I just tossed togethor a quick little script that will easily display the database names and user count per database
//this scripts gets all the database names and counts the number of users per database
$dblist=Get-MailboxDatabase
($dblist | %{write-host $_.name (get-mailbox -database $_.name).count})
Exchange 2010 is now GA
http://www.microsoft.com/presspass/press/2009/nov09/11-09techedeurope09pr.mspx
Microsoft no longer requires multiple network adapters in each DAG member. A single network adapter in each DAG member is supported. When using a single network, Microsoft recommends that you ensure that the design of your overall solution accounts for that.
For those that use LCS or OCS in you environments, I wanted to make you aware of a potential issue with one of Microsofts latest security updates that could cause an outage by showing LCS or OCS running as an evaluation version and then noting it as expired.
The hotfix (MS09-056) is detailed @ http://www.microsoft.com/technet/security/bulletin/ms09-056.mspx
Please refer to the Office Communications Server Blog entry for more information @ http://communicationsserverteam.com/archive/2009/10/14/632.aspx
Today Oct. 8th the best versions of Microsoft Exchange has been offically released!
http://msexchangeteam.com/archive/2009/10/08/452775.aspx
We are happy to announce that Exchange 2010 is Code Complete! Our senior leadership team has signed off on the final code, and it has been sent to our early adopters for one final look before its public release. This Release to Manufacturing (RTM) milestone means we are on our way to general availability and the launch at Tech·Ed Europe 2009 (http://www.microsoft.com/europe/teched/) in early November.
For those of you attending Tech·Ed in Berlin this year, be sure to check out the Unified Communications track, which is packed with technical content on Exchange 2010. And be sure to visit us at the Exchange product booth in the Exhibition Hall and let us know what you think of the product. Crystal Flores, who interviewed some of you on video at Tech·Ed North America earlier this year, will be on-hand in Berlin in a few weeks, armed with a camera and interview questions. A group of us are also marching to Las Vegas for Exchange Connections the same week where our fearless leader Rajesh is giving the keynote.
We hope to see you in Berlin or Vegas, but if you can’t join us in person, tune in via the Web (www.thenewefficiency.com) to be part of the launch.
- The Exchange Team
One of the major changes with Exchange 2010 is related to the mapi end point. In all previous versions of Exchange the Outlook client (using mapi) would connect directly to an Exchange mailbox server, with Exchange 2010 the Outlook client will connect to an Exchange server running the CAS role as its mapi end point for all connection except public folder access which will go direct to the mailbox server.
As you will discover later in this blog a common issue that user experience if they are running Outlook 2003 is related to the default configuration requiring encryption to be enabled on the Outlook client or connections will fail. I will go into more detail later on this topic.
When a user opens Outlook today a number of items occur but the main one I am going to talk about is the connection from the client directly to the mailbox server to retrieve their mail via mapi-rpc.
How clients connected pre Exchange 2010
Some of the issues with this configuration even when using an SCC or CCR cluster is during a failover the client connection point will be disrupted even if only for a few moments. This also means that clients are making a direct connection to the server which is limited to 60k connections to the information store. This does not mean 60k users, as client makes a number of connections to the system.
As the Exchange team looked at how they can better scale Exchange 2010 one of the new techniques was to move the client connection endpoint to the CAS server instead of the mailbox server. This allows for a number of things to happen.
Let’s take a look at our Exchange settings….
How do I know what my mapi end point is?
At first thought you may think this is configured per user however that is not the case. To find out what your rpc client end point is you need to run the following command get-mailboxdatabase “yourdatabase” | fl name,rpc* the output of this command will show you each RpcClientAccessServer associated with each database.
By default there is no rpc array configured, the name of a random CAS server in the same AD site will be directly associated with each database.
Let’s run our command and see what settings we have get-mailboxdatabase | fl name,rpc*
You can see that our RpcClientAccessServer points to my CAS server
Let’s create a new mailbox database in EMC:
Open EMC -> Organization Configuration -> mailbox
Right click and select New Mailbox database
I am going to call my database rpcservercheck and specify the server as E14Ex1
Specify the logs and database path
C:\db\db and c:\db\logs
**note I dont recommend these location but this is just a lab **
Click New to complete the database
Now that we create the new database lets run our command again:
You can see the new database also shows the CAS server, since I only have one CAS in this environment they are configured the same.
Outlook Profile
After setting up an Outlook profile let’s take a look at see that our mapi end point is now the CAS server
With Outlook 2007 click Tools – Accounts Settings
Select the profile and click Change
We can see that our Microsoft Exchange Server information points to the CAS fqdn and not our mailbox server
If we hold down CTR and right click the Outlook system tray icon we can bring up our connection status
You can see that all Directory and mail connections are now going to the CAS server with 1 exception, public folders. Yes, public folders calls are still direct connections from the client to the mailbox server hosting the public folder.
WireShark
If we use a network sniffer to capture traffic from our client 192.168.1.59 we can see that NSPI and MAPI requests from Outlook are all directed to the CAS
How does this work?
On each CAS server there is a new service that runs called the MSExchangeRPC which runs as Microsoft.Exchange.RpcClientAccess.Service.exe and listens on port 6001 for HTTP connection and uses dynamic ports by default for tcp/ip connections
By default when you install Exchange 2010 the files that makeup this service will be located in C:\Program Files\Microsoft\Exchange Server\V14\Bin
When connections are made to the CAS server by the mapi client, the CAS server then creates a channel to the mailbox server to retrieve the mailbox data. The CAS server will create a maximum of 100 Rpc connections to the mailbox server
Encryption
As I briefly mentioned in the introduction by default Exchange requires the client to connect with encryption enabled. This is not set on each database but on each rpc server and can be found with the following command Get-RpcClientAccess | fl server,encrypt*
[PS] C:\>Get-RpcClientAccess | fl server,encrypt*
Server : E14-EX1
EncryptionRequired : True
Server : E14-EX2
EncryptionRequired : True
Server : E14CAS1
EncryptionRequired : True
After running the command you can see that each CAS and Mailbox server has this configuration. You may ask why would the mailbox server require this is all the client connections are direct to the CAS? You may recall that I stated above that the clients still connects direct to the mailbox server for public folder access.
How do I know if my Outlook client is setup to use encryption?
Let’s look in our Outlook client to see this setting:
Using the same steps as before open your Outlook settings -> click More Settings
Select the Security Tab
We can see that Outlook 2007+ defaults to having encryption enabled however Outlook 2003 does not
If you have a large number of Outlook 2003 users you have a few options:
**Recommended configuration is to keep encryption enabled**
**Note this will also affect Outlook Anywhere users (formerly Rpc.https) **
Configuring an Rpc Array
Now that we have a basic understanding of how MOMT is used lets configure our first Rpc Array. You can use NLB or a hardware Load Balancer like F5 for the rpc array as either is supported however you cannot use NLB if your server is multi roled and a member of a DAG.
The dns entry for the array should not use a public dns name and only needs to be resolvable to the internal network.
Lets start with the Get-ClientAccessArray command just to show that we do not currently have an array
1. Create a DNS entry for your array name (I am going to use Site1Array.ExchangeGenie.local)
a. Open the DNS administration tool
b. Select the appropriate DNS Zone (for me .ExchangeGenie.local)
c. Right click and create a new host record (a cname would work as well)
d. Input the name and Ip for the record
e. Click Add Host
F. Click Done
G. Validate the record had been created
H. Lets use Nslookup to validate the record is seen
Create an RPC Array
From an EMS window we will use the new-clientaccessarray command if you use the help …. get-help new-clientaccessarray, we can see the command takes in 2 require parameters FQDN and Site
If you dont know your AD site information you can use the get-ADSite command to get that information
As you can see I have renamed my default site to GenieSite1
New-ClientAccessArray -Name Site1Array.ExchangeGenie.Local -fqdn Site1Array.ExchangeGenie.Local -Site GenieSite1
As you can see we now have a new array called Site1Array.ExchangeGenie.Local
**Note the memeber paramenter will show every Exchange 2010 CAS in the AD site of the Array, which CAS server actually participate are based on the NLB nodes **
Does this mean you are done?
No, creating an array but its self does nothing we have 2 additional steps 1. create the NLB for the Array and 2. associate the array to our database.
Creating an NLB for our Array
I am going to use WNLB for this blog which is a viable option however for large organization a hardware load balancer is advised.
If NLB is not installed on your CAS server you will need to do that first.
1. Open Server Manager
2. Select Features
3. Select Network Load Balancing
4. Click Next
5. Click Install
6. Click close after the installation completes successfully
7. Launch NLB Manager
8. From the file menu click Cluster -> New
9. Input the IP address or hostname of the CAS server and click Connect
10. Select Next
11. Select Next unless you need to add an additional dedicated ip to the server
12. Click Add to add the VIP for the cluster ** this should match the ip that we used to create our dns record for the array**
13. Enter the IP asscociated with the array and click OK
14. Click Next
15. Enter an FQDN that will be associated with the NLB, I have selected Mulicast for my cluster mode however please select the method that best fits your environment.
16. Click Next
17. Click Remove to delete the default listening ports
You can choose to listen on all ports however lets use the minimum required for the array which we will later scope down even lower. The minimum ports required will be 135, 1024-65535
a. Click Add
b. Remove the check box “All” so that we can scope which IP the ports listens on
c. Add port 135 – 135 TCP and click OK
d. Report for port 1024 -65535 TCP and click OK
18. Click Finish to complete building the NLB
Validate the NLB has been created properly
Associating the Array with databases
The final step for us is to associate the client array with our existing databases. Any new databases will be automatically associated with the array in that site.
Lets open our Outlook client so we can see our current settings
Let’s use the following command to set our new array on all the current databases we have created
Get-MailboxDatabase | Set-MailboxDatabase -RpcClientAccessServer site1array.exchangegenie.local
**Please note the above command would do all databases you can use the –server switch to scope the databases returned you can use something like this to scope the site
C:\>Get-ExchangeServer | where {$_.isMailboxServer -eq $true -and $_.Site -eq ‘ExchangeGenie.Local/Configuration/Sites/GenieSite1′} | Get-MailboxDatabase **
We can validate the array association with the following command Get-MailboxDatabase | fl rp*
***Please note it could take a few minute for this information to get updated for clients do to the store cache**
If we look at our client setting, they will get updated with autodiscover if the client is Outlook 2007+, for Outlook 2003 the client should be redirected after connecting to the current configured server.
You can see that all communication (except pf) is now connecting to our new client array
Scoping the Mapi Ports
By default when you open your Outlook client it attempts to make a connection to the rpc port ( 135) on the server andnegotiate a dynamic port above 1024 for usage. If there are no firewalls between the clients and servers then you dont mind all the traffic however in many scenarios there are firewalls between the client network and servers. To keep from the requirement of open port 135 and 1024 – 65535 you can make a few simple modifications to your CAS server to reduce the number of ports that are required to be open on the firewall.
There are 3 modifications you must make 1. Mapi which is a registry key change 2. Addres Book (NSPI) which is modifed in the config file and 3. Referral Service (RFR) modified in the config file.
We can restrict Rpc Client Access Array to a single port for each of the following settings Mapi,Address Book, and Referral Service let’s take a look at the default configuration below:
Key:HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeRPC\ParametersSystem
Value:TCP/IP Port
Type:DWORD
**Note you need to create the key ParametersSystem **
For Public Folder Access you need to use the same command but replace MSExchangeRpc with MsExchangeIS
Key:HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
Value:TCP/IP Port
Type:DWORD
Earlier you saw the network wireshark data with the server making connections to the CAS on radom high number ports, in this section we are going to scope the port range down to 3 ports of our choosing. Please note the client will still need access to port 135 for the initial connection.
Scoping the CAS server ports
1. Open the regsitry editor (start -> run -> regedit
2. browse to HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeRPC
3. Create a new key ParametersSystem (Right click new-> key)
4. Create a new Dword TCP/IP Port
5. Input a port I have selected 50000
6. Restart the Microsoft Exchange RPC Client Access Service
7. Open a command window and run NetStat -na
We can see that we are connecting the CAS server on port 50,000 and 135
**You will need to repeat these steps for any mailbox server this is hosting a public folder database**
8. Open Microsoft.Exchange.AddressBook.Service.Exe.config with notepad (default location is C:\Program Files\Microsoft\Exchange Server\V14\Bin)
9. Modify the section “RpcTcpPort” to the port you desire, I am going to use 50,001 since I used 50,000 for the mapi port
10. Restart the Microsoft Exchange Active Directory Topology Service (note this will stop all the Exchange services)
11. Open a command window and run NetStat -na
You can see we are now listeing on port 50,000 for map and port 50,001 for Address Book
If we open Outlook again and run a netstat -na from our client we can see that we are connecting to the CAS server on port 50,001 and 50,001 and to our mailbox on port 50,000
CAS IP 192.168.1.60 and Mailbox 192.168.1.57 and CAS Array 192.168.1.61
As with most people I am primarily an Outlook based user and only use OWA for quick access to my mailbox. Today one of the guys I work with was trying to send a 6mb attachment from OWA but kept getting the following error.
My coworkers first reaction was hey, why are the sending limits so low, 5mb is nothing for an attachment size?
My first response was, we do not have 5mb attachment limits but have them to set to 30mb ……….
What to do?
I opened a trusty TS session to the CAS server that he was connected too and I knew that in the web.config file there is a setting that OWA uses to specify that max attachment size.
Note : By deafult the web.config file is located C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\Owa
After I opened the web.config file with notepad I located the section for <httpRuntime maxRequestLength=”30000″ />
The <httpRuntime maxRequestLength=”30000″ /> is stored in Kb which mean that OWA defaults to 30MB attachment size limits so that could not be that users problem
Where are all the attachment size limits?
1. trasnport config
2. Send connectors
3. recieve connectors
4. users mailbox settings
Lets open EMS and take a look…………
The first command we are going to run is get-mailbox Brian.Tirch | fl max*
we can see that current the user does not have any limits set for sending or receiving.
Next we check our send connector which by default is configured for a 10mb limit so that could not be it……
that does not appear to be the issue ….
Lets check the receive connector which by default is set to 10mb
we can see the connectors on each server are set to 10mb and should not be causing the issue…with only one place left to check and that is the transport configuration.
Lets use the get-transportconfig | fl max* command to get our settings
by default in Exchange 2010 this should be set to 10mb but in this situation you can see that we are set to Unlimited just like on our users properties.
After checking all the settings there is nothing configured to force OWA to a 5mb attachment limit so now what do you do………. After reaching out to some friends in MS who ran into this before we found out that unlimited on the transport config does not really mean no limit
The problem here is the meaning of Unlimited… Basically Unlimited means that the values for the MaxSendSize and MaxMessageSize are not specified. It doesn’t mean any size message will be sent.
There are limits for mailbox, system, and connectors. The MaxSendSize for the system is set with set-TransportConfig. The MaxMessageSize for the ReceiveConnector and SendConnector are set on those connectors. When the attributes for a user, “submissionContLength” and “deliverContLength” are not set in AD (default setting) a query by “get-TransportConfig” will return that the size is also unlimited. However, the exact meaning is that the MaxSendSize is that the setting is not specified.
In this case, the sending code will use its own way to decide what is the maximum allowed send size. If the client is OWA, the default maximum allowed message size is 5MB when the MaxSendSize is not specified. If the MaxSendSize returns a value, OWA will use that value up to the value set on the maxRequestLength in the web.config.
Per the following article http://www.tuaw.com/2009/09/10/iphone-os-3-1-now-enforces-exchange-encryption-policy-may-block/ users that have an Iphone that is not a 3GS may not be able to sync when connected to Exchange 2007 SP1+ system due to the encryption policy.
I have been Beta testing Exchange 2007 SP2 for many months now along with Exchange 2010 and Microsoft has released the final product as of today. If you plan on deploying Exchange 2010 into your Exchange 2007 envrionment SP2 will be a requirement.
Whats new:
In my last article I briefly touched on the fact that everything in Exchange 2010 is now controlled by EMS and RBAC and can be controled by creating custom roles and assigning them to users. In this article I am going to go over the default view a user will see in ECP without any customization.
When a user accesses the ECP directory https://mailurl.com/ecp or clicks the options button in the top right of OWA the below view is what the users will see.
one item I would like to point out, is the links “shortcuts to things you can do“. Most of these links take the user to other sections of the ECP however if you click “connect Outlook to this account” they will be directed to http://help.outlook.com . In the current builds its unsupported to attempt to modify this information to point to internal faq’s
The default page a users lands on is the Account sections, which by default will allow a user to update a number of their AD properties like Address, Phone Number, etc..
1. click edit at to bottom of the page
2. Modify attribute and click SAVE
The next section Organize E-mail has 3 features that we can use 1. inbox rules, 2. automatic replies, and 3. delivery reports.
This is similar to the rules we had in Exchange 2007 however there are some new features available to us.
1. click New
2. Select create a new rule for arriving messages
3. On the menu select the drop down under the section “When the message arrives, and:”
4. I am going to select apply to all messages
5. Under the “Do the following:” sections I am going to pick “Redirect the message to”
6. When the address picker windows open I am going to select Jodie (if you want to redirect to an address not in the GAL just type the address in)
7. click OK
8.Click More Options
9. Select move,copy, or delete and then Delete the message
10. If you want to add an exceptions, select the Add Exception button
. 
11. Select the exception that applies
12. Now that we have created the rule we want click the save button
Now we can see we have a rule that will redirect all messages to Jodie
Automatic Replies
The Automatic Replies section does not bring any new feature from Exchange 2007 but is the section that we use to set an Out Of Office message or for the old school exchange advocates OOF (Out of Facility)
The first section is set to internal away messages, this is determined by the Accepted Domains that are configured in your Exchange Org.
1. Click the button to Send automatic replies
2. Specify the date range you want to use
3. Enter the message
4. If you wish to set a message for external senders repeat steps 1.-3 for the External Senders section
5. Click the Save button
One of my personal favorite features is Delivery Reports which allows a users to perform self message tracking on messages to them or send by them. If enabled the user will also see that the message has been read even if a read reciept was not sent with the message.
* to enable the read tracking use Set-OrganizationConfig -ReadTrackingEnabled $true more can be found at http://msexchangeteam.com/archive/2009/06/25/451680.aspx
Unfortunately you must use the user picker feature and cannot just type in either of the first two fields
Lets search for the 2 test messages that I sent out
1. Click the radius button “Search for messages I have receieved from”
2. When the address picker opens select the user (or just type in the address) and click OK
3. Click the Search button
4. You can see I have 2 messages in the report, you can either double click the message or highlight it and click the details button
5. You can see in this report the date and time the message was submitted , that is was delivered and marked as read
A nice feature that was been made available is the ability for users to join groups that have been created. If you also choose to enable another feature users have the ability to create distribution groups from ECP as well.
1. Clikc the Join button
*I have created 3 groups Demo-Open, Demo-closed,Demo-ManagerApproval *
2. A windows will open showing all the available groups that can be joined
3. Lets select the first group which is set to be closed and attempt to join it
You see we get a message stating we cannot join this group because its closed
4. Lets select the next group which requires manager approval
You see we get a message back stating that we have to wait for the manager approval
As the group Owner you will get a message to approve the user
5. Lets select the remain group which is open to everyone can join
You can see what receieved a message stating we have joined the group
6. Lets now leave the open group that we have joined, select the group Demo-OpenMember and click the Leave button
7. You are now presented with a validation that you want to leave the group, click Yes
The first section under the settings tab is Mail, which is broken up into 5 subsections – 1. E-Mail Signature 2.Read Receipts 3.Reading Pane 4. Conversations 5.Message Format and 6. Message Options
The Read Receipts section provide us 3 options on how to hande Read Receipts on messages
1. Ask me before snding a response <Default>
2. Always send a response
3. Never send a response
The next section is the Reading Pane section, which allows a user to configure how to handle a message that is viewed in the reading pane and provides us 3 options
1. Mark the item displayed in the Reading Pane as Read
2. Mark the item as Read when the selection changes <Default>
3. Do not automatically mark the item as Read
By default in the OWA UI messages are placed into the new conversation view which does take a bit of getting user too. This section controls how the conversation view is displayed
This section is broken up into 2 parts
1. Sort messages in the conversation Reading Pane in this order:
There is nothing really new in this section but provides a user a location to input an email signature, if you want this signature added to each out going message you need to select the check box at the bottom Automatically include my signature on messages I send
The Message Format section allows us to modify the following
1.
3. Compose messages in this format allows us to set the default message type of HTML or Plaint Text
4. We can configure the default font type and size of messages
The last section we have is the Message Options section which allow us to configure a number of settings. |
The spelling section allows us to configure a number of options for spell checking. The ability to configure a custom dictionary is still not there however we do have the same options as Exchange 2007.
Calendar
General
The General section allows us to configure two options
1. E-Mail name resolution
2. Accessibilty
Once common issue I have found over the years is a user enabling the accessibility options when they first logon to thier mailbx which will then force OWA Light.
Regional
Reginal settings allow a user to configure the following
1. Language
2. Date format
3. Time format
4. Current time zone
Password
The password section allows a user to change thier current password however you must know the old password when using this feature.
S/MIME
The S/MIME button will only be avaiabled with IE7+ and is not a feature that is supposed with Firefox or Safari since this uses an active X control. When attempting to install this control you will need to have local Admin rights to the machine.
The S/MIME control allows a user to be able to digitally sign or encrypt a message
*Note : currently the control requires the user to have thier certificate published to the directory however there is no feature in the web UI that allows a user to publish thier certificate and there for an Outlook profile or automatic provisioning will be required to use send digitally signe or encrypted messages.
Phone
The phone section is broken down into 3 sub sections Voice Mail (only if your account has been UM enabled), Mobile Phones and Text Messaging.
Voice Mail
Exchange 2007 introduced a new server role called Unified Messaging which intergrates Exchange into systems like OCS and telephony devices. The OWA web UI now allows a users the ablity to managed settings.
There are 4 sections that can be managed
1. Call Answering Rules
2. Outlook Voice Access
3. Notifications
4. Voice Mail Preview
Mobile Phones
Text Messaging
Another new feature of Exchange 2010 is the ability to use text messages to send notification to your phone. If you are already using a phone like Windows Mobile, Iphone, Palm Pre etc.. that can sync with Exchange this is most likely not a feature that you would be using however for those users who do not have a phone that is capable of syncing with the system this feature provides you notification for email, calendar, and voicemail. By default this feature is disabled.
Enabling Notifications
Click “Turn on Notifications”
Next we will be ask to select our country and cell phone provider
You may note if you carrier is not listed there is a link that will take you to the following information page http://help.outlook.com/en-us/beta/ms.exch.ecp.configureregionandmobileoperator.aspx?r=ia&l=0
Click Next
Now you are ask to input your cell phone number
Click Next
A text message will now be sent to your cell phone with a pin code that will be used to complete the next section
Input the pin that was sent to you phone and click Finish
Once this process has been completed you will find a new rule that has been created to send copies of information to your phone.
Block or Allow
Exchange provides users with a simple interface to allow user to configure junk filters for thier mailbox.
The first section that we come across is the ability to turn off or on the junk mail filtering
By enabling this feature you allow the system to move messages into our junk email folder that meet your configuration. Please note that the system can be configured to move messages to the junk folder as well.
Under the Safe Senders and Recipients section we can add users to our safe list to these users to not get placed into our junk mail foler
We also have the option of trusting anyone in our contact list
After the allow section we find the Blcoked Senders information. If a user is added to this section it will not block email from them but tag this message to be listed as junk and move the message to the junk folder.
We can also specify to that all email is considered junk unless the users is explicity listed in our safe list.
If you attempt to add a user that is apart of your email organization you will receive an error stating you cannot perform this action
1,043 | Unique Visitors |
