The EXPTA {blog}

Fix for 'The server name is invalid' error when installing Exchange 2007 Management Tools

2009-11-06T13:55:00.000-08:00

You may receive the following error when installing the Exchange 2007 management tools on a computer:

Error:
The server name is invalid. It contains characters other than 'A'-'Z', 'a'-'z', '0'-'9' and "-".

While the error indicates that the problem is with the server, it's actually with the name of the local computer where the Exchange 2007 management tools are being installed. The most common reason for this I've seen is when there's a underscore "_" in the local computer name.

The fix for this is to replace the exbpa.prereqs.xml file on the Exchange Server 2007 installation source with the RTM version of the file. Here are the steps to do this:

Download the RTM version of exbpa.prereqs.xml from this blog (right-click the link and choose Save target as...) and save it to a temporary location
Disable automatic updating for Exchange 2007 setup. Otherwise, setup will automatically download the most recent version of the file and replace it. Run the following command at the CMD prompt:

reg add "HKCU\Software\Microsoft\Exchange\ExBPA" /v "VersionCheckAlways" /t REG_DWORD /d 0 /f

Copy the exbpa.prereqs.xml file you downloaded earlier to the \setup\serverroles\common\en folder on your Exchange 2007 installation media.
Now run setup and install the Management Tools, as usual. You will still see the same error message, as shown above, but you will see an Install button instead of a Retry button.

When the installation is complete, remove the VersionCheckAlways registry key to reenable the automatic update feature using the following command:

reg delete "HKCU\Software\Microsoft\Exchange\ExBPA" /v "VersionCheckAlways" /f

Keep in mind that you may have to do this same procedure again in future update rollups and/or service pack updates.

Fix for Remote Desktop Gateway authentication error from clients

2009-11-06T13:11:00.000-08:00

If you use Remote Desktop Gateway Manager (formerly, Terminal Services Gateway) in Windows Server 2008 R2, you may find that Windows clients are unable to authenticate to the RD Gateway server.

This happens because the default configuration in Windows Server 2008 R2 Remote Desktop Gateway is to request that clients send a statement of health before the connection can be made. If this option is selected and you do not have a Remote Desktop connection authorization policy (RD CAP) for Network Access Protection (NAP) configured, clients will be unable to connect to the RD Gateway. They will repeatedly be prompted for Gateway Server Credentials as shown below:

To fix this issue, ensure that you have a valid statement of health configured in NAP. Alternatively, as in the case of clients that cannot or do not provide a statement of health (I'm looking at you, Windows XP), you can disable requesting statements of healthy entirely. Here's how to do that:

Logon to the Remote Desktop Gateway computer and open the RD Gateway Manager (Start > Administrative Tools> Remote Desktop Services > Remote Desktop Gateway Manager)
Click the RD CAP Store tab and clear the checkbox for "Request clients to send a statement of health", as shown below and click OK.

It may take a moment for the change to go into effect. Occacionally, I've had to restart the Remote Desktop Services service.

How to Use a Recovery Database in Exchange 2010

2009-10-30T14:35:00.000-07:00

This is another in my series of articles on Exchange 2010. In this post I'll be writing about the Recovery Database feature in Exchange 2010.

Exchange 2010 no longer has the notion of Storage Groups, which were used in Exchange 2007 and 2003 to contain logical groupings of databases. E2010 now simply lets you create databases on mailbox servers. E2010 Standard Edition lets you create up to 5 databases per server. The Enterprise Edtion scales up to 100 databases per server.

In Exchange 2003/2007 you could restore a database "on top" of an original database to replace the existing database, or you could restore the database "along side" the existing database to recover select mailboxes or items. You can do the same thing with Exchange 2010. The difference is that in Exchange 2003/2007, you created a Recover Storage Group (RSG) to restore the database into. In Exchange 2010, you simply restore the database and connect to it as a Recovery Database (RDB). Here's how you do it in Exchange 2010.

Note: Ross Smith IV has a great article on single item recovery in Exchange 2010. This assumes that the item can be recovered from the dumpster. This article covers how to restore from a backup when the item cannot be recovered from the dumpster. For example, on the rare occasion when a user realizes he/she deleted a folder or item past the dumpster retention period.

First, you have to have a good backup that contains the item to be recovered. Windows Server 2008 and Windows Server 2008 R2 have the built-in Windows Server Backup feature. I cover how to use WSB to backup Exchange here.

Now you must restore the data, but redirect it to another location. In Windows Server Backup, this is done by choosing to recover the Exchange application (detailed in my previous article) and recovered to another location. Typically, this is a new folder on the same Exchange server:

Once the recovery is complete, the database (EDB file) and transaction logs (LOG files) will reside in the new recovery D:\Recovery folder. Note that WSB will not create this folder, it must already exist.

Now you need to add this database to the Exchange mailbox server as a Recovery Database. Currently, this is done using the Exchange Management Shell (EMS), as there is no way to do this from the GUI. Run the following command to create a Recovery Database:

New-MailboxDatabase -Recovery -Name RDB1 -Server EX1 -EdbFilePath "D:\Recovery\Mailbox Database 1882717321.edb" -LogFolderPath "D:\Recovery"

This will cause Exchange to create a new recovery database named RDB1 on server EX1 using the database and logs in D:\Recovery. Once this command is run, you will see the recovery database in the Exchange Management Console (EMC), but it must be brought into a clean shutdown state before it can be mounted.

