form would mirror anything I would allow to be put into production.

Tip 1: Make sure that your Quorum drive (assuming it is not a local quorum) is on a RAID volume. This particular cluster uses iSCSI as its SAN. When the iSCSI server was initially set up (not by me), no RAID was used. I knew that it would eventually have to be changed, but due to the setup, I just kept pushing it off because, well, I didn't want to have to redo the entire cluster. Of course, one of the hard drives in the system failed. After letting the cluster sit for a while (offline, of course), I decided to tackle it and get it fixed. The first priority was getting the iSCSI server fixed. It was set up properly, with a RAID5 array for the hosts to use.

Tip 2: Make sure that you have the Windows (2003) Resource Kit downloaded and installed. There are some awesome utilities included in the Resource Kit. If you've worked with Windows long enough, you'd remember that there used to be actual Books and CD's for resource kit materials, and they weren't free! Thankfully, the Windows 2003 Resource Kit tools are freely downloadable. They came in VERY handy!

Armed with my knowledge, and my l337 searching skills, I began to search for how to fix my problem. In this case, I couldn't even start the cluster service. Attempting to do so generated an error indicating that the drive signature that was expected for the quorum couldn't be found. Duh. It wasn't coming back, either! Anyway, I came across several articles (Thanks to EventID.net) that helped me with this. The error I was seeing was event 1034 with a source of ClusSvc. Here are some of the resources I consulted.

http://technet2.microsoft.com/WindowsServer/en/Library/b410b421-78a5-4b3f-9247-e4f248f878fc1033.mspx?mfr=true http://technet2.microsoft.com/WindowsServer/en/Library/e2e5674c-0625-4aba-afee-0c7057f8ac2e1033.mspx?mfr=true http://technet2.microsoft.com/WindowsServer/en/library/3974d0c5-1c3f-4dce-921c-2859a8abd8ae1033.mspx?mfr=true

With the help of these articles, I was able to start up the cluster service with the /fixquorum switch (to do this, from a command prompt, use net start clussvc.exe /fixquorum), which allows the cluster service to be started. As anyone who works with clusters understands, until that cluster service is started, there really isn't much that can be done. With the cluster service started, I was then able to create a new physical disk resource, and then use the clusterrecovery tool, which is available in the aforementioned Windows 2003 Resource Kit utilities (Free download). The clusterrecovery tool allows you to replace a failed quorum drive by choosing another physical disk resource to replace it with. Once it does it's magic, it appends (lost) to the old Quorum resource and instructs you to delete it.

Of note is that once you are done with this maintenance, you need to restart the cluster service, otherwise it will continue running in the fixquorum state. Also of note here is that when replacing the quorum disk using clusterrecovery, ALL resources must be in an offline state (or failed, as it was in my case – hehe). Because of this, when you try to connect to the cluster, you must specify the physical node name as the cluster name, not the actual cluster virtual name (the Network Name resource is offline, so the cluster virtual name won't respond).

All done with this, I tested failing over to the other node to make sure that the resources all came online – they did. I then went about fixing the Exchange Virtual server, which was much easier. I'm pretty sure that I've blogged about that in the past, so I'll skip it this time, other than to say that the physical disk the Exchange virtual server was using had also failed (NEVER use RAID0 on a production server!), so I went through the process of creating a new physical disk resource for that, then deleting/re-creating the Exchange System Attendant Resource to fix the MS Search problems. I lost all the databases for that virtual server, but again, since it was a dev system, the data really didn't matter.

Remember to sign up for Exchange 2007 Beta2!

2006-07-18T10:29:00.000-05:00

The Exchange 2007 Beta2 program is going to be a Public Beta. Everyone who signs up will be accepted into the program and given access to the media, so if you have any interest at all in Exchange 2007 and the changes that will be coming, make sure that you remember to sign up. Indications are that Beta2 will be available at the end of July.

http://www.microsoft.com/exchange/preview/default.mspx

In addition, you can now find all the most up-to-date technical documentation for Exchange 2007 online, and there are also other great resources such as sample Monad (PowerShell) scripts.

