Showing posts with label Exchange. Show all posts
Showing posts with label Exchange. Show all posts

Thursday, 7 June 2018

Exchange 2013+: Set Up a Receive Connector for MFP/Copier/Device Relay

The following are the two steps required to enable an internal anonymous relay in Exchange 2013/2016/20*.

Step 1: Create the Receive Connector

New-ReceiveConnector –Name MFP-APP-AnonRelay –Usage Custom –Bindings 0.0.0.0:25 –RemoteIPRanges 192.168.25.1-192.168.25.10,192.168.25.225-192.168.25.254 –Comment “Allows anonymous relay” –TransportRole FrontEndTransport –AuthMechanism None –PermissionGroups AnonymousUsers

Variables:

  • -Name: Change this if needed but must match for both steps
  • -RemoteIPRanges: Only put trusted device IP addresses in this section

Once the receive connector is set up it can be managed via EAC.

Step 2: Allow Anonymous Rights

Get-ReceiveConnector “MFP-APP-AnonRelay” | Add-ADPermission -User “NT AUTHORITY\ANONYMOUS LOGON” -ExtendedRights “Ms-Exch-SMTP-Accept-Any-Recipient”

Variable:

  • The Receive Connector name must match the one set in Step 1

Conclusion

Once the above steps are set up there is no need to set a username and password on any device that has an allowed IP.

For obvious reasons one should never put an Internet IP address in this rule! But, that being said, one always denies all SMTP 25/587 inbound traffic to a third party sanitation provider's subnets right (we use ExchangeDefender for our own and our client's needs)?

Also, this setup is for on-premises Exchange.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Web Site
Our Cloud Service

Tuesday, 1 August 2017

Exchange: ERROR: The internal transport certificate cannot be removed... FIX

We recently renewed an Exchange server's trusted certificate.

When we went to remove the old certificate in EAC we received the following error:

error
A special Rpc error occurs on server SERVERNAME: The internal transport certificate cannot be removed because that would cause the Microsoft Exchange Transport service to stop.
To replace the internal transport certificate, create a new certificate. The new certificate will automatically become the internal transport certificate. you can then remove the existing certificate.
Searching turned up a lot of suggestions to just delete the old certificate in the Personal certificates store. Somehow, that did not strike as being the correct methodology since the error makes it clear that the old certificate is still in use.

The proper methodology is to run the following PowerShell in the Exchange Shell to create and bind a new self-issued certificate. Since the certificate is bound to internal services there are no trust issues as indicated by the error message.

New-ExchangeCertificate -IncludeServerFQDN -IncludeServerNetBIOSName -Confirm:$False

The result would be something like this:


Once the command has completed we were able to delete the expired third party certificate in EAC.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Cloud Service
Twitter: @MPECSInc

Wednesday, 7 December 2016

AutoDiscover “Broken” in Outlook 2016

We have a client that has their services spread across a number of different cloud systems.

Recently, users had started “losing” their connection to their hosted Exchange mailbox with Outlook coughing up some really strange errors that were not very helpful.

We ran the gamut trying to figure things out since any calls to the hosted Exchange provider and eventually the company hosting their web site always came back with “There’s a problem with Outlook”.

Indeed.

What we’ve managed to figure out is that Outlook 2016 will _always_ run an AutoDiscover check even if we’re manually setting up the mailbox for _any_ Exchange ActiveSync (EAS) connection. It must be some sort of new “security” feature in Outlook 2016.

What does that mean?

It means that when something changes unbeknownst to us things break. :(

In this case the AutoDiscover setup in Outlook for EAS connections and the web host changing something on their end as things were working for a _long_ time before the recent problems. Or, a recent update to Outlook 2016 changed things on the AutoDiscover side that revealed what was happening on the www hosting side.

Okay, back to the problem at hand. This is the prompt we would get when setting up a new mailbox, or eventually all users started getting who already had mailbox connections:

image

Internet E-mail Name@Domain.com

Enter your user name and password for the following server:

Server: gator3146.hostgator.com

Well, our mailboxes are on a third party and not HostGator. So, on to chatting and eventually phoning them after opening a ticket with the Exchange host and hearing back that the problem was elsewhere.

