Exchange CXP team has released Update Rollup 2 for Exchange Server 2007 Service Pack 2 (KB 972076) to the download center.

 In addition to bug fixes reported by customers we have added new rules to the Exchange Best Practices Analyzer to check the health of your system. Starting this rollup, customers who wish to deploy the new BPA health rules to a server with no internet connection can do so by downloading the installing the update rollup on the server. Until Exchange Server 2007 Service Pack 2, updates to the BPA rules were available only via the web which meant customers wanting to deploy the new health check rules to servers not connected to the internet would have had to copy over the XML files manually. In Exchange 2007 SP2, we implemented a work item which allows us to ship updates to the BPA health check rules via the rollup and as well as via the traditional web based channel. More on this via a blog post in the near future.

KBA 972076 lists all the fixes included in this rollup. Here are some of the product improvements and critical bug fixes we’d like to call out:

1. KB 972705: This one is for all the IT pros and anyone who has ever had to explain abnormal database size/log file growth in a short period of time. We have added three new registry entries to help speed up troubleshooting the issue:
   • BytesLogWarningThreshold
   • BytesLogErrorThreshold
   • BytesLogCheckPeriodInMinutes

   More information on the values to set in the above registry keys is documented in KB 972705.

2. KB 975404: Accepting meeting requests sent via an application using CDO like Blackberry devices sometimes results in rendering an embedded message attached to the meeting request inaccessible.
3. KB 976137: We have made a change to the behavior of the Unified Messaging Auto attendant when it plays the greeting for callers on a holiday. Currently when callers call on a holiday, they hear the non-business hours greeting followed by the holiday greeting. In this rollup we have made a change so that the callers calling on a holiday will only hear the holiday greeting. If your greetings are configured such that they would make sense to callers calling on a holiday only if they hear both the non-business hours greeting and the holiday greeting, then you need to re-configure them when you install this update rollup.
4. KB 971177: Another change in the UM Auto Attendants configuration in the Exchange Management Console. It is now aware if your time zone follows Daylight Saving Time.
5. KB 975165: In an environment using self-signed certificates and CAS-CAS proxying, Exchange Web Services requests proxied may start failing after the Availability Service has made a proxy request.
6. A bug where the OWA Virtual Directory cannot be accessed via the Exchange Management Console in an environment coexisting with Exchange 2010 if the Exchange 2007 server was upgraded from Exchange 2007 SP1 to SP2.

KB 972076 has more details about this release and a complete list of all fixes included in this rollup. Exchange CXP team has released Update Rollup 2 for Exchange Server 2007 Service Pack 2 (KB 972076) to the download center.

In addition to bug fixes reported by customers we have added new rules to the Exchange Best Practices Analyzer to check the health of your system. Starting this rollup, customers who wish to deploy the new BPA health rules to a server with no internet connection can do so by downloading the installing the update rollup on the server. Until Exchange Server 2007 Service Pack 2, updates to the BPA rules were available only via the web which meant customers wanting to deploy the new health check rules to servers not connected to the internet would have had to copy over the XML files manually. In Exchange 2007 SP2, we implemented a work item which allows us to ship updates to the BPA health check rules via the rollup and as well as via the traditional web based channel. More on this via a blog post in the near future.

KBA 972076 lists all the fixes included in this rollup. Here are some of the product improvements and critical bug fixes we’d like to call out:

1. KB 972705: This one is for all the IT pros and anyone who has ever had to explain abnormal database size/log file growth in a short period of time. We have added three new registry entries to help speed up troubleshooting the issue:
   • BytesLogWarningThreshold
   • BytesLogErrorThreshold
   • BytesLogCheckPeriodInMinutes

   More information on the values to set in the above registry keys is documented in KB 972705.

2. KB 975404: Accepting meeting requests sent via an application using CDO like Blackberry devices sometimes results in rendering an embedded message attached to the meeting request inaccessible.
3. KB 976137: We have made a change to the behavior of the Unified Messaging Auto attendant when it plays the greeting for callers on a holiday. Currently when callers call on a holiday, they hear the non-business hours greeting followed by the holiday greeting. In this rollup we have made a change so that the callers calling on a holiday will only hear the holiday greeting. If your greetings are configured such that they would make sense to callers calling on a holiday only if they hear both the non-business hours greeting and the holiday greeting, then you need to re-configure them when you install this update rollup.
4. KB 971177: Another change in the UM Auto Attendants configuration in the Exchange Management Console. It is now aware if your time zone follows Daylight Saving Time.
5. KB 975165: In an environment using self-signed certificates and CAS-CAS proxying, Exchange Web Services requests proxied may start failing after the Availability Service has made a proxy request.
6. A bug where the OWA Virtual Directory cannot be accessed via the Exchange Management Console in an environment coexisting with Exchange 2010 if the Exchange 2007 server was upgraded from Exchange 2007 SP1 to SP2.