How does Dell do it?

2006-07-18T09:57:00.000-05:00

I suppose the bigger question is how much money they are losing on each laptop purchase, and will prices go up once they've garnered a larger market share?

Currently, Dell is running a special on their Inspiron 6400 line of laptops (expires tomorrow) for Small Businesses. Their 6400 with a DuoCore processor (1.6Ghz), 1GB ram, 80GB hard drive and DVD+/-RW (Dual layer even) is starting at ~~$604~~ $699. I ask again, how can they do that without taking a loss on each sale? Or compromising quality? That's a pretty darn low price for a laptop, and though the Inspiron's are really geared more towards home users, I like them and like the way they look. They are a little bigger and heavier than their Latitude counterparts, but Dell has been touting these as desktop replacement systems, so probably the thinking is that you won't have to lug it around as much. Even if you do, at ~6lbs, it really isn't that bad.

My Father-in-law recently experienced a problem with his Inspiron 6000 where the network card was having issues. That escalated into more severe problems that seemed to point to a faulty mainboard. It's finally getting fixed, but it does sort of highlight the above question, though I know several other people that own Inspiron 6000's (my mother being one), and haven't heard of any widespread issues with them.

One thing to note is that the default warranty that comes with these laptops is a 1 year economy on-site warranty, so perhaps that is part of why the low cost. However, I'm a firm believer that if there are going to be serious problems, they will usually crop up fairly early.

Bottom line here is that if you are in the market for a mid-level laptop, it looks like Dell wants your business pretty bad.

Update: The price has been changed and is now $699, not $604. Possibly it was a pricing mistake.

Registry Settings for Windows Mobile devices

2006-07-17T10:50:00.000-05:00

Here's another post in my series about Windows Mobile devices. My last post talked about frustrations with the Q. Those issues never got fully resolved, but I'm not as concerned about them, because I don't own the device, and I haven't been asked to get it working.

I did find some interesting information, though. I feel rather fortunate that my device is completely unlocked, so I can muck with all the settings I want. For those that don't have unlocked devices, there may be *some* hope.

MSDN contains information on the Default Security Policy settings for both Windows Mobile Pocket PC's and Windows Mobile-based Smartphones. Check them out! Of interest is the section referring to the Grant Manager settings. I had seen several comments on the Windows Mobile team blog that referred to changing the registry key value in HKLM\Security\Policies\Policies\00001017 from the default of 128 to 144 and that this would aid in being able to install certificates, but didn't quite understand why that would make a difference until I read the MSDN documentation. The MSDN article indicates that the registry key 00001017 is the setting for the Grant Manager Policy, which basically defines which roles are granted system administrative authority. To understand these settings, let's look first at what the different roles are (there are actually a few more which are listed in the link below, but I don't think they are particularly relevant):

Security Role	Registry Key Value (Decimal)
SECROLE_OPERATOR_TPS	128
SECROLE_PPG_TRUSTED	2048
SECROLE_PPG_AUTH	1024
SECROLE_TRUSTED_PPG	512
SECROLE_USER_AUTH	16
SECROLE_MANAGER	8
SECROLE_OPERATOR	4

The thing to understand about registry settings such as these is that they can be used singularly, or in combination. When you look at the value of the key, it represents all settings that are enabled. By default, on non-phone based devices (Pocket PC only), the default setting (outlined in the MSDN article) is actually set to Decimal 16 (Hex of 0x000010), which equates to SECROLE_USER_AUTH. On phone-based devices (Pocket PC Phone edition and Smartphones), however, it defaults to Decimal 128 (Hex 0x000080), which is SECROLE_OPERATOR_TPS. By changing the value to Decimal 144 (Hex 0x000090), what you are actually doing is enabling both SECROLE_OPERATOR_TPS and SECROLE_USER_AUTH (128+16 = 144). In the same section of the MSDN site, another page describes the various security roles.

The only bit of advice I feel compelled to share here is to make sure that you document any settings when you make changes. There is nothing worse than knowing you changed something, but forgetting where it was you made the change, and what the default value was, especially when it is causing problems.

Verizon, what have you done with the Q?

2006-07-13T14:42:00.000-05:00

I now understand what the comments were talking about in my earlier blog about being continually prompted for the password when attempting to get Exchange ActiveSync up and working.

I tried to get a Motorola Q working via Exchange ActiveSync today, and could not get it working. I tried everything I had done with my device, including adding the registry key (remember, we use a wildcard cert), and attempting to install our cert. Verizon has apparently locked down being able to just add certs the normal way with Windows Mobile 5 (BOOOOOO!!!), and requires you to use the old spaddcert.exe tool, which apparently won't let you add just any cert. When I tried adding ours, it kept telling me that it wasn't a valid root certificate.

Anyways, modifying the registry key (HKEY_CURRENT_USER\Software\Microsoft\ActiveSync\Partners\Partnership for Exchange server) and adding the key of secure=0 got rid of the invalid certificate prompt, so perhaps the certificate issue has been resolved. Even so, I'm not quite sure how to get past the password prompt.

In summary, I've got a few issues with what Verizon has done to the Q.

Why on earth does the Q not ship with MSFP/AKU 2.0? That is INSANE! We're talking about an update that was released to manufacturers in November of LAST YEAR, for goodness sakes. Verizon needs to get off it's rear end and get an MSFP/AKU 2.0 update pushed out.
What is really the rationale behind locking down devices, such as preventing the installation of certain certificates? I can completely understand a carrier wanting to lock down a device so that it will only work with their network, but I don't understand this nonsense of locking down other portions of the device so that it makes life harder for IT folks.

I will, however, give kudos to Motorola. The form factor on the Q is pretty nice, and even with the extended battery installed, it still seems smaller than any Blackberry I've seen. The screen (even though it is only 320x240) appears bright and sharp. The screen, however, isn't a touchscreen, so don't expect to use it as such (no stylus included).

Are you experiencing similar issues with your Q, or another Windows Mobile 5 device? Have you gotten the dreaded continual password prompt? If so, what did you do to get around it?

Windows Mobile tidbit

2006-07-11T09:03:00.000-05:00

If your Windows Mobile device isn't automatically syncing with Exchange, make sure you check the Date and Time on your device. If it isn't correct, then you won't be getting updates.

I recently was without my Windows Mobile device for 3 weeks, and when I got it back, it was *completely* out of juice. Luckily, with Windows Mobile 5.0, I didn't have to worry about losing any data (Yay!). Once I charged my device, I did a sync to get everything working, and it pulled in a bunch of e-mail, so I figured everything was ok. Then I noticed that it wasn't receiving updates. I'd see new messages on my Outlook client, then I'd see that they weren't there on my Jasjar. I thought that was a bit odd, because with Direct Push, I'd usually end up seeing the messages on my device before they would show up in Outlook (cached mode). Performing a manual sync on the device would pull over all mail, but nothing was getting synced automatically. I was hoping that I wouldn't have to delete and re-create the Exchange server partnership, but was almost ready to do just that.

What finally caught my attention was looking at the day that was displayed on the home screen. It said it was Sunday, when in fact it was Monday. Turns out it was a whole year off. Anyways, once the time issue was corrected, Direct Push started working again just like normal. So this is a note to remind you that if you aren't getting automatic syncs, check your date and time.

Extreme Case Mods

2006-07-07T09:37:00.000-05:00

I subscribe to ExtremeTech's blog. Lately, what's been going on over there is a Case Mod contest. I just saw their latest winner, and all I can say is - Wow! Check it out for yourself.
http://www.extremetech.com/article2/0,1558,1985709,00.asp?kc=ETRSS02129TX1K0000532
That is one amazing case, and I can only imagine how much time it must have taken to complete. I wish I had extra time like that, but a wife and 4 kids tend to take up most of my free time :-)