To bring the database into a clean shutdown state, use ESEUTIL /R to perform a recovery of the database. Often, I've seen that Exchange is unable to perform a successful recovery, giving the following error:

Operation terminated with error -1216 (JET_errAttachedDatabaseMismatch, An outstanding database attachment has been detected at the start or end of recovery, but database is missing or does not match attachment info) after 11.625 seconds.

In these cases, I have run an ESEUTIL /P (repair) to force the database into consistency. Once the database has been successfully recovered or repaired, mount the database in EMC or using the Mount-Database cmdlet.

Now we're ready to recover deleted items from the recovery database. In order to do this, though, you need Organization Management rights in Exchange 2010. The following are cmdlet examples for recovering items from the RDB:

This example restores a mailbox for user Keith Johnson, overwriting the existing mailbox:

Restore-Mailbox -ID 'Keith Johnson' -RecoveryDatabase RDB1

This example restores Keith Johnson's mailbox content into an Investigation mailbox:

Restore-Mailbox -ID 'Keith Johnson' -RecoveryDatabase RDB1 -RecoveryMailbox Investigation

This example restores only the mail with the word "contract" in the subject and the word "CompanyABC" in the body of the message from the Inbox or Saved folders.

Restore-Mailbox -ID 'Keith Johnson' -RecoveryDatabase RDB1 -SubjectKeywords 'contract' -ContentKeywords 'companyabc' -IncludeFolders \Inbox,\Saved

There are a lot of different options in the Restore-Mailbox cmdlet and recovery databases that make it a powerful tool for recovery. Take the time to learn them before you need to use them.

How to Backup Exchange 2010 RTM at Release Timeframe

2009-10-30T10:46:00.000-07:00

As with any other major release of Exchange, there will be a gap in third-party vendor support for Exchange 2010 when it is released to general availability next month.

One of those gaps will be supported backup solutions for Exchange 2010. Thankfully, Microsoft recognized this and added VSS backup support to the built-in Windows Server Backup feature in both Windows Server 2008 and Windows Server 2008 R2. This capability has been introduced in Exchange 2007 SP2 and Exchange 2010 RTM, allowing you to backup Exchange 2007 SP2 and Exchange 2010 using a native VSS application provider.

Exchange automatically registers its application provider in VSS when Exchange 2010 is installed or when the Exchange 2007 server is upgraded to SP2. This happens even if the Windows Server Backup feature isn't installed on the server yet. You simply need to add the Windows Server Backup feature using Server Manager to your Exchange server to enable the Exchange aware VSS backup capability.

Windows Server Backup (WSB) will allow you to perform Exchange aware backups, similar to NTBackup, with a few notible points:

Legacy (streaming) backups are not supported.
Since Windows Server Backup performs volume-only Volume Snapshot Service (VSS) backups, there is no specific "Exchange only" backup capability. When you perform a backup of a volume that contains Exchange data (EDB and log files), WSB automatically performs an Exchange aware backup. The only visual queue you will see is this, just before the data is backed up:

Once WSB notifies Exchange that the VSS Full Backup has completed successfully, Exchange will truncate the log files for all the Exchange 2010 databases or Exchange 2007 SP2 Storage Groups.

Note: The default behavior of WSB is to perform a VSS Copy Backup, which will not truncate the logs. To configure a VSS Full Backup you must configure a Custom backup (not Full Server), add the volumes that contain the Exchange data, click Advanced Settings, and select VSS Full Backup on the VSS Settings tab.

Backups must be run against the active node on Database Availability Groups (DAGs) or the active node in an Exchange 2007 CCR cluster. When the backups complete successfully and the logs are truncated on the active node, the same operation will occur on the passive node.
You can backup either to a local hard drive or a network share
There is no remote server backup functionality. You must perform the backup from the Exchange server.
You can schedule the backups using WSB or install the WSB command line extensions to run a backup from the command line.
When restoring, you do not have to restore the whole backed up volume. You can choose to restore only Exchange application data by choosing to recover only the Exchange application, as shown:

And then select Exchange:

Recovery can be performed to the original location (overwriting the existing data) or to a new folder or location. If you choose to recover to another location, WSB will copy just the application data, not recover the Exchange application itself. You can then use this data in an Exchange 2010 Recovery Database (RDB) or an Exchange 2007 Recovery Storage Group (RSG).
You can redirect the restore of an Exchange application to another server.
Microsoft Data Protection Manager (DPM) 2010 is also in beta and is available for download.

In a future article, I will explain the process of using an Exchange 2010 Recovery Database (RDB) to recover data from a backup set.

Windows 7 Interoperability Pack Released

2009-10-27T15:25:00.000-07:00

Microsoft announced today the release of the Platform Update for Windows Server 2008 and Windows Vista, as well as Remote Desktop Connection Client 7.0 and Windows Management Framework. This was previously known as the Windows 7 Interoperability Pack.

Please see the following Microsoft Knowledge Base articles for more information.

Platform Update for Windows Server 2008 and Windows Vista - http://support.microsoft.com/kb/971644
Remote Desktop Connection 7.0 client update - http://support.microsoft.com/kb/969084
Windows Management Framework Core - http://support.microsoft.com/kb/960930
Windows Management Framework BITS - http://support.microsoft.com/kb/960568

Windows Management Framework Released

2009-10-27T15:16:00.001-07:00

Windows Management Framework, which includes Windows PowerShell 2.0, WinRM 2.0, and BITS 4.0, was officially released to the world this morning. By providing a consistent management interface across the various flavors of Windows, we are making our platform that much more attractive to deploy. IT Professionals can now easily manage their Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 machines through PowerShell remoting – that’s a huge win!

You can download the packages here: http://go.microsoft.com/fwlink/?LinkID=151321

Paused Hyper-V VMs Do Not Release RAM

2009-10-26T14:28:00.000-07:00

Windows Server 2008 Hyper-V allows the administrator to pause a running Hyper-V virtual machine. When a VM is paused, the VM system state is written to a file on the host server and the VM no longer will process operations. This is similar to the sleep feature in other versions of Windows.

When the VM is resumed, Hyper-V will read this saved state information back into its working set and the VM will continue to function as it was when the VM was paused. This is a very quick operation.

Pausing a VM is handy when you want to quickly and temporarily take a machine offline without shutting it down. For example, you may want to test cluster failover or you may need to briefly free up main processor resources.

Be aware, however, that pausing a VM does not free up the RAM associated with the VM. I've seen several customers make this mistake, thinking that they could essentially "over-subscribe" their Hyper-V host server by pausing running VMs to free up resources (RAM) and run other VMs.

When you pause a virtual machine, the RAM allocated to the paused VM is not released back to the host. Take a look at the sample perfomance monitor screenshot below:

This perfmon example shows available megabytes free on a Windows Server 2008 Hyper-V host server with 8GB RAM. RAM drops when a 4GB VM is started up, as expected. The VM is then pause and the available megabytes free remains steady at about 3289MB free. RAM utilization remains steady when the VM is resumed a short time later. RAM is only released back to the Hyper-V host when the VM is powered off.

If you want to free up RAM from a running VM, you need to either turn off the VM or use the Hyper-V "Save" action. Save is similar to the Windows hibernate feature, where both the system state and the RAM working set are written to disk files and then released to the host server. When the VM is started, it will read these files back into memory and restore the VM to its previous state.

Hyper-V-Worker Event 23012 Explained

2009-10-23T10:07:00.000-07:00

If you load a Windows Server 2008 R2 virtual machine on a Windows Server 2008 Hyper-V host server, you will get an error on the host server similar to the following:

Log Name: Microsoft-Windows-Hyper-V-Worker-Admin

Source: Microsoft-Windows-Hyper-V-Worker
Date: 10/23/2009 7:56:48 AM
Event ID: 23012
Task Category: None
Level: Error
Keywords:
User: NETWORK SERVICE
Computer: mailgate.theguillets.com

Description:
Device 'VMBus' in 'EX1 ENT x64' cannot load because it is incompatible with virtualization stack. Server version 13 Client version 65537 (Virtual machine 98EEEED7-A97D-48CF-87F5-E1E8F698D169).

This happens because the Windows Server 2008 R2 Hyper-V Integration Components are not compatible with the Hyper-V v1 release components.

Incompatible does not mean they won't work - because they do. It's just that the R2 version includes enhancements and changes that are beyond the capabilities of Hyper-V v1.

If you want to run an R2 build in a VM on Hyper-V v1 and you don't want to see this error, use a Legacy NIC for the R2 VM.

The Integration Components are already present in Windows Server 2008 and Windows Server 2008 R2. You do not need to install them on these VMs. You can only upgrade the Integration Components, not downgrade them.

Exchange Server 2010 RTM Upgrade and Installation - Phase 2

2009-10-22T21:54:00.000-07:00

These are my notes for phase 2 of my migration from Exchange 2007 SP2 to Exchange 2010 RTM. My notes for phase 1, where I introduced the first Exchange 2010 Hub/CAS/Mailbox server into my existing Exchange 2007 environment, can be read here.

Now in phase 2, I needed to configure the new 2010 server, test mailflow, move the mailboxes, and configure ActiveSync.

I decided to create a third phase, where I will decommission the Exchange 2007 Hub/CAS/Mailbox server, migrate the Windows Server 2008 SP2 Hyper-V host server to Windows Server 2008 R2, and install the Exchange 2010 Edge Transport role on it.

I configured the logging for each server and resubscribed my Edge Transport server. If you don't do this, you'll get the following warning in the Application event log of the 2010 Hub Transport server:

Log Name: Application

Source: MSExchange EdgeSync
Date: 10/22/2009 3:07:25 PM
Event ID: 1032
Task Category: Topology
Level: Warning
Keywords: Classic
User: N/A
Computer: ex1.expta.com

Description:
Microsoft Exchange EdgeSync can't find the replication credential on EX1.expta.com to synchronize with Edge server mailgate.expta.com. This may happen if EX1.expta.com joined the current Active Directory site after subscription for edge.expta.com was established. To have this Hub Transport server participate in EdgeSync, re-subscribe mailgate.expta.com to the current Active Directory site.

There's no need to remove the old subscription. Just create a new subscription file using the New-EdgeSubscription cmdlet on the Edge Transport server and import it using the New Edge Subscription action in EMC on the 2010 Hub Transport server, as usual. It will update the existing Edge subscription for the new 2010 server.