KB 972076 has more details about this release and a complete list of all fixes included in this rollup.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=4c4bd2a3-5e50-42b0-8bbb-2cc9afe3216a

Whats new:

http://msexchangeteam.com/archive/2009/05/11/451281.aspx

http://msexchangeteam.com/archive/2009/05/13/451311.aspx

http://www.microsoft.com/downloads/details.aspx?FamilyID=93cb3f66-ae72-4356-bdbf-35029cff6df1&displaylang=en

Some of the challenges that Dave has assisted me with are related to the size of the directory in my environment which supports over 2.4 million objects.

So this blog will be dedicated to Dave and all the help he has given me over the years to better understand the OAB process. I could not explain its function as well as Dave however I am going to give a high level overview of how the OAB process works in Exchange 2007.

Lets start by talking about the service that is responsible for generating the OAB, the Microsoft Exchange System Attendant (MAD.EXE), This service is only located on an Exchange 2007 Server that has the mailbox role installed.

The system attendant invokes OABGEN.DLL

If we read the description we will see what the service is utilized for:

Forwards directory lookups to a global catalog server for legacy Outlook clients, generates e-mail addresses and offline address books, updates free/busy information for legacy clients, and maintains permissions and group memberships for the server. If this service is disabled, any services that explicitly depend on it will fail to start.

As you can see the service is responsible for a number of different Exchange items however we are going to keep our focus on the offline address book, from here on out referred to as OAB.

Now that we know what service is responsible for OAB generation how do we know what server is actually responsible?

Open EMC

Organizational Configuration

Select Mailbox

Select the tab Offline Address Book

from this view you can see if you have configured an OAB or which server is responsible for generating the OAB.

We could have also used EMS to get this information with the get-offlineaddressbook command

I am going to delete the current OAB that I have created so we can walk through the few simple steps to configure the OAB.

1. Right Click -> New OAB

2. Provide a Name for your address list, I am going to use OAB Demo

3. Click browse and select the server you wish to generate the OAB

**Note at the time of writing this there is a known issue with OAB generation on an Exchange Mailbox server installed on Windows 2008 that is hosted on a clustered node **

4. Select or Deselect if you wish to publish the default global or add any additional address lists.

5. click Next

We now get prompted to ask for the methods to distribute the OAB to clients. New to Exchange 2007 and Outlook 2007 are the web distribution points that I will go into more detail later. The 2nd option is public folders, which all clients pre Outlook 2007 will utilize to download the OAB.

I am going to enable both options:

Once you enable web distribution you must click the ADD button to select the CAS servers you want to act as distribution points

Notice the OAB virtual directory which is used for web distribution

6. Click Next to continue

7. On the configuration summary we are show the options we selected -> click New

8. On the completion page we are shown the powershell commands that where run to configure the OAB. -> click finish

Now that we have setup a new OAB generation let look at what options whe can configure

1. Rick the the OAB and select properties

2. On the General Tab we have the Name and default schedule which runs 1 time per day at 5am

Select the customize button to manipulate the schedule

3. If we select the address list tab we can see the lists that we select to generate an OAB for

4. If we select the distribution tab we have some setting we did not have in EMC during creation. This is the ability to tell the system which version of OAB to generate v2,v3, or v4. I recommand you only select v4 as it has a number of improvements over the previous version.

the link below has additional information about each version

http://msexchangeteam.com/archive/2005/08/01/408473.aspx

NOW WHAT………..

So we setup and OAB and clicked a few buttons so what happens next?

Lets start by turning up the logging for the OAB so that we can get more information from the events logs to assist us in our journey to figure what is about to happen.

In Exchange 2007 the only way to turn up the logging is via EMS, there are some tools written that will provide a gui for this function but lets stay native for now.

1. Open EMS

2. Set-eventloglevel “MSExchangeSA\OAL Generator” -loglevel medium

On each server listed as the generating server we can find the following directory where the SA places a compressed version of the OAB

C:\Program Files\Microsoft\Exchange Server\ExchangeOAB

* this assumes the default installation path*

Since we just created our OAB this path is currently empty, you will also notice the folder is shared.

unfortunately there is no magic way or registry key that you can use to move this from inside the installation path. So if you wish this to be on the D drive then you must install Exchange to the D drive.

Lets look at the permission on the share, as we know there are 2 types of permissions Share Permissions and NTFS permission. I am not going to explain the differences and which wins in the article but you should understand those.

The Share Permission have 3 accounts with rights:

Administrators – FC

System – FC

Exchange Servers – Read

On the NTFS permission we can see:

Exchange Server Read and Execute

Administrators – FC

System – FC

Lets force the OAB to run so we can populate this folder, we can do that in a number of ways from EMS or EMC.

1. open EMC

2. Organizational Configuration

3. Mailbox

4. Select the OAB tab

5. Right click the address book that we created -> select update

6. What are then prompted for verification to continue, Click Yes and the OAB generation has been started.

Now lets revisit the ExchangeOAB folder on our generation server.

You can see that we now have a folder which is the guid of the address list

you can also see this from the get-offlineaddressbook command

Server : E2K7MBX1

AddressLists : {Default Global Address List}

Versions : {Version4}

IsDefault : True

PublicFolderDatabase : E2K7MBX1\Second Storage Group\Public Folderdatabase

Identity : \OAB Demo

Guid : e56699d4-2b04-4268-bfc6-55cc60500cb2

ObjectCategory : vm1.local/Configuration/Schema/ms-Exch-OAB

Now lets open that folder and see whats inside……………….

In the graphic below you see we have a number of compressed files and a file called OAB.XML

Let open the OAB.XML file and see whats inside

Later we will discuss how the files get from this location to where the need to be for clients to download.

Event Logs:

Now that we started the generation process lets take a look in the events logs to see what information we get.

The first event we come across in the logs tells us that the OAB generation process is going to write files to C:\Windows\Temp. When the OAB makes calles to AD temporarily writes this information to the Temp directory before creating the address list information.

The 2nd event we see is our generation server making a connection to AD to our DC which it will use to get the user information for the OAB

Our 3rd event is telling us that the OAB generation has started

The 4th event tells us that our server is making a connection to the public folders to deploy a copy of the OAB

The 5th event tells us that our OAB list is being generated

The 6st event shows us that the server is generating OAB v4 files

The 7th event tells us that the generation server did not see the manifest file, since this is our first run that is ok, however it could mean there is an issue.

The 8th event tells us the generation server is opening the OAB folder on the public folder server to copy the OAB information

The 9th and final event tells us that the OAB process has been completed

How do the files get to the Public Folder and CAS server

After the OAB files have been created on the generation server the CAS servers use Microsoft Exchange File Distrobution service to copy the files to the distribution point on the CAS servers.

At the moment the synchronization has not happened and by default occurs every 8 hours, so we can see that our CAS server currently do not have the data replicated.

by deafult the distrobution point on the CAS server is located in c:\program files\microsoft\Exchange Server\ClientAccess\OAB

Lets restart the Microsoft Exchange File Distrobution service to force the files to synchronize

“C:\Program Files\Microsoft\Exchange Server\Bin\MSExchangeFDS.exe”

We can now see that on the files have been copied from the generation server to our CAS server and are ready to be downloaded by Outlook 2007 users.

How does the OAB get from the generation server to the public folders?

As we can see above the OAB generation process make calls to the public folders, this is done via a mapi session that is created by the system attendant service and passes this to OABgen.dll which makes the connection to the system folders for OAB download

How does the OAB get from the server to the client?

This answer depends on what version of Outlook is being used and the client configuration. As you know with Outlook 2007 and autodiscover we can now configure web distribution points as seen above.

For Outlook 2003 or older this client will make mapi calls to the public folder to download the OAB

How can I validate this has worked

Lets open Outlook 2007 and test our autodiscover to see if we are recieving the OAB url for web distrobution.

Steps:

Next lets force a OAB full download for our client.

steps:

now we can put Outlook into offline mode and see if we can still browse the directory.

J. Peter Bruzzese has a nice site with video clips and turned this blog into a instructional video see the link below for the video clip

http://www.exclusivelyexchange.com/exchangegenie.html

To Be continued……

http://msexchangeteam.com/archive/2008/09/11/449787.aspx

Now the real RU4 has been released today but will only be listed on the Windows Download site and not on the Microsoft Update servers.

Update Rollup 4 for Exchange Server 2007 Service Pack 1 (KB952580)

http://www.microsoft.com/downloads/details.aspx?FamilyID=8b492ed2-ea92-412f-a852-3aa1c58d9499&DisplayLang=en

The below links outlines all the changes in the rollup

http://support.microsoft.com/?kbid=952580

So how does Safe List aggregation work?

When a user adds items to thier safe list 2 attributes can get updated in AD depending if its a safe recipient or safe sender.

msExchSafeRecipientsHash – This attribute stores the hash of the Safe Recipients List collection for the user.
msExchSafeSendersHash – This attribute stores the hash of the Safe Senders List collection for the user.

Lets take a look at these properties:
1. Open ADSIEdit
2. domain
3. select a users
4. find the msExchSafeRecipientsHash

We can see the value is “NOT SET”

Lets logon to Brian’s mailbox in OWA

1. Logon to mailbox
2. Select Options
3. Junk

Notice all the sections are grayed out, this is because we need to set the option to enable junk filtering.

Select the radius button “Automatically filter junk email”

Save the settings.

Now Lets add a user to our safe recipients list:

1. Under Manage Safe Recipients List select ADD

2. Input the users email address you want to add, in this case I used John.Smith@madeup.com

Now that the user has done thier part its time for the administrator to actually make this functional.

I am going to run this for just the Brian’s account in the example however you would really want to run this against all users mailboxes

1. Open EMS
2. Update-Safelist Brian.Tirch -type both
** by default this command will run only safe senders if do not use the -type switch and specify both or saferecipients.

now lets check in ADSI to see if anything has changed

Notice the information was not updated, why?

Did you install the anti spam agents in the org and enable content filtering?

To install the anti spam agents run the built in scrip install-antispamagents.ps1
or see my posting on anti spam http://exchange-genie.blogspot.com/2007/12/exchange-2007-anti-spam.html

Now lets check our properties in ADSI

we no longer have an empty value but a hashed value

Since this is not an automatic process an Admin would need to create a schedule task to run nightly to update the users information on a regular basis. The two articles below can assist with scheduling this to run against all users nightly.

Update-Safelist
http://technet.microsoft.com/en-us/library/bb125034(EXCHG.80).aspx

Safe list aggregation
http://technet.microsoft.com/en-us/library/aa998280(EXCHG.80).aspx

You can see the message tracking is ENABLED by defaultThe only 2 options we have from the EMC is :
1. Enable message tracking
2. specify the log path

If we look at the properties of the mailbox server we cannot manipulate any of the setting from

EMS
We can use the get-transportserver and get-mailboxserver cmdlets to show message tracking information.

get-mailboxserver


get-transportserver

We can see from the output from our cmdlets that we have much more information in EMS then in EMC.

This is a default configuration:
MessageTrackingLogSubjectLoggingEnabled : True

MessageTrackingLogEnabled : True
MessageTrackingLogMaxAge : 30.00:00:00
MessageTrackingLogMaxDirectorySize : 250MB
MessageTrackingLogMaxFileSize : 10MB
MessageTrackingLogPath : C:\Program Files\Microsoft\Exchange S erver\TransportRoles\Logs\MessageTracking
MessageTrackingLogSubjectLoggingEnabled : True

I cannot provide an answer as to what the settings above should be as these should be part of your company policy how long the logs must be retained.

At a minimum I recommend the log path be moved from the OS partition however if you limited a limited number of drives and your OS is a Raid 1 mirror the logs can perfrom find on the OS disk.

We can manipulate our settings with the Set-TransporServer and Set-Mailboxserver cmdlets

I am going to use the Get-TransportServer cmdlet and pipe it to the Set-transportserver cmdlets to set the Log path, Max Age and directory size

Get-TransportServer | Set-TransportServer -MessageTrackingLogMaxAge 60 -MessageTrackingLogMaxDirectorySize 500mb -MessageTrackingLogPath d:\MessageTrac kingLogs

We can use the Get-Transportserver to view our changes

Lets take a look at our log, we can see the location has been moved to our specified location

Lets look at the log in its native format

Searching Message Tracking Logs

Permissions:

Exchange 2007 RTM, the account you use must be delegated the following:

• Exchange Server Administrator role and local Administrators group for the target server

Exchange 2007 SP1, the account you use must be delegated the following:

• Exchange View-Only Administrator role

Edge Transport server role you must log on by using an account that is a member of the local Administrators group on that computer.

EMC

Lets take a look at some message tracking option in EMC

Click “toolbox” -> Under Mail flot tools –> Select Message tracking

when the this is first selected the tool will connect to Microsoft and see if there are any new updates.

next we are presented with the welcome screen

On the Message Tracking Parameters we have the ability to select from the following filters
Recipients, Sender, Server, Event ID (Receive, Send, Fail, DSN, Deliver, BadMail, Resolve, Expand), Message ID, Internal Message ID, Subject m reference, Start, and End

Once we have made our selections the window as the bottom shows up the EMS commands that will be run to retrive the logs

I sent a message from brian.tirch@vm.local to generate some log data, for my filters I selected Sender,Start, and End

We can see the 2 entries are returned 1. Receive and 1 for Deliver

We can see in the data returned that there are a number of fields listed that are not search able from EMC like client IP and Server IP

From this log we can see that the message was received from vmmbx1 to vmcashub and then delivered from vmcashub to vmmbx1

**Notice the only logs we have data are from the server which we ran the message tracking tool from**

http://technet.microsoft.com/en-us/library/bb124375(EXCHG.80).aspx

Event name	Description
BADMAIL	A message was submitted by the Pickup directory or the Replay directory that cannot be delivered or returned.
DELIVER	A message was delivered to a mailbox.
DEFER	Message delivery was delayed.
DSN	A delivery status notification (DSN) was generated.
EXPAND	A distribution group was expanded.
FAIL	Message delivery failed.
POISONMESSAGE	A message is put in the poison message queue or removed from the poison message queue.
RECEIVE	A message was received and committed to the database.
REDIRECT	A message was redirected to an alternative recipient after an Active Directory directory service lookup.
RESOLVE	A message’s recipients were resolved to a different e-mail address after an Active Directory lookup.
SEND	A message was sent by Simple Mail Transfer Protocol (SMTP) to a different server.
SUBMIT	A message was submitted by an Exchange 2007 computer that has the Mailbox server role installed to an Exchange 2007 computer that has the Hub Transport server role or Edge Transport server role installed. The message tracking logs that are generated by the Mailbox server role contain only SUBMIT events.
TRANSFER	Recipients were moved to a forked message because of content conversion, message recipient limits, or agents.

EMS:
Lets use EMS to search the message tracking logs and please reference the “How to Search Message Tracking Log” article below to see the differences between the available fields.

If we run the Get-Help command we can see the available switches.

C:\>get-help Get-MessageTrackingLog

Name
Get-MessageTrackingLog

SYNOPSIS
Use the Get-MessageTrackingLog cmdlet to search message information that i
stored in the message tracking log.

SyNTAX
Get-MessageTrackingLog [-DomainController ] [-End ] [-Even
Id ] [-InternalMessageId ] [-MessageId ] [-Message
ubject ] [-Recipients ] [-Reference ] [-ResultSi
e ] [-Sender ] [-Server ] [-Start ] []

let perform the same search as above and see if we get any different data:
Get-Messagetrackinglog -Sender “brian.tirch@vm.local” -Start “5/10/2008 7:42:00PM” -End “5/12/2008 7:52:00 PM”

you can see the first return is truncated

so we can pipe to the FL command to get more details

After viewing this the data both results are the same…..

Now we can add some parameters to our command so that we can pull logs from all servers.
Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog

by piping the Get-ExchangeServer cmdlet to the Where command we can pull logs from all hubs servers and mailbox server to limit our filter to pull from selected servers.

Lets run the same command for Get-Messagetrackinglog but add the leading Where statement.

We can see now that we have an additional entry for Submit

the Submit entry shows the log from our mailbox server submitting a message to a hub server for delivery.

We can see that the message tracking logs can be vary useful in determining any issues or validating messages delivery.

References:

How to Search Message Tracking Logs
http://technet.microsoft.com/en-us/library/bb124926.aspx

Managing Message Tracking

http://technet.microsoft.com/en-us/library/bb124375(EXCHG.80).aspx

How to configure Message Tracking

http://technet.microsoft.com/en-us/library/aa997984(EXCHG.80).aspx

When utlizing Outlook 2007 the autodiscover service is heavily tied into Outlook anywhere functionality, I am going to reference a previous posting that explains those functions in detail.
http://exchange-genie.blogspot.com/2007/07/autodiscover-ad-attribute.html

With Exchange 2007 in order to allow clients remote access to the mail system you will need to install an Exchange 2007 CAS server which will allow clients to access thier mail via Imap,Pop,OWA,Active Sync, and Rpc/https (outlook anywhere).

For this article I am going to skip the installation of each server role and just work with the configuration. The lab consists of 1 DC, 1 CAS/Hub and 1 MBX server running Windows 2003 and Exchange 2007 SP1.

Rpc/http was first introduced with Exchange 2003 and has been renamed with Exchange 2007 to Outlook Anywhere. In order to use this functionality with Exchange we must install the RPC over HTTP Proxy networking component on a server (recommened on your Exchange server).

What does this network componet do for us?
RpcProxy.dll is an Internet Server API (ISAPI) that runs in Internet Information Services (IIS). RpcProxy.dll listens for activity on the RPC virtual directory

The rpcproxy.dll requires authentication and will not pass anonymous request even if IIS is configured for anonymous authentication.

When an Outlook clients typicaly communicates with an Exchange server the client attempts to connect via Mapi Rpc, with Rpc/http Outlook makes a http connection to the rpc proxy server which strips the http and send the rpc request to tha appropriate Exchange server.

Installing Rpc/http networking componet:
1. From the Add/Remove programs select Windows components
2. Select Networking Services then details

3. Select Rpc over http proxy -> OK

4. Click Next to start the installation
5. Click Finish to complete the installation

How do we verify the installation?
1. Validate you have 2 virtual directories installed called RPC and RPC with Cert
The 2 new virtual directories points to C:\WINDOWS\System32\RpcProxy which is the location of the rpcproxy.dll

2. Verify the RPC Proxy server extension is allowed in IIS (this will be enabled after you install the component)

Later we will look at a tool called rpc dump that can be used to troubleshoot connectivity problems.

After we have installed our CAS server we need to enable Outlook Anywhere which can be done in 1 of two ways, 1. EMS (command line) or 2. EMC (gui)

1. EMS
To work with Outlook anywhere via EMS we would use the the following set of commands Get-OutlookAnywhere,Set-OutlookAnywhere,Enable-OutlookAnywhere.

A. Open EMS
B. Now we will use the Enable-OutlookAnywhere command to enable this feature
–The following switches are available for the command
** Pre SP1
Enable-OutlookAnywhere -DefaultAuthenticationMethod -ExternalHostname -SSLOffloading <$true $false> [-Confirm []] [-DomainController ] [-Server ] [-TemplateInstance ] [-WhatIf []]
** Post SP1
Enable-OutlookAnywhere -ClientAuthenticationMethod -ExternalHostname -SSLOffloading <$true $false> [-Confirm []] [-DomainController ] [-IISAuthenticationMethods ] [-Server ] [-TemplateInstance ] [-WhatIf []]

For this demo I used the following command
[PS] C:\>Enable-OutlookAnywhere -Server vmcashub -SSLOffloading:$false -ExternalHostname vmcashub.vn.local -ClientAuthenticationMethod basic -IISAuthenticationMethods basic

*Note if you use the defaultauthenticationmethod is will override the clientauth and IISAuth **
*Setting the ClientAuthMethod is what autodiscover will user to configure the client*

Enable-OutlookAnywhere
http://technet.microsoft.com/en-us/library/bb124993%28EXCHG.80%29.aspx

We can ouse the Get-OutlookAnywhere command to view our configuration
Get-OutlookAnywhere
http://technet.microsoft.com/en-us/library/bb124263%28EXCHG.80%29.aspx

Once we have enable Outlook Anywhere any future modification will be done with the Set-OutlookAnywhere command (i.e. changing authentication)
Set-OutlookAnywhere http://technet.microsoft.com/en-us/library/bb123545%28EXCHG.80%29.aspx

2. EMC
a. Open EMC –> Server configuration –> client Access Server
b. Select the CAS server you want to enable
c. Click the button to Enable Outlook Anywhere

d. Enter the External name that clients will use to connect to your Exchange Server, note this name should match the name on your certificate. Select the authentication method of choice

e. On the Completion Wizard Click finish

As you saw there is very little configuration when enabling Outlook Anywhere we have 3 options
1. Url 2. authentication and 3. Enable SSL offloading

Once we have Enabled Outlook Anywhere we can validate the registry key has configured correct ports for communication to our mailbox servers. Note only the name listed in the key can be used by clients to connect and you will notice there is no IP address listed so testing via IP will fail through the rpc proxy.

1. Click start Run
2. Regedit – this will open the registry editor
3. HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\RpcProxy
4. Notice the Dword called Enabled set to 1
5. There is a String value called “ValidPorts”
VMMBX1:6001-6002;VMMBX1:6004;vmmbx1.vm.local:6001-6002;vmmbx1.vm.local:

**Note if the port are not listed it could take up to 15 minutes to update or you can restart the Microsoft Exchange Service Host **
we can see that the rpc proxy connects to our mailbox server on the following port 6001-6002 and 6004. Each port is defined below

Microsoft Exchange Information Store service: 6001
referral service of DSProxy: 6002
proxy service of DSProxy: 6004
Active Directory (if the global catalog server and Exchange Server are on the same server): 6004

In our client testing we can validate the proxy making connections to our mailbox server with these ports.

Configure a client:
Manually
1. Create a New profile
2. check the manually configure box at the bottom

3. Select Microsoft Exchange

4. Input your mailbox server name (this could be FQDN or Netbios Name)

5. Click the “More settings” button

6. Select the connections tab

7. Check the box “Connect to Microsoft Exchange using HTTP” -> Exchange Proxy Settings

8. Input the url of your Outlook Anywhere server, check the appropriate authentication

9. Click OK and finish the profile

2. Autodiscover
** if autodiscover is not working please refer to my blog on autodiscover **
http://exchange-genie.blogspot.com/2007/07/autodiscover-ad-attribute.html

1. Click Add

2. Give a name for the profile

3. Input the display name and users email address and password
**Note a domain logged on user will auto populate the information**

5. Logon to your mailbox

6. Click Finish

Validation:
That we have installed all the components we need to do some testing to validate we have access to our mail.

Check Outlook connection status:
1. Log onto Outlook
2. in the System tray hold the CTRL key and right click the Outlook icon
3. select connection status

You can see our connection shows https, which validates we are going through the CAS server and proxying our connection.

Netstat:
We can use netstat to show our connection for each hop Client-> CAS -> Mbx -> DC

Open a command windows on the CAS server and type netstat -na

You can see from the screen shot above that our client 192.168.1.5 is making connections are port 443 to our CAS server 192.168.1.101

As noted in the connections window from Outlook you can see that the Outlook client makes multiple connections to the CAS server on port 443 and this is validated in the netstat

CAS -> MBX
On the mailbox server open a command window and type Netstat -na

The first item to note is our mailbox server listening on ports 6001,6002, and 6004 which is the ports used by rpc/http to make connections

Below you can see our mbx server 192.168.1.102 receiving connections on port 6001 and 6004 from our CAS server 192.168.1.101

MBX -> DC
On our domain controller we can see Ldap 389 and GC 3268 ports with connections from both our CAS server and MBX server.

Packet Captures:
We can use a tool like NetMon or WireShark to perform network captures on each hop as well to validate our traffic between each node. We must note this is encrypted traffic so we will only see sessions between the nodes

This capture is run on the XP client and we can see TLS communication between our client 192.168.1.5 and our CAS 192.168.1.101

This capture show communication from the CAS 192.168.101 to the mailbox server on port 6001/6004

See the highlighted section showing a destination port 6001 from the CAS to the MBX server

See the highlighted section showing a destination port 6004 from the CAS to the MBX server

Mailbox Server -> DC/GC
Below we can see our mailbox server making connections to the DC Ldap port 389

RPCPing:

RpcPing is a utility that we can use to troubleshoot or validate that our rpc proxy is working properly.
Rpc ping is a command line tool that can be found in the Windows 2003 resource kit http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en We can use this tool to test rpc connectivity through an rpc proxy server which is used for Outlook Anywhere.

You can use this MS article to assist with this utility http://support.microsoft.com/kb/831051

1. Open a command line to the resource kit directory

2. Lets connect to port 6001 =store

rpcping -t ncacn_http -s vmmbx1.vm.local -o RpcProxy=mail.vm.local -P “brian.tirch,vm.local,*” -I “brian.tirch,vm.local,*” -H 1 -F 3 -v 3 -B msstd:mail.vm.local -e 6001 -u 10 -a connect

You can see we make a successful connection

3. Lets connect to port 6004 =DsProxy

rpcping -t ncacn_http -s vmmbx1.vm.local -o RpcProxy=mail.vm.local -P “brian.tirch,vm.local,*” -I “brian.tirch,vm.local,*” -H 1 -F 3 -v 3 -B msstd:mail.vm.local -e 6004 -u 10 -a connect

You can see we make a successful connection

These tests show us that we are properly connecting through the rpc proxy server to the correct ports associated with Outlook Anywhere.

reference the above MS article for a break down of the switches.

PerfMon:
Windows 2008 has added some additional perf counters that we can use with Rpc/Proxy that can assist in identifying connectivity and user load.

common issues:
1. Certificates – If the client machine does not trust the certificate that is being presented it will fail to connect. So if you are using self signed or self issued certificates you will need to deploy them to each client machine

http://technet.microsoft.com/en-us/library/bb124149%28EXCHG.80%29.aspx

 

Windows 2008 has added a number of new security enhancement from firewalls to a more secure version of IIS, with these new security settings the installation of Exchange 2007 SP1 is slightly different. You cannot install Exchange 2007 on Windows 2008 but only Exchange 2007 SP1.

Thanks to Paul Bowden of Microsoft I am going to post a few Xml files which can make your installation of Exchange 2007 SP1 easier on a Windows 2008 server. These file where not included with the Exchange 2007 release but will be included in future version of Exchange

No longer is powershell a download and install but Windows 2008 has included powershell in the OS and can be installed from a command prompt as you will see later in this blog.

Note: the following xml files are not included with Exchange 2007 you can choose to use them to simplify an installation or manually install each component.

Windows 2008 has added a new command line tool that allows an administrator to install any number of Windows components from a command line. To evoke this tool you would use the command ServerMangerCmd the -i switch tell the system to install.

For Example to install powershell on a Windows 2008 server you would type ServerManagerCmd -i PowerShell

There are 5 Xmil files to install componets, notice the Hub do not have any special requirements and the base is all that is needed to install those roles.

XML Files:
1. Exchange-base.xml
2. Exchange-Typical.xml
3. Exchange-CAS.xml
4. Exchange-Mbx.xml

** Please note I had to remove bracets to display the information on the page, see the screen shot for the correct format***

I have also labeled each row with a letter so I can refer to each line of the code

a:ServerManagerCmd Answer File compatible with Longhorn
b:Usage: ServerManagerCmd -ip Exchange-Base.xml
c:Contact: PBowden
d:ServerManagerConfiguration
E: Action=”Install” xmlns=”http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1“>
F:BASE: Install PowerShell feature
G:Feature Id=”PowerShell”
H:– PREPARESCHEMA: Install LDIFDE and other directory tools –
I:Feature Id=”RSAT-ADDS”
j:ServerManagerConfiguration

What does this file do?
The baseline file will install Powershell and the Directory tools for a Windows 2008 server, you can see in lines G and I calls to install those components.

to use this file I would open a command windows and type servermanagecmd -ip c:\exchange-base.xml

This would then install powershell and the Admin tools for Windows 2008

2. Exchange-Typical.xml
– ServerManagerCmd Answer File compatible with Longhorn Beta 3 –
- Usage: ServerManagerCmd -ip Exchange-Typical.xml –
– Contact: PBowden –
ServerManagerConfiguration Action=”Install” xmlns=”http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1“>
– BASE: Install PowerShell feature –
Feature Id=”PowerShell”
– PREPARESCHEMA: Install LDIFDE and other directory tools –
Feature Id=”RSAT-ADDS”
– CAS/MBX: Install the Web Server role with additional child components –
Role Id=”Web-Server”
RoleService Id=”Web-Metabase”
RoleService Id=”Web-Lgcy-Mgmt-Console”
– CAS: Install the three authentication types for OWA, GZip compression, plus Outlook Anywhere support –
RoleService Id=”Web-Basic-Auth”
RoleService Id=”Web-Digest-Auth”
RoleService Id=”Web-Windows-Auth”
RoleService Id=”Web-Dyn-Compression”
Feature Id=”RPC-over-HTTP-proxy”
ServerManagerConfiguration

A typical Exchange 2007 installation would constist of the hub,cas, and mbx role and as we can see this xmil file install the required Windows componets including the components of the Exchange-base.xml file.

The following components are install in the typical file:
Feature Id=”PowerShell”
Feature Id=”RSAT-ADDS”
Role Id=”Web-Server”
RoleService Id=”Web-Metabase”
RoleService Id=”Web-Lgcy-Mgmt-Console”
RoleService Id=”Web-Basic-Auth”
RoleService Id=”Web-Digest-Auth”
RoleService Id=”Web-Windows-Auth”
RoleService Id=”Web-Dyn-Compression”
Feature Id=”RPC-over-HTTP-proxy”

3. Exchange-CAS.xml
– ServerManagerCmd Answer File compatible with Longhorn
– Usage: ServerManagerCmd -ip Exchange-CAS.xml –
- Contact: PBowden -
ServerManagerConfiguration Action=”Install” xmlns=”http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1“>
– Install the Web Server role with additional child components -
Role Id=”Web-Server”
RoleService Id=”Web-Metabase”
RoleService Id=”Web-Lgcy-Mgmt-Console”
– Install the three authentication types for OWA, GZip compression, plus Outlook Anywhere support –

RoleService Id=”Web-Basic-Auth”
RoleService Id=”Web-Digest-Auth”
RoleService Id=”Web-Windows-Auth”
RoleService Id=”Web-Dyn-Compression”
Feature Id=”RPC-over-HTTP-proxy”

The Exchange-CAS.xml install the same components as the Exchange-Typical exceprt for powershell and the Adminsitration tools. This mean you would need to run the Exchange-base.xml file first or user the typical installation file which installs the same components.

4. Exchange-Mbx.xml
Exchange 2007 SP1 still requires a small amount of IIS components to be installed on the mailbox server.

ServerManagerConfiguration
Action=”Install” xmlns=”http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1“>
– Install the Web Server role with default child components –
Role Id=”Web-Server”
– Install the optional IIS6 Metabase and console –
RoleService Id=”Web-Metabase”
RoleService Id=”Web-Lgcy-Mgmt-Console”
ServerManagerConfiguration

5. Exchange-Edge.xml
The Exchange-Edge.xml installs ADAMServerManagerConfiguration Action=”Install” xmlns=”http://schemas.microsoft.com/sdm/Windows/ServerManager/Configuration/2007/1“>
– Install AD Lightweight Directory Services (aka ADAM) –
Role Id=”ADLDS”
ServerManagerConfiguration

Lets go ahead use the exchange-base.xml and Exchange-typical with the exchange-typical.xml

1. Launch a command window with Administrative rights

2. either run from the directory or specify the path of the xml file utilizing the servermanagecmd cli tool.

Servermanagecmd -ip exchange-base.xml

3. Reboot the computer

4. Run the command prompt as Administrator again and launch the exchange-typical.xml file

Notice the following components are installed

6. Run the Exchange 2007 sp1 setup as administrator

- this can be done from the command line or gui, since we already have a command prompt open I am going to use the comannd window to start the installation.

7. setup /m:install /r:h,c,m

This command will install the Hub,CAS, and mailbox role on our Windows 2008 server

8. reboot the server

9. validate the installation

**Please note there have a been a number of issue with rpc/https and Windows 2008 when Ipv6 is enabled see the link below on how to disable ipv6
http://www.microsoft.com/technet/network/ipv6/ipv6faq.mspx

Lets Logon to OWA

3. Select the correct address list – All rooms etc…

4. book room
I am going to select a date of Thursday, January 17, 2008 2:30 PM-3:30 PM.

Now lets create a 2nd meeting request

As you can see user should not require access to view a rooms availability directly with their calendar but should be using the free/busy information to find out when the resource is available. This reduces Administration on the room mailbox.