Exchange 2010 – Antivirus Exclusions

 

If you're deploying file-level scanners on Exchange 2010 servers, make sure that the appropriate exclusions, such as directory exclusions, process exclusions, and file name extension exclusions, are in place for both memory-resident and file-level scanning. This section describes directory exclusions, process exclusions, and file name extension exclusions for each server or server role

Directory Exclusions
Server role	Exclusion Type	Item(s)	Exclusions	Exclusion Consolidated Paths
Mailbox Server Role	File-Level	Databases	Command to Retrieve the location:   Get-MailboxDatabase -server <servername> | format-list *path*
		Log Files
		Checkpoints
		Database Content Indexes (default is same location as databases)
		Group Metrics files	%ExchangeInstallPath%\GroupMetricsExchangeInstallPath%\TransportRoles\Logs   and %ExchangeInstallPath%\Logging)
		Offline Address Book Files	%ExchangeInstallPath%\ExchangeOAB
		IIS System Files	%SystemRoot%\System32\Inetsrv
		Temporary Folder	Same Path where Eseutil.exe resides
		Mailbox database temporary folder	%ExchangeInstallPath%\Mailbox\MDBTEMP
		Any Exchange aware Anti-Virus Folders
		Mailbox Server that is a member of a Database Availability Group (DAG)	%Winnt%\Cluster
		Witness Server directories:  (Typically on the Hub Transport Server)	\\%SystemDrive%:\DAGFileShareWitnesses\<DAGFQDN>
Hub Transport Server Role	File-Level	Log Files:  Message Tracking, Connectivity logs,…	Default path:   %ExchangeInstallPath%\TransportRoles\Logs Command to Retrieve the location:  Get-TransportServer <serverName> | Format-List *logpath*,*tracingpath*	%ExchangeInstallPath%\TransportRoles\
		Pickup and Replay directories	Default Path:  %ExchangeInstallPath%\TransportRoles Command to Retrieve the location: Get-TransportServer <serverName> fl *dir*path*
		Queue database, checkpoint and log files	Default path:  %ExchangeInstallPath%\TransportRoles\Data\Queue
		Sender Reputation database, checkpoint, log files	Default Path:  %ExchangeInstallPath%\TransportRoles\Data\SenderReputation
		IP filter Database, Checkpoint, log files	Default Path:  %ExchangeInstallPath%\TransportRoles\Data\IpFilter
		Temporary Folders	Exchange Servere Temp folder:  TMP
			OLE Conversions:    %ExchangeInstallPath%\Working\OleConvertor
		Any Exchange aware Anti-Virus Folders
Edge Transport Server Role	File-Level	AD LDS log files	Default:  %ExchangeInstallpath%\TransportRoles\Data\ADAM
		Pickup and Replay directories	Default Path:  %ExchangeInstallPath%\TransportRoles Command to Retrieve the location: Get-TransportServer <serverName> fl *dir*path*	%ExchangeInstallPath%\TransportRoles\
		Queue database, checkpoint and log files	Default path:  %ExchangeInstallPath%\TransportRoles\Data\Queue
		Sender Reputation database, checkpoint, log files	Default Path:  %ExchangeInstallPath%\TransportRoles\Data\SenderReputation
		IP filter Database, Checkpoint, log files	Default Path:  %ExchangeInstallPath%\TransportRoles\Data\IpFilter
		Temporary Folders	Exchange Servere Temp folder:  TMP
			OLE Conversions:    %ExchangeInstallPath%\Working\OleConvertor
		Any Exchange aware Anti-Virus Folders
Client Access Server Role	File-Level	Servers using IIS 7.0:    Temporary files	"%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files"
		Servers using IIS 6.0:  Temporary files	"%SystemRoot%\IIS Temporary Compressed Files"
		IIS System Files	%SystemRoot%\System32\Inetsrv
			InetPub\logs\logfiles\w3svc
		Internet Related Sub Folders	%ExchangeInstallPath%\ClientAccess
		Servers with POP3:	%ExchangeInstallPath%\Logging\POP3
		Servers with IMAP4:	%ExchangeInstallPath%\Logging\IMAP4
		Temporary Folders for Conversions:	Exchange Servers Temp Folder:   TMP
			%ExchangeInstallPath%\Working\OleConvertor
Unified Messaging Server Role	File-Level	Grammer Files for different locales	%ExchangeInstallPath%\UnifiedMessaging\grammars
		Voice Prompts	%ExchangeInstallPath%\UnifiedMessaging\Prompts
		VoiceMail Files	%ExchangeInstallPath%\UnifiedMessaging\Voicemail
		Temporary Files	%ExchangeInstallPath%\UnifiedMessaging\temp
Forefront Protection for Exchange	File-Level	Forefront install folder	Default: "%Program Files%\Microsoft Forefront Security\Exchange Server"	%Program Files%\Microsoft Forefront Security\Exchange Server
		Archived Messages	Default:  "%Program Files%\Microsoft Forefront Security\Exchange Server\Data\Archive"
		Quarantined files	Default:  "%Program Files%\Microsoft Forefront Security\Exchange Server\Data\Quarantine"
		Antivirus Engine files	Default:  "%Program Files%\Microsoft Forefront Security\Exchange Server\Data\Engines\x86"
		Configuration Files	Default:  %Program Files%\Microsoft Forefront Security\Exchange Server\Data
Process Exclusions
Server role	Exclusion Type	Process exclusions
Set these for all Server Roles	Process-Exclusion	Cdb.exe	Microsoft.Exchange.Search.Exsearch.exe
		Cidaemon.exe	Microsoft.Exchange.Servicehost.exe
		Cluster.exe	MSExchangeASTopologyService.exe
		Dsamain.exe	MSExchangeFDS.exe
		EdgeCredentialSvc.exe	MSExchangeMailboxAssistants.exe
		EdgeTransport.exe	MSExchangeMailboxReplication.exe
		ExFBA.exe	MSExchangeMailSubmission.exe
		GalGrammarGenerator.exe	MSExchangeRepl.exe
		Inetinfo.exe	MSExchangeTransport.exe
		Mad.exe	MSExchangeTransportLogSearch.exe
		Microsoft.Exchange.AddressBook.Service.exe	MSExchangeThrottling.exe
		Microsoft.Exchange.AntispamUpdateSvc.exe	Msftefd.exe
		Microsoft.Exchange.ContentFilter.Wrapper.exe	Msftesql.exe
		Microsoft.Exchange.EdgeSyncSvc.exe	OleConverter.exe
		Microsoft.Exchange.Imap4.exe	Powershell.exe
		Microsoft.Exchange.Imap4service.exe	SESWorker.exe
		Microsoft.Exchange.Infoworker.Assistants.exe	SpeechService.exe
		Microsoft.Exchange.Monitoring.exe	Store.exe
		Microsoft.Exchange.Pop3.exe	TranscodingService.exe
		Microsoft.Exchange.Pop3service.exe	UmService.exe
		Microsoft.Exchange.ProtectedServiceHost.exe	UmWorkerProcess.exe
		Microsoft.Exchange.RPCClientAccess.Service.exe	W3wp.exe
Forefront Protection for Exchange Server	Process-Exclusion	Adonavsvc.exe	FscStatsServ.exe
		FscController.exe	FscTransportScanner.exe
		FscDiag.exe	FscUtility.exe
		FscExec.exe	FsEmailPickup.exe
		FscImc.exe	FssaClient.exe
		FscManualScanner.exe	GetEngineFiles.exe
		FscMonitor.exe	PerfmonitorSetup.exe
		FscRealtimeScanner.exe	ScanEngineTest.exe
		FscStarter.exe	SemSetup.exe

