Thursday, July 29, 2010

Exchange 2010 3rd Party Certificate Issue “certificate status could not be determined because the revocation check failed”

 

 

PROBLEM:

After installing a 3rd party certificate on the Client Access Server(s) you receive the following status for the certificate

“The certificate status could not be determined because the revocation check failed”

 

SOLUTION:

Exchange uses WinHTTP to determine the validity of a certificate.  WinHTTP seems to use Web Proxy Auto-Discover Protocol (WPAD), so if you have a Proxy Access Control (PAC) file being specified through DHCP or DNS, it's going to pick that up and use it, regardless of what you have set up in IE for your proxy.
If you are not using a PAC file, it's possible that WinHTTP is not configured at all with proxy settings.
To determine which settings are currently in use by your Exchange server, log into it, start up an admin console and run the following command:


netsh winhttp show proxy


This should give us the current proxy info being used by Exchange.  If it's not showing the right server, you may want to try changing it using the next command:


netsh winhttp set proxy proxy-server="http=myproxy:88;https=sproxy:88" bypass-list= "*.foo.com"


Replace myproxy and sproxy with the name or IP of your own proxy server, and be sure to specify ports.  The bypass section is optional.

Command Reference:http://www.dbits.be/index.php/pc-problems/65-vistaproxycfg

NOTE: If you can't seem to get the command to run, and keep getting a message that says "command was not found: netsh winhttp set proxy-server", you may want to copy the command above directly into the command prompt and edit it from there.  I have tried this on 3 computers, and somehow can't get it to work if I type it in, but it works fine if I paste it in, then edit it.

Close, then re-open the Exchange Management Console and check the status of the certificate.

If the proxy settings are correct, and it still doesn't work, try the following commands to clear the OCSP/CRL cache:

certutil -urlcache ocsp delete

certutil -urlcache crl delete

Next, reboot your server, and open the Exchange Management Console back up to check the status of the certificate again.

Thursday, July 22, 2010

Transition Exchange 2003 to Exchange 2010

 

This article will document the process for transitioning your existing Exchange 2003 environment to Exchange 2010.

Readiness Checks

First things first, you must validate whether your existing Exchange 2003 environment is ready for Exchange 2010.  To do this download/update and run the Exchange Best Practice Analyzer (ExBPA) tool.  Select the “Readiness” check from the list of tests to run. Remediate any issues flagged.  Following remediation, re-run the ExBPA tool and to verify the environment is ready.

Exchange Server 2010 can easily coexist in a Exchange Server 2003 organization as long as the Exchange Server 2010 prerequisites are met:

  • Your domains and the domain controllers meet the system requirements in the "Network and Directory Servers" section of Exchange 2010 System Requirements.
  • The Active Directory forest needs to be in Windows Server 2003 forest functionality mode;
  • All domains that contain Exchange recipients need to be in Windows Server 2003 domain native mode;
  • The Global Catalog Servers and the Active Directory Schema Master need to be at a minimum level of Windows Server 2003 SP1 (which equals to Windows Server 2003 R2);
  • The Exchange 2003 organization needs to be running in ‘native mode’;
  • Link State updates on all Exchange Server 2003 servers need to be disabled according to Microsoft knowledge base article KB 123456.
    • To disable the use of link state information by all connectors, you have to edit the registry on the Exchange server with the connectors in question:
      1. Go to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\RESvc\Parameters.
      2. Add a new REG_DWORD value in this key named SuppressStateChanges and set it to 1.
      3. Restart the system (or at least Exchange Server services).
  • Namespace Changes
    • In Exchange Server 2010 this has changed. When a client connects to Exchange Server 2010, it actually connects to the Exchange Server 2010 Client Access Server and if the mailbox is still on the Exchange Server 2003 Mailbox Server then the client is redirected to the Exchange Server 2003 front-end server. This front-end server then handles the connection request. This automatically means the namespaces of the Exchange environment will change. For this article this means that the following namespaces are used:
      • https://webmail.contoso.com – This is used by all Internet clients that connect to the Exchange environment. This name is not different than in the Exchange Server 2003 namespace, but it will now point to the Exchange Server 2010 Client Access Server;
      • https://autodiscover.contoso.com – This is used by Outlook 2007 and (Outlook 2010) clients for autodiscover purposes;
      • https://legacy.contoso.com – This will be the new namespace for the Exchange Server 2003 front-end server. This automatically means that the namespace for the Exchange Server 2003 front-end server is going to change!

Prepare Active Directory

For a more in depth explanation of the process reference the following article:  http://technet.microsoft.com/en-us/library/bb125224.aspx 

Basic Steps:

Note:  PrepareAD will handle the SchemaPrep, legacyExchangePermissions, Adprep operations.

