Exchange Server 2007 / 2003 (tips and tricks) sprinkled with SMS and AD stuff...

I’ve been getting this question a lot! “What tasks CANNOT be performed from the Exchange Management Console?”

The following is the answer to this question. I’ve done a “best effort” to compile a complete list of these tasks. Feel free to comment here if you feel I should add information to this post or if there is incorrect information.

Tasks that MUST be performed from the Exchange Management Shell

Mailbox, Recipient and Public Folder Settings  

·         Get a list of all mailboxes, organized by size and number of items – Get-MailboxStatistics

·         Perform bulk management of multiple attributes for mailbox recipients – Get-mailbox | Set-Mailbox

·         Bypass antispam filtering for a specific recipient(s) Set-Mailbox -AntispamBypassEnabled $true

·         Get information about public folder sizes – Get-PublicFolderStatisics

·         Upgrade address lists and email address policies from LDAP syntax (after a migration from 2003) to OPATH syntax – Set-EmailAddressList

·         Give permission to a user’s mailbox (to another user) – Add-MailboxPermission

·         Give permission to an entire database, to a user – Add-ADPermission

·         All Public Folder management, for example:

o   Create Public Folders (Can be done from Outlook)

o   Mail Enable Public Folders

o   Enable Public Folder replication

o   Suspend/Resume Public Folder replication

o   Modify Public Folder Replication

o   Set/Modify Public Folder Quota

o   Modify Public Folder Referrals

·         Extract specific content from a mailbox and copy it to an alternate location – Export-Mailbox

·         Configure a resource mailbox to automatically accept all meeting requests – Set-MailboxCalendarSettings

·         Create (and modify) a new Global Address List – New-GlobalAddressList

Transport Settings

·         Set a maximum message size for incoming or outgoing messages (org) – Set-TransportConfig

·         Disable Xexch50 for outbound ESMTP connections – Set-TransportConfig

·         Set a maximum message size for incoming or outgoing messages (conn) – Set-ReceiveConnector

·         Add the Antispam tab to the Exchange Management Console – Set-TransportServer –AntispamAgentsEnabled $true

·         Set advanced SMTP connection settings such as Tarpit, connection timeouts, inactivity timeouts etc... – Set-ReceiveConnector

·         Install or uninstall antispam agents on a Hub Transport server – (un)install-AntispamAgents

·         Modify the properties of the Content Filtering agent to filter messages originating from authenticated servers INSIDE the organization – Set-ContentFilterConfig (useful if another server relays the message but does not perform filtering)

·         Add an exception to the Content Filtering agent to NOT perform any filtering for a specified SMTP Domain or Sender – Set-ContentFilterConfig –BypassSenderDomains / BypassSenders

·         Update the safe senders aggregation list -  Update-SafeList

·         Modify properties for the transport dumpster (Enable/disable – Max Size) – Set-TransportServer

·         Override AD Site link costs with Exchange Specific costs – Set-ADSiteLink

·         Design Exchange Hub Sites for message routing – Set-ADSite

·         Force a manual start to the Edge Synchronization between the HT and the ET servers – Start-EdgeSynchronization

Client Access Settings

·         Set connection time-outs for POP3/IMAP4 servers – Set-IMAPSettings / Set-POPSettings

  Following settings should be used with a Get-CASMailbox and piped to the Set-CASMailbox to be applied globally.

·         Prevent previous versions of Outlook from connecting to Exchange – Set-CASMailbox –MAPIBlockOutlookVersions

·         Enable/disable POP3 or IMAP4 for a user – Set-CASMailbox

·         Disable selected features of OWA (Calendaring, Change Password button etc...) – Set-CASMailbox

Other

·         Reseed a LCR or CCR (Maybe SCR ?) database copy – Update-StorageGroupCopy

·         Specify a message class for Managed Content Settings (For message classes NOT available in the EMC, such as IPM.XYZ) -  New-ManagedContentSettings

·         Create a customized quota message to mailbox recipients – New-SystemMessage

·         Create a customized Delivery Status Notification message – New-SystemMessage

·         Enable/disable, modify the properties of Message Tracking – Set-MailboxServer

·         Specify the number of ‘unreplicated logs’ that a CCR node will allow, and still mount a database a failover – Set-MailboxServer –AutoDatabaseMountDial

·         Allow a database to be overwritten by a restore operation – Set-MailboxDatabase –AllowFileRestore

·         Configure domain controllers that should NOT be used by your Exchange server – Set-ExchangeServer –StaticExcludedDomainControllers

       Modify the email address visible by external recipients, for internal users – New-AddressRewriteEntry

• To install antispam agents on a Hub Transport server: From EMS, Install-AntiSpamAgents.PS1
• To enable the Antispam Tab in the Exchange Management Console: Set-TransportServer -AntiSpamAgentsEnabled $True (Automatically run as part of the script mentioned above)
• To view the list of INSTALLED Transport Agents: Get-TransportAgent (Note: If you disable an agent from the EMC, it will still show under this task as ENABLED)
• To view the status of a specific Transport Agent, for example Content Filtering agent: Get-ContentFilterConfig | FL (Note: If you disable the agent from the EMC, it will show under this task as DISABLED)
• To disable a specific Transport Agent, for example Content Filtering agent: Set-ContentFilterConfig -Enabled $False

Confused yet?

Basically, when you disable an agent from the list of agents in the EMC, and run a Get-TransportAgent, it shows as enabled. That is because you are disabling the filtering feature of the agent from the EMC and not the actual agent running on the messages. The whole thing is really not documented anywhere and may lead to confusion from some admins. Even more confusing, if you run the Set-TransportServer -Antispamagentsenabled $True cmd, the tab will show up in the EMC, but the agents will actually NOT be installed.

1. Ensure that ActiveSync is enabled both at the organization leve (global settings) and at the use level.
2. Ensure that a valid certificate is imported in for the Server ActiveSync Virtual Directory in IIS.
3. If you are using a certificate from an internal Windows CA, ensure that the PDA either has imported the CA's root certificate or is not verifying the validity of certificates (disablecertchk.exe).
4. Ensure that the certificate is issued to the Exchange server's name (you will run into the same issue with RPC over HTTP, certificate name must map to the FQDN of the Exchange server)
5. Ensure that the ServerActiveSync Virtual Directory is NOT set to Require SSL.
6. Ensure that the web site hosting the Exchange serverdirectories is NOT using host headers (this one might only be specific to going through an ISA server, not 100% sure if its needed without ISA)
7. Import the Exchange server's certificate into the ISA server and create a new Web Listener in ISA. Associate the new Web Listener to the new access rule for HTTPS.
8. Ensure that the FQDN on the cert can be resolved through external DNS.

Once all of this is done, configure the profile on the PDA to point to the FQDN on the certificate and start syncing!!!

• Beta 1: Q4 2005
• Beta 2: Mid-2006
• RTM: Late 2006 / Early 2007

So which one will it be 2006 or 2007. Let the pool begin... I'm betting on March 2007.

At TechEd last week, I noticed that over half of the attendees carried blackberries. Today, almost all my clients incorporate BES servers into their messaging infrastructures. This means one thing for me, i need to know more about troubleshooting BES servers and their communication with AD and Exchange. So look for more Bberry info in this blog in the future. Here's an issue I just encountered this week.

When a mailbox is moved from one Exchange server to another. the BES server needs to be told. If not, the BBerry device is useless. You need to run a utility called handheldcleanup.exe with an –m parameter to update moved mailboxes. You can run the tool in a verification mode only first to identify moved mailboxes before applying the change. The tool will update the DN name of the mailbox in the BES database. You can find this utility in this directory on the BES server C:\>Program Files\Research In Motion\BlackBerry Enterprise Server\Utility

I recently came into a memory fragmentation issue on a large Exchange server. As most of you already now, large Exchange mailbox servers have little to gain from more than 4GB of physical memory. Manufacturers that ship preinstalled servers with more than 4GB of physical memory often enable the PAE switch in boot.ini to allow access to that additional memory to the operating system. Additionally, some hardware automatically enables Physical Address Extensions (PAE). Exchange Server 2003 is not compatible with the PAE boot.ini switch.

To ensure that PAE is not enabled in your hardware, ensure that you add the /NOPAE switch to your boot.ini file.

UPDATE: SEEMS LIKE THE PAE SWITCH WILL BE SUPPORTED ON EXCHANGE SERVER 2003 SP2. I will update more later about this.

***UPDATE: Alright, that's what happens when you don't check your blog for a couple of months. Like Russ kindly stated, the PAE switch is now supported ***AND RECOMMENDED*** on Exchange Server 2003 running on Windows Server 2003 SP1 (Patch required for Windows Server 2003 pre-sp1).

Since I just uploaded a link to my to the teched blogger site, I figure its about time i update my blog. I've been extremely busy with projects and have not had anytime for this. So I got some questions from students today and I think many will benefit from the answers.

If you want to automate the creation or management of Exchange recipients, you have (at least) for methods you could use:

1. Use the Exchange Task Wizard from ADUC, highlight multiple recipients and select Exchange Tasks or Properties, depending on what you want to do.
2. Use LDIFDE.exe to export the directory, modify the text file (LDF file) and import it back with LDIFDE -i -f filename.
3. Use a VB script. In order to find an appropriate script, search the Microsoft website, they've got tons of sample scripts. If that fails, google it.
4. CSVDE - See next paragraph

CSVDE.exe - This tool can be used to import objects into Active Directory, in the form of a .CSV file. The file can be created by exporting information from another directory or database. CSV is a pretty standard format. The key with CSV files is getting a good "Header" file with the appropriate LDAP attributes you want to add to the objects. If you want to create mailboxes, here are the headers you can add to your csv file, then populate it with the appropriate information.

DN,objectClass,cn,mailNickname,displayName