Exchange Server 2007 / 2003 (tips and tricks) sprinkled with SMS and AD stuff...: Exchange Server 2003

SSL certificate server name is incorrect - Exchange System Manager issue

Thu, 25 Oct 2007 05:01:02 GMT

I came across this issue today, where the Exchange System Manager returns the following error when accessing the Public Folders node:

SSL certificate server name is incorrect

All Internet queries to this problem point to the following Microsoft article: http://support.microsoft.com/kb/324345 The article offes two solutions, one is to match the FQDN of the server in the certificate assigned to the website. This was not a realistic option for us, given that the server was installed with a .PRIV domain name. The second option was to remove the SSL requirement on the EXADMIN virtual directory. This task was easy enough to do, but didn't solve the problem. I found that the solution was actually in Active Directory. When we made the modifications on the EXADMIN virtual directory in IIS manager, the setting did not propagate to Active Directory. So to resolve the issue, browse to the EXADMIN object in ADSIEdit and remove the SSL port value (443) from the MSExchSecureBinding property.

Now, we can manage our Public folders again.

Troubleshooting Exchange Server ActiveSync through an ISA server

Fri, 21 Apr 2006 14:08:33 GMT

I'm spending more time on advanced issues related to Exchange Server 2003 these days. I don't get calls anymore to migrate or install servers, i'm getting requests for RPC over HTTP, multi-node clusters and configuring Server ActiveSync. This makes for much more interesting projets...

So this week I had to configure a new client's Server ActiveSync environment and ensure connectivity through an existing ISA 2004 server. Of course, the current environment wasn't properly configured and I had to stabilize a few things before I could move on... However, when it came to the ActiveSync portion of the work, I ended up forgetting a few details and I made myself a list of gotcha's. Here they are:

Ensure that ActiveSync is enabled both at the organization leve (global settings) and at the use level.
Ensure that a valid certificate is imported in for the Server ActiveSync Virtual Directory in IIS.
If you are using a certificate from an internal Windows CA, ensure that the PDA either has imported the CA's root certificate or is not verifying the validity of certificates (disablecertchk.exe).
Ensure that the certificate is issued to the Exchange server's name (you will run into the same issue with RPC over HTTP, certificate name must map to the FQDN of the Exchange server)
Ensure that the ServerActiveSync Virtual Directory is NOT set to Require SSL.
Ensure that the web site hosting the Exchange serverdirectories is NOT using host headers (this one might only be specific to going through an ISA server, not 100% sure if its needed without ISA)
Import the Exchange server's certificate into the ISA server and create a new Web Listener in ISA. Associate the new Web Listener to the new access rule for HTTPS.
Ensure that the FQDN on the cert can be resolved through external DNS.

Once all of this is done, configure the profile on the PDA to point to the FQDN on the certificate and start syncing!!!

Will it be named Exchange Server 2006 or 2007?

Wed, 16 Nov 2005 04:44:38 GMT

At the IT Forum in Barcelona, Microsoft announced the release schedule for the next version of Exchange, code named Exchange 12. I've blogged about E12 before, including all its exciting new features. More details to come about this very soon...

Exchange 12 release schedule:

Beta 1: Q4 2005
Beta 2: Mid-2006
RTM: Late 2006 / Early 2007

So which one will it be 2006 or 2007. Let the pool begin... I'm betting on March 2007.

Using MONAD to administer Exchange Server 2003

Wed, 17 Aug 2005 06:34:38 GMT

I know, i've been MIA for a while. I've been busier than a japanese tourist at a Canon Outlet, but something real interesting brought me out of hiding.

As many of you know, MONAD is all the buzz these days. Especially, the security benefits of this new technology in being touted around. However, what I only learned a few weeks ago is the administrative benefits that MONAD will provide for Exchange 12. For Exchange administrators that are not comfortable writing or using complex ADSI scripts to perform automated Exchange management, MONAD will provide a simplified syntax for management.

Here are a couple of examples I just came across from the Exchange Team Blog:

To Set the send quota for ALL mail enabled users in a DL to 1MB

Get-DistributionGroup “DL_NAME” | Get-DistributionGroupMember | Set-Mailbox –ProhibitSendQuota 1024

To move all users from one Exchange server to another Exchange server

Get-Mailbox –server SOURCE_SERVER_NAME | move-mailbox –targetDatabase “DESTINATION_SERVER_NAME\DESTINATION_MBXSTORE”

This looks like pretty exciting stuff. More about E12 soon, but before that ,watch out for some SP2 stuff coming up.

How to move an Exchange mailbox with a BlackBerry / BES user

Sat, 18 Jun 2005 03:37:18 GMT

At TechEd last week, I noticed that over half of the attendees carried blackberries. Today, almost all my clients incorporate BES servers into their messaging infrastructures. This means one thing for me, i need to know more about troubleshooting BES servers and their communication with AD and Exchange. So look for more Bberry info in this blog in the future. Here's an issue I just encountered this week.

When a mailbox is moved from one Exchange server to another. the BES server needs to be told. If not, the BBerry device is useless. You need to run a utility called handheldcleanup.exe with an –m parameter to update moved mailboxes. You can run the tool in a verification mode only first to identify moved mailboxes before applying the change. The tool will update the DN name of the mailbox in the BES database. You can find this utility in this directory on the BES server C:\>Program Files\Research In Motion\BlackBerry Enterprise Server\Utility

What is the NOPAE switch?

Sun, 12 Jun 2005 20:02:48 GMT

I recently came into a memory fragmentation issue on a large Exchange server. As most of you already now, large Exchange mailbox servers have little to gain from more than 4GB of physical memory. Manufacturers that ship preinstalled servers with more than 4GB of physical memory often enable the PAE switch in boot.ini to allow access to that additional memory to the operating system. Additionally, some hardware automatically enables Physical Address Extensions (PAE). Exchange Server 2003 is not compatible with the PAE boot.ini switch.

To ensure that PAE is not enabled in your hardware, ensure that you add the /NOPAE switch to your boot.ini file.

UPDATE: SEEMS LIKE THE PAE SWITCH WILL BE SUPPORTED ON EXCHANGE SERVER 2003 SP2. I will update more later about this.

***UPDATE: Alright, that's what happens when you don't check your blog for a couple of months. Like Russ kindly stated, the PAE switch is now supported ***AND RECOMMENDED*** on Exchange Server 2003 running on Windows Server 2003 SP1 (Patch required for Windows Server 2003 pre-sp1).

How to create mailbox-enabled users with CSVDE

Tue, 31 May 2005 04:34:36 GMT

Since I just uploaded a link to my to the teched blogger site, I figure its about time i update my blog. I've been extremely busy with projects and have not had anytime for this. So I got some questions from students today and I think many will benefit from the answers.

If you want to automate the creation or management of Exchange recipients, you have (at least) for methods you could use:

Use the Exchange Task Wizard from ADUC, highlight multiple recipients and select Exchange Tasks or Properties, depending on what you want to do.
Use LDIFDE.exe to export the directory, modify the text file (LDF file) and import it back with LDIFDE -i -f filename.
Use a VB script. In order to find an appropriate script, search the Microsoft website, they've got tons of sample scripts. If that fails, google it.
CSVDE - See next paragraph

CSVDE.exe - This tool can be used to import objects into Active Directory, in the form of a .CSV file. The file can be created by exporting information from another directory or database. CSV is a pretty standard format. The key with CSV files is getting a good "Header" file with the appropriate LDAP attributes you want to add to the objects. If you want to create mailboxes, here are the headers you can add to your csv file, then populate it with the appropriate information.

DN,objectClass,cn,mailNickname,displayName,sAMAccountName,userAccountControl,

msExchHomeServerName,homeMDB

Caution: Make sure the CN value in the DN is identical to the CN value two attributes down the line.

When the file is all nice and ready, import it with CSVDE -i -f filename

See you at TechEd!

Tools not available on an Exchange 2003 Cluster

Thu, 07 Apr 2005 18:34:59 GMT

I've been researching this for a client for an upcoming migration from Exchange 2000 to Exchange 2003. We will be moving from a stand-alone server to a two node A/P Exchange 2003 cluster. I mentioned to the client that some Exchange features are not available on the cluster and that they should be aware of those, but I did not have a comprehensive list. Here's what I came up with, if anyone has any more information, i'm all ears/eyes:

1. Internet Mail Wizard (cannot be run)

2. Intelligent Messaging Filter (IMF)

3. Active Directory Connector (ADC) (Does not impact my client, but worth a mention)

4. Site Replication Service (SRS) (Still no impact for my client)

5. /Disasterrecovery setup switch.

6. Cannot be the first Exchange 2k3 server in the 5.5 site (mostly because of #4)

Can anyone think of something else?

IMPORTANT - Another issue with W2k3SP1 and Exchange 2003

Fri, 01 Apr 2005 16:49:13 GMT

This one is not going to occur after a default installation of Service Pack 1 (W2K3), it will only cause issues to MAPI clients if you decide to lock down the server with the Security Configuration Wizard (SCW).

http://support.microsoft.com/?id=896742

IMPORTANT - Hotfix for Exchange clusters with W2K3SP1

Fri, 01 Apr 2005 03:53:22 GMT

Just a heads up... If you're running Exchange Server 2003 in a clustered configuration, Outlook Web access will generate Internal Error - 500 after an installation of SP1 for Windows Server 2003. This is caused by a security feature in SP1 that blocks certain HTTP calls. Administrators will not experience this problems.

Here is the link to download the patch http://support.microsoft.com/kb/841561

Weird feature of Exchange Server 2003

Fri, 18 Mar 2005 20:44:02 GMT

Last year, a conversation with a client (We implemented their AD and Exchange 2003 - Multi-site)went like this (it always stuck with me, I know it's old news;)):

Client (far from an Exchange specialist): Our Exchange servers got hacked.

Me: No they didn't, I monitor them remotely and everything is fine.

Client: They've been hacked.

Me: No they haven't.

Me: Alright, why do you think you've been "hacked"?

Client: Well I just fired one of my network admins and added his smtp address to my mailbox properties, to recieve mail destined to his address. Now, when I open my OWA, the IE status bar (bottom left) displays http://myexchangeserver/exchange/MYFIREDADMIN (replace MYFIREDADMIN with the mailNickname value for the "fired admin".) I never liked him and now he's hacked into my mailbox and set his name in my IE properties. Our security has been compromised, and I can't bare to look at his name on my desktop. Fix it!

Me: First of all, your security has not been compromised, so lets cool it. I just looked into it, and it seems OWA displays the status bar based on alphabetical order. Your name starts with "X" his name starts with "A". I'll create another mailbox for the fired admin, with a secured account password and have it forward to your mailbox. No worries.

Client: You can do that?

Me: Good bye!

New version of EXPBA released

Thu, 17 Mar 2005 04:54:32 GMT

Well, version 2.0 of our favorite Exchange server tool, Exchange Best Practices Analyser, has just been released. Here are some updates to existing features from the previous version:

Integration with MOM 2005. Exbpa can initiate notifications to MOM administrators about misconfigurations in Exchange
A "Best Practices" category has been added to warn administrators about urgent issues
Performance sampling and analysis
Scheduling capabilities
A DNS collector to verify the existance of necessary records in DNS

Download the new EXBPA V.2 at this location.

Preventing MAPI client connections to Exchange Servers

Tue, 08 Mar 2005 19:51:33 GMT

I was asked a question today that made me dig deep in my memory and try to find a solution that I knew existed, but couldn't find anymore. I was trying to figure out how to prevent certain versions of MAPI clients from connecting to an Exchange server. I remembered it to be a registry modification on the Exchange server, but could not find any reference to it. After turning to one of my trusted Exchange sources (thanks Yan!), I've got the link to the article. Requires a restart of the Information Store, but besides that, pretty easy mod.

What's up with "Exchange 12"

Fri, 04 Mar 2005 04:45:12 GMT

A couple of weeks ago, I blogged about the upcoming release of "Exchange 12" and mentioned some of it's new features, including the breakdown of the continuous rumour of SQL integration. Yesterday, the Exchange Team blogged about some of the new features and inspired me to do a little recap of what we DO know about the next version of this Notes killer ;)

The database engine will not be based on SQL
There will (probably) be some Unified Messaging integration with corporate PBX's. If you're wondering what that would like, check out a (montreal based) company that's been offering it for years.
Much more integration with other MS technologies, maintaining a full collaboration vision(quoting Dave Thompson VP for Exchange). Sharepoint workspace access through OWA, amongst others.
Support for 64-bit platform, both for W2k3 and longhorn.
No more OMA, better ActiveSync.
Database replication mechanism (DT mentioned that SAN's/shared storage would no longer be necessary to configuring clustering in Exchange) Now if this ends really happening, would be a major design change and could bring us closer to the alusive "Continuous availability" Russ was blogging about last week.
More "edge services" adding to what will trickle in along the way. (E2k3SP2 will include support for the much discussed SendID anti-spam feature)
Lots of integration with "Office 12"

Many more improvements I'm sure will be discussed in the months to come, leading up to a probable RTM around late 2006.

Things I'm sick of repeating in my Exchange courses...

Tue, 01 Mar 2005 20:52:57 GMT

There are quite a few misconceptions about Exchange technologies, it seems like the same ones keep on coming back, time after time. Maybe MS should do a better job at clarifying these concepts to their client base. Or maybe I should stop whinning and teach this stuff clearly...

A mail-enabled user is not the equivalent of a custom recipient in Exchange 5.5. A mail-enabled contact is.
Exchange Server 2003 still requires NETBios name resolution. DNS is not enough.
You don't need an SMTP connector to send SMTP mail to the internet.
2 SMTP Virtual Servers will not speed up your outbound or inbound SMTP traffic.
You should not run ESEutil.exe to compact your database every month. Check your application log, it will tell you if you to what extend your database is "fragmented" and whether or not you need to run it.
You do not have to put the /3GB in the boot.ini, if you have 1GB of physical memory. Well maybe you do, but there's a lot more to it.
A mailbox is only created in the database when the user logs on for the first time, or receives his first mail message. NOT WHEN THE SMTP/X400 ADDRESS SHOWS UP ON THE EMAIL ADDRESSES TAB!
The M: drive is not "gone" in Exchange 2003, but merely hidden. You can make it visible again with a little registry key modification.

I'm sure there are many more, but I'm going to leave it at that for now...

Modifying filter for OWA GAL display

Wed, 09 Feb 2005 21:19:04 GMT

I was faced with a question from a student this week, to which I did not know the answer. They wanted to segregate a portion of remote users from displaying the default GAL filter in Outlook Web Access. After a lot of digging, i found this article for Exchange 2000; I tried it on Exchange 2003 and it worked as expected...

The article basically describes the procedure to modify the MsExchQueryBaseDn in ADSIEdit for the user account. The modification will establish the scope of the query to a selected OU. That OU will generate the GAL for the user when querying from OWA.

The not-so-bad Active/Active Configuration

Mon, 07 Feb 2005 03:26:09 GMT

I've been too busy these days to update with anything of interest, so I'll just refer to an interesting blog entry I just read. Russ Kaufmann is one of those guys that I drop a line to when I have an Exchange question. Along with Rod, he's got tons of first hand experience with clustering technologies. To put it simply, I think he's a pretty smart guy...

This blog entry was his take on the whole Active/Active vs Active/Passive configuration of Exchange Server 2003.

New update to IMF

Wed, 02 Feb 2005 22:19:44 GMT

If you're supporting small scale environments and have decided to implement the Intelligent Mail Filter(IMF) to prevent spam, you might notice that the number of spam has increased over the past few weeks. There's a good reason for that, the IMF has not been updated since the day it was released.

Today Microsoft released an update to the IMF charasteristics.

Download it here.

Restore a lost ADC server

Tue, 01 Feb 2005 14:45:55 GMT

As most experienced Exchange engineers know, one of the the trickiest portions of a migration from Exchange 5.5 is the manipulation of the Active Directory Connector. So, in a way, one of the worst things that could happen during a migration is a loss of an ADC server. Of course backing up the ADC server is important, but I just ran into a bit of information that may be interesting during a restore process. Since ADC stores information in AD, it's not surprising to see that to restore an ADC server, you may have to manipulate some information using ADSIedit. As this KB article describes the CA's become orphaned when the old ADC server is removed, and they have to be re-assigned to the new ADC by modifying the msExchHomeSyncService attribute.

I've been lucky enough never to run into this, but I was wondering who else here has run into it...

Where to put the MSDTC resource?

Mon, 24 Jan 2005 20:39:30 GMT

When running an Exchange Server 2003 cluster on Windows Server 2003, you must create a DTC (Distributed Transaction Coordinator) resource. This resource is necessary to support a workflow function that is installed by Exchange. However, after the Exchange installation, unless you actually have a workflow application running, you will never use the DTC resource again. Microsoft's recommendation up to now has been to create a dedicated cluster group for the DTC resource. However, the reality that this would be a waste of resource is finally emerging and according to the Ehlo blog, this recommendation is about to change. MS will soon start to officially recommend including the MSDTC resource in the default cluster group, eventhough this article says you shouldn't...

New version of Exchange announced.

Fri, 21 Jan 2005 20:36:43 GMT

Microsoft just recently announced the release of the next version of Exchange, code named "Exchange 12" or "E12" around 2006/2007. A major point about this release is the fact that it will not be running on an SQL database as was previously speculated. This next version will run on both Longhorn and Windows Server 2003, eventhough Longhorn will not be an OS requirement. My guess is it will be released soon after the next version of Outlook/Office, code named "Office 12". Look for new features in Exchange to leverage the upgrade to Outlook 12.

Can't wait for Beta ;)

More than just clustering...

Tue, 18 Jan 2005 16:36:53 GMT

I was on vacation and really slacked updating this blog, so hopefully this will make up for the past month...

What often makes me laugh the most are SNAD's (Stupid Network Administrator Decisions). Network admins will often spend countless hours getting their SAN up, properly configured with a 4 Node MSCS cluster and loose sight of other, less exciting parts of making your network redundant. Here's a reality check:

Are your DNS servers redundant? How many GC's can you access from each site?
Have you implemented hardware redundancy to eliminate single points of failure? If you haven't, start here
Have you checked your UPS lately?
Is your disaster recovery plan up to the job? Check this out.
Have you implemented NLB for your Front-End Servers?
Patched a server lately? WUS is coming, but SUS is here.

Once all of this has been configured properly, you're ready for your first cluster. When that day finally comes, go check out my buddy Rod's blog, he's "the man" when it comes to clustering...

Solutions Accelerator for Exchange Consolidation and Migration

Tue, 21 Dec 2004 16:51:34 GMT

IMHO, the planning and designing phases of a messaging infrastructure migration are the most crucial in the successfull completion of the project. On some projects, we've been contracted to perform only the design phase, followed by a migration plan. The actual execution of the migration can often be performed by the in-house IT staff, depending on their level of knowledge.

When planning a migration, we spend a great deal of time talking to the client (anyone from the help desk personnel to the CIO) about the current setups, their users, their expectations of Exchange, their underlying network infrastructure and many other factors relevant to the path we will take for migration. The "Solutions Accelerator for Exchange Consolidation and Migration" is the first good document I've seen to help consultants through this process. It's worth taking a look, even if you've already migrated to Exchange Server 2003.

Enjoy!

Have they used the ADC before?

Thu, 16 Dec 2004 18:03:56 GMT

Some issues i run into when consulting on Exchange servers are down right ridiculous.

Some clients are not upfront about what they've done to their exchange environments. One of the examples of this I can think of relates to the ADC (Active Directory Connector).

How do i know if the client has used the ADC before? Well sure, I can dig into AD with ADSIEdit and look for the container in the Configuration partition, but just lets me know the Schema mods were done. How do I actually know they've set up CA's and launched replication?

Open up Admin.exe in raw mode (admin -r) and look for the ADC-Global-Names attribute for mailboxes in your Exchange organization. This means that the mailboxes have been associated with a Security principal in AD. Advice, don't sync up your mailboxes at this point, simply remove the attributes using the instructions in this KB article: http://support.microsoft.com/kb/319474

Good luck!

demistifying the /3GB switch

Wed, 15 Dec 2004 05:13:29 GMT

Want to really understand what that switch is about? This is definitely the most extensive resource for understanding the way your Exchange Server manages it's virtual memory settings. Yeah, and it's from another blog

http://weblogs.asp.net/oldnewthing/archive/2004/08/22/218527.aspx