  • Setup /prepareAD /Organization:
  • setup /PrepareDomain

 

Installing Exchange 2010 Servers

Note: The installation process will reflect a Front-end (HT and CAS) and Backend (MBX) server topology.

Installing the Front-end (HUB and CAS)

  • Install Prerequisites/Roles/Features
Item Info
Install Prerequisites

The servers that will hold the Exchange Server 2010 server roles have the following prerequisites:

  • The servers need to be running on Windows Server 2008 or Windows Server 2008 R2;
  • .Net framework 3.5 with SP1 needs to be installed;
  • PowerShell 2.0 needs to be installed;
  • Office 2007 Filter packs needs to be installed for the Hub Transport Server role and the Mailbox Server role; Http://go.microsoft.com/fwlink/?LinkId=123380

Make sure that after installing Windows on the servers that they are up-to-date with the latest hotfixes and service packs.

Install Roles/Features From a Powershell Command Prompt (With elevated privileges)

<prompt> Import-Module ServerManager
<prompt> Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy –Restart

After the servers have rebooted, we must open an elevated Windows PowerShell window again, and set the service to start automatically. This can be accomplished with the following command:

Set-Service NetTcpPortSharing –StartupType Automatic

Since we are going to install both the Hub Transport on these servers, we must also install the Microsoft Filter Pack.

Additional Configurations

I will then turn off the Internet Explorer Enhanced Security Configuration for Administrators.
Go to the Server Manager, Scroll down to the Security Information

  • Installing Exchange Client Access/Hub Server Role:  Automated Install

    Setup.com /mode:install /roles:ht,ca /ExternalCASServerDomain:webmail.contoso.com
    /LegacyRoutingServer:Ex2003srv.contoso.com

 

Install Exchange Certificate for Exchange 2003 and Exchange 2010 Servers

Within this article we will not step through the process of creating an Exchange certificate or applying the Exchange certificate, because there are a number of different scenarios that warrant different processes.  In our case we generated a certificate using the “New Exchange Certificate” wizard in Exchange 2010.  This was accomplished through the Exchange Management Console > Server Configuration > CAS node > New Exchange Certificate in the right hand action pane.  

For the Exchange Certificate Configuration we defined the following data:
Certificate requirements will vary depending upon the environment. Whether its externally accessible, etc.. Generally 3rd party certificates are recommended for the FrontEnd Exchange 2010 Servers (CAS), so that all clients connecting will trust them (internal/External).


Exchange Configuration:

Outlook Web App is on the Intranet webmail.contoso.com, <CASfqdn>
Outlook Web App is on the Internet webmail.contoso.com
Exchange Active Sync is enabled webmail.contoso.com
Exchange Web Services is enabled
Outlook Anywhere is enabled
webmail.contoso.com

Certificate Domains:

webmail.contoso.com
autodiscover.contoso.com
legacy.contoso.com
<casFQDN>

enter the rest of the data according to you organizations requirements.

 

 

OWA 2010 needs to be configured for use with Exchange Server 2003;

During installation of the Exchange Server 2010 Client Access Server all settings have been configured for use on the Internet. The only thing that needs to be configured is the coexistence information for Outlook Web App. The Client Access Server needs to be configured in case a mailbox is still on Exchange Server 2003 and the client needs to be redirected to the Exchange Server 2003 front-end server.

On an Exchange Server 2010 server enter the following Management Shell Command:

Set-OWAVirtualDirectory <CASHUB01>\OWA -ExternalURL https://webmail.contoso.com/owa -Exchange2003URL https://legacy.contoso.com/exchange

This will make sure that when a user connects to Exchange Server 2010 Client Access Server for Outlook Web Access and the mailbox is still on Exchange 2003 the client will be redirected to the old Exchange Server 2003 front-end server.

 

 

Installing the Mailbox Server Role

Note:  This process assumes that a Database Availability Group (DAG) will be configured.

Item Info
Install Prerequisites

The servers that will hold the Exchange Server 2010 server roles have the following prerequisites:

  • The servers need to be running on Windows Server 2008 or Windows Server 2008 R2;
  • .Net framework 3.5 with SP1 needs to be installed;
  • PowerShell 2.0 needs to be installed;
  • Office 2007 Filter packs needs to be installed for the Hub Transport Server role and the Mailbox Server role;
    Http://go.microsoft.com/fwlink/?LinkId=123380

Make sure that after installing Windows on the servers that they are up-to-date with the latest hotfixes and service packs.

Install Roles/Features From a Powershell Command Prompt (With elevated privileges)

<prompt> Import-Module ServerManager
<prompt> Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,
Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server -Restart

After the servers have rebooted, we must open an elevated Windows PowerShell window again, and set the service to start automatically.
This can be accomplished with the following command:

Set-Service NetTcpPortSharing –StartupType Automatic

Since we are going to install both the Mailbox Server Role on these servers, we must also install the Microsoft Filter Pack.

 
Configuring Network Adapters

Two NICs should be installed on each Mailbox Server.  For our example we will use the following Network Connections:

  • PROD (Connection to Production Network)
  • REPLICATION  (Connected to the isolated Replication network)


Figure 1: Network connections

Let us first open the property page of the PROD interface. Here it is typically fine to leave the default settings as is. Optionally, you can uncheck QoS Packet Scheduler and Internet Protocol Version 6 (TCP/IP v6).


Figure 2: Properties of PROD interface

Open the property page of Internet Protocol Version 4 (TCP/IPv4). Here we have a static IP address configured as well as the other necessary settings (default gateway, subnet mask, and DNS server).


Figure 3: TCP/IP Version 4 Properties for the PROD interface

When you have configured the NIC correspondingly, close the property page by clicking OK twice.

It’s time to configure the network settings for the “REPLICATION” interface, so let us open the property page of the “REPLICATION” NIC. Uncheck “Client for Microsoft Networks” and “File and Printer Sharing for Microsoft Networks” as shown in Figure 4. In addition, you may optionally uncheck QoS Packet Scheduler” and Internet Protocol Version 6 (TCP/IPv6).


Figure 4: Properties for the REPLICATION interface

Now open property page of  REPLICATION network - “Internet Protocol Version 4 (TCP/IPv4)” and enter an IP address and subnet mask on the isolated replication subnet. Since this NIC solely is used for replication, seeding and heartbeats, you should not specify any default gateway or DNS servers.

Note:
If routing on the “REPLICATION” interface for some reason is necessary between the two servers, you should use static routes instead of specifying a default gateway.


Figure 5: TCP/IP Version 4 properties for the REPLICATION interface

Now click “Advanced” and uncheckRegister this connection’s addresses in DNS” and then click “OK” twice.


Figure 6: Advanced TCP/IP Properties for REPLICATION interface

Now that we have configured each NIC, we must make sure the “PROD” NIC is listed first on the binding order list. To bring up the binding order list, you must press the ALT key, and then select Advanced > Advanced Settings.


Figure 7: Selecting Advanced Settings in the Network Connection menu
If not already the case, move the PROD NIC to the top as shown in Figure 8.


Figure 8: Binding order for the network interfaces

Click OK and close the Network Connections window.

Note:
You should of course make sure the above steps are performed on each of the MBX servers.

Prepare your Storage

Create your Database and Log LUNS on your storage solution.  Make sure to assign each LUN disk identically on each MBX server.

For our demo purposes we have the following storage configuration:
Note:  By rights I would normally place the Exchange Binaries on a separate volume however for this demo it will be installed on the system volume.

Drive/Volume Size Directory
C:\ System 80GB na
G:\   DBLUN1 500GB G:\MDB1
H:\   LogLUN1 250GB H:\MDB1LOG
Installing Exchange 2010 Mailbox Role

At this point you should have your Prerequisites installed, Windows updates applied, DAG created, Network setting applied and Storage prepared.   Next step is to install Exchange Server 2010 mailbox role onto the designated Exchange 2010 Mailbox Server(s).       This process is straight forward following the Wizard on the installation media.  If you desire to use the command line installation, the command is listed below.

Setup.com /Mode:Install /Roles:Mailbox /MdbName:MDB01 /DbFilePath:C:\Mailbox\MDB01\mdb01.edb LogFolderPath:C:\Mailbox\MDB1Log

image

Moving Exchange Database Paths

If you did not use the command-line above for specifying Database name, file and folder location for the first database, then you should go into the Exchange Management Console to Move and Rename each Mailbox database.  Even if you have used the command line install, you should verify the names and paths are correct.

To move and rename the Database(s):
  1. Open Exchange Management Console > Organization Configuration > Mailbox.  Within the Database Management tab in the center pane, select the database you wish to move and rename.
  2. Right click on the database, select “Move Database Path”.  The Move Database Path wizard will open.
  3. Within the wizard change the path for the Database and Logs, so that they are placed in the proper LUNs created in the Prepare Storage section.  At this point you may also want to rename the database file name.
  4. Once the file name is changed, Click “Move” button.
  5. when Completed click “Finish” button.
  6. Now you can rename the actual database name.  This is done by right click the Database within the console, select Properties, and Change the name of the database and click OK.

<Insert Image>

 

Creating the DAG:

Note: This process can be completed before or after the mailbox server is installated.

  • Permissions Required to create the DAG:
    You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Database availability groups" entry in the High Availability Permissions topic.
  • Creating the DAG using Exchange Management Shell:
    • Create the DAG, define a witness server, witness directory, and static IP address for DAG

      New-DatabaseAvailabilityGroup -Name DAG01 -WitnessServer EXHUB01 -WitnessDirectory C:\DAG01 -DatabaseAvailabilityGroupIPAddresses x.x.x.x
    • The IP is for the MAPI or CorporateNetwork 
      Add Mailbox Server(s) to the DAG
      Note:  Dont complete:Add Mailbox Server(s) process unless you have already installed Exchange 2010 Mailbox Role in the environment.  In our case we have not yet, so we will  -execute this command after Exchange Mailbox Role installation.

      Add-DatabaseAvailbilityGroupServer -Identity DAG01 -MailboxServer MBX01

     

    • Create DAG Network (for mailbox DB replication)

      New-DatabaseAvailabilityGroupNetwork -DatabaseAvailabilityGroup DAG01 -Name DAGNetwork01 -Subnets 10.10.2.0/24 -ReplicationEnabled:$true

    Note:  Dont complete:Add Mailbox Server(s) process unless you have already installed Exchange 2010 Mailbox Role in the environment.  In our case we have not yet, so we will execute this command after Exchange Mailbox Role installation.

     

    Note:  Adding the mailbox server(s) to the DAG will install the Failover Clustering Component on the servers.  This process may take a few minutes.

    • Check the configuration of the Database Availability Group.  Open the Exchange Management Shell and enter the following command.

      Get-DatabaseAvailabilityGroup | FL

<Insert Image cmd window>

Once complete open Failover Cluster Manager and check the resources

<Insert Image Failover CM> 

Check the configuration of the Database Availability Group.  Open the Exchange Management Shell and enter the following command.

Get-DatabaseAvailabilityGroup | FL

<Insert Image cmd window>

Adding Mailbox Database Copies

If you have multiple Exchange mailbox servers within your DAG you can create the Mailbox Database Copies.  If you are not planning on utilizing the DAG, then hopefully you did not create a DAG otherwise what would be the point.

To add mailbox database copies perform the following:

  1. Open the Exchange Management Console > Organization Configuration > Mailbox > Database Management tab
  2. Right click the Database you wish to create a copy, and select “Add Mailbox Database Copy” from the menu.
  3. Click Browse button and select from the list of available Mailbox server you wish to maintain a copy on.

  4. Once the server is selected, click “Add”.
  5. When the wizard completes successfully, click Finish.
  6. Now you can open the Properties of the Database and view the status of the “Database Copies” .
  7. If you log on to the Mailbox Server that you added in step 3 above, you can navigate to DB and seeded and log files replicated.

    Log files replicate to the server holding the passive database copy.
    Database seeded

 

 

Configuring the Exchange 2010 Servers

When both Exchange servers are installed it is time to configure the Exchange environment properly before Exchange Server 2010 can be used and mailboxes can be moved. The following needs to be configured:

 

System Folder Replication

A new Public Folder database will also be automatically created on the new Mailbox Server. The hierarchy, which is the structure of all Public Folders will be automatically replicated between all Public Folder Databases in the entire organization. The content replication of the System Folders will have to be configured manually though.

To replicate the Offline Address Book and Free/Busy folders from Exchange Server 2003 to Exchange Server 2010:

  1. open the Exchange System Manager on the Exchange Server 2003 server and navigate to the System Folders in the ‘Folders’ folder in the First Administrative Group Navigate to the first Offline Address Book (/o=<Exchange Org>/CN=….)folder, right click it and select “All Tasks…”. The next is to select “Manage Settings”.

If you want to toggle between the System Folders and the normal Public Folders, navigate to the Public Folders, right click the Public Folders and select “View System Folders” or “View Public Folders”.

clip_image001

  1. The “Manage Public Folder Settings wizard” will appear. Click Next on the Welcome page and select the “Modify lists of replica servers”. Follow the wizard and add the Exchange Server 2010 Mailbox Server Public Folder Database  as a new replica. When finished, the folder and all its subfolders will be replicated to the Exchange Server 2010 Public Folder database.
  2. Repeat this step for the EX:/o=<>  Offline Address Book folder and the Schedule+ Free Busy folder.

Note: When the “Manage Settings” option is not available you can select “Properties” and select the replication tab to add the Exchange Server 2010 Public Folder Database.

  1. The (default) Public Folder that are located on the Exchange Server 2010 Mailbox Server should be replicated to the Exchange Server 2003 Mailbox Server. To accomplish this logon to the Exchange Server 2010 Mailbox Server, open the Exchange Management Console and navigate to the Tools node. Under the Tools node open the Public Folder Management Console.
  2. Right click the Offline Address Book in the results pane, select Properties and click the Replication tab.

clip_image002

3.  Add the Exchange Server 2003 Mailbox Server to the replica list, the contents will now be replicated to the Exchange Server 2003 Mailbox Server. Be aware that Public Folder replication is a low priority mechanism, so it takes some time before both Public Folder databases are in sync.

4.  Repeat these steps for the Schedule+ Free/Busy folder.

Public Folder Replication

Following System Folder replication, you can move on to adding an Exchange 2010 MBX server as a replica to the public folders.

Open EMS and jump to path  drive:\Program Files\Microsoft\Exchange Server\V14\Scripts and run the script AddReplicaToPFRecursive.ps1
This will add replica of public folders on Exchange Server 2003 to Exchange Server 2010. This is the simplest way to add replica of all PFs to Exchange 2010 PF database.

Note:  I recommended performing the replication off hours.  This operation will generate significant traffic depending on the public folder data amounts.

C:\Program Files\Microsoft\Exchange Server\V14\Scripts>.\AddReplicaToPFRecursive.ps1 -TopPublicFolder "\" -ServerToAdd "exchange2010"

DONOT MOVE ONTO THIS NEXT STEP OF REMOVING THE 2003 REPLICAS UNTIL REPLICATION IS COMPLETE, AND YOU ARE COMFORTABLE WITH REMOVING 2003 AS A REPLICA.  I GENERALLY INCLUDE THIS STEP AFTER 2003 USERS HAVE BEEN MOVED OVER TO EXCHANGE 2010.

Once the replica is added the next step is to move the replica from Exchange 2003 to Exchange 2010. To do this, jump to scripts directory and run following command.

C:\Program Files\Microsoft\Exchange Server\V14\Scripts>.\MoveAllReplicas.ps1 -Server "Exchange2003" -NewServer "Exchange2010"

 

Offline Address Book Generation

 

Address List Conversion

RECOMMENDATION:  DO NOT DO THIS PART UNLESS YOU ARE CLOSE TO DECOMMISSIONING YOUR 2003 SERVERS.  EMAILADDRESS POLICIES THAT WILL NOT CONVERT WILL CAUSE PROBLEMS>

There is a major change in the way Address Lists were handled by Exchange 2003 and the way Exchange 2010 handles them. The most important thing that needs to be known before migrating the Address Lists to the Exchange 2010 server is to know that Exchange 2010 does not support the LDAP filters. The LDAP filters must be converted to OPATH filters before the Address Lists can be moved. If you have custom LDAP filters implemented to configure Address Lists make sure that you prepare the corresponding OPATH filters as well. Also, there is no GUI interface for upgrading or moving the Address Lists to Exchange 2010. This movement/upgrade has to be done using EMS.

 

Moving Mailboxes

Moving mailboxes from Microsoft Exchange Server 2003 Service Pack 2 (SP2) or later to Exchange Server 2010? Consider the following:

  • The move process is performed offline, and end-users won't be able to access their mailboxes during the move.
  • Perform the move from a server running Exchange 2010 by using the move request cmdlets in the Exchange Management Shell. You can't use Exchange System Manager on an Exchange 2003 server to move the mailboxes.
  • You can't move mailboxes from Exchange 2003 Service Pack 1 (SP1) or earlier.
  • Exchange 2003 doesn't have resource mailboxes. Instead, you must use shared mailboxes to represent resources. If you move a shared mailbox from Exchange 2003 to Exchange 2010, the move request creates the mailbox as a shared Exchange 2010 mailbox. After you move the mailbox to Exchange 2010, you can convert it to a resource mailbox. For more information, see Convert a Mailbox.

Don’t forget to update your LDAP filters to OPATH filters when transitioning from Exchange 2003 to Exchange 2010

 

Reference Article:  Dont Forget to Update you LDAP Filters to OPATH
A lot of posts have been done by the Microsoft Exchange Team to document why and how one should remember to convert any LDAP filter used in your Exchange 2003 environment to OPATH filtering.

For more info have a look here:

Last month I was in Luxembourg, talking about Exchange 2010, and one of the attendees wanted to know if the script provided by Bill Long to convert LDAP to OPATH, was still valid to convert any LDAP filter to OPATH in an Exchange 2003-Exchange 2010 environment. I promised to blog the answer, which is, lucky enough: YES :-)

Environment

In my demo environment, I have an Exchange 2003 SP2 server, and I have just finished installing an Exchange 2010 RTM (Mailbox, CAS, HUB) server in that organization. As can be seen in the picture below:

Pic0649

I have the following address lists defined in my Exchange organization:

Pic0650

All Rooms, is a new address list, included within Exchange 2010, which includes all resources that have been designated as a a room in your organization. It is in this setup the only address list that can be managed using Exchange 2010 management tools.

Why do we need to convert from LDAP to OPATH?

As taken from the MsExchangeTeam blog, here it is:

OPATH is basis for the filtering syntax used by PowerShell, and is therefore the filtering syntax used by Exchange 2007. It replaces the complicated syntax of LDAP used in Exchange 2003, and will allow for filters which are easier to create and interpret.

When using the Exchange Management Console 2010 to edit any of the existing address lists (besides All Rooms), the following error message will pop-up:

Pic0651

Using the Exchange System Manager, no error pops up…except for the newly built-in address list All Rooms, which generates the following error when trying to edit it using the Exchange System Manager:

Pic0657

Pic0658

Convert from LDAP to OPATH

The conversion can be done using the Exchange Management Shell, and its cmdlet Set-AddressList, which will enable you to populate a value for the parameter RecipientFilter:

Pic0669

Converting the default Address Lists is not that complicated, for example converting the default address lists, you just need to run the following lines:

Set-AddressList “All Users” –IncludedRecipients MailboxUsers

Set-AddressList "All Groups" -IncludedRecipients MailGroups

Set-AddressList "All Contacts" -IncludedRecipients MailContacts

Set-AddressList "Public Folders" -RecipientFilter { RecipientType -eq 'PublicFolder' }

The Default Global Address List is a bit more complicated…

Set-GlobalAddressList "Default Global Address List" -RecipientFilter {(Alias -ne $null -and (ObjectClass -eq 'user' -or ObjectClass -eq 'contact' -or ObjectClass -eq 'msExchSystemMailbox' -or ObjectClass -eq 'msExchDynamicDistributionList' -or ObjectClass -eq 'group' -or ObjectClass -eq 'publicFolder'))}

Converting any custom built LDAP filter, is less easy, and that’s where the script can be a tremendous help!

Using the script

To download the script, click here!

Exchange 2010 Mailbox Role Setup Failure

 

 

Problem:

When you try to install the Microsoft Exchange Server 2010 Mailbox role, the installation process may fail.When this problem occurs, you receive the following error message in the Exchange Events:

EventID: 4
Source: MSExchange Configuration CmdLet –  Management Console
Details:

(PID 2324, Thread 27) Task Install-MailboxRole writing error when processing record of index 0. Error: Microsoft.Exchange.Management.Deployment.ScriptExecutionException: The following error was generated when "$error.Clear(); $arbUsers = @(get-user -Filter {lastname -eq "MSExchApproval 1f05a927-3be2-4fb9-aa03-b59fe3b56f4c"} -IgnoreDefaultScope -ResultSize 1); if ($arbUsers.Length -ne 0) { $mbxname = $arbUsers[0].name; $mbxs = @( get-mailbox -arbitration -Filter {name -eq $mbxname} -IgnoreDefaultScope -resultSize 1 ); if ( $mbxs.length -eq 0) { $dbs = @(get-MailboxDatabase -Server:$RoleFqdnOrName -DomainController $RoleDomainController); if ($dbs.Length -ne 0) { enable-mailbox -Arbitration -identity $arbUsers[0] -database $dbs[0].Identity; } } }" was run: "The LdapRecipientFilter "(&(&(|(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))(&(objectCategory=person)(!objectSid=*))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14)))(anr=wil*)))" on Address List or Email Address Policy "All Candidate" is invalid. Additional information: ANR isn't supported.". ---> Microsoft.Exchange.ProvisioningAgent.RusException: The LdapRecipientFilter "(&(&(|(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))(&(objectCategory=person)(!objectSid=*))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14)))(anr=wil*)))" on Address List or Email Address Policy "All Candidate" is invalid. Additional information: ANR isn't supported. ---> Microsoft.Exchange.ProvisioningAgent.LdapFilterException: ANR isn't supported.
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.SinglePropertyLdapFilter.ValidateAndSetAttributeType(String wsAttr, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.SinglePropertyLdapFilter.Parse(String wsFilterCond, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilter.Parse(String wsFilter, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilter.Parse(String wsFilter, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilter.Parse(String wsFilter, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilterProvider.PrepareLdapFilter(String stringFilter)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.EmailAddressPolicyHandler.UpdateRecipient(ADRecipient recipient)

This problem occurs because a recipient policy within the Exchange Organization contains a Ambiguous Name Resolution filter (ANR=<value).

Solution:

The solution is to discover which Recipient policy is throwing the error.  This will be listed within the details of the Event. In my case it was “Some Policy” Recipient Policy.  Figure out whether you require the recipient policy.  If not then delete the policy, wait for AD Replication and restart the Exchange 2010 installation.

If you still require the policy decide if you can create a new filter without using “ANR”.

Wednesday, July 14, 2010

NLB - Hyper-V Virtual Machines

This article begins, post VM creation and OS installation/Patching process.

Assumptions:

  • Guest Operating System is Windows 2008 R2
  • HyperV Host is running Windows 2008 R2
  • Each VM guest has two network adapters presented to it.
  • NLB Cluster will be in (UNICAST) Mode

Configuration Steps:

  1. Configure Network Adapters
  2. Configure Network Load Balancing
  3. Validate Configuration

Scenario: Desired NLB Configuration

The image below illustrates the desired NLB topology/configuration for this article. 

Note:  This particular scenario is used for an Intranet, so the NLB and CorpNet networks are on the same network.  If we desired external access to the NLB cluster, the NLB and CorpNet would most likely be on seperate networks.

NLBTopo

Configure Network Adapters

Note:  When running Unicast, the NIC that has NLB enabled will have its’ MAC Address overwritten (Each Node will share the MAC address assigned to the NLB Cluster).  Because of this there will be additional configuration required within HyperV for the assigned NLB network interfaces. 

1.  Install on the Guest VM Windows 2008, and install the latest patches and drivers.

2. Create DNS A-Record for the Cluster Name.  My cluster name is NLBCluster.contoso.com

image

3. On each Guest, in Windows Rename the network connections accordingly.  I have mine as such:
image

4.  On each Guest VM, in Windows, Configure each Network Adapter based on your network address scheme.  The required configuration information for each Network adapter is as follows:

  • NLB NIC: IP Address and Subnet Only Configured
      •        Metric:  20
      •        WINS:  Disable Netbios

IMPORTANT:  DO NOT MANUALLY select the “network load balancing (NLB) connection”!! This will happen automatically during the NLB Cluster creation process.  If its manually selected the NLB Cluster creation will not pick up this network interface as an option.  This image is merely to serve as a reference to remove all connections accept NLB and TCP.

image

  • Corp Network NIC: Corporate network configuration (IP, GW, DNS). 
      •        Metric:    1
  • Binding Order
      • Corp Network
      • NLB
      • Remote Access Connections
      • image
      • image

My Server NIC configuration:

Server1

 image Server2

image

5. Once the NICs are configured... Run an IPCONFIG /all and note the IP and MAC Address assignment for both Network Interfaces.

Note: Once the cluster is created, the designated cluster Network Interface will receive a new MAC Address, and NLB Property will be Enabled on the Network Interface (NLB) 

6.  IMPORTANT!!!     By default Windows 2008 has IP  Forwarding disabled.  In order for this configuration with TWO NLB NICs to work and Not Define a Gateway to adhere to best practices, you have to enable IP forwarding on the NLB NIC so that requests sent to it are forwarded to the other; otherwise backend communication will not function.  Below is the simple command line to run on each NLB Node.
Note:  Be sure to open the command prompt as “Run as Administrator”, also if you are running IPV6 make sure to substitute the ipv4 with ipv6.

netsh interface ipv4 set int “<NLB NIC NAME>” forwarding=enabled

My Scenario:    netsh interface ipv4 set int “NLB” forwarding=enabled

7.  Next proceed with creating and configuring the new NLB Cluster.

Create and Configure Network Load Balancing Cluster

This process will detail the process for creating and configuring the NLB Cluster.

1.  Log into one of the Guest Virtual Machines (NLB Nodes). In my case Server1 (First node in the cluster)

2.  Right Click Network Load Balancing Manager, and select “RUN AS ADMINSTRATOR”.

3. In the console tree, right-click Network Load Balancing Clusters, and then click New Cluster.

4. In the Host box, type the computer name (Server1.contoso.com) of the guest virtual machine that will be the first host of the cluster, and then click Connect. (Host Name, not cluster name)

5.  In the Interfaces available for configuring a new cluster list, select a network adapter for the NLB cluster, and then click Next.

6.  Under interfaces select NLB Network Interface.

Note:  If your NLB Network interface does not show up in the list, verify that the “Network Load Balancing” property is un checked within the network interface properties.  NLB will not pick up the network interface if that checkbox is already enabled.

7.  On the New Cluster: Cluster IP Addresses screen, define the virtual IP address. In my case its the IP Address assigned to

image

NLBCluster.contoso.com  A-Record (192.168.1.130) for the NLB cluster.

image

Important:  Note the MAC address in the Network Address property, and then click Next. You will use this MAC address later.

8.  Under Cluster operation mode, click Unicast, and then click Next.

9. Complete the rest of the NLB configuration, and then shut down the virtual machine.

10.  At this point you have a single node within the NLB Cluster, and the MAC Address has been changed.  To verify, run an IPCONFIG /ALL, and check to see if the NLB Network Connection changed from what was previously noted, to a new MAC Address.  In my case, mine changed from (Previous MAC: 00:15:5D:CC:16:5E to 02:BF:0A:01:0A:A0).

11.  If you didn't do it in step 7, be sure to note the new MAC Address, and shutdown the Node (Server1).

12.  Once the Guest (Server1) is shutdown, open HyperV Manager and Select the Server1 > Settings > Network Adapter (The one assigned to NLB).

13.  Under MAC Address, set the MAC Address to STATIC, and enter the MAC Address assigned to the NLB Network Interface (Note earlier).

15.  Next select “Enable spoofing of MAC addresses”, and select apply.
image

Add the second VM to the NLB Cluster

1. Continuing from step 15, startup the VM (Server1) and log into Windows.

2.  Open Network Load Balancing Manager (RUN AS ADMINISTRATOR).

3.  Right click the NLB cluster, and then click Add Host To Cluster.

4.  Specify the name of the new host (Server2), and then click Connect. The network adapters that are available for the host are listed at the bottom of the dialog box.

5.  Click the network adapter that you want to use for Network Load Balancing (In my case NLB), and then click Next.

6.  The IP address that is configured on this network adapter is the dedicated IP address (192.168.1.132) for this host.

7.  Complete the rest of the NLB configuration, and then shut down the virtual machine (Server2).

8.  Once the Guest (Server2) is shutdown, open HyperV Manager and Select the Server1 > Settings > Network Adapter (The one assigned to NLB).

9.  Under MAC Address, set the MAC Address to STATIC, and enter the MAC Address assigned to the NLB Network Interface (Note earlier).

10.  Next select “Enable spoofing of MAC addresses”, and select apply.

image

11. Next, Start the virtual machine (Server2).

12. Open Network Load Balancing Manager.

13.  Verify that the NLB cluster is up as well as both nodes.

14.  At this point you now have a two-node NLB Cluster, each node sharing the same MAC address on the NLB network interface.

NLBTopo-final

Windows 2008 and NETBIOS browsing

 

It has been reported that NETBIOS is on its way out; however as most have found out, it is still a critical part of most Windows Environments.  This article will explain issues that may surface during the implementation/upgrade/migration to Windows 2008 server environments.

When installing a new Windows 2008 server or upgrading an existing server to Windows 2008, the Computer Browser service is set to disabled by default.

Issue

If you upgrade the Domain Controller that has been assigned the PDC Emulator FSMO role over transfer that role to a Windows 2008 DC, you will see the domain wide NETBIOS network browse list shrink and remote subnet machines will disappear from the list.  Eventually you may only see computers from the local subnet in the network browse list.  If you have subnets with only one server and it is Windows 2008, then you may also see inconsistent local subnet browse lists due to clients taking a master browser role and they may be rebooted, turned off, etc.

Solution

To resolve this problem, you can either set the Computer Browser service to Automatic on the DC holding the PDC role, or move the PDC role to another DC that has the Computer Browser service started.  You will need File and Printer sharing On in the Network and Sharing Center, otherwise the Computer Browser service will fail to start since the required ports will not be open.  In a multiple subnet environment, make sure WINS is configured properly so that you have the proper NetBIOS name resolution.  After making the corrections, the computers holding the master browser roles will begin to populate the browse list for the entire network.

Additional Checks;

Registry and TCP/IP configurations on the DCs for Browser parameters.

  • TCP/IP Configuration:   Verify NetBIOS over TCP/IP is ENABLED
  • Registry parameters: 
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster = TRUE
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Browser\Parameters\MaintainServerList = AUTO

Note:  You should reboot the PDC after making the change.

Troubleshooting

Tools to help troubleshoot the NETBIOS Browsing Issues:

  • BROWSTAT.exe (Resource Kit)
  • NBTSTAT (Native to the Windows system)

 

Command Usage Checks Steps
net view view the browse list available to the client machines and the servers hosting WINS If a list of machines are presented, validate the which subnet the machines are located using “Ping”.  Does the subnet match that of the machine running the command?  Document a machines from different subnets to see what is displayed for each.  This will help in the troubleshooting process.

Some steps I use from a test machine:

  1. IPConfig /all
    • Verify WINS Servers
  2. IPConfig /FlushDNS
    • Flush DNS resolver cache
  3. NBTSTAT –n
    • Check Local Names table
  4. NBTSTAT -RR
    • Release and Refresh Registration
  5. net view
    • Check browser list
NBTSTAT –n

Local Name Table check status column for “Conflicts”.  If conflicts exist, you may have to clean up WINS.  Either remove the problem records or rebuild WINS DB (Easier to rebuild).

Note:  If status column lists Registered or Registering you can release and refresh the registration.  NBTSTAT –RR

Then check the NBTSTAT –n results.
Rebuild WINS DB>
1.  Stop WINS Service
2. Backup WINS DB to alternate location.
3.  Delete WINS directory contents
4.  Start WINS service, and the db will rebuild.
5.  Create necessary replication partners, but DONT pull from other possibly infected WINS DBs, unless they are cleaned prior.
browstat dn To get the transports bound to the interface(s) Use the correct interface number (ex. 1) for the next command.  Browstat getpdc 1 <Netbios domainName>  
browstat GETPDC 1 contoso Get the machine with PDC role Run this check from machines that cannot see the browser list properly, as well as the WINS servers themselves.  
browstat GETMASTER 1 contoso Get the master browser    

WINS REFERENCE MATERIAL: