Using Active Directory Module for Windows Powershell (part of Windows 2008 R2 Active Directory and downloadable for earlier versions of AD) use the following cmdlet to set all your user to have non-expiring passwords. Great for lab environments:
Get-ADUser | Set-ADAccountControl –PasswordNeverExpires $True
Or indeed, not working at all! I had the issue of it working one way only (On-Premise Exchange organization > Office 365) but the other way (cloud to on-premise) did not work at all.
The answer is shown in this video
http://www.microsoft.com/showcase/en/us/details/a16a9d39-416a-4b01-a88f-5ff511580424
This covers the reasons why Free/Busy (and the other federation features of MailTips, archive and move mailbox might not work both ways in a Hybrid Coexistence setup for Office 365 or between two Exchange on-premise organizations.
The reason I found was the Organization Relationship contained the wrong list of domains. There are three domains (at least) that are needed in the organization relationship. These are:
In the organization relationship on-premise (or Org A if you are doing two on-premise organizations) set the following domains after the relationship is created. This includes the primary SMTP namespace and the service namespace for the other organization. This can be set with the following Exchange Management Shell cmdlet:
Set-OrganizationRelationship -Identity "To Cloud" -DomainNames "service.fabrikam.com","fabrikam.com" -MailTipsAccessEnabled $True -MailTipsAccessLevel All -DeliveryReportEnabled $True –TargetOwaUrl https://outlook.com/owa/fabrikam.com -ArchiveAccessEnabled $True –MailboxMoveEnabled $True
In Org B (or on Office 365) use a similar cmdlet, but use the Exchange Delegation namespace and the primary SMTP domain. Also Office 365 does not let you set the MailboxMoveEnabled property to $True
Set-OrganizationRelationship -Identity "To On-premises" -DomainNames "exchangedelegation.fabrikam.com","fabrikam.com" -MailTipsAccessEnabled $True -MailTipsAccessLevel All -DeliveryReportEnabled $True -ArchiveAccessEnabled $True
Supposedly Service Pack 2 for Exchange 2010 will do all this and more for you with the Hybrid Configuration Wizard, but its always useful for troubleshooting to discover what changes and why when you run a wizard to do things!
To configure the CRM Email Router with Exchange 2010 you need to do the following. Not all of these points are clearly documented on the internet.
New-ManagementRoleAssignment –Name: "ApplicationImpersonation-CRM Router" -User: "CRM_Router@domain.com" –Role:"ApplicationImpersonation"
To enable single sign-on in Office 365 and a variety of other applications you need to provide a federated authentication system. Microsoft’s free server software for this is currently Active Directory Federation Server 2.0 (ADFS), which is downloaded from Microsoft’s website.
ADFS is installed on a server within your organisation, and a trust (utilising trusted digital certificates) is set up with your partners. If you want to authenticate to the partner system from within your environment it is usual that your application connects to your AFDS server (as part of a bigger process that is better described here: http://blogs.msdn.com/b/plankytronixx/archive/2010/11/05/primer-federated-identity-in-a-nutshell.aspx). But if you are outside of your organisation, or the connection to ADFS is made by the partner rather than the application (and in Office 365 both of these take place) then you either need to install ADFS Proxy or publish the ADFS server through a firewall.
This subject of the blog is how to do this via ISA Server or TMG Server. In addition to configuring a standard HTTPS publishing rule you need to disable Link Translation and high-bit filtering on the HTTP filter to get it to work.
Here are the full steps to set up AFDS inside your organisation and have it published via ISA Server – TMG Server is to all intents and purposes the same, the UI just looks slightly different:
ADFS should now work through ISA or TMG assuming you have configured ADFS and your partner organisations correctly!
This quick script will process all your user accounts in the domain and change the UPN for each of them to a new one, which you need to specify in the script in advance of running it. This script is useful for Office 365 Rich Co-Existence scenarios which require that the UPN (User Principal Name) for each account matches their email address.
Before running the below, add the UPN that you are going to use (your verified vanity domain in Office 365) to Active Directory Domains and Trusts and then copy the below to a text file, saving it as Update-UPN.ps1. Then run this script from an Exchange Management Shell.
$users = Get-User * -ResultSize Unlimited
foreach($user in $users)
{
$UPN = "$($user.sAMAccountName)@new.upn"
Write-Host "Setting " $UPN
$user | Set-User -UserPrincipalName $UPN
}
Tip: Comment out the Write-Host line with # if you do not want feedback on each user changed – it will make the script go much faster
Tip: For testing purposes change the * in the first line to the name of a test user or do something like test* to change all users starting with the word “test” in their username.
If you are configuring single sign-on for Office 365 then you will need a server running Active Directory Federation Services 2.0 (ADFS 2.0). When you install this you are asked for a URL that acts as an endpoint for the ADFS service, which if you are publishing that endpoint through a firewall such as TMG needs to be on a mutually trusted certificate as either the subject name or alternative subject name.
The documentation uses sts.yourdomain.com which means you need to have this as a valid name of the certificate. I use StartCom SSL, which provide cheap certificates (approx. $100 for as many certificates as you like), but to change a certificate to add an additional alternative subject name requires revoking the current cert, and that comes at additional cost.
So I have a certificate with lots of name on it for my domain, just not sts.mydomain.com so I set about changing the endpoint in ADFS 2.0
Firstly open the ADFS 2.0 administrative console and select the root note:
Click Edit Federation Service Properties in the Action Pane and modify the three values on the General tab:
After clicking OK, restart the AD FS 2.0 Windows Service.
After the restart, create a new Token-Signing Certificate and Token-Decrypting Certificate. These are self signed certificates. To allow you to add these you need to turn off automatic certificate rollover if enabled. This can be done from PowerShell using Set-ADFSProperties –AutoCertificateRollover $false and this cmdlet is available in Windows PowerShell Modules in the Administrative Tools menu.
To update Office 365 start the Microsoft Online Services Module for Windows PowerShell, installed as part of the Office 365 rich co-existence process. In this PowerShell window type Update-MsolFederatedDomain –DomainName yourFederatedDomain.com. You will also need to login to Office 365 in this window first (Connect-MsolService) and set PowerShell with the name of the ADFS server (Set-MsolADFSContext –Computer ADFS_ServerName). Type Get-MsolFederatedDomain –DomainName yourFederatedDomain.com to ensure that the returned URL’s and certificates are correct.
Now its time to update the TMG rule, or create a new one. The listener in TMG must have the same third party certificate and be for HTTPS with the Public Name matching the certificate subject/subject alternative name and the Path value set to /adfs/*. The To page needs to be set with the same URL and internal IP address of the ADFS 2.0 server.
And that should be it – after the Update-MsolFederatedDomain –DomainName yourFederatedDomain.com has completed both sides of the federation trust are aware of the certificate change and automatic login to http://outlook.com/yourFederatedDomain.com should work.
If you require delegates to approval all room bookings in Exchange 2010 and you have the following two settings set to True then rooms will automatically be approved
To require that rooms are approved by the delegate regardless of when the room is booked set AllRequestOutOfPolicy to False.
These settings require that AllBookInPolicy is False and that BookInPolicy and RequestInPolicy are both null.
You download and begin to install an Exchange Rollup Update only to find after waiting ages for it do the NGen stuff it fails, and on watching it closely you notice it fails on stopping services.
In the event log you are pointed at a website with information on verbose logging for MSI installations.
But you can forget that – the fix is easy! Start and administrative command prompt and run the rollup update from the command line! It will work first time (as long as the update msi file is actually copied to the local machine, it will typically not run from a copy on a network drive.
During a configuration of Blackberry Enterprise Server today I found that I was getting .DLL errors when trying to create a MAPI profile on the BES Server (v5.0.2) when running IEMSTest.
Well it was not the usual stuff – it ended up being the alias that had been assigned to the BESAdmin account. The policy at the company where I am installing Exchange 2010 is last_first@domain.com, but the BESAdmin account does not have a first or last name and so got an email address of _9c73@domain.com, and so though I could login in OWA, I could not do a MAPI login (IEMSTest or Outlook – because the alias was not BESAdmin as they default to).
Once I changed the SMTP Address to BESAdmin@domain.com then it all worked fine.
I have been sent a few emails from a client that start like this:
æ ¼tml> æ ¼ead> 猼tyleã°¾!-- .hmmessage P { margin:0px; padding:0px } body.hmmessage { font-size: 10pt; font-family:Tahoma } -->⼼style> ⼼head> ã°Šbody class='hmmessage'>
The HTML characters repeat throughout the message, but not on every message, though those sent from Hotmail are typically affected (but it is not always Hotmail).
The problem is due to the email having character encoding in the charset META tag that differs from the character encoding in the MIME part and a HTML disclaimer having been added. When Exchange 2010 SP1 adds the HTML disclaimer it re-encodes the message and this results in a corrupt message because the wrong character set information is read.
The fix for this has been documented in KB969129, which refers to Exchange 2007, but the same fix is true for Exchange 2010 SP1.
The fix is to add the DisableDetectEncodingFromMetaTag attribute to EdgeTransport.exe.config. This file can be found at \Program Files\Microsoft\Exchange Server\V14\bin and can be opened in Notepad. Make a backup of the file before you change it and then add to the <appsettings> area of the file the following
<add key="DisableDetectEncodingFromMetaTag" value="true" />
After you save the config file you need to restart the Microsoft Exchange Transport service for the setting to take effect.
Fame at last! Well not really, but here (http://blogs.technet.com/b/themasterblog/archive/2010/12/28/mcm-exchange-video-preview.aspx) is a video introducing the MCM Exchange class posted on the MCM Blog. The video is a 30 minute segment from the class without the interaction amongst the students that the class always has, and the reason for this lack of interaction is that it was recorded in the front room of my house.
Typically this content (the Header Firewall and Connector Permissions) could take one hour or more to cover when you include specific examples, a lab and all the different things to be aware of with regard to the subject.
I had a bit of an issue with Go Daddy yesterday in that they took 5 days to approve a Subject Alternative Name change to a certificate, and as the usual route of adding a file to a website was unavailable to me I decided to prove ownership of the domain by the addition of a new TXT record to the domain.
Go Daddy’s instructions for doing this are only suitable for domains hosted at Go Daddy and there are no clear instructions for doing this if you do not use Go Daddy for your DNS hosting.
So how do you create an SSL approval with TXT record? You do it by creating a TXT record for a subzone. The subzone is DZC and the value of the record is the seven character string that Go Daddy sent you via email. For example dzc.domain.co.uk TXT AbCdEfG.
Once DNS has replicated to ALL of your DNS servers you can return to Go Daddy’s web form and approve your SSL certificate. You can check if all your DNS servers have your new data by using NSLookup or Dig, but preferred is the use of either of these two tools from an independent third party on the internet – for example www.kloth.net/services/nslookup.php or www.dnssy.com/lookup.php.
It’s a well documented issue with Outlook 2003 connecting to Exchange 2010 that means Outlook 2003 is not as responsive in Online mode as it was with legacy versions of Exchange Server (http://support.microsoft.com/kb/2009942).
What is less well documented is an odd error message that can appear because of this interaction.
Imagine the following scenario. User on Outlook 2003 has lots of messages to delete, and deletes them one at a time. Outlook will not refresh the display for up to 5 seconds (the lowest setting that you can tell Outlook to refresh, via the Maximum Polling Frequency registry key). The problem is that if the user deletes a message and it does not disappear from the screen and then (thinking its gone, and the highlight has moved onto the next message) presses delete again. Outlook generates “Unknown Error” – which is not exactly helpful, and could appear as often as every other message that is deleted.
How to fix: Cached mode (though in the scenario I came across the above it was Outlook on a Terminal Server, so that’s not an option), upgrade the client version of Outlook, or use Shift or CTRL select and delete all your emails in one go!
This is a well known problem now, and has been since the first releases of the iPhone 4 in July 2010. Later updates to iOS (4.1 and later) do not exhibit this problem, but if you are upgrading an Exchange 2003 organization to Exchange 2010 there comes a point where you switch over the endpoints that the users connect to. Its at this switchover that you will experience performance issues if there are any unpatches iPhones in your user population. But, and here is the catch, as you have yet to migrate these users to Exchange 2010 you cannot use the Allow/Block/Quarantine feature (ABQ) of Exchange 2010 to restrict the phones access attempts.
The phones will connect to Exchange 2010 and be proxied to Exchange 2003 and the performance issues will set in. So how do you stop the phones at Exchange 2010?
You use a feature of IIS instead, you can block query string values in the Request Filtering feature of IIS 7.5 (or installable add-on for IIS 7.0).
Add the following to the web.config in c:\inetpub\wwwroot to globally block iPhones, and once you have a list of bad specific devices you can expand this list some more.
<system.webServer>
<security>
<requestFiltering>
<denyQueryStringSequences>
<add sequence="DeviceType=iPhone" />
</denyQueryStringSequences>
</requestFiltering>
</security>
</system.webServer>
Windows 7 has Windows Search built in, but it will only index locations on the local PC or folders that you have made available offline.
What about the rest of your network? An error you might see because of this is “This network location can't be included because it is not indexed”. If the servers also get an install of Windows Search on them then Windows Search on the client can talk to the Windows Search instance on the server and produce one set of search results, covering all network locations and local folders.
How do you tell the client which servers to communicate with for search results? You need to add the folders that you are interested in querying the index for to your Libraries on Windows 7. Let’s walk through this process.
Install Windows Search on your servers
If you are running Windows 2008 then add the File Services/Windows Search Server role. You probably have some of the File Services role already installed, and in that case use Add Role Services to add the Windows Search Service role.
If you are running Windows 2003 Server then you can install Windows Search 4.0 as a download from Microsoft.
The installation in Windows 2008 will ask for the storage locations to index, and you need to include the drives that contain your shared folders.
Once installed the index for the search will begin to be created. This can take some time initially, and if you want to be able to index content other than the default content (see http://msdn.microsoft.com/en-us/library/bb233501.aspx for the default filters installed) then you should install these filters as soon as possible (to save the index needing to redo files it does not know first time around). Most importantly you need to install Adobe Reader iFilter if you want to filter .pdf documents and the Microsoft Office 2010 Filter Pack if you want to index the new file formats for Microsoft Office.
Adobe have a free filter (download the correct one based on the version of your server) and Foxit Software have a paid for one, which is more reliable than the Adobe one. Adobe are on version 9 at the time of writing and can be downloaded from http://www.adobe.com/support/downloads/detail.jsp?ftpID=4025 for the x64 version (which is the one needed if you are running SBS 2008).
The Microsoft Filter Pack can be downloaded from http://www.microsoft.com/downloads/en/details.aspx?FamilyID=5CD4DCD7-D3E6-4970-875E-ABA93459FBEE&displaylang=en
Other iFilters for other document types exist. If you are running a 32bit version of Windows then an installation of Adobe Reader will include the 32bit iFilter. A search of Google for “iFilter” will show you others.
Finally, via Control Panel > Indexing Options > Advanced you can set the location where the search index data is to be stored. This can total up to 40% of the size of the indexed content and so should be placed on a suitably sized disk. You need to restart Windows Search to move this index.
Configure Windows 7
Once the search is configured, you can add the shared folders to the Libraries feature in Windows 7. To do this open Explorer to Computer and under Desktop you will find Libraries. Create a new Library called “Network” (or a name of your choice)" and add the shared folders on the server that is now indexed to the library. Note you cannot add shared folders that are not included on a server running search to a Library.
Now you can go to Start and type keywords into the Search bar and find documents on the local machine or on remote servers!
Configure Legacy Clients
Windows XP and Vista can have Windows Search installed, but do not support Libraries. For a legacy client to search a network location they need to open the network location (either via mapped drive letter or directly with the \\server\share UNC path format. The client will query the search server remotely and return quick results. There is no way on the legacy clients to do a single search from the Start Menu or Taskbar search box of all your locations in one go, unlike Windows 7.
If you have many servers then consider Microsoft FAST Search Server 2010 for SharePoint instead.
I am presenting at Exchange Connections 2010 later this year, and I need to set up some demo machines. I need my demo to run Exchange 2010, which is a 64bit application and I do not have guaranteed internet access so I cannot run my demo’s via my lab machines in the UK.
But I cannot use Virtual PC 7 installed on my Windows 7 laptop. And I do not want to reinstall my laptop with Windows 2008 Server to allow me to run Hyper-V.
So I have installed Oracles VM desktop product, VirtualBox. And this blog is just to describe how to do what we know as base images and differencing files in Virtual PC/Hyper-V on VirtualBox, and to use the VHD disk format which VirtualBox supports so that I have the option of moving my virtual servers between Virtual PC (if it ever supports x64 guests), Hyper-V servers and VirtualBox.
So to create a new VHD hard disk for use in VirtualBox open a command prompt, change to the directory in which you installed VirtualBox (probably C:\Program Files\Oracle\VirtualBox) and run the following command:
VBoxManage createhd --filename "path\filename.vhd" --size 130048 --format VHD --variant standard --remember
This will create a dynamically expanding hard disk in the location specified, in the Microsoft VHD format, and 130048KB (127GB).
Next you create a new virtual guest in the VirtualBox application (or via the VBoxManage command line if you wish) that uses this existing disk.
Boot this virtual guest, and then install the required OS and patches etc. Once this guest is ready to be a base image you can shut it down. If you are going to use this base images as a Domain Controller then you need to reset the SID’s on the device using either NewSID from Sysinternals or Sysprep before you move onto the next step.
Now that you have the base image, you need to mark it as such in VirtualBox. This is done from the command line:
VBoxManage modifyhd "path\filename.vhd" --type immutable
And then you need to delete the virtual guest settings that you used to create this disk. This disk is not deleted.
To create the virtual guests that use the “immutable” disk (aka parent/base disk) in Virtual PC/Hyper-V you would need to make a second disk, but not in VirtualBox. Here you just use the same disk. As you have marked it as immutable a snapshot disk will be created (in the .VirtualBox folder of your profile) and all changes will be written to this disk instead.
Exchange Server 2010 has the ability to limit user and administrative actions. But in testing this feature in a lab I set the default policy (which by default affects everyone, including the Administrator account) to a policy that stopped me undoing the policy again!
I ran Set-ThrottlingPolicy def* -PowerShellMaxConcurrency 1 -PowerShellMaxCmdletsTimePeriod 1000 -PowerShellMaxCmdlets 1 which had the effect of saying I could open one PowerShell session (that is okay - its my lab environment), run a single cmdlet (maybe a bit too low) and to run one cmdlet every 1000 seconds. I had not worked out that 1000 seconds is over 15 minutes.
The problem came two days later, starting Exchange Management Shell and connecting to the remote PowerShell endpoint obviously invokes more than one cmdlet. The second cmdlet is terminated, and so Exchange Management Shell cannot start - ever!
The error message I got was:
The WS-Management service cannot process the request. The user load quota of X requests per Y seconds has been exceeded. Send future requests at a slower rate or raise the quota for this user. The next request from this user will not be approved for at least Z milliseconds.
X is the value of PowerShellMaxCmdlets and Y is the PowerShellMaxCmdletsTimePeriod
So to fix I cracked open ADSIEdit - not to be done lightly, as it runs the risk of destroying the entire Exchange organization and Active Directory.
To fix this and reset the Throttling Policy connect to the Configuration Naming Context in ADSIEdit and navigate to CN=Global Settings,CN=organization name,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain. Open CN=Default Throttling Policy_guid and edit msExchPowerShellThrottlingPolicyState to read:
v~0~con~18~cmds~-1~per~-1~que~-1~excmds~-1
Once Active Directory replicates you will be able to run PowerShell cmdlets in Exchange Management Shell. The first cmdlet I would run would be one to ensure that you are back to the default policy just in case you made a mistake in ADSIEdit:
Set-ThrottlingPolicy def* -PowerShellMaxConcurrency 18 -PowerShellMaxCmdletsTimePeriod $null -PowerShellMaxCmdlets $null -PowerShellCmdletQueueDepth $null
Error -2147024894 appears when you use the WScript.Shell RegRead object to read a registry key that does not exist. But why would you get this error when the key does exist!
Probably because you are running your code inside a HTA and using a 64bit operating system.
The HTA environment is mshta, which is 32 bit. This means that when your code reads registry entries such as HKLM\Software\Microsoft\Windows via a HTA on a 64bit OS it is really reading HKLM\Software\Wow6432Node\Microsoft\Windows. Therefore if you have values or keys at HKLM\Software\Microsoft\Windows and not at HKLM\Software\Wow6432Node\Microsoft\Windows then you will get error -2147024894 because the value/key cannot be found.
Run the HTA on a 32bit OS and it work fine. But most confusing is that if you take the code from the HTA script and save it to a .vbs or .js file and run it (on the 64bit OS) via wscript or cscript then the script will find the registry key at HKLM\Software\Microsoft\Windows because in this instance the wscript or cscript environment is 64bit.
Of course this is true for any HKLM\Software registry entry.
To do a backup of the virtual machines installed on your Hyper-V Server (2008 or 2008 R2 editions) you need to complete the following steps.
There are numerous instructions on the internet for creating and booting a server with a USB key, but they were all complex or hard to read – even for a techy like myself.
So I thought I would rewrite a simple list of instructions to allow you to create a DOS bootable USB pendrive/key that you can use for any purpose (i.e. flashing BIOS's and other low level functions, as well as booting into other operating systems).