Next, I reconfigured port forwarding for my Client SMTP Send Connector (TCP port 587) to be directed to the new 2010 server. I tested this using my iPhone, which is connected to my home email using IMAP4 and SMTP. In this configuration, the iPhone gets email from the Exchange 2007 server, but sends email through the Exchange 2010 server. Both incoming and outgoing emails tested fine.

Now I needed to move the mailboxes to the new 2010 server. This is accomplished using the Exchange 2010 Management Console to perform Local Move Requests to the database on the 2010 server. Once the move is completed, I cleared the Move Request in the console to complete the move.

Now it was time to move IMAP services to the new 2010 server. As in previous versions of Exchange, the Microsoft Exchange IMAP4 and Microsoft Exchange POP3 services are set to manual and stopped, by default. I changed the Microsoft Exchange IMAP4 service to automatic and started it. Then I reconfigured port forwarding for IMAP4 (TCP port 143) and IMAP4/TLS (TCP port 993) to be directed to the new server. I sync'd the iPhone using secure IMAP and it worked fine.

Note: I use self-signed certificates for Exchange 2007 and 2010. The iPhone will give a warning saying that the certificate may not be trusted. When you continue anyway, the certificate is automatically installed on the iPhone and you won't be prompted again. Cool!

Next, I used the Microsoft Exchange ActiveSync Connectivity Tests in the Microsoft Exchange Remote Connectivity Analyzer to test that ActiveSync is working properly. This tool allows you to remotely test several aspects of you Exchange infrastructure, including Outlook and ActiveSync AutoDiscover records, ActiveSync functionality, Outlook Anywhere, inbound / outbound SMTP email, and more from a Microsoft-hosted website. Very. Very. Cool. The Exchange team just recently updated the ExRCA to work with Exchange 2010.

Here, I ran into an unexpected problem. The ActiveSync tests were failing in ExRCA with the error, "Exchange ActiveSync returned an HTTP 500 response", as shown below.

Unfortunately, the "Tell me more about this issue and how to resolve it" link refers to a less than helpful article for Exchange 2003. I checked the event logs and found the following error in the Application event log:

Log Name: Application

Source: MSExchange ActiveSync
Date: 10/22/2009 9:18:03 PM
Event ID: 1053
Task Category: Configuration
Level: Error
Keywords: Classic
User: N/A
Computer: ex1.expta.com

Description:
Exchange ActiveSync doesn't have sufficient permissions to create the "CN=Keith Johnson,CN=Users,DC=expta,DC=com" container under Active Directory user "Active Directory operation failed on dc1.expta.com. This error is not retriable. Additional information: Access is denied.

Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
".
Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type "msExchangeActiveSyncDevices" and doesn't have any deny permissions that block such operations.

After a bit of research, I discovered that this happens when a user is a member of a Windows built-in group. In my case, the user was a member of Domain Admins. As you probably know, it's best practice to only use admin accounts for administrative functions and to not use them for regular user functions, such as ActiveSync.

To fix the problem, you must remove the user from the built-in group and reconfigure the user's security to apply inheritance (in ADUC, select the Security tab, Advanced, and check Include inheritable permissions from this object's parent). If you don't remove the user from the built-in group, Windows will deselect inheritance.

Once I did all this and retested the ActiveSync functionality using ExRCA, I was ready to configure ActiveSync for my most important user - my wife with her iPhone. It worked like a charm.

There's just a little bit of cleanup to do now. I need to move the Offline Address Book to the new 2010 server and then I can move on to phase 3, where I will decommission the Exchange 2007 server and upgrade the Hyper-V host and Edge Transport server.

Exchange Server 2010 RTM Upgrade and Installation Notes

2009-10-19T11:50:00.000-07:00

I installed Exchange 2010 RTM into my Exchange 2007 SP2 environment this weekend. This article explains the upgrade process, steps, issues, and resolution for those issues.

My environment consists of a single Windows Server 2008 SP2 Hyper-V host server, running the Exchange 2007 SP2 Edge Transport role. There are two VMs -- one Windows Server 2008 R2 DC/GC and one Exchange 2007 SP2 Hub/CAS/Mailbox server running on Windows Server 2008 SP2.

My upgrade will be in two stages, as shown above. Stage one is to remove the Exchange 2010 RC1 beta, introduce Exchange Server 2010 RTM into my existing Exchange 2007 environment, and to migrate all the mailboxes to it. Stage two is to upgrade my host server from Windows Server 2008 to Windows Server 2008 R2 and decommission the Exchange 2007 infrastructure.

Prior to stage one, I've already replaced my existing Windows 2008 SP2 DC/GC with a new Windows 2008 R2 DC/GC and installed Exchange Server 2007 SP2. Exchange 2007 SP2 extends the Active Directory schema to include all the new Exchange 2010 attributes and allows for interoperability between the two versions.

Removing the Exchange 2010 RC1 Beta

Before I began to install Exchange Server 2010 RTM, I wanted to completely remove Exchange 2010 RC1 (build 639.11) from my environment. As with any other version of Exchange, you need to move/remove all mailboxes from the E2010 RC1 server first.

The only mailboxes I had on Exchange 2010 RC1 were test accounts that I used when writing for the book, "Exchange 2010 Unleashed", so I simply deleted them with the following commands in the Exchange 2010 Management Shell (EMS):

[PS] C:\>Get-MailboxDatabase

Name Server Recovery ReplicationType
---- ------ -------- ---------------
Mailbox Database 0767927725 EX1 False None

[PS] C:\>Get-Mailbox -Database 'Mailbox Database 0767927725' | Remove-Mailbox

This will delete all the regular mailboxes in the specified database. Exchange 2010 also uses hidden arbitration mailboxes, which must be deleted before the mailbox server can be decommissioned. Chris Lehr wrote a great article explaining arbitration mailboxes, which I highly recommend reading. If you don't delete the arbitration mailboxes you will get the following error when you try to uninstall the Exchange 2010 mailbox role:

Error:

Uninstall cannot continue. Database 'Mailbox Database 0767927725': This mailbox database contains one or more mailboxes or arbitration mailboxes. To get a list of all mailboxes in this database, run the command Get-Mailbox -Database . To get a list of all arbitration mailboxes in this database, run the command Get-Mailbox -Database -Arbitration. Before you can remove this mailbox database, you must disable, move, or remove user mailboxes and move arbitration mailboxes.

Run the following command in EMS to delete the arbitration mailboxes:
[PS] C:\Get-Mailbox -Arbitration | Remove-Mailbox -Arbitration -RemoveLastArbitrationMailboxAllowed
Now you can uninstall all the Exchange 2010 RC1 roles and management tools using Control Panel > Programs and Features. This will also uninstall the Microsoft Full Text Indexing Engine for Exchange, also listed in Programs and Features. Once the uninstallation completes, restart the server.

Installing Exchange 2010 RTM
Installing Exchange 2010 RTM is very straight-forward and has very few prerequisites in Windows Server 2008 R2, since it already includes Powershell V2 and WSMan. Windows Server 2008 will require ManagementPlatformx64.msi to install these components.

Here are the steps I used for installation of Exchange 2010 RTM:

Extract Exchange2010-RC1-x64_639-21.exe to a destination folder and run Setup.exe
Select Step 3. Choose Exchange Language Option and Install only languages from the DVD

Select Step 4. Install Microsoft Exchange. The Exchange 2010 binaries will copy to a temporary folder for installation.
Click Next at the Introduction screen
Accept the license agreement and click Next
Enable automatic error reporting and click Next
Select Custom Exchange Server Installation and click Next

Select the Mailbox Role, Client Access Role, and Hub Transport Role. The Exchange 2010 Management Tools are installed automatically. Click Next.

Check The Client Access server role will be Internet-facing. Enter the FQDN for the CAS (i.e., webmail.companyabc.com) and click Next.
Select the Customer Experience Improvement Program choice and click Next. The Exchange Readiness Checks will run.
The Readiness Checks said that the Hub Transport and Mailbox roles require the 2007 Office System Converter: Microsoft Filter Pack (http://go.microsoft.com/fwlink/?LinkId=123380)
Download and install FilterPackx64.exe. Click Back and Next to re-run the Exchange Readiness Checks.
Click Install to install Exchange 2010 RTM. The installation ran without error in 9 minutes; 24 seconds on my Hyper-V VM.

Clear the Finalize installation in the Exchange Management Console checkbox and click Finish
Click Step 5: Get critical updates for Microsoft Exchange. Windows Update will run. If prompted, install and run the ActiveX component to install Microsoft Update for other products.
Click Check for new updates and install any needed updates. Restart if prompted.
Click Close in the Exchange 2010 setup program
Launch the Exchange Management Console and verify the Exchange 2010 version is build 639.21.

Restart the Exchange 2010 server if it was not restarted for the updates, just to ensure that all the services come up OK.
Create a test mailbox on the new server and test mailflow

This is where I'm at right now. I still need to move my mailboxes from the Exchange 2007 mailbox server to Exchange 2010 before moving on to phase 2. I'll post again when that's done.

Users... Ugh

2009-10-19T08:21:00.000-07:00

Quote of the day:

"And don't even get me started on the kind of trash that average users install on their machines when they have local-admin rights. It's amazing how the most unsophisticated user, incapable of so much as a password reset without help-desk support, can find a way to install complex multi-tiered client-server front-end applications if the reward involves shopping or sports." -- Bill Boswell, TechNet Magazine

Exchange 2010 Certified!

2009-10-16T09:16:00.000-07:00

This morning I received the following email from Microsoft:

Congratulations on earning your Microsoft Exchange Server 2010, Configuration certification! We hope you enjoy the benefits of your certification and of membership in the Microsoft Certified Professional community.

Nice way to start the day!

How to Convert Local and Global Groups to Universal Groups

2009-10-15T16:16:00.000-07:00

As you may know, Exchange Server 2007 and Exchange Server 2010 force you to create all new distribution groups as universal distribution groups.

The reason for this is that Exchange 2007/2010 requires a local Global Catalog (GC) server in the Exchange site to query for group expansion. A GC can expand domain local, global, and universal groups. However, domain local groups (and sometimes global groups) can only be expanded within the domain local scope. If the GC is a member of the companyabc.com domain, it will be unable to expand a domain local group in the sales.companyabc.com subdomain.

Universal groups can be used anywhere in the same Windows forest. A GC is able expand universal groups in any domain or subdomain in that forest, as long as the domain functional level (DFL) and forest functional level (FFL) are at least Windows Server 2003 Interim Level.

Obviously, the issue with group expansion only occurs in multi-domain "enterprise" environments, but Exchange 2007/2010 doesn't care. Distribution groups and mail-enabled security groups must still be universal groups, even in a single domain environment.
If you're moving from Exchange 2000/2003 to Exchange 2007 or Exchange 2010, you're going to want to convert all your domain local and global distribution and mail-enabled security groups to universal groups so they can be managed using the Exchange management tools.

You can change group types and group scope using Active Directory Users and Computers (ADUC), but you can only do one group at a time. When I first started writing this article I was convinced that Powershell was the best way to do this. But due to limitations in the way that Powershell accesses Active Directory, my scripts were getting quite large and complicated, even when using third party Powershell extensions like Quest's free ActiveRoles Management Shell for Active Directory. I started to look for other ways to perform bulk changes of distribution and security groups.

The most efficient way I found is to use the internal Windows dsquery and dsmod tools. These handy and oft-forgotten tools are installed with the operating system in Windows 2000 and later.

The following command will produce a list of all the groups in the domain and their scope (domain local, global, or universal) and whether the group is a security group. The output is redirected to the Groups.txt file:

This command can take a while to run if the domain contains a large number of groups. It took about a minute to process over 6,100 groups.

dsquery group -limit 0 | dsget group -samid -scope -secgrp > Groups.txt

The command to convert all domain local and global groups (both distribution and security groups) is:

dsquery group -limit 0 | dsmod group -c -q -scope u

The first part of this command uses dsquery to query AD for all groups and then pipes the collection to dsmod to convert each group to a universal group. The -c switch tells dsmod to output any errors and continue. The -q switch tells dsmod to run in quiet mode (suppress successful changes).

Note: Some groups cannot be converted to Universal groups. All of the Windows built-on groups are global and cannot be converted to a different group scope.

Also know that a global group cannot have a universal group as a member. When you see this error, it means that the group is a member of another group that cannot be converted to a universal group (for example, the built-in Account Operators group. Sometimes, this can be like chasing a rat down a hole. The groups may be so deeply nested that it's hard to find the group that is preventing the conversion.

Sometimes it helps to run the conversion command again. For example, dsmod may be unable to convert Group-A to a universal group because it contains the domain local group, Group-B. Later in the process, Group-B is converted from a local group to a universal group. If you run the conversion again, Group-A can now be converted.

Note: Exchange 2007 and Exchange 2010 will automatically convert universal distribution groups to universal security groups if the distribution group is used to apply security settings for a MAPI or Public Folder. My next article will cover this in more detail.

Exchange 2010 - Stick a Fork in it

2009-10-08T14:51:00.000-07:00

It's done! The Microsoft Exchange Team reported today that Exchange 2010 is code complete and on its way to general availability.

I think this is the best version of Exchange I've ever worked with. Finally, Exchange Server is truly enterprise ready with true high availability built in, not just as an afterthought.

Exchange 2010 is scheduled to RTM in November along with the launch of TechEd Europe 2009.

I'm proud to have been a co-writer for the upcoming book, "Exchange 2010 Unleashed," by Sams Publishing. I've been working with it through several alpha and beta builds and have been consistently impressed with the build quality and the direction that Microsoft is taking with this product.

Joining the Dark Side

2009-10-05T16:41:00.000-07:00

So, I finally joined the dark side by getting an Apple iPhone 3GS and.... I absolutely love it. It's nothing short of awesome.

Now that the iPhone support most of the features of ActiveSync for Exchange 2007/2010, I can say it's almost enterprise ready. I say "almost" because it still requires iTunes and it doesn't support all the ActiveSync policy features.

Even so, for me, it's a truly fabulous device that I can use as my phone, email device, music player and more. Oh, so much more. I love all the apps!

And best of all, it just plain works. No more tinkering in the Windows Mobile registry, trying new ROMS, etc. just to try to get it to work the way I want. The iPhone works -- right out of the box.

I highly recommend it.

Sizing Recommendations for Exchange 2010

2009-09-28T14:03:00.000-07:00

There are some changes in architecture in Exchange 2010. All clients, even Outlook, connect via the Client Access Servers (CAS). There are some changes in recommendations around the ratio of resource for CAS/Hub and the mailbox servers.

Microsoft provides detailed guidelines on this Technet page and this one.

The basic guidelines for server role ratios are as follows. They're based on the number of mailbox server cores.

Hub Transport Server — 7:1 (no antivirus on Hub) or 5:1 (antivirus on hub). 1GB of memory for each core.
Client Access Server (CAS) — 4:3 (note this is much higher than with previous Exchange installations). 2GB of memory for each core.
Domain Controller — 1:4 (32-bit Domain Controller (DC)) or 1:8 (64-bit DC, and the DC has enough memory to cache the entire NTDS.DIT file).
Edge Transport Server — Based on peak connections and messages per second and average message size. 1GB of memory for each core.

Each mailbox server should have 4GB of memory plus 2-10MB per mailbox, based on if the mailbox is in light, average, or heavy use.

Thanks to John Savill for the info.

Worst. AT&T Experience. Ever.

2009-09-10T08:54:00.000-07:00

The EXPTA {blog} is back online! Sorry about the prolonged outage, folks.

This blog is hosted on my own server, which is connected to the Internet using a DSL line from AT&T. I choose to do this instead of hosting it on blogspot because it gives me a lot more flexibility.

I finally decided to cancel my local phone service, since we only use our cell phones anyway, and why pay $25 a month to let cold-callers interrupt our dinner. Trouble is, a provisioned DSL line is normally tied to the landline phone number. To get DSL on its own, it needs to be converted to what AT&T calls a "dry loop". This can be done very quickly at the central office (CO), and then the phone line can be disconnected. When done correctly, the outage is very brief and the DSL customer (me) retains his user accounts, email addresses, and settings. But, when it's done wrong....

Problem #1: Human nature. When making a change request such as this (disconnect local phone service), the AT&T rep taking the call is a salesperson. Salespeople don't make money disconnecting service. Salesperson: "How can I make a buck off this? Ahh, I'll cancel BOTH the local phone service and DSL, and then put in a NEW order for DSL. Cha-ching!" Oh, and don't bother telling the customer (me) that you're going to do this.

Problem #2: Phone mail hell. The work will be performed sometime between 8am-8pm. My DSL was turned off promptly at 8am (of course), but my phone still worked. Several calls throughout the day resulted in transfers to at least three different departments. Apparently none of them work for the same company. "Be patient, sir, your order will be completed by 8pm."

Problem #3: We're closed. At 8pm sharp, my phone service stops, but I still don't have DSL. I called the "broadband customer care" department and find that all the techs have gone home for the day. A supervisor says he'll put me "first on the list tomorrow morning at 8am and we'll call your cell". Guess what?

Problem #4: Wires crossed. Many phone calls (all by me) and a service tech visit to the house (how could it possibly be a problem with my house wiring when it was working before they started screwing around?) results in a trip to the central office. "Oops, we connected the wrong wires."

So, 34 hours later I finally have my DSL service back, albeit with a new account and no access to my old email accounts. Next stop, a call to the Customer Retention department for a bill credit. Grrrrr!

Getting Information About User's Exchange Mailbox Using VBScript and PowerShell

2009-09-04T17:40:00.000-07:00

Here are two short scripts, one in VBScript and the other in PowerShell that search Active Directory and display a user's Exchange server, storage group, and mailbox store. They work on against any version of Exchange 20xx.

First, the VBScript:

'Mailbox.vbs, v1.00

'This script will display a user's current mailbox server and storage group

Set theArgs = WScript.Arguments
If theArgs.Count > 0 Then strSearch = theArgs.Item(0)
If strSearch = "" Then
    strSearch = InputBox("Please enter the user ID to look up.", "Mailbox Search")
    If strSearch = "" Then WScript.Quit
End If

Set con = CreateObject("ADODB.Connection")
con.Provider = "ADsDSOObject"
con.Open "DS Query"
Set command = CreateObject("ADODB.Command")
Set command.ActiveConnection = con
Command.Properties("searchscope") = 2

command.CommandText = "SELECT AdsPath,homeMDB,name FROM 'LDAP://DC=domain,DC=com' WHERE sAMAccountName = '" & strSearch & "' AND objectclass='User'"

Set rs = Command.Execute

If NOT rs.EOF Then
    mailbox = rs.Fields(1).Value
    mailbox = Left(mailbox, Instr(mailbox, "CN=InformationStore") - 2)
    msg = "User: " & rs.Fields(0) & vbCRLF & "Mailbox: " & mailbox
    MsgBox msg, vbInformation, "Mailbox Search"
Else
    MsgBox "User '" & strSearch & "' not found!", vbCritical, "Mailbox Search"
End If

And here's the same script in PowerShell:

$sam = Read-Host "Enter the user logon name"

$searcher=New-Object DirectoryServices.DirectorySearcher
$searcher.Filter="(&(objectcategory=person)(objectclass=user)(samaccountname="+$sam+"))"
$result=$searcher.FindOne()
if ($result -eq $null)
{
    Write-Host "Logon name not found"
}
else
{
    $a = [string] $result.properties.homemdb
    $b = $a.split(",")
    Write-Host "Exchange Mailbox Server: " $b[3]
    Write-Host "Storage Group: " $b[1]
    Write-Host "Mailbox Database: " $b[0]
}
Write-Host

Both scripts will take an argument (the user's logon name), and will prompt for it if it was not supplied in the command line.

Convert Your Windows 7 ISO to a Universal ISO Disk

2009-08-31T11:10:00.000-07:00

When you download Windows 7 ISOs from MSDN or TechNet, you'll notice that there are several versions of the same disk. These downloads include the Home Premium, Professional, and Ultimate editions.

An ISO-9660 image file is an exact representation of a CD or DVD, including the content and the logical format. The Windows 7 binaries for each edition are identical, it's the product key that unlocks the various features that make each edition what it is.

There is a small file called ei.cfg in the \sources folder of each ISO that "locks" them to each edition. If this file is deleted, it unlocks the ISO and allows you to select to edition of the Windows 7 operating system to install, as shown below:

As you can see, this not only allows you to install Home Premium, Professional, or Ultimate editions, it also allows you to install Starter or Home Basic editions. Starter and Home Basic editions are less featured and are designed for emerging markets and low powered netbooks and laptops.

You can edit the ISO to remove the ei.cfg file using any ISO editor, such as PowerISO or UltraISO. Keep in mind that you will have to rebuild (save) the new ISO, which can take some time and disk space.

An even better way to do this is by using a cool little utility called eicfg_remover from code.kliu.org. The utility disables the ei.cfg file by toggling the deletion bit in the UDF table in the ISO to treat it like it no longer exists. This eliminates the need to rebuild the ISO and makes it possible to reverse the patch, restoring it to its original state. Just run eicfg_remover again to do so.

By creating a "universal" Windows 7 disk, you'll save disk space and increase the ISO's versatility.

How to Find a MAC Address

2009-08-28T06:53:00.000-07:00

Most of us are familiar with using the IPCONFIG /ALL command to display the full IP configuration, including the MAC address of each network adapter. The trouble with using this command to get the MAC address is that it displays too much information, especially if your computer has multiple NICs. Another problem is that it can only be run on the local machine - you cannot use it to get the MAC address of a remote computer or server.

That's where a little known utility, GETMAC, comes in. GETMAC has been included in every Windows build since at least Windows XP, up through Windows 7 and Windows Server 2008 R2.

The command:

GETMAC /V

will display the name and MAC (Physical Address) each local network adapter.

You can get the same information about a remote computer using the command:

GETMAC /S [ComputerName] /V

Note that you must have administrator rights on the remote machine.

How to Create Custom Error Notifications for IP Block List Providers in Exchange 2007

2009-08-25T14:10:00.000-07:00

This doesn't seem to be documented anywhere in Microsoft TechNet, so I figured I'd write up a post about it.

IP Block List Providers in Exchange 2007 are a means to reduce spam from entering your organization. They are configured on the Edge Transport servers, which is detailed in TechNet here. This article explains how to use variables to create a custom error message when an email is rejected by an IP Block List filter.

In Exchange 2003, you can pass parameters to the custom error message using the %0, %1 and %2 variables.

%0 = IP address of the sending mail server
%1 = Rule name of the connection filter (Provider name)
%2 = The RBL provider (Lookup domain)

In Exchange 2007 the variables are the same, but the way you call the variables has changed.

{0} = IP address of the sending mail server
{1} = Rule name of the connection filter (Provider name)
{2} = The RBL provider (Lookup domain)

Using these variables we can craft more helpful error messages, in the event that a real person (not a spammer) is blocked by your block list (aka, RBL) provider.

In the custom error message example above, the following error message would be returned from blocked server 127.0.0.1:

Host 127.0.0.1 was blocked by Trend Micro Email Reputation Services (ERS). Please see http://www.mail-abuse.com/cgi-bin/lookup/cgi-bin?ip_address=127.0.0.1

Name that Port, Powershell Style!

2009-08-21T09:49:00.000-07:00

In a previous post, I presented a VBScript that displays the service assigned to common port numbers. You can also enter a search string to find any ports whose service (protocol) contain the search string.

Richard Siddaway suggested that the script should be written in Powershell instead, so here it is: Get-Port.ps1

Usage:

Get-Port.ps1 portnumber
This command gets the specified port number and displays the associated service

Get-Port.ps1 searchstring
This command displays all ports and services that match the search string. Searchstring is case insensitive.

Name that Port!

2009-08-20T08:40:00.000-07:00

I wrote a simple VBScript that helps you identify TCP/UDP ports and their well known services.

Download port.vbs and place it anywhere in your system path.

To use it, enter port [portnumber] (i.e., port 389) and the script will display the well known service associated with the port, as shown above.

Alternatively, you can enter port [searchstring] and the script will show all ports that contain that search string. For example, port ldap will show all the ports with ldap in the service name.

The script works best from the command line when WScript is set to be your default script handler. Simply enter wscript from the command line to do this. Otherwise, you'll need to type cscript port [search] from the command line.

Update! See this post for the same script in Powershell.

RAM Upgrade

2009-08-19T19:57:00.001-07:00

I just doubled the RAM on my Hyper-V server to 16GB. This is the server that hosts this blog, as well as my other domains and Exchange 2007. Much faster!

Now I have more room to add another Windows Server 2008 R2 test domain and Exchange 2010. Good thing, too, since I just got an invitation email from Microsoft to take the beta exam 71-662: TS: Microsoft Exchange Server 2010, Configuring. I'll probably be taking that in September.

Windows 7 Feature Matrix

2009-08-11T08:13:00.001-07:00

Windows 7 is available in 6 different SKUs, but for the most part it boils down to three major editions: Windows 7 Home Premium, Windows 7 Professional, and Window 7 Ultimate / Enterprise.

The Ultimate and Enterprise editions both have the same features, the difference is how Windows 7 is purchased. Ultimate is for the retail (individual user) channel and Enterprise is for volume licensing customers. Enterprise customers with Software Assurance also benefit from the features in the Microsoft Desktop Optimization Pack (MDOP).

Each edition is available for both x86 (32-bit) and x64 (64-bit) platforms.

The following table lists the new features in Windows 7 for each edition (SKU).

Choosing the correct version of Windows 7 is made easier when you look at the features available in each version. Most small and medium-sized customers will choose Windows 7 Professional.