Unfortunately, HostGator was not very helpful via chat or phone when we initially reached out. Outlook was always the problem they claimed.

So, we set up a test mailbox on the hosted Exchange platform and went to our handy Microsoft tool: Microsoft Remote Connectivity Analyzer.

We selected the Outlook Autodiscover option and ran through the steps setting up the mailbox information, then the CAPTCHA a few times ;-), and received the following results:

image

We now had concrete evidence that HostGator was not honouring the AutoDiscover.domain.com DNS setup we had for this domain which was not on their system.

A question was sent out to a fellow MVP on Exchange and their reply back was “HostGator had a URLReWrite rule in place for IIS/Apache that was grabbing the AutoDiscover polls from Outlook and sending them to their own servers.”

During that time we created the /AutoDiscover folder and put a test file in it. The problem still happened.

Okay, back on the phone with HostGator support. The first call had two “escalations” associated with it unfortunately with no results. A second call was made after seeing the MVP response with a specific request to HostGator: Delete the URLReWrite rule that was set up on this client’s site within the last month.

They could not do it. Nothing. Nada. Zippo. :(

So, for now our workaround was to move the DNS A record for @ (Domain.com) to the same IP as the hosted Exchange service’s AutoDiscover IP to at least get Outlook to fail on the initial domain poll.

Moral of the story?

We’re moving all of our client’s web properties off HostGator to a hosting company that will honour the setup we implement and use the Microsoft Remote Connectivity Analyzer to test things out thoroughly.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Cloud Service

Tuesday, 5 July 2016

Outlook Crashes - Exchange 2013 or Exchange 2016 Backend

We’ve been deploying Office/Outlook 2016 and Exchange 2016 CU1 in our Small Business Solution (SBS) both on-premises and in our Cloud.

Since we’re deploying Exchange with a single common name certificate we are using the _autodiscover._tcp.domain.com method for AutoDiscover.

A lot of our searching turned up “problems” around AutoDiscover but pretty much all of them were red herrings.

It turns out the Microsoft has deprecated the RPC over HTTPS setup in Outlook 2016. What does this mean?

MAPI over HTTPS is the go-to for Outlook communication with Exchange going forward.

Well, guess what?

MAPI over HTTPS is _disabled_ out of the box!

In Exchange PowerShell check on the service’s status:

Get-OrganizationConfig | fl *mapi*

To enable:

Set-OrganizationConfig -MapiHttpEnabled $true

Then, we need to set the virtual directory configuration:

Get-MapiVirtualDirectory -Server EXCHANGESERVER | Set-MapiVirtualDirectory -InternalUrl  https://mail.DOMAIN.net/MAPI -ExternalUrl https://mail.DOMAIN.net/MAPI

Verify the settings took:

Get-MapiVirtualDirectory -Server EXCHANGESERVER | FL InternalUrl,ExternalUrl

And finally, test the setup:

Test-OutlookConnectivity -RunFromServerId EXCHANGESERVER -ProbeIdentity OutlookMapiHttpSelfTestProbe

EXCHANGESERVER needs to be changed to the Exchange server name.

Hat Tip: Mark Gossa: Exchange 2013 and Exchange 2016 MAPI over HTTP

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Cloud Service

Tuesday, 16 February 2016

Cluster 101: Some Hyper-V and SOFS Cluster Basics

Our focus here at MPECS Inc. has grown into providing cluster-based solutions to clients near and far over the last eight years or so as well as cluster infrastructure solutions for small to medium I.T. shops.

There were so many misconceptions when we started the process to build out our first Hyper-V cluster in 2008.

The call in to us was for a large food manufacturing company that had a very specific requirement for their SQL, ColdFusion, and mail workloads to be available. The platform of choice was the Intel Modular Server with an attached Promise VTrak E310sD for extra storage.

So, off we went.

We procured all of the hardware through the Intel and Promise demo program. There was _no_ way we were going to purchase close to $100K of hardware on our own!