Exchange 2010 – NLB Client Access (on Virtual Machines)

 

 

This article begins, post VM creation and OS installation/Patching process.

Assumptions:

• Guest Operating System is Windows 2008 R2
• HyperV Host is running Windows 2008 R2
• Each VM guest has two network adapters presented to it.
• NLB Cluster will be in (UNICAST) Mode

Configuration Steps:

1. Configure Network Adapters
2. Configure Network Load Balancing
3. Validate Configuration
4. Decide on you DNS records for Client Access
   Reference: 

Scenario: Desired NLB Configuration

The image below illustrates the desired NLB topology/configuration for this article. 

Note:  This particular scenario the NLB and CorpNet networks are on the same network.  If we desired external access to the NLB cluster, the NLB and CorpNet would most likely be on seperate networks.

Configure Network Adapters

Note:  When running Unicast, the NIC that has NLB enabled will have its’ MAC Address overwritten (Each Node will share the MAC address assigned to the NLB Cluster).  Because of this there will be additional configuration required within HyperV for the assigned NLB network interfaces. 

1.  Install on the Guest VM Windows 2008R2, and install the latest patches and drivers.

2. Create DNS A-Record for the Cluster Name.  My cluster name is webmail.contoso.com

3. On each Guest, in Windows Rename the network connections accordingly.  I have mine as such:

4.  On each Guest VM, in Windows, Configure each Network Adapter based on your network address scheme.  The required configuration information for each Network adapter is as follows:

• NLB NIC: IP Address and Subnet Only Configured
  •        Metric:  20
  •        WINS:  Disable Netbios

IMPORTANT:  DO NOT MANUALLY select the “network load balancing (NLB) connection”!! This will happen automatically during the NL10.1.B Cluster creation process.  If its manually selected the NLB Cluster creation will not pick up this network interface as an option.  This image is merely to serve as a reference to remove all connections accept NLB and TCP.

• Corp Network NICn: Corporate network configuration (IP, GW, DNS). 
  •        Metric:    1
• Binding Order
  • Corp Network
  • NLB
  • Remote Access Connections
  • 
  • 

My Server NIC configuration:

CAS01

  

CAS02

5. Once the NICs are configured... Run an IPCONFIG /all and note the IP and MAC Address assignment for both Network Interfaces.

Note: Once the cluster is created, the designated cluster Network Interface will receive a new MAC Address, and NLB Property will be Enabled on the Network Interface (NLB) 

6.  IMPORTANT!!!     By default Windows 2008 has IP  Forwarding disabled.  In order for this configuration with TWO NLB NICs to work and Not Define a Gateway to adhere to best practices, you have to enable IP forwarding on the NLB NIC so that requests sent to it are forwarded to the other; otherwise backend communication will not function.  Below is the simple command line to run on each NLB Node.
Note:  Be sure to open the command prompt as “Run as Administrator”, also if you are running IPV6 make sure to substitute the ipv4 with ipv6.

netsh interface ipv4 set int “<NLB NIC NAME>” forwarding=enabled

My Scenario:    netsh interface ipv4 set int “NLB” forwarding=enabled

7.  Next proceed with creating and configuring the new NLB Cluster.

 

Install Client Access (in our case Hub and CAS) Role, Features, Apps, etc.

 

Installing the Front-end (HUB and CAS) – Loadbalanced using NLB

• Install Prerequisites/Roles/Features

Item	Info
Install Prerequisites	The servers that will hold the Exchange Server 2010 server roles have the following prerequisites: The servers need to be running on Windows Server 2008 or Windows Server 2008 R2; .Net framework 3.5 with SP1 needs to be installed; PowerShell 2.0 needs to be installed; Office 2007 Filter packs needs to be installed for the Hub Transport Server role and the Mailbox Server role; Http://go.microsoft.com/fwlink/?LinkId=123380 Make sure that after installing Windows on the servers that they are up-to-date with the latest hotfixes and service packs.
Install Roles/Features	From a Powershell Command Prompt (With elevated privileges) <prompt> Import-Module ServerManager <prompt> Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy,NLB –Restart After the servers have rebooted, we must open an elevated Windows PowerShell window again, and set the service to start automatically. This can be accomplished with the following command: Set-Service NetTcpPortSharing –StartupType Automatic Since we are going to install both the Hub Transport on these servers, we must also install the Microsoft Filter Pack.
Additional Configurations	I will then turn off the Internet Explorer Enhanced Security Configuration for Administrators. Go to the Server Manager, Scroll down to the Security Information

• Installing Exchange Client Access/Hub Server Role:  Automated Install

  Setup.com /mode:install /roles:ht,ca /ExternalCASServerDomain:webmail.contoso.com
  /LegacyRoutingServer:Ex2003srv.contoso.

 

Create and Configure Network Load Balancing Cluster

This process will detail the process for creating and configuring the NLB Cluster.

1.  Log into one of the Guest Virtual Machines (NLB Nodes). In my case Server1 (First node in the cluster)

2.  Right Click Network Load Balancing Manager, and select “RUN AS ADMINSTRATOR”.

3. In the console tree, right-click Network Load Balancing Clusters, and then click New Cluster.

4. In the Host box, type the computer name (CAS01.contoso.com) of the guest virtual machine that will be the first host of the cluster, and then click Connect. (Host Name, not cluster name)

5.  In the Interfaces available for configuring a new cluster list, select a network adapter for the NLB cluster, and then click Next.

6.  Under interfaces select NLB Network Interface.

Note:  If your NLB Network interface does not show up in the list, verify that the “Network Load Balancing” property is un checked within the network interface properties.  NLB will not pick up the network interface if that checkbox is already enabled.

7.  On the New Cluster: Cluster IP Addresses screen, define the virtual IP address. In my case its the IP Address assigned to

webmail.contoso.com  A-Record (192.168.1.130) for the NLB cluster.

Important:  Note the MAC address in the Network Address property, and then click Next. You will use this MAC address later.

8.  Under Cluster operation mode, click Unicast, and then click Next.

9. Complete the rest of the NLB configuration, and then shut down the virtual machine.

10.  At this point you have a single node within the NLB Cluster, and the MAC Address has been changed.  To verify, run an IPCONFIG /ALL, and check to see if the NLB Network Connection changed from what was previously noted, to a new MAC Address.  In my case, mine changed from (Previous MAC: 00:15:5D:CC:16:5E to 02:BF:0A:01:0A:A0).

11.  If you didn't do it in step 7, be sure to note the new MAC Address, and shutdown the Node (Server1).

12.  Once the Guest (Server1) is shutdown, open HyperV Manager and Select the Server1 > Settings > Network Adapter (The one assigned to NLB).

13.  Under MAC Address, set the MAC Address to STATIC, and enter the MAC Address assigned to the NLB Network Interface (Note earlier).

15.  Next select “Enable spoofing of MAC addresses”, and select apply. 

Add the second VM to the NLB Cluster

1. Continuing from step 15, startup the VM (CAS01) and log into Windows.

2.  Open Network Load Balancing Manager (RUN AS ADMINISTRATOR).

3.  Right click the NLB cluster, and then click Add Host To Cluster.

4.  Specify the name of the new host (CAS02), and then click Connect. The network adapters that are available for the host are listed at the bottom of the dialog box.

5.  Click the network adapter that you want to use for Network Load Balancing (In my case NLB), and then click Next.

6.  The IP address that is configured on this network adapter is the dedicated IP address (192.168.1.132) for this host.

7.  Complete the rest of the NLB configuration, and then shut down the virtual machine (CAS02).

8.  Once the Guest (CAS02) is shutdown, open HyperV Manager and Select the CAS01 > Settings > Network Adapter (The one assigned to NLB).

9.  Under MAC Address, set the MAC Address to STATIC, and enter the MAC Address assigned to the NLB Network Interface (Note earlier).

10.  Next select “Enable spoofing of MAC addresses”, and select apply.

11. Next, Start the virtual machine (CAS02).

12. Open Network Load Balancing Manager.

13.  Verify that the NLB cluster is up as well as both nodes.

14.  At this point you now have a two-node NLB Cluster, each node sharing the same MAC address on the NLB network interface.

 

Configure Client Access Array

After the NLB cluster, Exchange is installed you can

Previous Exchange versions (Exchange 2000/2003) did not support to the use the front-end server by internal MAPI clients. They were connected directly to internal Back-End servers via MAPI over RPC. With the introduction of Exchange server 2007 this limitation has decreased significantly. Client Access Server worked for most protocols except MAPI clients.

With Exchange Server 2010 all protocols should go through the Client Access Server and cannot connect to Mailbox servers by MAPI clients directly. This has been done by introducing a new Client Access Server(CAS) service known as the RPC Client Access service.

To configure Exchange Server 2010 CAS array, you should follow the five steps mentioned bellow.

1. You must configure internal DNS entry for the name of the CAS array. This name must be unique for the internal network.
2. You must configure Network Load Balancing. In this case i use Windows Network Load Balancing technology.
3. Create the new Client Access Array.
4. Configure a mailbox database to use Cas Array 
5. Verify the Autodiscover services is working with CAS Array. (This step is optional, but it would be good to verify this)

 

1. To create the ClientAccessArray , Launch the Exchange 2010 Management Shell.  Run the following cmdlet:

New-ClientAccessArray -Name “Internal CAS Array” -FQDN webmail.contoso.com

One ClientAccessArray can be created per Active Directory site and, once it has been created, new mailbox databases will automatically detect its existence and configure themselves to use it.  However, for any mailbox databases that have already been created, you must update the RPCClientAccessServer attribute on each database to configure client mailboxes hosted on these databases to also use the ClientAccessArray.

Run the following cmdlet:

Set-MailboxDatabase “NAME_OF_DATABASE” -RPCClientAccessServer webmail.contoso.com

Note that you could also set the RPCClientAccessServer attribute by running Get-MailboxDatabase | Set-MailboxDatabase -RPCClientAccessServer internalCASArray.client.local and it would configure this attribute for all mailbox databases in the organization.  If you have multiple sites, you would want to restrict this.

  4.  Check the output of the following cmdlet to confirm that the RPCClientAccessServer attribute was set properly for the appropriate databases:

Get-MailboxDatabase | Select Name,RPCClientAccessServer | fl

Once the above steps have been completed, try creating a MAPI profile for a user hosted in Exchange 2010.  Enter your load balanced name (internalCASArray.client.local), a username, and click Check Name.  You should see your load balanced name remain and not be replaced by one of your underlying CAS servers!

 

More info

Autodiscover Troubleshooting: 
http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_3002-Exchange-2007-2010-Web-services-and-Autodiscover-Ultimate-Troubleshooting-Guide.html 

Configuring the clientAccessArray:  http://howtoexchange.wordpress.com/2009/12/16/configuring-client-access-array-for-exchange-2010-walkthrough/

Exchange 2010 Rollup Installation Nightmare

 

 

Many people feel that installation of Exchange Update Rollup is a nightmare, and I agree; however I have created a checklist to step through to make sure your Rollup installs successfully on the Exchange 2010 Server

Pre-Install Check list is below:

Known Issues & Pre Installation Checklist

0. Disable User Access Control (Optional)

You can save yourself the hassle of experiencing installation failures, and disable UAC. However it is not always an option, because there may be an outage if the servers are not fault tolerant, etc..

IMPORTANT:  If you are going to disable UAC (Which is not appealing to many), make sure that they proper steps are taken for the restart.

If you dont feel like disabling UAC temporarily, then you can try to run the installation “RUN AS ADMINISTRATOR”.  .

Note:  U can re-enable UAC after rollup installs.

1. Previous Interim Update (IU) Exists, Remove/Uninstall

Microsoft releases critical IUs for Exchange outside the Rollup schedule and can be obtained by contacting PSS. If you attempt to install the Rollup prior to removing the IU, you may get an error.

Prevention Step: Any installed IUs must be removed prior to applying a Rollup.

2. Permission Required

It is recommended to use the same account which was used to install Exchange server while installing Update Rollups.

If you have to use different account then make sure that you have highest permission like Exchange Organization Admin and a member of Local Admin group of Exchange server.

3. Do you have CAS to CAS Proxying deployed?

Apply the update rollup to the Internet-facing Client Access servers before you apply the update rollup to the non-Internet-facing Client Access servers.

4. Do you have Outlook Web Access customization?

When you apply an update rollup package, the update process will copy over the OWA files if it is necessary. If you have modified the Logon.aspx file or other OWA files, the customizations will be overwritten to ensure that OWA is updated correctly.

Prevention Step: Always make a backup copy of any customized Outlook Web Access files before you apply the update rollup.

After you apply the update rollup package, re-create Outlook Web Access customization in Logon.aspx.

5. Status of IPv6

Do you have IPv6 enabled in “Local Area Connection”? If you have IPv6 network and ticked/enabled in Local Area Connection, then it is fine.

But if you do NOT have IPv6 network and somehow unticked/disabled in Local Area Connection, follow below steps before Update Rollup installation.

• Enable IPv6 in Local Area Connection.
• Use Registry Editor and add registry key to completely disable IPv6 on a Windows Server 2008
  http://www.windowsreference.com/networking/disable-ipv6-in-windows-server-20008-full-core-installation/ 

This may cause Exchange services to start or from changing ‘Startup Type’ (disabled to Automatic) after installation.

6. Lack of Internet Connectivity

You may experience long installation times and you may receive the following message:
“Creating Native images for .Net assemblies”

This issue occurs because the Exchange server issues network requests to connect to http://crl.microsoft.com/pki/crl/products/CodeSigPCA.crl and look up the certificate revocation list at NGEN time for each assembly that it compiles to native code.

Because the Exchange server is not connected to the Internet, each request must wait to timeout before moving on.

Prevention Step: Turn off the Check for publisher’s certificate revocation option on the server that is being upgraded. Follow these steps:

In Windows Internet Explorer –> Tools –> Internet Options –> Advanced tab
In the Security section, uncheck or clear the box for below tow options

“Check for publisher’s certificate revocation”
“Check for server certificate revocation”

It is considered safe to clear this security option in Internet Explorer if the computer is in a tightly controlled environment. After the setup has completed, turn on the Check for publisher’s certificate revocation option again

Further information can be found here…
Exchange 2007 managed services might time out during certificate revocation checks
http://msexchangeteam.com/archive/2008/07/08/449159.aspx

7. Unblock the Installation File

Note:  If you already disabled UAC, then you should not have to perform this step.

Another check is to see if the security properties and UNBLOCK.

8. Execute the Rollup Install from a command prompt “Run As Administrator”

IMPORTANT!   If the server you are about to apply the rollup to is a member of a DAG (Database Availability Group), you will have to execute additional procedures prior to the actual install of the rollup.  You DO NOT want active databases on the server while you are updating it.  So the active databases will have to be moved prior to the installation.  For a detailed procedure reference these links:

• Procedure: http://www.ucblogs.net/blogs/exchange/archive/2009/12/15/Installing-Exchange-2010-rollups-on-DAG-servers.aspx 
• Scripted procedure (also referenced in article above):  http://www.ucblogs.net/files/folders/powershell/entry139.aspx 

To kick off the installation:

1. Open the command prompt with elevated privileges (RUN AS ADMINISTRATOR). 
2. Navigate to the install location and execute the installation.
3. Once the installation completes, reset any of the UAC (If you disabled) back to their original settings, and reboot the machine.
4. If this was a DAG member, be sure to continue with the procedure/script to complete moving the active database back to their preferred owner.

Exchange 2010 3rd Party Certificate Issue “certificate status could not be determined because the revocation check failed”

 

 

PROBLEM:

After installing a 3rd party certificate on the Client Access Server(s) you receive the following status for the certificate

“The certificate status could not be determined because the revocation check failed”

 

SOLUTION:

Exchange uses WinHTTP to determine the validity of a certificate.  WinHTTP seems to use Web Proxy Auto-Discover Protocol (WPAD), so if you have a Proxy Access Control (PAC) file being specified through DHCP or DNS, it's going to pick that up and use it, regardless of what you have set up in IE for your proxy.
If you are not using a PAC file, it's possible that WinHTTP is not configured at all with proxy settings.
To determine which settings are currently in use by your Exchange server, log into it, start up an admin console and run the following command:

netsh winhttp show proxy

This should give us the current proxy info being used by Exchange.  If it's not showing the right server, you may want to try changing it using the next command:

netsh winhttp set proxy proxy-server="http=myproxy:88;https=sproxy:88" bypass-list= "*.foo.com"

Replace myproxy and sproxy with the name or IP of your own proxy server, and be sure to specify ports.  The bypass section is optional.

Command Reference:http://www.dbits.be/index.php/pc-problems/65-vistaproxycfg

NOTE: If you can't seem to get the command to run, and keep getting a message that says "command was not found: netsh winhttp set proxy-server", you may want to copy the command above directly into the command prompt and edit it from there.  I have tried this on 3 computers, and somehow can't get it to work if I type it in, but it works fine if I paste it in, then edit it.

Close, then re-open the Exchange Management Console and check the status of the certificate.

If the proxy settings are correct, and it still doesn't work, try the following commands to clear the OCSP/CRL cache:

certutil -urlcache ocsp delete

certutil -urlcache crl delete

Next, reboot your server, and open the Exchange Management Console back up to check the status of the certificate again.

Transition Exchange 2003 to Exchange 2010

 

This article will document the process for transitioning your existing Exchange 2003 environment to Exchange 2010.

Readiness Checks

First things first, you must validate whether your existing Exchange 2003 environment is ready for Exchange 2010.  To do this download/update and run the Exchange Best Practice Analyzer (ExBPA) tool.  Select the “Readiness” check from the list of tests to run. Remediate any issues flagged.  Following remediation, re-run the ExBPA tool and to verify the environment is ready.

Exchange Server 2010 can easily coexist in a Exchange Server 2003 organization as long as the Exchange Server 2010 prerequisites are met:

• Your domains and the domain controllers meet the system requirements in the "Network and Directory Servers" section of Exchange 2010 System Requirements.
• The Active Directory forest needs to be in Windows Server 2003 forest functionality mode;
• All domains that contain Exchange recipients need to be in Windows Server 2003 domain native mode;
• The Global Catalog Servers and the Active Directory Schema Master need to be at a minimum level of Windows Server 2003 SP1 (which equals to Windows Server 2003 R2);
• The Exchange 2003 organization needs to be running in ‘native mode’;
• Link State updates on all Exchange Server 2003 servers need to be disabled according to Microsoft knowledge base article KB 123456.
  • To disable the use of link state information by all connectors, you have to edit the registry on the Exchange server with the connectors in question:
    1. Go to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\RESvc\Parameters.
    2. Add a new REG_DWORD value in this key named SuppressStateChanges and set it to 1.
    3. Restart the system (or at least Exchange Server services).
• Namespace Changes
  • In Exchange Server 2010 this has changed. When a client connects to Exchange Server 2010, it actually connects to the Exchange Server 2010 Client Access Server and if the mailbox is still on the Exchange Server 2003 Mailbox Server then the client is redirected to the Exchange Server 2003 front-end server. This front-end server then handles the connection request. This automatically means the namespaces of the Exchange environment will change. For this article this means that the following namespaces are used:
    • https://webmail.contoso.com – This is used by all Internet clients that connect to the Exchange environment. This name is not different than in the Exchange Server 2003 namespace, but it will now point to the Exchange Server 2010 Client Access Server;
    • https://autodiscover.contoso.com – This is used by Outlook 2007 and (Outlook 2010) clients for autodiscover purposes;
    • https://legacy.contoso.com – This will be the new namespace for the Exchange Server 2003 front-end server. This automatically means that the namespace for the Exchange Server 2003 front-end server is going to change!

Prepare Active Directory

For a more in depth explanation of the process reference the following article:  http://technet.microsoft.com/en-us/library/bb125224.aspx 

Basic Steps:

Note:  PrepareAD will handle the SchemaPrep, legacyExchangePermissions, Adprep operations.

• Setup /prepareAD /Organization:
• setup /PrepareDomain

 

Installing Exchange 2010 Servers

Note: The installation process will reflect a Front-end (HT and CAS) and Backend (MBX) server topology.

Installing the Front-end (HUB and CAS)

• Install Prerequisites/Roles/Features

Item	Info
Install Prerequisites	The servers that will hold the Exchange Server 2010 server roles have the following prerequisites: The servers need to be running on Windows Server 2008 or Windows Server 2008 R2; .Net framework 3.5 with SP1 needs to be installed; PowerShell 2.0 needs to be installed; Office 2007 Filter packs needs to be installed for the Hub Transport Server role and the Mailbox Server role; Http://go.microsoft.com/fwlink/?LinkId=123380 Make sure that after installing Windows on the servers that they are up-to-date with the latest hotfixes and service packs.
Install Roles/Features	From a Powershell Command Prompt (With elevated privileges) <prompt> Import-Module ServerManager <prompt> Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy –Restart After the servers have rebooted, we must open an elevated Windows PowerShell window again, and set the service to start automatically. This can be accomplished with the following command: Set-Service NetTcpPortSharing –StartupType Automatic Since we are going to install both the Hub Transport on these servers, we must also install the Microsoft Filter Pack.
Additional Configurations	I will then turn off the Internet Explorer Enhanced Security Configuration for Administrators. Go to the Server Manager, Scroll down to the Security Information

• Installing Exchange Client Access/Hub Server Role:  Automated Install

  Setup.com /mode:install /roles:ht,ca /ExternalCASServerDomain:webmail.contoso.com
  /LegacyRoutingServer:Ex2003srv.contoso.com

 

Install Exchange Certificate for Exchange 2003 and Exchange 2010 Servers

Within this article we will not step through the process of creating an Exchange certificate or applying the Exchange certificate, because there are a number of different scenarios that warrant different processes.  In our case we generated a certificate using the “New Exchange Certificate” wizard in Exchange 2010.  This was accomplished through the Exchange Management Console > Server Configuration > CAS node > New Exchange Certificate in the right hand action pane.  

For the Exchange Certificate Configuration we defined the following data:
Certificate requirements will vary depending upon the environment. Whether its externally accessible, etc.. Generally 3rd party certificates are recommended for the FrontEnd Exchange 2010 Servers (CAS), so that all clients connecting will trust them (internal/External).

Exchange Configuration:

Outlook Web App is on the Intranet	webmail.contoso.com, <CASfqdn>
Outlook Web App is on the Internet	webmail.contoso.com
Exchange Active Sync is enabled	webmail.contoso.com
Exchange Web Services is enabled Outlook Anywhere is enabled	webmail.contoso.com

Certificate Domains:

webmail.contoso.com

autodiscover.contoso.com

legacy.contoso.com

<casFQDN>

enter the rest of the data according to you organizations requirements.

 

 

OWA 2010 needs to be configured for use with Exchange Server 2003;

During installation of the Exchange Server 2010 Client Access Server all settings have been configured for use on the Internet. The only thing that needs to be configured is the coexistence information for Outlook Web App. The Client Access Server needs to be configured in case a mailbox is still on Exchange Server 2003 and the client needs to be redirected to the Exchange Server 2003 front-end server.

On an Exchange Server 2010 server enter the following Management Shell Command:

Set-OWAVirtualDirectory <CASHUB01>\OWA -ExternalURL https://webmail.contoso.com/owa -Exchange2003URL https://legacy.contoso.com/exchange

This will make sure that when a user connects to Exchange Server 2010 Client Access Server for Outlook Web Access and the mailbox is still on Exchange 2003 the client will be redirected to the old Exchange Server 2003 front-end server.

 

 

Installing the Mailbox Server Role

Note:  This process assumes that a Database Availability Group (DAG) will be configured.

Item	Info
Install Prerequisites	The servers that will hold the Exchange Server 2010 server roles have the following prerequisites: The servers need to be running on Windows Server 2008 or Windows Server 2008 R2; .Net framework 3.5 with SP1 needs to be installed; PowerShell 2.0 needs to be installed; Office 2007 Filter packs needs to be installed for the Hub Transport Server role and the Mailbox Server role; Http://go.microsoft.com/fwlink/?LinkId=123380 Make sure that after installing Windows on the servers that they are up-to-date with the latest hotfixes and service packs.
Install Roles/Features	From a Powershell Command Prompt (With elevated privileges) <prompt> Import-Module ServerManager <prompt> Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth, Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server -Restart After the servers have rebooted, we must open an elevated Windows PowerShell window again, and set the service to start automatically. This can be accomplished with the following command: Set-Service NetTcpPortSharing –StartupType Automatic Since we are going to install both the Mailbox Server Role on these servers, we must also install the Microsoft Filter Pack.

 

Configuring Network Adapters

Two NICs should be installed on each Mailbox Server.  For our example we will use the following Network Connections:

• PROD (Connection to Production Network)
• REPLICATION  (Connected to the isolated Replication network)

Figure 1: Network connections

Let us first open the property page of the PROD interface. Here it is typically fine to leave the default settings as is. Optionally, you can uncheck QoS Packet Scheduler and Internet Protocol Version 6 (TCP/IP v6).

Figure 2: Properties of PROD interface

Open the property page of Internet Protocol Version 4 (TCP/IPv4). Here we have a static IP address configured as well as the other necessary settings (default gateway, subnet mask, and DNS server).

Figure 3: TCP/IP Version 4 Properties for the PROD interface

When you have configured the NIC correspondingly, close the property page by clicking OK twice.

It’s time to configure the network settings for the “REPLICATION” interface, so let us open the property page of the “REPLICATION” NIC. Uncheck “Client for Microsoft Networks” and “File and Printer Sharing for Microsoft Networks” as shown in Figure 4. In addition, you may optionally uncheck QoS Packet Scheduler” and Internet Protocol Version 6 (TCP/IPv6).

Figure 4: Properties for the REPLICATION interface

Now open property page of  REPLICATION network - “Internet Protocol Version 4 (TCP/IPv4)” and enter an IP address and subnet mask on the isolated replication subnet. Since this NIC solely is used for replication, seeding and heartbeats, you should not specify any default gateway or DNS servers.

Note:
If routing on the “REPLICATION” interface for some reason is necessary between the two servers, you should use static routes instead of specifying a default gateway.

Figure 5: TCP/IP Version 4 properties for the REPLICATION interface

Now click “Advanced” and uncheck “Register this connection’s addresses in DNS” and then click “OK” twice.

Figure 6: Advanced TCP/IP Properties for REPLICATION interface

Now that we have configured each NIC, we must make sure the “PROD” NIC is listed first on the binding order list. To bring up the binding order list, you must press the ALT key, and then select Advanced > Advanced Settings.

Figure 7: Selecting Advanced Settings in the Network Connection menu
If not already the case, move the PROD NIC to the top as shown in Figure 8.

Figure 8: Binding order for the network interfaces

Click OK and close the Network Connections window.

Note:
You should of course make sure the above steps are performed on each of the MBX servers.

Prepare your Storage

Create your Database and Log LUNS on your storage solution.  Make sure to assign each LUN disk identically on each MBX server.

For our demo purposes we have the following storage configuration:
Note:  By rights I would normally place the Exchange Binaries on a separate volume however for this demo it will be installed on the system volume.

Drive/Volume	Size	Directory
C:\ System	80GB	na
G:\   DBLUN1	500GB	G:\MDB1
H:\   LogLUN1	250GB	H:\MDB1LOG

Installing Exchange 2010 Mailbox Role

At this point you should have your Prerequisites installed, Windows updates applied, DAG created, Network setting applied and Storage prepared.   Next step is to install Exchange Server 2010 mailbox role onto the designated Exchange 2010 Mailbox Server(s).       This process is straight forward following the Wizard on the installation media.  If you desire to use the command line installation, the command is listed below.

Setup.com /Mode:Install /Roles:Mailbox /MdbName:MDB01 /DbFilePath:C:\Mailbox\MDB01\mdb01.edb LogFolderPath:C:\Mailbox\MDB1Log

Moving Exchange Database Paths

If you did not use the command-line above for specifying Database name, file and folder location for the first database, then you should go into the Exchange Management Console to Move and Rename each Mailbox database.  Even if you have used the command line install, you should verify the names and paths are correct.

To move and rename the Database(s):

1. Open Exchange Management Console > Organization Configuration > Mailbox.  Within the Database Management tab in the center pane, select the database you wish to move and rename.
2. Right click on the database, select “Move Database Path”.  The Move Database Path wizard will open.
3. Within the wizard change the path for the Database and Logs, so that they are placed in the proper LUNs created in the Prepare Storage section.  At this point you may also want to rename the database file name.
4. Once the file name is changed, Click “Move” button.
5. when Completed click “Finish” button.
6. Now you can rename the actual database name.  This is done by right click the Database within the console, select Properties, and Change the name of the database and click OK.

<Insert Image>

 

Creating the DAG:

Note: This process can be completed before or after the mailbox server is installated.

• Permissions Required to create the DAG:
  You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Database availability groups" entry in the High Availability Permissions topic.
  
• Creating the DAG using Exchange Management Shell:
  • Create the DAG, define a witness server, witness directory, and static IP address for DAG
    
    New-DatabaseAvailabilityGroup -Name DAG01 -WitnessServer EXHUB01 -WitnessDirectory C:\DAG01 -DatabaseAvailabilityGroupIPAddresses x.x.x.x
  • The IP is for the MAPI or CorporateNetwork 
    Add Mailbox Server(s) to the DAG
    Note:  Dont complete:Add Mailbox Server(s) process unless you have already installed Exchange 2010 Mailbox Role in the environment.  In our case we have not yet, so we will  -execute this command after Exchange Mailbox Role installation.
    
    Add-DatabaseAvailbilityGroupServer -Identity DAG01 -MailboxServer MBX01

   

  • Create DAG Network (for mailbox DB replication)
    
    New-DatabaseAvailabilityGroupNetwork -DatabaseAvailabilityGroup DAG01 -Name DAGNetwork01 -Subnets 10.10.2.0/24 -ReplicationEnabled:$true

  Note:  Dont complete:Add Mailbox Server(s) process unless you have already installed Exchange 2010 Mailbox Role in the environment.  In our case we have not yet, so we will execute this command after Exchange Mailbox Role installation.
  

   

  Note:  Adding the mailbox server(s) to the DAG will install the Failover Clustering Component on the servers.  This process may take a few minutes.
  

  • Check the configuration of the Database Availability Group.  Open the Exchange Management Shell and enter the following command.
    
    Get-DatabaseAvailabilityGroup | FL

<Insert Image cmd window>

Once complete open Failover Cluster Manager and check the resources

<Insert Image Failover CM> 

Check the configuration of the Database Availability Group.  Open the Exchange Management Shell and enter the following command.

Get-DatabaseAvailabilityGroup | FL

<Insert Image cmd window>

Adding Mailbox Database Copies

If you have multiple Exchange mailbox servers within your DAG you can create the Mailbox Database Copies.  If you are not planning on utilizing the DAG, then hopefully you did not create a DAG otherwise what would be the point.

To add mailbox database copies perform the following:

1. Open the Exchange Management Console > Organization Configuration > Mailbox > Database Management tab. 
2. Right click the Database you wish to create a copy, and select “Add Mailbox Database Copy” from the menu.
3. Click Browse button and select from the list of available Mailbox server you wish to maintain a copy on.
   
   
4. Once the server is selected, click “Add”.
5. When the wizard completes successfully, click Finish.
6. Now you can open the Properties of the Database and view the status of the “Database Copies” .
7. If you log on to the Mailbox Server that you added in step 3 above, you can navigate to DB and seeded and log files replicated.
   
   Log files replicate to the server holding the passive database copy.
   Database seeded

 

 

Configuring the Exchange 2010 Servers

When both Exchange servers are installed it is time to configure the Exchange environment properly before Exchange Server 2010 can be used and mailboxes can be moved. The following needs to be configured:

 

System Folder Replication

A new Public Folder database will also be automatically created on the new Mailbox Server. The hierarchy, which is the structure of all Public Folders will be automatically replicated between all Public Folder Databases in the entire organization. The content replication of the System Folders will have to be configured manually though.

To replicate the Offline Address Book and Free/Busy folders from Exchange Server 2003 to Exchange Server 2010:

1. open the Exchange System Manager on the Exchange Server 2003 server and navigate to the System Folders in the ‘Folders’ folder in the First Administrative Group Navigate to the first Offline Address Book (/o=<Exchange Org>/CN=….)folder, right click it and select “All Tasks…”. The next is to select “Manage Settings”.

If you want to toggle between the System Folders and the normal Public Folders, navigate to the Public Folders, right click the Public Folders and select “View System Folders” or “View Public Folders”.

1. The “Manage Public Folder Settings wizard” will appear. Click Next on the Welcome page and select the “Modify lists of replica servers”. Follow the wizard and add the Exchange Server 2010 Mailbox Server Public Folder Database  as a new replica. When finished, the folder and all its subfolders will be replicated to the Exchange Server 2010 Public Folder database.
2. Repeat this step for the EX:/o=<>  Offline Address Book folder and the Schedule+ Free Busy folder.

Note: When the “Manage Settings” option is not available you can select “Properties” and select the replication tab to add the Exchange Server 2010 Public Folder Database.

1. The (default) Public Folder that are located on the Exchange Server 2010 Mailbox Server should be replicated to the Exchange Server 2003 Mailbox Server. To accomplish this logon to the Exchange Server 2010 Mailbox Server, open the Exchange Management Console and navigate to the Tools node. Under the Tools node open the Public Folder Management Console.
2. Right click the Offline Address Book in the results pane, select Properties and click the Replication tab.

3.  Add the Exchange Server 2003 Mailbox Server to the replica list, the contents will now be replicated to the Exchange Server 2003 Mailbox Server. Be aware that Public Folder replication is a low priority mechanism, so it takes some time before both Public Folder databases are in sync.

4.  Repeat these steps for the Schedule+ Free/Busy folder.

Public Folder Replication

Following System Folder replication, you can move on to adding an Exchange 2010 MBX server as a replica to the public folders.

Open EMS and jump to path  drive:\Program Files\Microsoft\Exchange Server\V14\Scripts and run the script AddReplicaToPFRecursive.ps1
This will add replica of public folders on Exchange Server 2003 to Exchange Server 2010. This is the simplest way to add replica of all PFs to Exchange 2010 PF database.

Note:  I recommended performing the replication off hours.  This operation will generate significant traffic depending on the public folder data amounts.

C:\Program Files\Microsoft\Exchange Server\V14\Scripts>.\AddReplicaToPFRecursive.ps1 -TopPublicFolder "\" -ServerToAdd "exchange2010"

DONOT MOVE ONTO THIS NEXT STEP OF REMOVING THE 2003 REPLICAS UNTIL REPLICATION IS COMPLETE, AND YOU ARE COMFORTABLE WITH REMOVING 2003 AS A REPLICA.  I GENERALLY INCLUDE THIS STEP AFTER 2003 USERS HAVE BEEN MOVED OVER TO EXCHANGE 2010.

Once the replica is added the next step is to move the replica from Exchange 2003 to Exchange 2010. To do this, jump to scripts directory and run following command.

C:\Program Files\Microsoft\Exchange Server\V14\Scripts>.\MoveAllReplicas.ps1 -Server "Exchange2003" -NewServer "Exchange2010"

 

Offline Address Book Generation

 

Address List Conversion

RECOMMENDATION:  DO NOT DO THIS PART UNLESS YOU ARE CLOSE TO DECOMMISSIONING YOUR 2003 SERVERS.  EMAILADDRESS POLICIES THAT WILL NOT CONVERT WILL CAUSE PROBLEMS>

There is a major change in the way Address Lists were handled by Exchange 2003 and the way Exchange 2010 handles them. The most important thing that needs to be known before migrating the Address Lists to the Exchange 2010 server is to know that Exchange 2010 does not support the LDAP filters. The LDAP filters must be converted to OPATH filters before the Address Lists can be moved. If you have custom LDAP filters implemented to configure Address Lists make sure that you prepare the corresponding OPATH filters as well. Also, there is no GUI interface for upgrading or moving the Address Lists to Exchange 2010. This movement/upgrade has to be done using EMS.

 

Moving Mailboxes

Moving mailboxes from Microsoft Exchange Server 2003 Service Pack 2 (SP2) or later to Exchange Server 2010? Consider the following:

• The move process is performed offline, and end-users won't be able to access their mailboxes during the move.
• Perform the move from a server running Exchange 2010 by using the move request cmdlets in the Exchange Management Shell. You can't use Exchange System Manager on an Exchange 2003 server to move the mailboxes.
• You can't move mailboxes from Exchange 2003 Service Pack 1 (SP1) or earlier.
• Exchange 2003 doesn't have resource mailboxes. Instead, you must use shared mailboxes to represent resources. If you move a shared mailbox from Exchange 2003 to Exchange 2010, the move request creates the mailbox as a shared Exchange 2010 mailbox. After you move the mailbox to Exchange 2010, you can convert it to a resource mailbox. For more information, see Convert a Mailbox.

Don’t forget to update your LDAP filters to OPATH filters when transitioning from Exchange 2003 to Exchange 2010

 

Reference Article:  Dont Forget to Update you LDAP Filters to OPATH

A lot of posts have been done by the Microsoft Exchange Team to document why and how one should remember to convert any LDAP filter used in your Exchange 2003 environment to OPATH filtering.

For more info have a look here:

• OPATH recipient filtering for Exchange Server 2007
• Need help converting your LDAP filters to OPATH?
• Address List and EAP filter upgrades with Exchange Server 2007

Last month I was in Luxembourg, talking about Exchange 2010, and one of the attendees wanted to know if the script provided by Bill Long to convert LDAP to OPATH, was still valid to convert any LDAP filter to OPATH in an Exchange 2003-Exchange 2010 environment. I promised to blog the answer, which is, lucky enough: YES :-)

Environment

In my demo environment, I have an Exchange 2003 SP2 server, and I have just finished installing an Exchange 2010 RTM (Mailbox, CAS, HUB) server in that organization. As can be seen in the picture below:

I have the following address lists defined in my Exchange organization:

All Rooms, is a new address list, included within Exchange 2010, which includes all resources that have been designated as a a room in your organization. It is in this setup the only address list that can be managed using Exchange 2010 management tools.

Why do we need to convert from LDAP to OPATH?

As taken from the MsExchangeTeam blog, here it is:

OPATH is basis for the filtering syntax used by PowerShell, and is therefore the filtering syntax used by Exchange 2007. It replaces the complicated syntax of LDAP used in Exchange 2003, and will allow for filters which are easier to create and interpret.

When using the Exchange Management Console 2010 to edit any of the existing address lists (besides All Rooms), the following error message will pop-up:

Using the Exchange System Manager, no error pops up…except for the newly built-in address list All Rooms, which generates the following error when trying to edit it using the Exchange System Manager:

Convert from LDAP to OPATH

The conversion can be done using the Exchange Management Shell, and its cmdlet Set-AddressList, which will enable you to populate a value for the parameter RecipientFilter:

Converting the default Address Lists is not that complicated, for example converting the default address lists, you just need to run the following lines:

Set-AddressList “All Users” –IncludedRecipients MailboxUsers

Set-AddressList "All Groups" -IncludedRecipients MailGroups

Set-AddressList "All Contacts" -IncludedRecipients MailContacts

Set-AddressList "Public Folders" -RecipientFilter { RecipientType -eq 'PublicFolder' }

The Default Global Address List is a bit more complicated…

Set-GlobalAddressList "Default Global Address List" -RecipientFilter {(Alias -ne $null -and (ObjectClass -eq 'user' -or ObjectClass -eq 'contact' -or ObjectClass -eq 'msExchSystemMailbox' -or ObjectClass -eq 'msExchDynamicDistributionList' -or ObjectClass -eq 'group' -or ObjectClass -eq 'publicFolder'))}

Converting any custom built LDAP filter, is less easy, and that’s where the script can be a tremendous help!

Using the script

To download the script, click here!

Exchange 2010 Mailbox Role Setup Failure

 

 

Problem:

When you try to install the Microsoft Exchange Server 2010 Mailbox role, the installation process may fail.When this problem occurs, you receive the following error message in the Exchange Events:

EventID: 4
Source: MSExchange Configuration CmdLet –  Management Console
Details:

(PID 2324, Thread 27) Task Install-MailboxRole writing error when processing record of index 0. Error: Microsoft.Exchange.Management.Deployment.ScriptExecutionException: The following error was generated when "$error.Clear(); $arbUsers = @(get-user -Filter {lastname -eq "MSExchApproval 1f05a927-3be2-4fb9-aa03-b59fe3b56f4c"} -IgnoreDefaultScope -ResultSize 1); if ($arbUsers.Length -ne 0) { $mbxname = $arbUsers[0].name; $mbxs = @( get-mailbox -arbitration -Filter {name -eq $mbxname} -IgnoreDefaultScope -resultSize 1 ); if ( $mbxs.length -eq 0) { $dbs = @(get-MailboxDatabase -Server:$RoleFqdnOrName -DomainController $RoleDomainController); if ($dbs.Length -ne 0) { enable-mailbox -Arbitration -identity $arbUsers[0] -database $dbs[0].Identity; } } }" was run: "The LdapRecipientFilter "(&(&(|(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))(&(objectCategory=person)(!objectSid=*))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14)))(anr=wil*)))" on Address List or Email Address Policy "All Candidate" is invalid. Additional information: ANR isn't supported.". ---> Microsoft.Exchange.ProvisioningAgent.RusException: The LdapRecipientFilter "(&(&(|(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))(&(objectCategory=person)(!objectSid=*))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14)))(anr=wil*)))" on Address List or Email Address Policy "All Candidate" is invalid. Additional information: ANR isn't supported. ---> Microsoft.Exchange.ProvisioningAgent.LdapFilterException: ANR isn't supported.
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.SinglePropertyLdapFilter.ValidateAndSetAttributeType(String wsAttr, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.SinglePropertyLdapFilter.Parse(String wsFilterCond, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilter.Parse(String wsFilter, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilter.Parse(String wsFilter, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilter.Parse(String wsFilter, LdapFilterProvider provider)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.LdapFilterProvider.PrepareLdapFilter(String stringFilter)
   at Microsoft.Exchange.DefaultProvisioningAgent.Rus.EmailAddressPolicyHandler.UpdateRecipient(ADRecipient recipient)

This problem occurs because a recipient policy within the Exchange Organization contains a Ambiguous Name Resolution filter (ANR=<value).

Solution:

The solution is to discover which Recipient policy is throwing the error.  This will be listed within the details of the Event. In my case it was “Some Policy” Recipient Policy.  Figure out whether you require the recipient policy.  If not then delete the policy, wait for AD Replication and restart the Exchange 2010 installation.

If you still require the policy decide if you can create a new filter without using “ANR”.