Back then, there was a dearth of documentation … though that hasn’t changed all that much! ;)

It took six months of trial and error plus working with the Intel, Promise, LSI, and finally contacts at Microsoft to figure out the right recipe for standing up a Hyper-V cluster.

Once we had everything down we deployed the Intel Modular Server with three nodes and the Promise VTrak E310sD for extra storage.

Node Failure

One of the first discoveries: A cluster setup does not mean the workload stays up if the node it’s on spontaneously combusts!

What does that mean? It means that when a node suddenly goes offline because of a hardware failure the guest virtual machines get moved over to an available node in a powered off state.

To the guest OS it is as if someone hit the reset button on the front of a physical server. And, as anyone that has experienced a failed node knows the first prompt when logging in to the VM is the “What caused the spontaneous restart” prompt.

Shared Storage

Every node in a Hyper-V cluster needs identical access to the storage the VHD(x) files are going to reside on.

In the early days, there really was not a lot of information indicating exactly what this meant. Especially since we decided right from day one to avoid any possible solution set based on iSCSI. Direct Attached Storage (DAS) via SAS was the way we were going to run with. The bandwidth was vastly superior with virtually no latency. No other shared storage in a cluster setting could match the numbers. And, to this day the other options still can’t match DAS based SAS solutions.

It took some time to figure out, but in the end we needed a Shared Storage License (SharedLUNKey) for the Intel Modular Server setup and a storage shelf with the needed LUN Sharing and/or LUN Masking plus LUN Sharing depending on our needs.

We had our first Hyper-V cluster!

Storage Spaces

When Storage Spaces came along in 2012 RTM we decided to venture into Clustered Storage Spaces via 2 nodes and a shared JBOD. That process took about two to three months to figure out.

Our least expensive cluster option based on this setup (blog post) is deployed at a 15 seat accounting firm. The cost versus the highly available workloads benefit ratio is really attractive. :)

We have also ventured into providing backend storage via Scale-Out File Server clusters for Hyper-V cluster frontends. Fabric between the two starts with 10GbE and SMB Multichannel.

Networking

All Broadcom and vendor rebranded Broadcom NICs require VMQ disabled for each network port!

A best practice for setting up each node is to have a minimum of four ports available. Two for the management network and Live Migration network and two for the virtual switch team. Our preference is for a pair of Intel Server Adapter i350-T4s set up as follows:

  • Port 0: Management Team (both NICs)
  • Port 1 and 2: vSwitch (no host OS access both NICs)
  • Port 3: Live Migration networks (LM0 and LM1)

For higher end setups, we install at least one Intel Server Adapter X540-T2 to bind our Live Migration network to each port. In a two node clustered Storage Spaces setting the 10GbE ports are direct connected.

Enabling Jumbo Frames is mandatory for any network switch and NIC carrying storage I/O or Live Migration.

Hardware

In our experience GHz is king over cores.

The maximum amount of memory per socket/NUMA node that can be afforded should be installed.

All components that can be should be run in pairs to eliminate as many single points of failure (SPFs) as is possible.

  • Two NICs for the networking setup
  • Two 10GbE NICs at the minimum for storage access (Hyper-V <—> SOFS),
  • Two SAS HBAs per SOFS node
  • Two power supplies per node

On the Scale-Out File Server cluster and Clustered Storage Spaces side of things one could scale up the number of JBODs to provide enclosure resilience thus protecting against a failed JBOD.

The new DataON DNS-2670 70-bay JBOD supports eight SAS ports per controller for a total of 16 SAS ports. This would allow us to scale out to eight SOFS nodes and eight JBODs using two pairs of LSI 9300-16e (PCIe 8x)  or the higher performance LSI 9302-16e (PCIe 16x) SAS HBAs per node! Would we do it? Probably not. Three or four SOFS nodes would be more than enough to serve the eight direct attached JBODs. ;)

Know Your Workloads

And finally, _know your workloads_!

Never, ever, rely on a vendor for performance data on their LoB or database backend. Always make a point of watching, scanning, and testing an already in-place solution set for performance metrics or the lack thereof. And, once baselines have been established in testing the results remain private to us.

The two key ingredients in any standalone or cluster virtualization setting are:

  1. IOPS
  2. Threads
  3. Memory

A balance must be struck between those three relative to the budget involved. It is our job to make sure our solution meets the workload requirements that have been placed before us.

Conclusion

We’ve seen a progression in the technologies we are using to deploy highly available virtualization and storage solutions.

While the technology does indeed change over time the above guidelines have stuck with us since the beginning.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Thursday, 12 November 2015

Exchange Stall: Purging Exchange Logs

We’ve got our SBS (Small Business Solution) set up for client’s all-in-the-Cloud experience.

What we’re finding is that some vendor’s systems don’t trigger VSS within a VM running Exchange thus leaving Exchange thinking it is not being backed up. This means that the Exchange VM eventually stalls due to no space on the partition hosting the logs.

To remedy that run the following in a script say once a week, or more depending on the volume of mail, on the Exchange VM:

  1. Elevated CMD
  2. DiskShadow
  3. Add Volume C:
  4. Begin Backup
  5. Create
  6. End Backup 

Once the snapshot completes Exchange will think it’s been backed up and consolidate all of the logs.

NOTE: Make sure the VM/Server is backed up!

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Friday, 16 October 2015

E-mail NDR: #5.1.1 SMTP; 550 Rejecting for Sender Policy Framework (SPF too many lookups)

One of our clients was having issues sending an e-mail to one of our regional ISP’s e-mail servers.

  • Remote Server returned ‘<inbound.server.com #5.1.1 SMTP; 550 Rejecting for Sender Policy Framework>’
    • SPF too many lookups

There was no further information. The specifics came from a very helpful mail technician at the ISP.

So, we started to dig around and came up with the following:

A ticket went through Third Tier’s Help Desk this week that was based on this problem with Dave Shakelford pointing to the following blog post:

So, what does all of this mean?

It means that we need to make sure all of our clients that send mail via an ISP SMTP server, third party sanitation and continuity service, or mail hosting service need to have a correct SPF record in place.

As the JangoMail blog post makes clear, we may have to jump through a few hoops to get it right, but get it right we must as our client’s mail is critical to their business.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Thursday, 4 December 2014

Microsoft Ups Support Ticket to $499 – We Have a Great Alternative: Third Tier!

It seems that this may, or may not, depending on one’s thoughts of how Microsoft sees IT Pros in today’s “Cloud First Mobile First” be another shot at IT Pros that provide much of the front line support to SMB/SME clients.

I’ve been helping out with Third Tier for well over a year and a half now. I’ve been privileged to work on a team of amazing folks as well as work with a great group of IT Pros.

I believe that we at Third Tier offer a viable alternative to Microsoft’s $499 ticket (though I’m not sure what that will work out to in Canada as we pay substantially more than the US equivalent) for spot support or even ongoing support needs.

Given the experience our team has the Third Tier rate of $175/Hour is very reasonable. Active Directory, Exchange, Remote Desktop Services, Hyper-V, VMware, Cluster, and very soon a number of key vertical products and services to help our IT Pros get the job done right the first time!

Third Tier offers a Micro Staffing program where we can be a part of your IT Pro team for ongoing support challenges or staffing challenges. We can be a part of your team for a very reasonable cost.

I’m also excited about some of the things we’ve been working on at Third Tier to provide our IT Pros with a one-stop solution for their data centre that will allow them to provide IaaS and even our SBS (Small Business Solution) at a very reasonable cost per seat! More to come on that soon.

One final thought. If one is caught in a bind with a server down situation then the Microsoft ticket may be the best way. With Action Pack we still get BizCrit (Business Critical) support though via a call back model.

Our response model tends towards scheduled time for tickets as opposed to crash responses. So, please keep that in mind.

Here are some of the areas we can help you with:

  • Disaster Recovery Planning and Practice
  • Infrastructure planning, migration, support, and recovery
  • Active Directory and Group Policy planning, support, and recovery
  • Remote Desktop Services planning, support, and recovery
  • Exchange planning, migration, support, and recovery
  • SQL planning, migration, support, and recovery
  • Hyper-V planning, support, and recovery
  • Virtualization Solution Performance planning and support
  • Specialized Bookkeeping Support and Services
  • IT Business Models, Plans, Direction, Vision, and More

Whatever the task, we have a team member that can help. Not only that, one can expect the task to be done in short order and in a professional manner.

If you have not checked us out before please do now.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Monday, 15 September 2014

Our SBS (Small Business Solution) Options with Standalone and Cluster Hardware Considerations

We’ve received a number of questions about the “How” we present our SBS to prospective and existing clients.

Our primary focus is on what we have provided with Small Business Server starting with SBS 2003 Standard.

  • Active Directory permissions based security
  • Remote Web Access (RWA/RWW) Portal
  • Remote Desktop access via RD Gateway (since SBS 2008 Standard)
  • RemoteApp access via RD Gateway for LoBs (since SBS 2008 Standard)
  • E-mail services access via Outlook, Outlook Anywhere, Exchange ActiveSync, and Outlook Web Access
  • Remote Folders and Files access
  • SharePoint based document management system
  • SQL backend for LoB, SharePoint, and other needs

We focus on the services the prospect would require while our existing clients are already used to them.

Once we have an understanding of the prospect’s needs, since we already know our client’s business really well, we move forward with a proposal that would be geared towards their business size and sensitivity to downtime.

On the services front where we are installing into a standalone host we would have two options:

  1. Base
    1. Requires two Windows Server OS Licenses
    2. DC, Exchange, RDS, and LoB (WSUS and LoBs)
  2. Premium Add-On
    1. Requires one Windows Server OS License
    2. SQL and SharePoint

Obviously the server and CALs would also be needed for the various components that will be installed into the guest OS.

If we are setting up a cluster then one needs to consider the number of VMs running on one or more of the nodes in the event of a node failure.

On the hardware side we would have a number of options:

  1. Entry-Level Single
    1. E3-1270v3, 32GB ECC, Hardware RAID, 8x 2.5” 10K SAS
  2. Mid-Level Single
    1. Single Socket 1U R1208JP4OC, E5-2600 series, 128GB ECC, Hardware RAID, 8x 2.5” 10K SAS
  3. High-Level Single
    1. Dual Socket 2U R2208GZ4GC, E5-2600 pair, 128GB-256GB ECC, Hardware RAID, 8x 2.5” 10K SAS or 16x 2.5” 10K SAS
  4. Entry-Level Asymmetric Cluster
    1. Pair of 1U R1208JP4OC or 2U R2208GZ4GC and an Intel JBOD2224S2DP
  5. Mid-Level Cluster
    1. Four 2U R2208GZ4GC and an Intel JBOD2224S2DP
      • Two Scale-Out File Server cluster nodes
      • Two Hyper-V cluster nodes
  6. High-End Cluster
    1. Six 2U R2208GZ4GC and three Intel JBOD2224S2DP units
      • Three Scale-Out File server cluster nodes
      • Three Intel JBODS with Two-Way or Three-Way Mirror and Enclosure Resilience
      • Three Hyper-V server cluster nodes

Within the above hardware configurations we would have a lot of flexibility that allows us to customize to the specific needs of the prospective client or our clients.

We work with a number of different firms that are prime candidates for at least an asymmetric cluster setup to minimize the possibility of downtime. The cost associated with these entry-level clusters versus a single larger server for the host platform makes them very attractive.

The basic VM configuration would involve fixed VHDX files unless the files are installed on dedicated partitions/LUNs. Note that we would use a shared set of partitions/LUNs if there are around 10 or more VMs as things get to be a bit of a bear to manage otherwise.

Our base VM configurations would be as follows:

  • DC: 4GB, 95GB OS VHDX, and 1TB Data VHDX
  • Exchange: 8GB, 95GB OS VHDX, and 250GB + 20GB/Mailbox Data VHDX
  • RDS: 4GB+, 95GB OS VHDX, and 100GB + 20GB/User Profile Disk
  • LoB: 8GB, 95GB OS VHDX, and 1TB Data VHDX Minimum
  • SQL: 16GB, 95GB OS VHDX, and 250GB+ Data VHDX
  • SharePoint: 16GB, 95GB OS VHDX, 200GB Data VHDX

We have a set of PowerShell steps and scripts that we use to configure these environments. PowerShell helps to greatly reduce the amount of time required to set things up. It also gives us consistency across all of our client deployments which is vital to troubleshooting if the need arises.

Shameless Plug: We’ve spent some time on the above in our SMBKitchen ASP Author Chats. If you are looking for more information the Author Chat is one of the best ways to do so.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Saturday, 11 January 2014

Set Exchange 2010 and 2013 Internal and External Virtual Directory URLs in PowerShell

Here are the elevated PowerShell commands to run to set the virtual directory URLs

The elevated PowerShell commands to verify the settings:

  • Get-ActiveSyncVirtualDirectory | fl internalurl,externalurl
  • Get-AutoDiscoverVirtualDirectory | fl internalurl,externalurl
  • Get-ECPVirtualDirectory | fl internalurl,externalurl
  • Get-OabVirtualDirectory | fl internalurl,externalurl
  • Get-WebServicesVirtualDirectory | fl internalurl,externalurl

Please note that we run a split DNS setup to have the external URL map to an internal IP address while folks are in the office (as per SBS STD).

UPDATE 2014-02-14: Dave Shackelford was kind enough to point out the errors in my copy & paste methodology. The proper syntax for each Set command has been done. :)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
Third Tier: Enterprise Solutions for Small Business

Tuesday, 26 November 2013

SBS 2003 R2 Premium Migration to 2012 R2 Domain and Exchange 2013

We are beginning our adventure migrating our last SBS 2003 R2 Premium server setup to a completely new setup.

We used the ShadowProtect backup image to restore to our Hyper-V server and utilized the Hardware Independent Restore process to inject the Hyper-V 2012 R2 VM drivers so we did not get any blue screens on the restored VM OS.

image

Our goal will be to end up with an RWA setup in 2012 Essentials R2 or we will be pitching the new Scorpion Software AuthAnvil Portal setup as an RWA replacement to this firm (and eventually all firms we manage).

Given that most accounting firms need to log into many different sites for their day-to-day routines we believe that new portal service will meet that need along with the partners that would prefer a short PIN to log on. :)

Plus it will give them a huge step up in security.

For now, we have their server up and running on one of our Server 2012 R2 Hyper-V lab setups as we will be running through the migration process a few times to make sure we have everything down.

We set up a Windows 7 Professional SP1 VM to verify that the SBS 2003 was happy:

image

The SBS Connect Computer wizard was run to successfully connect the Win7 VM to the SBS domain. From there we installed Office 2010 SP1 and reset a couple key user's passwords to hook into their profiles.

We are now ready to begin the migration process in our lab.

  1. Install: Windows Server 2012 R2 DC VM
  2. Install: Windows Server 2008 R2 OS Temp VM
    1. Exchange 2010 with current SP installed
  3. Migrate Mailboxes and Public Folders
  4. Install: Windows Server 2012 RTM VM
    1. Install Exchange 2013 and CU3
  5. Migrate Mailboxes and Public Folders
  6. Install: Windows Server 2012 R2 VM(s)
    1. LoB Migration

Once we have run through the above process we will then move on to migrating their actual production network.

Philip Elder
Microsoft MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business

Sunday, 1 September 2013

Exchange Server 2013: IE10 on Server 2012 and Windows 8 Crashes in /ECP Exchange admin center

In our greenfield deployments getting Exchange 2013 up and running around RTM time was a bit of a challenge give the reality that IE 10 on both Windows Server 2012 and Windows 8 just did not work.

To fix that problem the following needs to be installed:

Note that some security related settings may be reset once this update is installed.

A  prompt to set IE10 security settings is also to be had after the update was installed.

It is good to see that EAC can now be accessed as expected and without interruption.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Exchange 2013 ECP Error: The user has insufficient access rights. Active directory response: 00002098: SecErr: DSID-03150BC1, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

After setting up Exchange 2013 Standard on a VM we hit the following problem:

image

Server Error in '/owa' Application.

The user has insufficient access rights.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.DirectoryServices.Protocols.DirectoryOperationException: The user has insufficient access rights.
Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[DirectoryOperationException: The user has insufficient access rights.]

System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, ResultAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut) +1904

System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout) +381

Microsoft.Exchange.Data.Directory.PooledLdapConnection.SendRequest(DirectoryRequest request, LdapOperation ldapOperation, Nullable`1 clientSideSearchTimeout) +3849

Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync) +1062

[ADOperationException: Active Directory operation failed on vW2012E.MPECSINC.local. This error is not retriable. Additional information: Insufficient access rights to perform the operation.

Active directory response: 00002098: SecErr: DSID-03150BC1, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

]

Microsoft.Exchange.Data.Directory.ADDataSession.AnalyzeDirectoryError(PooledLdapConnection connection, DirectoryRequest request, DirectoryException de, Int32 totalRetries, Int32 retriesOnServer) +3736

Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync) +1945

Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException) +27

Microsoft.Exchange.Data.Directory.ADDataSession.Save(ADObject instanceToSave, IEnumerable`1 properties, Boolean bypassValidation) +2082

Microsoft.Exchange.Data.Storage.ExchangePrincipal.Save() +1078

[StoragePermanentException: There was a problem accessing Active Directory. Check your network connections and try again.]

Microsoft.Exchange.Data.Storage.ExchangePrincipal.Save() +1600

Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.HandleLanguagePost(RequestContext requestContext, CultureInfo culture, String timeZoneKeyName, Boolean isOptimized, String destination) +2072

Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.DispatchIfLanguagePost(RequestContext requestContext) +642

Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.InternalDispatchRequest(RequestContext requestContext) +620

Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.DispatchRequest(RequestContext requestContext) +297

Microsoft.Exchange.Clients.Owa2.Server.Core.OwaRequestHandler.OnPostAuthorizeRequest(Object sender, EventArgs e) +352

System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +80

System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +165

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.17929

There was not a lot that turned up in our searches.

In the end, we needed to run the following command on the Windows Server 2012 Essentials server from the Exchange 2013 install disk:

  • Setup /PrepareAD /IAcceptExchangeServerLicenseTerms
  • image

Once the above command finished running we hit refresh in IE and we were in.

image

Please note that these shots are via one of our labs we are running through in preparation for some SMB Kitchen Project content.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Tuesday, 27 August 2013

Exchange Error: Edit E-mail Address Policy – Address List Service Cannot Be Found

We were attempting to update the E-mail Address Policy (EAP) on an Exchange server and hit this error:

image

Edit E-mail Address Policy

The wizard could not complete.

Error:

An Exchange 2007 server on which an address list service is active cannot be found.

This particular SBS 2008 with Exchange 2007 was being tweaked as it is a restore into our lab cluster setup.

A quick search pointed to the Exchange System Attendant service not being online and sure enough it was not.

After starting the server we had a successful EAP change:

image

We could then move on to our next tasks at hand for this project.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Friday, 2 August 2013

Exchange Transport TLS Certificate Expiry Warnings and/or Errors

For those that have been supporting SBS Standard for a number of years now will be finding that Exchange Self-Issued certificates are expiring.

One self-issued certificate, and note that it seems to be independent of the SBS Third Party Trusted Certificates Wizard, is used for Transport Layer Security (TLS).

    MSExchangeTransport

    Event Details:   

    There is no valid SMTP Transport Layer Security (TLS) certificate for the FQDN of SBS.DOMAIN.local. The existing certificate for that FQDN has expired. The continued use of that FQDN will cause mail flow problems. A new certificate that contains the FQDN of SBS.DOMAIN.local should be installed on this server as soon as possible. You can create a new certificate by using the New-ExchangeCertificate task.

The domain listed in the error is the key to figuring out which Thumbprint we need.

  • Open Exchange PowerShell (Run As Admin)
  • Get-ExchangeCertificate | Select CertificateDomains,Thumbprint,Status,Services | fl

The resulting list will post all certificates installed in the Personal Store on that server. Note the certificate with an INVALID status that points to SERVER.DOMAIN.LOCAL.

Copy the GUID and paste it into the following command:

  • Get-ExchangeCertificate –Thumbprint GUIDHere | New-ExchangeCertificate

At the prompt to replace the existing certificate answer Yes.

The expired certificate should now be replaced and Exchange Transport will continue on.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Wednesday, 3 April 2013

Exchange 2013 OWA Comparison: RTM to CU1

We are happy to report that after walking through all of the troubleshooting steps we needed to that Exchange 2013 CU1 installed successfully on one of our Exchange 2013 RTM greenfield deploys.

image

Note that there were 18 steps to the whole process _after_ completing the AD prep steps and installing the required components on Server 2012.

This is a shot of Exchange 2013 RTM OWA:

image

This is a shot of Exchange 2013 CU1 OWA:

image

We now have the SPAMfighter folder listed.

One thing we noticed is that OWA loaded a _lot_ faster on the new platform than it used to on RTM.

As always, _test_ updates in a lab setting before wondering out and running them on production systems.

We had a System State and a full ShadowProtect backup of this particular setup before we jumped in as a just-in-case.

Given that some of the RTM bugs were critical at this site we jumped into CU1 right away on a production system.

So far, we can report that things are back to normal. So far . . .

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Might want to hold off on Exchange 2013 CU1

We ran into a hiccup with applying CU1 in the "Prerequisite" stage. We backed off with essentially no changes made, at least the routine did not jump into running the actual update and this morning we have no mail flow.

In the mean time, things are not working. :(

image

The above is OWA and mail flow is not coming in or going out.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Thursday, 28 February 2013

How to test the Autodiscover._tcp SRV record for Exchange

We needed to test a domain's autodiscover setup that we had them configure since we are not confident in the hoster's abilities anymore.

  1. Open an elevated command prompt.
  2. NSLookup [Enter]
  3. set type=srv [Enter]
  4. _autodiscover._tcp.mpecsinc.ca [Enter]
    • image

And, the test for the hosting provider shows that they did indeed make a mess of it. Back to the drawing board. :(

The How-To for formatting the Autodiscover SRV record is in the TechNet article below. That method works for our own SBS 2011 Standard integrated Exchange and our client's setups as well.

We now use this SRV record for all of our client's Internet DNS setup.

Hat tip: Unify and Conquer: Quick Tip: Testing DNS SRV Records with NSLookup

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Monday, 25 February 2013

Need Microsoft Partner Help: Please Log in and Vote “Me Too” On These Forum Posts

Hi, we need some help please:

image

Note the number 4 showing that four folks have bumped this thread. Thank you for doing that! We have one bump on the PDF problem.

Please click on the link, log in with your Microsoft Partner account, and click the “Me Too” button! Then, do so for the other question.

The internal relay question is due to a documentation fail while the PDF Attachments being mangled is an outright catastrophic fail as the Microsoft Exchange 2013 product went out the door like this.

We hope that we can get a lot of support underneath these two questions since both directly impact SMB/SME/ENT.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Friday, 22 February 2013

Exchange 2013 Full Stop: MIME/Multipart/Mixed Message Scrambled Error

Wow, did we ever hit a full stop at 110MPH today. :P

Needless to say we have found out that Exchange 2013 does not like to receive PDF attachments from a copier/MFP/scanner.

image

The above snip is from an e-mail that shows the PDF attachment as a bunch of characters in the e-mail body itself that goes on and on and on.

As per the forum post apparently this will be fixed in the first Cumulative Rollup for Exchange 2013.

In the mean time we are scrambling to work on a workaround for those folks that are hitting this problem.

And, we may have found one:

The instructions are almost useless. Almost ...

image

We have an account set up, we went in as per the above instructions, and we set up the copier to use port 587 and encryption. Now on to get it going.

Copiers are never easy to work with. However, we will hopefully get them going this way until Microsoft releases the fix for this problem.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer