UC Revolution

Getting Started with FIM 2010

2010-05-03T15:04:00.001-07:00

The following resources are available for Getting Started with FIM 2010

OSD Task Sequence: “There are not task sequences available for this computer”

2010-05-03T12:59:00.001-07:00

OSD Task Sequence fails with "There are no task sequences available for this computer" if multiple machines have the same SMBIOS GUID

Issue:

When attempting to deploy an operating system using OSD in System Center Configuration Manager 2007, the Task Sequence may fail with the following error:

There are no task sequences available for this computer.

If you look in the SMSTS.log you may also see the following error:

No assigned task sequence.

Setting wizard error: There are no task sequences available for this computer.

The SMSTS.log may also show the SMBIOS GUID as follows:

Setting SMBIOS GUID = 4C4C4544-0000-2010-8020-80C04F202020.

Setting SMBIOS GUID = 03000200-0400-0500-0006-000700080009.

Note: Analyzing the Advertisement and the Collection confirms that the target computer is in the proper Collection that the Advertisement is pointing to. Deleting the computer from the SCCM database and re-adding it back to the SCCM and the Collection via the Import Computer Information wizard using the MAC address or SMBIOS GUID does not resolve the problem.

Cause:

The issue can be caused by there being more than one computer in the environment with the same SMBIOS GUID (aka System UUID). Similar to MAC Addresses, SMBIOS GUIDs should be unique on each computer and no two computers should have the same SMBIOS GUID. The SMBIOS GUID is stored in the computer's BIOS. Do not confuse the SMBIOS GUID with the SMS GUID. These are two separate, different, and distinct items.

The problem occurs because when the SCCM database is queried for available Task Sequences that are advertised to that PC, it does so first by using the computers SMBIOS GUID. Each record in the SCCM database records the computers SMBIOS GUID under the field System UUID. If it does not match a record with the SMBIOS GUID, it then uses the MAC Address.

However, if multiple computers exist in the environment and are in the SCCM database with the same SMBIOS GUID, it may find the record for a PC other than the one where the Task Sequence is trying to be initiated. It will then query policy for that other PC, and if that other PC does not have a Task Sequence advertised to it, it will return back that there are no task sequences available for this computer.

Resolution:

To see if this problem exists in your environment, create a query or collection in SCCM based on the suspected duplicate SMBIOS GUID. If more than one computer has the same SMBIOS GUID then the problem exists in the environment and needs to be fixed at a hardware level. You will need to contact the OEM vendor for a fix.

I Have found the following to resolve the problem (If you are doing a Build and Capture):

Verify the Reference machine does not already exist in a computer collection (Agent was once installed, etc…)
- If so remove it.

Create a collection using the SMBIOS GUID located in the SMSTS.log "Setting SMBIOS GUID".
- System Resource
- System UUID
- <Guid Value>

Advertise your task sequence to "Unknown Computers" Collection.

Additional Information: The SMBIOS GUID SMBIOS GUID (aka System UUID) can be found in the SMSTS.log in the line:

"Setting SMBIOS GUID = "

It can also be found by inspecting the SMSPXE.log as the PC tries to PXE boot. In addition, it can also be obtained by hitting the Pause/Break key on the keyboard on the affected PC at the PXE boot screen. The SMBIOS GUID should be displayed somewhere on that screen.

SCCM OSD/PXE Issues in Native Mode

2010-05-03T12:55:00.001-07:00

There have been many posts out there trying to address the issue behind Native Mode and PXE and/or Boot Media problems. This posting publishes information I found in the following article and additions which I have made to clarify some certificate configurations.

Step 1

In the site properties , check that you have imported your Root CA certificates. If you have subordinate CA servers , import them as well as I have seen issues arriving when not importing them .The picture below will give you the idea :

Step 2

Create your OSD PXE service point Certificate & export it . Go to your certificate authority and duplicate the Computer certificate , name it Configmgr OSD certificate and make sure that you could export the private key !

My Comments:

MAKE SURE SUBJECT NAME TAB CONTAINS: SUPPLY IN REQUEST. When the request is made, give the certificate the following Attributes:

CommonName: <FQDN> (i.e. OSDpxeBootCert.<domain>.Com)
Alternate name: <Fqdn> OSDpxeBootCert.<domain>.com
Friendly name: Any descriptive name.

Note: Because certificates are Required through out the native mode deployment. FQDNs are also required for certificate Subject name and Alt Subject Names.

When you have created the certificate , export it to a DER format by going to MMC - Certificates - personal - Request new certificate . Select the Configmgr OSD certificate and install it on your machine . When done , right click on the certificate and select export . Export the certificate with private key and when exported , delete the certificate you have requested .

Step 3

Import you in the PXE role configuration pane .

Now we go to the SCCM console and go to Site systems - PXE Role , import the certificate you just exported . The picture below explains it :

You will get the following warning when you exported the certificate on the Site server itself . This is no problem and you should select "yes" to continue

Check the PXE Certificate in the SCCM console. Verify that the Root CA is trusted.

Try opening the Certificates | PXE node in SCCM. Find the certificate that is not "blocked" and right-click to Open it. Check the status of the CA Certificate. I found that it was "Not Trusted" in my environment.

When I clicked the Install button and selected the Trusted Root CA Authorities, the certificate was then "valid" when I reopened the certificate. My SMSPXE.log no longer reflected that the certificate was not set.

Step 4

Check that the following things below are set correctly

Network Access Account Not Set

Go into the Client Policy in SCCM and set a Network Access Account. It sometimes "disappears" even after everything has been working fine. And then the OSD Task sequence cannot access the content on the Distribution point !

Task Sequence Error 0x80004005

2010-05-03T12:46:00.001-07:00

Issue: During an Operating System Build / Capture task, you receive the following error upon the Configure Windows task.
Task Sequence: %TaskName% has failed with the error code (0x80004005). For more information, please contact your system administrator or helpdesk operator.

Resolution: This might be the product activation code for Windows Vista/Win7. Try once without any activation code and if that works add the activation code to the file \source\pid.txt

Exchange 2007 SP1 – Rollup 5 installation Issue (OWA)

2009-02-12T09:42:00.001-08:00

There have been quite a few incidents reported out there regarding installation issues with application of Rollup 5 (and other versions) to Exchange 2007. Granted many incidents have been reported with the Rollup 5 install for Exchange 2007 RTM; however there are also incidents with Exchange 2007 SP1 as well. Below I will provide a brief overview of a incident I have experienced and action taken to remediate.

Scenario:

Server State Pre-Installation of Exchange 2007 SP1 Rollup 5:

Exchange 2007 SP1 (w/ Rollup 3 applied).
No interim hotfixes for Exchange 2007 applied.
Antivirus services stopped
Backend servers have applied the rollup successfully

Problem(s):

Installation of Rollup 5 takes LONG time (30-60 min) – Hangs on .NET assemblies portion of installation
Exchange related services are left in a “DISABLED” state following installation as well as Reboot.
Exchange related service will not start up.
Users accessing OWA images are not displayed properly and pageNotFound for reading pane, etc…..

Symptoms:

Visible Symptoms:
- MSExchangeOWAAppPool does not exist for Rollup 5 version. (MSExchangeOWAAppPool > OWA 8.1.336.0)
  Problem Server
  
  Good Server
OWA does not display correctly when accessed. Images are replaced with a “X”.
*exe.config (C:\<drive>\Microsoft\Exchange Servers\Bin files have not been “recreated/updated” (reflecting Rollup application date)

Solution:

The installation of the rollup issue was not consistent across the board with the Client Access Servers. Some servers installed successfully and other did not. So the root cause was not determined; however the fix was the same across the board for problem servers.

If stopped > Start IISAdmin
Modify the properties of the OWA 8.1.336 virtual Directory (Default Web Site > OWA > OWA 8.1.336) and assign Application Name and Application Pool (MSExchangeOWAAppPool)
Start Exchange Related Services
If services do not start, Verify *exe.config file contents for the following files.
Start Exchange Related Services
Verify OWA Authentication and set accordingly
Verify OWA Connectivity

Start IISAdmin (if stopped/disabled)

1. Open command Exchange Management Shell.

If Disabled Type:  Set-Service “IISAdmin” –startupType Automatic
If Stopped Type:  Start-Service “IISAdmin”

Note: Verify W3SVC and HTTPSSL service as well.

Verify MSExchangeOWAAppPool virtual Directory for Rollup 5 (owa 8.1.336)

1. Open IIS Manager > ServerName > Application Pools >

MSExchangeOWAAppPool > owa/<RollupVersion> (ex. <default web site>/owa/8.1.336)

2. If version does not exist that matches the rollup version (Rollup 5 for Exchange 2007 SP1 = 8.1.336), navigate down to the Web Sites > Default Web Site > OWA > <rollup version>.

3. Right click the virtual directory that matches the rollup version, select Properties > Application Name click “Create”. Enter “owa” text. and then for Application Pool select MSExchangeOWAAppPool.

4. Select OK and verify that the MSExchangeOWAAppPool > owa/<rollupVersion> exists. (Procedure in Step 1.)

5. From command prompt, run: IISRESET /NoForce

If Exchange Services do not startup normally or hang. Verify the Exchange *.exe.config File Content of the following files:

Reference Article: http://msexchangeteam.com/archive/2008/07/08/449159.aspx

**Advise following the reference article for procedure. However the gist of it is listed below.

1. Check to see if the configuration files within the <Drive>\Microsoft\Exchange Server\bin directory contain the following key entry. If not backup the existing files and either create or modify existing files. List of files is below as well.

*.exe.config files: (exe.config versions of these files; so EdgeTransport.exe will have a EdgeTransport.exe.config file)

Bin\EdgeTransport.exe

Bin\ExBPA.exe

Bin\ExBPACmd.exe

Bin\ExTRA.exe

Bin\Microsoft.Exchange.Cluster.ReplayService.exe

Bin\Microsoft.Exchange.EdgeSyncSvc.exe

Bin\Microsoft.Exchange.Monitoring.exe

Bin\Microsoft.Exchange.Search.ExSearch.exe

Bin\Microsoft.Exchange.ServiceHost.exe

Bin\MSExchangeMailboxAssistants.exe

Bin\MSExchangeMailSubmission.exe

Bin\MSExchangeTransportLogSearch.exe

ClientAccess\PopImap\Microsoft.Exchange.Imap4.Exe

ClientAccess\PopImap\Microsoft.Exchange.Pop3.Exe

2. After the configuration files have been modified. Try to startup the Exchange services.

Verify OWA Authentication:

1. First check to see if the authentication method is set correctly for the OWA virtual directory.

get-owavirtualdirectoy -identity "msgexsv23004\owa (default web site)" | fl *authenti*

InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated}
BasicAuthentication           : False
DigestAuthentication          : False
WindowsAuthentication         : False
FormsAuthentication           : False

2. If authentication is not set correctly then set it according to your standards. Below is an example of enabling WIndows Integrated and Basic Authentication.

Set OWA Virtual Directory authentication (Integrated and Basic):

set-owavirtualdirectoy -identity "msgexsv23004\owa (default web site)"  -WindowsAuthentication $true -BasicAuthentication $true

3. Next you will want to reset IIS. Open a command prompt and run the following command.

IISRESET /NOFORCE

4. Finally, verify authentication settings and open a browser and test OWA access/connectivit. (Internal and External URLS). The command below is the same verification command issued in step 1.

get-owavirtualdirectoy -identity "msgexsv23004\owa (default web site)" | fl *authenti*

Exchange 2007 – UM – Terminology

2008-12-29T14:19:00.001-08:00

For the telephony challenged Exchange 2007 professional… Below are some common concepts and terminology that may stumble across during your Unified Messaging deployment.

Telephony Concepts
Terminology	Description
Circuit Switching (Telephone Networks)	→ Network in which there is a dedicated connection. → Analog and digital circuit switched networks ▪ Analog - deisgned for voice transmission ▪ Analog transmission signal must be encoded or converted into a digital format before it enters the telephony WAN
Connectivity Concepts	-->T1 and E1 lines ▪ E1 line can handle more simultaneous calls ▪ T1 is used mostly in North America and Japan Trunk and tie lines ▪ Trunk line - connects corporate PBX back to the phone company's PBX system ▪ Tie line - typically a T1 or E1 line used to connect two or more corporate PBX systems Time Division Multiplexing (TDM) ▪ Transmits separate voice signals simultaneously over a single physical, high bandwidth phone line
Packet Switching (Data Networks)
Voice over IP (VoIP)	Voice over IP (VoIP) is a technology that contains hardware and software that enabled people to use an IP-based network as a transmission medium for telephone calls. Protocols: SIP ; RTP ; T.38 (fax)
Session Initiated Protocol (SIP) and Real-Time Transport Protocol (RTP)	SIP Only used for setting up and tearing down voice or video calls RTP: All voice and video communications occur over RTP
Common Existing Enterprise Scenarios
System	Description
Central Office Telephone Exchange (Centrex)	A business phone service offered by a local telephone company from the phone company's central office (CO)
Key Telephone System	Is a multiple line telephone system typically employed by small organizations.
Private Branch eXchange (PBX)	aka Telephone switch or telephone switching device… Connects office telephones in a business to the public telephone network.
PBX Types
Type	Description
Analog PBX	Voice and signaling remain analog
Digital PBX	A code converts audio to a digital signal of a particualar format and vice versa. Digitized voice is routed over circuit-switched channels
IP PBX	The IP phone is a node on the data network and can digitize voice ; Voice traffic will be packet switched and routed over LAN and WAN data networks.
Hybrid PBX	A combination of IP and digital capbilities in a singe PBX
PBX Concepts
Concept/Term	Relationship to Unified Messaging
Direct Inward Dialing (DID)	Only requires DID for targeted custom auto attendants, such as one to go to "Sales".
Dial Plan	Dial plan +extension is unique identifier
Coverage Path	Used on specific extensions to route calls from the PBX to Unified Messaging
Hunt group	Direct calls to VoIP gateway and/or Unified Messaging
Pilot number	Used for Call answering, Outlook Voice Access, and Auto Attendants. (Address or Label Group)
Unsupervised Transfer	Transfer method used by Unified Messaging
VoIP Gateways
Concept
Their function-----	Translate TDM or Telephone circuit switched based protocols from PBX system to protocols based on VoIP or IP (SIP; RTP ; T.38)
Types of VoIP Gateways	IP/PBX - Single device capable of communicating directly with Unified Messaging server using supported VoIP protocols.
	PBX (legacy) and IP/VoIP gateways - Two separate components are deployed ; the legacy PBX and the VoIP gateway performing translation to supported VoIP protocols

Exchange 2007 – Services By Role

2008-12-29T14:03:00.001-08:00

Below is a table which breaks down the Exchange 2007 related services and the Exchange role associated with that service.

Service

Description

MBX

CAS

HUB

EDGE

Microsoft Exchange Active Directory Topology

Provide Active Directory topology information to Exchange services.

Microsoft Exchange ADAM

Provides ADAM directory service function to the Edge Transport server

Microsoft Exchange Credential Service

Manages credentials that the Hub Transport Server uses to authenticate to ADAM for a subscribed Edge Transport Server

Microsoft Exchange EdgeSync

Connects to ADAM instance on subscribed Edge Transport servers over secure Lightweight Directory Access Protocol (LDAP) channel to synchronize data between a Hub Transport server and an Edge Transport server

Microsoft Exchange File Distribution

Used to distribute offline address book and custom Unified Messaging prompts

Microsoft Exchange Anti-spam Update

Used to automatically download anti-spam filter updates from Microsoft Update

Microsoft Exchange IMAP4

Provides IMAP4 services to IMAP clients

Microsoft Exchange Information Store

Manages Exchange Server databases. Provides data storage for messaging clients

Microsoft Exchange Mail Submission Service

Used to notify a Hub Transport server located in the Mailbox server's Active Directory site that messages are ready for retrieval from a sender's outbox

Microsoft Exchange Mailbox Assistants

Provides functionality for Calendar Attendant, Resource Booking Attendant, Out of Office Assistant, and Managed Folder Mailbox Assistant

Microsoft Exchange Monitoring

Provides a remote procedure call (RPC) server that can be used to invoke diagnostic cmdlets

Microsoft Exchange POP3

Provides POP3 services to POP3 clients

Microsoft Exchange Replication Service

Provides log shipping functionality for local continuous replication (LCR) and cluster continuous replication (CCR)

Microsoft Exchange Search Indexer

Provides content to the Microsoft Search (Exchange Server) service for indexing

Microsoft Exchange Service Host

Configures the RPC virtual directory in Internet Information Services (IIS), and registry data for ValidPorts, NSPI Interface Protocol Sequences, and AllowAnonymous for Outlook Anywhere

Microsoft Exchange Speech Engine

Provides speech processing services for Unified Messaging

Microsoft Exchange System Attendant

Provides monitoring, maintenance, and directory lookup services for Exchange Server

Microsoft Exchange Transport

Provides Simple Message Transfer Protocol (SMTP) server and transport stack

Microsoft Exchange Transport Log Search

Provides message tracking and transport log searching

Microsoft Exchange Unified Messaging

Provides Unified Messaging features, such as the storing of inbound faxes and voice mail messages in a user's mailbox, and access to that mailbox via Outlook Voice Access

Microsoft Exchange (Exchange Server)

Provides full-text indexing of mailbox data content. This is a Microsoft Exchange-customized version of Microsoft Search

Exchange 2007 – Mail Disabling Objects

2008-12-23T14:54:00.001-08:00

Mail Disabling Objects

This section will detail procedures for mail disabling mail objects. The mail disabling process essentially strips the mail objects of its Exchange mail attributes. All Mail Specific attributes will be removed from the Active Directory object. The “Windows Email Address” (aka “mail”) attribute is the only attribute that will remain in tact, eventhough this attribute exists the object is not considered a mail object.

Mail Disabling Mail Users

How To Mail Disable a Mail User (Mail-Enabled user).

Command Shell
Note: The –identity can be any of the following attribute values for the mail user you are going to disable.

Identity Values

ADObjectID

GUID

distinguished name

Domain\SamAccountName

user principal name (UPN)

LegacyExchangeDN

E-mail Address

User alias

1. Open Exchange Management Shell
2. Have the Identity value on hand.
3. Enter the following command line pull the correct user object.

Get-MailUser –identity “<idValue>”

4. Verify that you have the correct Mail User based on the properties displayed.

5. If correct user has been chosen enter the following command to disable the mail user.

Tip: You can “Up” arrow to pull the command just entered above.

Get-MailUser –identity “<idValue>” | Disable-MailUser

6. Confirm action to perform. Press Enter.

Management Console (GUI)

1. Locate object within Exchange management console

2. Right Click and select Disable.

3. Follow the wizard and confirm successful disabling.

Mail Disabling Mailboxes

How To Mailbox Disable a Mailbox (Mailbox-Enabled user).

Command Shell

Note: The –identity can be any of the following attribute values for the mailbox you are going to disable.

Identity Values

GUID

Distinguished name

Domain\Account

User principal name

LegacyExchangeDN

SmtpAddress

Alias

1. Open Exchange Management Shell

2. Have the Identity value on hand.

3. Enter the following command line pull the correct mailbox object.

Get-Mailbox –identity “<idValue>”

4. Verify that you have the correct Mailbox based on the properties displayed.

5. If correct user has been chosen enter the following command to disable the mailbox.

Tip: You can “Up” arrow to pull the command just entered above.

Get-Mailbox–identity “<idValue>” | Disable-Mailbox

6. Confirm action to perform. Press Enter.

Management Console (GUI)

1. Locate object within Exchange management console

2. Right Click and select Disable.

3. Follow the wizard and confirm successful disabling.

Mail Disabling Distribution Groups

How to Mail Disable a Distribution Group.

Command Shell

Note: The –identity can be any of the following attribute values for the distribution group you are going to disable.

Identity Values

GUID

LegacyExchangeDN

Domain\Account Name

Alias

1. Open Exchange Management Shell

2. Have the Identity value on hand.

3. Enter the following command line pull the correct distribution group object.

Get-DistributionGroup –identity “<idValue>”

4. Verify that you have the correct Distribution Group based on the properties displayed.

5. If correct user has been chosen enter the following command to disable the distribution group

Tip: You can “Up” arrow to pull the command just entered above.

Get-DistributionGroup–identity “<idValue>” | Disable-DistributionGroup

6. Confirm action to perform. Press Enter.

Management Console (GUI)

1. Locate object within Exchange management console

2. Right Click and select Disable.

3. Follow the wizard and confirm successful disabling.

Mail Disabling Contacts

How to Mail Disable a Mail Contact object.

Command Shell

Note: The –identity can be any of the following attribute values for the mail contact you are going to disable.

Identity Values

ADObject

Distinguished name

GUID

Alias

2. Have the Identity value on hand.

3. Enter the following command line pull the correct distribution mail contact object

Get-MailContact –identity “<idValue>”

4. Verify that you have the correct Distribution Group based on the properties displayed.

5. If correct user has been chosen enter the following command to disable the Mail Contact.

Tip: You can “Up” arrow to pull the command just entered above.

Get-MailContact–identity “<idValue>” | Disable-MailContact

6. Confirm action to perform. Press Enter.

Management Console (GUI)

Locate object within Exchange management console

Right Click and select Disable.

Follow the wizard and confirm successful disabling.

Exchange 2007 – Message Tracking and Logging

2008-12-23T14:48:00.001-08:00

Message Tracking and Logging

How to verify message tracking settings.

To check current message tracking parameters set for an exchange mail server run the following commands. By default message tracking is enabled on exchange mailbox, Hub Transport and Edge Transport servers.

1. Start the Exchange Management Shell

2. Type Get-mailboxserver “servername” |fl *tracking*

3. The resulting output will show current tracking settings.

How to change the default Log file path

By default Exchange stores message tracking log files in the C:\Program files\Microsoft\Exchange Server\TransportRoles\Logs\MessageTracking.

To change this location use the following procedures. “C:\exchange logs” should be replaced with the directory of your choosing.

1. Start the Exchange Management Shell

2. Type Set-TransportServer “servername” –MessgaeTrackingLogPath “C:\Exchange Logs”

Note: The log file path must be local to the server. If the new target directory does not exist, the command will create it.

All log files that were generated in the original directory will not automatically be moved to the new directory.

How to change the default log directory size limits

By default the message tracking log directory is will over write the oldest log files once the maximum directory size of 250MB has been reached. The following procedures will change the max directory size.

1. Start the Exchange Management shell

2. Type Set-TransportServer servername –MessageTrackingLogMaxDirectorySize 1GB

Note: Sizes are factored in bytes (B), Kilobytes (KB) Megabytes (MB) gigabytes (GB) and terabytes (TB)

How to set the Max log file age

By default Exchange will retain message tracking log files for a period of 30 days before overwriting them. The following procedures will change this retention time.

1. Start the Exchange Management shell

2. Type Set-TransportServer servername –MessageTrackingLogMaxAge DD.HH:MM:SS

How to Track messages

Exchange 2007 provides a message tracking tool available through the Exchange Trouble shooting assistant in the Exchange management console as well as through Exchange Command Shell.

Management Shell – Message Tracking

Use the following procedure to track a message in Exchange Management Shell

1. From Hub Transport server (DCA-APP-CSHU01) open the Exchange Management Shell

2. Enter the following command line with the correct parameters.

Get-MessageTrackingLog <SearchFilters>

Filter Table:

Search filter	Corresponding field in the message tracking log
End	date-time
EventId	event-id
InternalMessageId	internal-message-id
MessageId	message-id
MessageSubject	message-subject
Recipients	recipient-address
Reference	reference
ResultSize	None. This parameter limits the number of results that are displayed by the search.
Sender	sender-address
Start	date-time

Console - Message Tracking

Use the following procedures to track a message in Exchange Console.

1. Start the Exchange Management Console.

2. In the left hand pane select Toolbox.

3. In the middle pane select Message tracking.

4. With Message tracking highlighted select Open tool from the right hand pane. This will open the Exchange Troubleshooting assistant (Extra).

Within Extra, the following search criteria are provided to track messages.

i. Recipients.

ii. Sender.

iii. Server sent from.

iv. Event ID

v. Message ID

vi. Internal Message ID

vii. Subject.

viii. Reference.ix. Start and End dates for the search.

5. Once the search criteria has been defined click next to begin the search.

6. The search results will display the following data fields.

a. Time stamp

b. Event ID

c. Source

d. Source Context

e. Message ID

f. Message Subject

g. Message Sender

h. Recipients

i. Internal Message

j. Client IP

a. Client Hostname

b. Server IP

c. Server Hostname

d. Connector ID

e. Recipient status

f. Total Byte size

g. Recipient count

h. Related recipients

i. Reference

j. Return path

k. Message Info

Message Tracking Example

This section will provide details for resolving a real world message routing issue.

Scenario: Sender Joe.Smith@company.com received NDR when sending to recipient:

Info	Details
Sender	Joe.smith@company.com
Recipient	Another.User@company.com
Date Time Message Delivered	10/07 12:01am – 2:00AM

NOTE: This is a Domino to Exchange mail routing scenario. All mail sent from Notes to Exchange targets the following Hub Transport Server (DCA-EM-CSHU01.amat.com)

Exchange Management Shell – Message Tracking

Below is the process for tracking the cause for the NDR for recipient Another.User@company.com

1. From Hub Transport server (HT01) open the Exchange Management Shell.

2. Enter the following command line based on information in table above.

get-messagetrackinglog -Recipients:Another.User@company.com -Start "10/7/2008 12:01:00 AM" -End "10/7/2008 2:00:00 AM"

3. Data will be displayed for the messages that meet the filter criteria.

4. Key in on the eventID column. “Fail” is key indicator. To view the that particular message details enter the following command.

get-messagetrackinglog –eventID “Fail” -Recipients:Another.User@company.com -Start "10/7/2008 12:01:00 AM" -End "10/7/2008 2:00:00 AM"

5. This will narrow down the search criteria to failed messages. Now view the message in Format-List view to display the message details.

get-messagetrackinglog –eventID “Fail” -Recipients:Another.User@company.com -Start "10/7/2008 12:01:00 AM" -End "10/7/2008 2:00:00 AM" | format-list.

6. The message status states the RecipientStatus of 550 5.1.4 ambiguous address. Now this can be a result of duplicate email adddresses or duplicate “legacyExchangeDN” addresses.

7. To verify, perform a number of searches for duplicates within the console to determine the problem.

a. To locate duplicate email addresses run the following command:

i. Get-Recipient –id Another.User@company.com .

ii. This command only came up with one recipient using that “email Address”. So duplicate email address is not the cause of the problem. Next step is to discover whether or not there are duplicate legacyExchangeDNs.

b. To locate duplicate legacyExchangeDNs.

Get-user –id “Another.User@company.com”

ii. This command comes up with two users. Now to compare legacyExchangeDNs. Run the format-list option for each user to get the “RecipientType” in order to display and inspect the “legacyExchangeDN” value.

Note: Another indicator of duplicate legacyExchangeDns is duplicate “Alias” attributes (aka mailNickname).

iii. If “RecipientType” value equals “MailUser”. Then run the following command.

get-mailUser –id “Another.User@company.com” | fl

iv. Inspect the legacyExchangeDN for each user. In this case (although not shown) each user had the same LegacyExchangeDN value. This was due to the HR contractor to perm employee conversion process.

v. To resolve the mail routing issue for legacyExchangeDN duplicates. The incorrect account must be mail disabled (stripping of Exchange Attributes).

Exchange Console– Message Tracking

Below is the process for tracking the cause for the NDR for recipient Another.User@company.com

Use the following procedures to track a message in Exchange Console.

1. Start the Exchange Management Console.

2. In the left hand pane select Toolbox.

3. In the middle pane select Message tracking.

a. Enter the following parameters for:

b. Recipients.

c. Start and End dates for the search.

4. Press “Next”

5. The next screen will disply the filtered list based on your pararmeters.

6. Notice the “EventID” which indicates a FAIL. The same information is available within this screen as it is within the command shell.

7. Note the Recipient Status column. This will provide the delivery issue.

8. This particular error indicates that there are duplicate email addresses or legacyExchangeDN duplicates. The easiest method to discover the root cause is through the command shell. Below is the command shell process used to resolve this particular recipient delivery issue.

9. To verify, perform a number of searches for duplicates within the console to determine the problem.

a. To locate duplicate email addresses run the following command:

i. Get-Recipient –id Another.User@company.com .

b. To locate duplicate legacyExchangeDNs.

Get-user –id “Anja_Niederbremer@amat.com”

iii. If “RecipientType” value equals “MailUser”. Then run the following command.

get-mailUser –id “Anaj_Niederbremer” | fl .

iv. Inspect the legacyExchangeDN for each user. In this case (although not shown) each user had the same LegacyExchangeDN value. This was due to the HR contractor to perm employee conversion process.

v. To resolve the mail routing issue for legacyExchangeDN duplicates. The incorrect account must be mail disabled (stripping of Exchange Attributes). Once stripped only one account will contain that legacyExchangeDN and therefore fix the mail delivery issue.

Exchange 2007 – Recipient Limits

2008-12-23T14:30:00.001-08:00

Recipient Limits

There are several ways to establish recipient limits within Exchange 2007.

· Organization Limits

· Global Limits

· Connector Limits

· Server Limits

· User Limits

Organization Limits: Apply to all Exchange 2007 Servers within the Organization.

Global Limits: Apply to all Exchange 2007 and Exchange 2003 servers that exist in the Organization.

Connector Limits: These limits apply to any messages that use the specified Send connector, Receive connector, or Foreign connector for message delivery.

Server Limits: These limits apply to a specific Hub Transport or Edge Server.

User Limits: These limits apply to a specific user object such as a contact, mailbox, distribution group, public folder.

Recipient Limit Recommendations

Generally, it is better to maximize the restrictiveness of your message limits. You should base any exceptions on a proven need to exceed the established size limits, and you should put those limits as close as possible to the objects that must exceed the established limits. This strategy helps make sure that messages in the transport pipeline are rejected as early as possible if they violate message size limits. It is a waste of system resources to set a high message size limit at the Exchange organization level, allow a message to enter the Exchange organization, and then reject the message at the last stage of delivery because of a violation of a message limit.

Scenario: Recipient Limit Requirements

Note: The information below is a stripped list of recipient limit Q&A taken from a real customer. Recommendations are based on these requirements, and as in the real world.. not all of the requirements can be fulfilled out of the box with Exchange or may go against best practice for setting limits.

Only select users can send to All the Organization? Yes
Restrict Certain Distribution Groups to only allow particular users to send to them (ex. All Users)? YES
Maximum Recipient limit for Messages Sent within the Exchange Organization (Exchange to Exchange): 500
Maximum Recipient limit for Messages Sent to the Internet? 500
Maximum Recipient limit for Messages Sent to Domino? 500
Maximum Recipient limit for Messages Received from Internet? Presently All Inbound mail flows through Domino to Exchange so the Recipient Limit from Domino would apply.
Maximum Recipient limit for Messages Received from Domino? No Limit

Recommended Recipient Limit configuration based on requirements defined by scenario above.

Set Receive Connector From Domino and Internet (Same Connector): Unlimited

WARNING: Mail from the Internet and Domino come through the same connector so no limit will be placed on Inbound Internet Mail. Recommendation would be to set this limit the same as the Exchange Organization limit or lower. If internal Exchange users cannot send to more than 500 users then email between the two messaging environments should adhere to the same limitations.

Set Organization: 500
Set Limits on who can send to Heavily Populated Distribution Groups (over Org Limit)
Even if the Organization Restriction is set to 500 and a Groups has 500+ members, the user/group granted the ability to send to this group will still be able to send to all members.

Setting Recipient Limits

This section will provide instruction to setting recipient limits at the Organization, Global, Connector, Server and User level.

Note: Exchange Management Shell is the most efficient way to make these changes, so the commands will be displayed below.

IMPORTANT! When setting limits, whether its recipient, message size, etc. make sure the settings do not step on each other at the various levels. Exchange 2007 SP1 was suppose to fix many of the issues of limits defined at the Organization and Global level; however there are instances where these issues are still evident in SP1.

Organization Recipient Limits

Example: Setting Recipient Limit to 3000:

Note: Default Recipient Limit within Exchange SP1 is “5000”.

Set-TransportConfig –MaxRecipientEnvelopeLimit 3000

To verify settings run the following command:

Get-TransportConfig | fl MaxRecipientEnvelopeLimit

Global Recipient Limits

In Exchange 2007 SP1, you shouldn't modify the global limits directly. In Exchange 2007 SP1, if you set a global limit to a different value than the corresponding organizational limit, you will generate event log errors. When you want to modify the organizational limits or the global limits in Exchange 2007 SP1, you should use the Set-TransportConfig cmdlet in the Exchange Management Shell or the Hub Transport organization configuration properties in the Exchange Management Console.

Conditions That Affect the Initial Values of Global Limits in Exchange 2007 SP1

The following list describes the conditions that cause the initial values of the global limits to differ from the default values in Exchange 2007 SP1:

The existing numeric values of delivContLength, submissionContLength, or msExchRecipLimit are preserved for the following circumstances:

The organization was upgraded from Exchange 2007 RTM and the corresponding organizational limit values that are specified by the MaxReceiveSize parameter, the MaxSendSize parameter, or the MaxRecipientEnvelopeLimit parameter on the Set-TransportConfig cmdlet were set to Unlimited.

The organization was upgraded from Exchange 2003, and a numeric value was specified for Incoming message size, Outgoing message size, or Maximum number of recipients.

The values of delivContLength, submissionContLength, or msExchRecipLimit are changed to match the values of the corresponding organizational limits that are specified by the MaxReceiveSize parameter, the MaxSendSize parameter, or the MaxRecipientEnvelopeLimit parameter on the Set-TransportConfig cmdlet when all the following conditions are true:

The organization was upgraded from Exchange 2007 RTM to Exchange 2007 SP1.

A numeric value was specified for delivContLength, submissionContLength, or msExchRecipLimit.

A different numeric value was specified for the corresponding organizational limit in the MaxReceiveSize parameter, the MaxSendSize parameter, or the MaxRecipientEnvelopeLimit parameter.

Connector Recipient Limits

This content is catered to the scenario’s environment so we will only go through the modifications for the Receive Connectors.

Ex. To set one Receive Connector at a time (ex. Set a connector named “From Domino” and a <server> to maximum of 1000 recipients):

Set-ReceiveConnector –identity “<server>\From Domino” –MaxRecipientsPerMessage 1000

Ex. To set ALL Receive Connectors at One Time:

Get-ReceiveConnector | Set-ReceiveConnector –MaxRecipientsPerMessage 1000

Set Server Recipient Limits

This section will provide instruction to setting recipient limits at the Server level.

Note: These limits are applied to a Hub Transporter server

Ex. To Set Hub Transport Server Recipient Limit on a specific HT server to 1000.

Set-TransportServer –Identity <serverName> -PickupDirectoryMaxRecipientsPerPage 1000

Ex. To Set ALL Hub Transport Servers to Recipient limit of 1000.

Get-TransportServer | Set-TransportServer –PickupDirectoryMaxRecipientsPerPage 1000

Setting User Recipient Limits

This section will provide instruction to setting recipient limits at the Server level.

Ex. Apply Recipient Limits to a Mailbox.

Set-Mailbox –Identity <mbxUserA> -RecipientLimits 400

Ex. Apply Recipient Limits to a Contact

Set-MailContact –Identity <mContactA> -MaxRecipientsPerMessage 400

Ex. Apply Recipient Limits to a Mail-User

Set-MailUser –Identity <mUserA> -RecipientLimits 400

Exchange 2007 – Global Message Limits

2008-12-23T14:17:00.001-08:00

Global Message Size Limits

This section will provide steps for setting Global message size limits.

Inbound Message Size Limits

Setting Inbound (Receive) Message Size Limits.

1. In Exchange Management Shell, run the following command where <size> is entered as the default of "unlimited" or the size in B (Bytes), KB (Kilobytes), or MB (Megabytes) in a range of 0 to 2147483647 bytes:

Set-TransportConfig -MaxReceiveSize <size>

a. For example, to set the maximum message size that can be received by recipients in the Exchange Organization to 10 Megabytes you would enter:

Set-TransportConfig -MaxReceiveSize 10MB

b. To set the maximum message size that can be received by recipients in the Exchange Organization to the default value of unlimited you would enter:

Set-TransportConfig -MaxReceiveSize unlimited

Outbound Message Size Limits

Setting Outbound (Send) Message Size Limits.

Set-TransportConfig -MaxSendSize <size>

a. For example, to set the maximum message size that can be sent by users in the Exchange Organization to 10 Megabytes you would enter:

Set-TransportConfig -MaxSendSize 10MB

b. To set the maximum message size that can be sent by users in the Exchange Organization to the default value of unlimited you would enter:

Set-TransportConfig -MaxSendSize unlimited

Exchange 2007 – Creating Message Disclaimers

2008-12-23T14:14:00.001-08:00

Creating Message Disclaimers in Exchange 2007

This section provides the procedure to configuring a rule to apply Message Disclaimers, which are applied to messages when they pass through the Hub Transport Server. Legal requirements vary significantly from business to business, and therefore a plan to configure/deploy message disclaimers range from simple to complex. The key is to gather the requirements from the legal department and from there plot out the ideal deployment.

There are so many ways to configure these transport rules to apply disclaimers, so below we have provided an example of applying a disclaimer to email messages sent by members of the Legal Distribution Group.

SCENARIO:

A Company has mentioned a specific need for users to be able to modify disclaimer text. In this instance, users would apply the disclaimer within their signature or manually in the message body. Exchange would then be configured to apply a disclaimer to every message, and an exception defined that if certain text (disclaimer text phase) is not included in a message; apply the default disclaimer to those messages.

Procedure:

Note: This example we will append a disclaimer to email messages sent by members of the Legal distribution group

1. Begin the process by opening the Exchange Management Console.

2. Navigate to Organization Configuration -> Hub Transport and select the Transport Rules tab.

3. Click the New Transport Rule link found in the Actions pane to launch the New Transport Rule wizard.

4. Enter a name for the Exchange Server 2007 transport rule you're creating. For this example, let's call the rule "Legal Department Disclaimer." This screen also contains an area in which you can enter a description of the rule that you are creating. (I've never been one to tell people to fill in description fields, but transport rules can be complicated enough that some rules may warrant a description.)

5. This screen also contains an "Enable Rule" checkbox, which is selected by default. This means that the rule you're creating will be enabled as soon as you finish creating it, unless you deselect this box. For our purposes, let's leave the "Enable Rule" checkbox selected, as shown in Figure A.

Figure A: You should leave the Enable Rule checkbox selected.

6. Click Next and you will be taken to the wizard's Conditions screen, which will allow you to choose the circumstances under which the rule is activated. Notice in Figure B that there are many conditions from which to choose. One of the reasons why transport rules can be so complex is because you have the option to choose multiple conditions.

Figure B: Select the circumstances under which rules will be activated.

7. This example we will append a disclaimer to email messages sent by members of the Legal distribution group, select the" From a Member of a Distribution List" checkbox.

8. In Figure B, notice that the bottom half of the screen says "Apply rule to messages from a member of a distribution list." The words "distribution list" are hyperlinked. You must click on this link to specify the specific distribution groups to which you want the rule to apply. After doing so, the text at the bottom of the screen changes to reflect the name of the distribution list, as shown in Figure C.

Figure C : The text reflects the name of the distribution group you've selected.

9. Click Next, and you will be taken to the wizard's Actions screen. We have already specified the circumstances that should trigger the transport rule. Now we must tell Exchange Server 2007 what should happen when the rule is triggered. Again, you have lots of options available to you. Since our goal is to create a confidentiality disclaimer though, choose the "Append Disclaimer Text" checkbox.

10. If you look at Figure D, you will notice that the last line of text at the bottom of the screen says "append disclaimer text using Arial, smallest, Gray, with separator and fallback to wrap if unable to apply". Exchange Server 2007 gives you the option of specifying the disclaimer text and how that text is displayed. By clicking on the various hyperlinks you can specify the font, its size, the font color, and whether or not you want to use a separator.

Figure D: Not only can you specify the disclaimer, but also how it is displayed.

11. The font and separator options are pretty much self-explanatory, but there are two options on this screen that I want to talk about a little bit more.

12. The first is the fallback option. Take another look at Figure D. The last part of the rule states that Exchange Server should fall back to wrap if unable to apply. Wrap is the default option, which is basically a way of telling Exchange Server to ignore the formatting and append the disclaimer in plain text.

13. You also have the option of falling back to an ignore state. If the disclaimer was unable to be applied for some reason, this option would cause Exchange Server to send the message without the disclaimer. Your other option in a fallback situation is to reject the message, so that it will not be sent without a disclaimer.

14. The second option is the append option. By clicking on the Append link, you have the option of either appending or prepending the disclaimer. This means that you can place the disclaimer at either the bottom or the top of the message.

15. Configuring exceptions to an Exchange 2007 transport rule

16. When you finish specifying the disclaimer text and the related options, click Next and you will be taken to the wizard's Exceptions screen. The Exceptions screen is used to specify circumstances in you do not want to apply the rule when it would normally be triggered.

17. Let's suppose that an employee in the legal department is also a member of the company's recreation committee. If that employee sends a message to all of the other employees asking for a volunteer to dress up as Santa Clause for the company Christmas party, the message really doesn't need to be treated as confidential.

18. There are a few different ways you could use transport rule exceptions to handle this type of situation. One possible option is to create an exception based on the message recipients. For example, you might create a rule exception that applies to users inside the company. That way the disclaimer won't be attached to messages sent to employees.

19. A better option is to base the exception on distribution group membership. For example, you could create a distribution group called "Social" that contains all company employees. You could then create an exception so that messages sent to the Social distribution group do not contain the disclaimer.

20. Still another option is to base the exception on keywords in the message' subject line. If an employee in the legal department wants to invite someone to lunch or something like that, they could put the word "social" in the subject line and the disclaimer would be left off.

21. If you do decide to create keyword-based exceptions, just make sure to choose your keywords carefully. Imagine the implications of someone sending an email with a subject line like "Social engineering related security breach." You would definitely want that message to be kept confidential. But the subject line contains the word "social," so our rule would omit the confidentiality disclaimer from the message.

22. After configuring any desired exceptions, click Next and you will see a screen that displays a summary of all of the information that you have entered. This screen displays the rule's name, description, and the conditions, actions, and exceptions that you have created. Assuming that everything looks good, click the New button and the rule will be created.

23. When the process completes, click the Finish button.

24. The Exchange Server 2007 transport rule is now ready to use.

Exchange 2007 – OWA Customization

2008-12-23T14:10:00.001-08:00

Outlook Web Access Customization

This section addresses AMAT ‘s specific Outlook Customizations. The list below summarizes customizations contained within this document.

· Setting Forms-Based Authentication Time-Out

· OWA - Computer File Access Configuration

Setting Forms-Based Authentication Time-Out

This topic explains how to configure the cookie time-out values for public and private computers by using forms-based authentication on a Microsoft Outlook Web Access virtual directory that is on a Microsoft Exchange 2007 server that has the Client Access server role installed.

Permissions Required:

To perform the following procedures, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server.

Note: Default Time-Out Settings for Outlook Web Access are as follows:

· Public Computer Time-Out: 15 Minutes

· Private Computer Time-Out: 4 Hours

Modify Public Computer Time-Out Settings

This topic explains how to configure the cookie time-out values for public computers by using forms-based authentication on a Microsoft Outlook Web Access virtual directory that is on a Microsoft Exchange 2007 server that has the Client Access server role installed.

1. On the Client Access server, log on by using the Exchange administrator account, and then start Registry Editor (regedit).

2. In Registry Editor, locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OWA

3. On the Edit menu, point to New, and then click DWORD Value. In the details pane, name the new value PublicTimeout.

4. Right-click the PublicTimeout DWORD value, and then click Modify.

5. In Edit DWORD Value, under Base, click Decimal.

6. In the Value Data box, type a value in minutes between 1 and 43,200 for a maximum of 30 days. Click OK.

Note: You must restart Internet Information Services (IIS) by using the command iisreset/noforce for these changes to take effect

To Modify the Public Time-Out settings through Exchange Management Shell:

Note: This command is to modify the Time-Out settings once the key already exists

set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\MSExchange OWA' -name PublicTimeout -value <amount of time> -type dword

Run the following command to view the public computer cookie time-out value:

get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\MSExchange OWA' -name PublicTimeout

Modify Private Computer Time-Out Settings

This topic explains how to configure the cookie time-out values for private computers by using forms-based authentication on a Microsoft Outlook Web Access virtual directory in Microsoft Exchange Server 2007. Private computers are also known as trusted computers.

1. On the Exchange Client Access server, log on by using your Exchange administrator account, and then start Registry Editor (regedit).

2. In Registry Editor, locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OWA

3. On the Edit menu, point to New, and then click DWORD Value. In the details pane, name the new value PrivateTimeout.

4. Right-click the PrivateTimeout DWORD value, and then click Modify.

5. In Edit DWORD Value, under Base, click Decimal.

6. In the Value Data box, type a value in minutes between 1 and 43,200 for a maximum of 30 days. Click OK.

To Modify the Private Time-Out settings through Exchange Management Shell:

Note: This command is to modify the Time-Out settings once the key already exists

set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\MSExchange OWA' -name PrivateTimeout -value <amount of time> -type dword

Run the following command to view the private computer cookie time-out value:

get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\MSExchange OWA' -name PrivateTimeout

OWA - Computer File Access Configuration

By default, public computer direct file access is enabled for new installations and upgrades of Outlook Web Access. Therefore, when users in your organization select This is a public or shared computer or This is a private computer on the Outlook Web Access logon page, they will be able to access files that are attached to e-mail messages.

Public and Private File Computer Access Settings

1. In the Exchange Management Console, click Server Configuration, and then click Client Access.

2. In the action pane, in Outlook Web Access, click Properties.

3. On the Outlook Web Access Properties page, click either the Public Computer File Access tab or the Private Computer File Access tab.

4. Make modification to the File Access configurations based on your business/security requirements.

More Info: Web Ready Document Viewing

WebReady Document Viewing converts documents to HTML files and displays them in a Web browser. This enables Outlook Web Access users to view a document that is attached to a message even when the application that would ordinarily be used to open that document is not present on the computer that is being used.

If the Client Access server is running Exchange 2007 SP1, WebReady Document Viewing supports the following file types:

· Word (.doc, .dot, rtf, .docx)

· Excel (.xls, .xlsx)

· PowerPoint (.ppt, .pps, .pptx)

· Adobe Portable Document Format (.pdf)

Exchange 2007 – Creating Dynamic Distribution Groups

2008-12-23T14:04:00.001-08:00

Creating Dynamic Distribution Groups

Scenario:

Dynamic Distribution Groups for the purpose of Maintenance Notifications to users. Unlike regular distribution groups that contain a defined set of members, the membership list for dynamic distribution groups is calculated each time a message is sent to them, based on the filters and conditions that you define. When an e-mail message is sent to a dynamic distribution group, it is delivered to all recipients in the organization that match the criteria defined for that dynamic distribution group.

How to create Dynamic Distribution Groups in Exchange 2007

Method 1: Exchange 2007 Management Console

1. Start the Exchange Management Console.

2. In the console tree, click Recipient Configuration node.

3. In the action pane, click New Dynamic Distribution Group. The New Dynamic Distribution Group wizard appears.

4. On the Introduction page, complete the following fields. All fields on this page are required:

· Organizational Unit By default, this box will show the organizational unit (OU) that is set as the recipient scope. Click Browse to open the Select Organizational Unit dialog box. Use this dialog box to select a different OU, and then click OK.

· Name Use this text box to type the name for the dynamic distribution group. The name cannot exceed 64 characters.

· Alias Use this text box to type the alias of the dynamic distribution group. The alias cannot exceed 64 characters and must be unique in the forest.

5. Click Next.

6. On the Filter Settings page, define the recipient filter for the new dynamic distribution group:

· Click Browse to select the OU to select the recipients from. A dynamic distribution group contains all recipients that are in the specified OU and any other OUs under it.

· Select the recipient types you want to include in the dynamic distribution group. You can select All recipient types or The following specific types. If you select The following specific types, you must select at least one recipient type.

7. Click Next.

8. On the Conditions page, define any additional conditions to further restrict the recipients included in this dynamic distribution group. You can set the conditions to have only the recipients that are in a specific state or province, work in a specific department, work for a specific company, or have specific values for custom attributes. Conditions are optional.

a. In the Step 1: Select condition(s) list box, select the check boxes that correspond to the conditions you want to set. As you select check boxes in this list box, the selected conditions will appear in the Step 2: Edit the condition(s) list box. A pencil icon will appear next to each condition indicating that a valid value needs to be provided.

b. In the Step 2: Edit the condition(s) list box, click the underlined value that reads specified for each condition and provide the value. After you provide a valid value for a condition, the corresponding pencil icon will disappear.

c. Click Preview to view the recipients that will be contained in the dynamic distribution group, based on the conditions that you specified.

Click Next.

On the New Dynamic Distribution Group page, review the Configuration Summary. To make any configuration changes, click Back. To create the new dynamic distribution group, click New.

On the Completion page, the Summary displays whether the dynamic distribution group was successfully created. The summary also displays the Exchange Management Shell command that was used to create the dynamic distribution group.

Click Finish

Method 2: Exchange Management Shell

· Run the following command to create a dynamic distribution group called Mailbox Users DDG that contains only mailbox users:

New-DynamicDistributionGroup -IncludedRecipients MailboxUsers -Name "Mailbox Users DDG" -OrganizationalUnit Users

· Run the following command to create a dynamic distribution group with a custom recipient filter. The dynamic distribution group contains all mailbox users on a server called Server1

New-DynamicDistributionGroup -Name "Mailbox Users on Server1" -OrganizationalUnit Users -RecipientFilter {((RecipientType -eq 'UserMailbox' -and ServerName -eq 'Server1') -and -not(Name -like 'SystemMailbox{*')

Exchange 2007 – Modify Default Managed Folders

2008-12-23T14:00:00.001-08:00

Modify Default Managed Folders (i.e. Deleted Items)

Scenario:

A company has elected to automate the deletion of messages within the “Deleted Items” folders based on a retention period of their choice. After the retention period for a specific message(s) with the “Deleted Items” folder, the message will be permanently deleted from that folder. However this will not apply to the Mailbox Database “Deleted Item Retention period currently enforced and users will still be able to perform the “recover deleted items” function from the client.

You can implement MRM (Message Records Management) within the organization to apply messaging policies in various scenarios. You can create managed custom folders in user mailboxes and apply MRM policies to these managed custom folders and also the default folder. You can then configure content settings for both the custom and the default e-mail folders

How to Modify Default Managed Folder (Deleted Items)

Method 1: From the Exchange Management Console

1. Run the EMC.

2. Expand the Organization Configuration node and then click Mailbox.

3. In the result pane, select the Managed Default Folders tab

4. Select the “Deleted Items” folder

5. Right Click and Select the “New Managed Content Settings”

6. Enter a name for the Managed Folder Content Settings (Ex. 2 –Day Retention All)

7. Message Type Enter “All Mailbox Content”. This refers to the type of messages that this policy will apply. In this case anything that is deleted (Contact, Notes, Messages, etc.) will be deleted from the deleted items folder after two days from the day it is placed in the Deleted Items folder.

8. Set the length of retention period (days).

9. Select when the Retention Period starts. In this case select “When item is moved to the folder”

10. Finally select the action to perform at the end of the retention period. Select “Delete and Allow Recovery”. This option will allow for users to still use the “recovery deleted items option” from the Outlook client.

11. Click “Next”

12. On the Journaling options page, do not select anything and click “Next”.

13. Finally Click “New” to create the content setting.

14. Once it is created, click “Finish”.

15. After its complete, you will see that the Deleted Items managed folder can be expanded and that new content setting is listed below.

Method 2: Exchange Management Shell

1. Open Exchange Management Shell

2. Enter the following command line:

new-ManagedContentSettings -Name '2 - Day Retention All' -FolderName 'Deleted Items' -RetentionAction 'DeleteAndAllowRecovery' -AddressForJournaling $null -AgeLimitForRetention '2.00:00:00' -JournalingEnabled $false -MessageFormatForJournaling 'UseTnef' -RetentionEnabled $true -LabelForJournaling '' -MessageClass '*' -MoveToDestinationFolder $null -TriggerForRetention 'WhenMoved'

MOM & SCOM – Exchange 2007 Availability Testing

2008-11-01T08:44:00.000-07:00

This article will provide procedures for creating Test Accounts for Exchange 2007 Availability Testing. Setting up test accounts makes it easier for executing builtin Exchange 2007 availability tests (for certain tests) without providing credentials, additionally these accounts are required for MOM 2005 and SCOM 2007 availability testing for the Exchange 2007 Management Pack.

Symptom:

Microsoft Operations Manager 2005 implementation is generating numerous service/connectivity failures for the Exchange 2007 environment. These tests include:

Test Cmdlet	Description
ActiveSync (Test-ActiveSyncConnectivity)	The Test-ActiveSyncConnectivity cmdlet lets you perform a full synchronization against a specified mailbox to test the configuration of Microsoft Exchange ActiveSync.
Outlook Web Access (Test-OWAConnectivity)	The Test-OwaConnectivity cmdlet can be used to test the connectivity of all Exchange 2007 Outlook Web Access virtual directories on a Client Access server or to test connectivity of a single Exchange 2007 Outlook Web Access URL.
Web Services (Test-WebServicesConnectivity)	Perform basic operations to verify the functionality of Exchange Web Services on a Microsoft Exchange Server 2007 computer that has the Client Access server role installed.
Unified Messaging (Test-UnifiedMessagingConnectivity)	The Test-UMConnectivity cmdlet can be used to test the operation of a Unified Messaging (U M)

Note: There are many more built-in Exchange 2007 health cmdlets, however the for mentioned cmdlets are the only ones that utilize and require a test account to be created.

Cause:

The Microsoft Exchange Server 2007 Management Pack for Operations Manager runs Exchange Management Shell cmdlets to monitor the Exchange environment. In order for these tests to run successfully against the Exchange 2007 environment, test accounts must be created which the “Test-*” cmdlets will run under for Exchange. If the test accounts are not created, MOM/SCOM alerts will be generated. It is recommended that these accounts be created for each Exchange 2007 Mailbox Server role (Mailbox & Public Folder) to enable MOM 2005 and the future deployment of SCOM 2007 to run these service health tests successfully.

Solution:

To remediate the service health failures thrown within MOM, test accounts must be created for each Exchange 2007 Mailbox Server Role. This section will detail the process for creating these accounts as well as the validation process following completion.

Requirements

The account that will be used to create the test accounts must meet the following requirements.

Group Membership	Target Location
Administrators	Mailbox/Public Folder Servers
Exchange Server Administrator Role	Exchange Organization
<group> Rights to Create Active Directory User	Active Directory. Default location is CN=Users container, however it can be modified within the script executed to create the accounts within a particular Organizational Unit. Script Modification will be discussed later in the document.

Virtual Directory Configuration

Verify Outlook Web Access is configured with an Internal and External URL. This can be done either within the Exchange Management Console or Exchange Management Shell. Below is the command to pull the configuration for the OWA virtual directory.

get-owavirtualdirectory | where{$_.name -eq "OWA (Default Web Site)"} | fl name,server,internalURL,externalURL

Sample Output:

If an Internal and External URL exists, proceed to “Create Test Accounts” section. Otherwise follow the procedure below for assigning a Internal/External URL.

Example (Set External URL)

To set an external URL, you need to run the Set-OwaVirtualDirectory Exchange Management Shell command. The syntax of the command is:

set-owavirtualdirectory “con01\owa (Default Web Site)" -externalurl:https://webmail.contoso.com/owa

Create Test Accounts

To create the test mailbox, log on to an Exchange 2007 server with a user account that is an Exchange Mailbox administrator.

Verify Script File Configuration

Before executing the “New-TestCASConnectivityUser.ps1”, verify that the following line of code within the script reflects the desired OU location for creating the test accounts. As stated earlier the default container is “Users”, and this may not be the desired location for the account. To modify the script file’s code follow the steps below, otherwise proceed to next section.

Note: If multiple mailbox servers exist, then it will be easiest to execute the Test Account creation process against ALL the mailbox servers, from just one Exchange 2007 management console.

Test-CASConnectivityUser.ps1 code modification:

Open the Exchange Management Shell, locate the Scripts directory under the installation path for Exchange 2007 (<drive> \Program Files\Microsoft\Exchange Server\Scripts) .

Enter from the command prompt

[PS]> notepad New-TestCASConnectivityUser.ps1

Modify line: 46 Col: 197 to reflect the correct OU location for the test account to be created. The OU location is in the format <domain>\OU\OU….

Once the OU location has been inserted. Save the changes and copy to a network share that the other Mailbox servers can connect.

After updating and saving the file, proceed to the next section “Run New-TestCASConnectivtyUser.ps1”.

Run New-TestCASConnectivityUser.ps1 Script

If not already, log onto an Exchange 2007 Mailbox server with a user account that meets the requirements in the requirements section.

Open the Exchange Management Shell, locate the Scripts directory under the installation path for Exchange 2007 (<drive> \Program Files\Microsoft\Exchange Server\Scripts) .

To get a list of all Exchange 2007 Mailbox Server run the following command.

[PS]> Get-MailboxServer

Once we have the list, you can begin to execute the script against each Exchange Mailbox Server .

Note: The script execution process will be the same for each mailbox server, with the exception of the command line server parameter.

Enter the following command

Note: In order for this to run successfully you have to PIPE a mailbox server into the command.

Multiple servers

Get-MailboxServer  | New-TestCASConnectivityUser.ps1

One server at a time

Get-MailboxServer –id <ServerName> | New-TestCASConnectivityUser.ps1

When prompted enter a password for the account, and press Enter.

Note: Make the password same across the test accounts for simplicity.

When asked to Create Test User On: <ServerName>, verify the target mailbox server name is correct and press Enter to continue.

Following creation of the account, verify the account was actually created. Easiest way is to open the Exchange Management Console and verify the mailbox exists, and that it was created for the correct mailbox server.

Note: The mailbox name will be in the format of: CAS_{GUID}. The GUID is like the first 16 characters of the mailbox server GUID.

Repeat this process for each Exchange 2007 Mailbox server that is to be tested.

Validation

Following account creation, the next step is to verify that the Test-* commands can be run successfully. Errors during testing could either point to improper Exchange service configuration or incorrect test account creation.

To validate proper configuration of Exchange Services and proper test account creation. Run the following tests and review results.

Note: Once the accounts are created MOM 2005 and SCOM 2007 will automatically pick up on them. Although this process will kick off automatically through monitoring, it is best to run the commands manually to see results first hand, and pursue remediation.

Test-ActiveSyncConnectivity

Run the following command to test Active Sync Connectivity.

Test-ActiveSyncConnectivity –MonitoringContext:$true –TrustAnySSLCertificate:$true –LightMode:$true

Verify the “Results” column lists “Success”. If not then begin troubleshooting the problem.

Test-WebServicesConnectivity

Run the following command to test Exchange Web Services.

Test-WebServicesConnectivity –MonitoringContext:$true –TrustAnySSLCertificate:$true –LightMode:$true

Verify the “Results” column lists “Success”. If not then begin troubleshooting the problem.

Test-OWAConnectivity

Run the following command to test Outlook Web Access connectivity.

TEST INTERNAL URL

Test-OWAConnectivity –TestType:Internal –MonitoringContext:$true –TrustAnySSLCertificate:$true –LightMode:$true

TEST EXTERNAL URL

Test-OWAConnectivity –TestType:External –MonitoringContext:$true –TrustAnySSLCertificate:$true –LightMode:$true

Verify the “Results” column lists “Success”. If not then begin troubleshooting the problem.

If all tests pass for each Connectivity test, move on to monitoring MOM 2005 and SCOM 2007 and verify that the tests are executing and completing successfully.

Script - Create New FreeBusy Connector

2008-10-28T19:33:00.001-07:00

The following script can be used to create a new Transporter Suite Free/Busy Connector. This can be for a new connector on an Existing Exchange Server or a new Connector on another Exchange Server. Modify the code accordingly.

#Create a new Domino Free Busy Connector

# Transporter Commmand Parameters (New-DominoFreeBusyConnector)
#        -Name: Connector name#
#        -DominoServer: Identifies the Lotus Domino server running the excalcon.exe task.
#        -DomainoSMTPDomains: Specifies the Domino SMTP domains that the Exchange transporter Domino Free/Busy Connector monitors for free/busy requests.
#        -NotesINIFile: Path to the Lotus Notes.ini file, including filename.
#        -RefreshIntervalSeconds: Number of seconds free/busy information will be retained for a previously requested user. The default is 900 seconds
#        -NotesPassword : The password associated with the local Lotus Notes ID file.
#        -MaintenanceIntervalMinutes : Determines how often the connector should verify that the Lotus Notes users are listed in the free/busy public folders.
#        -QueryWindowDays :Defines how many days of free/busy information to retrieve. The default is 60 days

# -RequestTimeOutSeconds : Specifies how long to retry accessing a server before returning an error.The default is 15 seconds

Write-Host
Write-Host
Write-Host "C R E A T E N E W F R E E / B U S Y C O N N E C T O R"
Write-Host

$Password=Read-Host "Enter Notes Password: " -AsSecureString

#DELETE EXISTING CONNECTOR PRODUCTION
Remove-DominoFreeBusyConnector -identity '<ExchServerHostingTransporterSuite>-DominoFreeBusyConnector' -Confirm:$False

#NEW FREE BUSY CONNECTOR PRODUCTION
New-DominoFreeBusyConnector -Name '<ExchServerHostingTransporterSuite Domino Free Busy Connector' -NotesPassword $Password -DominoServer '<DominoServerHostingEXCALCON/DOMINO DOMAIN-ConnectedDomains 'company.com; exchange.company.com;' -NotesINIFIle 'D:\lotus\notes\notes.ini' -RefreshIntervalSeconds '300'

#START FREE BUSY CONNECTOR
Start-DominoFreeBusyConnector

#START SYNCHRONIZE ENTRIES
Start-DominoFreeBusyConnector -synchronizeEntries $True

Exchange 2007 - Upgrading Email Policies

2008-09-03T12:38:00.001-07:00

Upgrading Email Address Policies (EAP)

If Exchange 2007 organization resides with legacy instances of Exchange 2000/2003. The deployment of Exchange 2007 within the same organization results in a coexistence with legacy Exchange and Exchange 2007. As with any coexistence/migration scenario, steps should be taken to convert/move legacy born objects to native Exchange 2007 objects. This section will talk about the steps you can take to upgrade your legacy LDAP filters for EAPs to the new syntax, allowing you to upgrade your Address List and Email Address Policy objects to the Exchange 2007 object version. Exchange 2007 uses a new style of filter syntax to replace the LDAP filters of previous versions.

Note: that if you decide not to upgrade the ALs or EAPs, there will be no broken functionality from the Exchange 2007 side. New users will still be provisioned according to those policies. However you will not be able to edit those objects from 2007 Exchange Management Console until they are upgraded.

To confirm the need to upgrade the filter (and the version) on your EAP. There are a couple of key indicators you can check. The first is that if you try to edit the EAP in Exchange 2007 GUI, you'll get a screen with this error - "Unable to edit the specified E-mail address policy. E-mail address policies created with legacy versions of Exchange must be upgraded using the 'Set-EmailAddressPolicy' task, with the Exchange 2007 Recipient Filter specified.":

Another way to check that doesn't rely on the GUI is to issue this one-liner:

Get-EmailAddressPolicy | Format-List Name,*RecipientFilter*,ExchangeVersion

This cmdlet will return all of your EAPs, and will include any properties containing RecipientFilter and the ExchangeVersion property. Look for these clues:

· LdapRecipientFilter is populated but RecipientFilter is empty - Exchange 2003 doesn't populate RecipientFilter; that's what we're about to do!

· RecipientFilterType is "Legacy"

· ExchangeVersion is "0.0 (6.5.6500.0)"

<Company> Email Address Policy Results (Pre-EAP Upgrade) –

· Sample One legacy (Exchange 2003) and One Native (Exchange 2007)

Legacy Sample

Name : Default Policy
RecipientFilter :
LdapRecipientFilter : (mailnickname=*)
LastUpdatedRecipientFilter :
RecipientFilterApplied : False
RecipientFilterType : Legacy
ExchangeVersion : 0.0 (6.5.6500.0)

Native Exchange 2007 Sample

Name : company
RecipientFilter : (CustomAttribute1 -eq 'company.com' -and Alias -ne $null)
LdapRecipientFilter : (&(extensionAttribute1=company.com)(mailNickname=*))
LastUpdatedRecipientFilter : (CustomAttribute1 -eq 'company.com' -and Alias -ne $null)
RecipientFilterApplied : True
RecipientFilterType : Precanned
ExchangeVersion : 0.1 (8.0.535.0)

Upgrading Default EAPs

Note: Once these changes are made, you can no longer manage the email policies within the Exchange 2003 System Manager.

IMPORTANT: This process is only for “Default” email policies. Upgrading Custom Email Policies.

Since the "Default Policy" EAP has a well-known filter, we can simply provide the Exchange 2007 equivalent of this well-known filter to do the upgrade. Here's the one-liner:

Set-EmailAddressPolicy "Default Policy" -IncludedRecipients AllRecipients

When you run this one-liner, you'll be prompted to ask whether you REALLY want to do the upgrade with this text: "To save changes on object "Default Policy", the object must be upgraded to the current Exchange version. After the upgrade, this object cannot be managed by a previous version of Exchange System Manager. Do you want to continue to upgrade and save the object?"

Once you've committed to a "Y" answer on this confirmation, the "Default Policy" EAP will be upgraded to Exchange 2007 version with the new Exchange 2007 filter in place. You can confirm this by looking at the same properties as before. Now you'll notice that there is a RecipientFilter property populated, that the RecipientFilterType is "Precanned", and that the Exchange version has bumped to 0.1 (8.0.535.0). Further, you may notice that you can no longer make changes to the recipient policy through Exchange 2003 ESM, although the Exchange 2003 Recipient Update Service (RUS) will continue to process these recipient policies just fine.

Upgrading Custom EAPs

What if you've created some special EAP or AL objects for your organization, over and above the built-in set of EAP and AL objects? How can you convert the "not-so-well-known" LDAP filter you have created into an equivalent OPATH filter for use by PowerShell?

Upgrading Custome EAPs is not as simple as upgrading Default Policies. There is more to than simply running a command.

http://msexchangeteam.com/archive/2007/01/11/432158.aspx

Domino to Exchange 2007 Migration Tool Comparison

2008-08-29T16:48:00.001-07:00

Domino/Notes to Exchange/Outlook migration tool set comparisons:

** Note: These are Data Migration Tool Comparisons. Not Coexistence features.

Migration Capability	Detail	MS Transporter	CMT - Universal Binary Tree	Quest - Notes Migrator
Mail	Will it move mail?	Y	Y	Y
Encrypted Mail	Will it decrypt mail?	N	Y	Y
Archived Local	Will it import archives from local client?		Y	Y
Archived Server	Will it import server based archives?	Y	Y	Y
To-Do	Will it migrate To Do Lists to Tasks?	Y	Y	Y
Keep-To-Do-Assignments	Will it keep all the information?	N	Y	N
Doc Links	Are they converted?	Y	Y	Y
Excluded hidden folders- custom	Will it migrated user private folders?	N	Y	Y
Personal Address Book	Will it do local names.nsf to contacts?	Y	Y	Y
Personal DL and Membership	Will it translate these names.nsf to contacts?	Y	Y	Y
Server Groups	Can it migrate server groups?	Y		Y
Mail InDB	Can it migrate Mail-in databases?	N	Y	Y
Document Library	Can it migrate document libraries?	Y	Y	N
Discussion Library	Can it migrate Discussion libraries?	Y	Y	N
iNotes Contacts	Will it migrate iNotes contacts to Outlook contacts?	N	Y	Y
Filter Mail	Filter mail based on date?	Y	Y	Y
Filter Attachment	Filter based on size?	*	Y	Y
Filter Calendar	Filter calendar based on date?	*	Y	Y
Filter To-Do	Filter based on date?	*	Y	Y
Powershell	Does it interface with Powershell?	Y	N	Y
Migrate to PST	Will it migrate mail directly to a PST?	N	Y	Y
PST Contains Calendar	Will it migrate calendar directly to PST?	N	Y	Y
PST Contains Tasks	Will it migrate tasks directly to PST?	N	Y	Y
PST Contains Contacts	Will it migrate Contacts directly to PST?	N	Y	Y
Custom Address Mapping	Custom address translation during migration of data?	N	Y	Y
Rules	Will it move Notes client rules to Outlook Rules?	N	Y	N
Rooms/Resources		N	Y	Y
Custom Reoccurring Meeting	Will it migrate rooms and resources to Exchange?	N	Y	Y
Pre-Processing	Do you have any pre-processing setup options?	*	Y	Y
Post-Processing	Do you have any Post-Processing setup options?	*	Y	Y
Domino Directory Manipulation	Does it change the Domino directory?	*	Y	Y
Batch Mode	Can it be batched?	*	Y	Y
Config Files Required	Does it require a config file for batch migrations?	*	N	Y
Migrate All Document Views	Does it migrate documents not in any folder?	N	Y	Y
Users Created Required ?	Does it require mailbox to exist?	N	Y	Y
Merge Contact to User	Does it do AD manipulation?	Y	N	Y
Mail Enabled users required?	Does it do AD manipulation?	N	Y	Y
Mailboxes Created required?	Does it do AD manipulation?	N	Y	N
Reporting	Are reports available?	N	Y	N
End-User Option	Can an end user DITY?	N	Y	N
Purge mail mode	If you have to restart the migration can you purge mail first?	Y	Y	N
Merge Mail mode	If you have to restart the migration can you merge the information without remigrating?	Y	Y	N
Maximum Threads	Can thread count be modified to increase performance?	16	Y	32
Skip Empty Folder option	Can you skip empty folders?		Y
Pre Migration Customizable AD Scripts	Do you provide free scripts to enhance the process?		Y
Post Migration Customizable AD Scripts	Do you provide free scripts to enhance the process?		Y
Reschedule Meetings Post Migration	Can you reschedule a meeting successfully POST Migration?		Y

Migration Tools Features Matrix

2008-06-20T09:33:00.001-07:00

This post will provide migration/coexistence capabilities for a few select Domino to Exchange 07 migration on the market today. Unfortunately there is no single winner and depending on your particular migration/coexistence needs, you may have to integrate multiple tools to get the job done.

KB References

2008-04-11T11:23:00.001-07:00

This post will provide Knowledge Base references.

Describes that you may receive a "[0xC3EC7840]" error message in the OCS 2007 setup log... When you use the Create/Upgrade Enterprise Edition Pool Setup program to create a Microsoft Office Communications Server 2007 enterprise pool ...

http://support.microsoft.com/kb/911787/en-us

Address Book Chaos

2008-04-11T11:22:00.001-07:00

The following article will detail procedures for resolving common Address Book configuration issues.

Service Unavailable Issues
Address Book authentication issues
Address Book download errors

Service Unavailable Issue

Address Book access could be a direct result of a stopped IIS service on the ABS host. Checking for a service outage is performed from a browser and IIS Manager console.

Check that services are online:

Open IIS Manger and navigate to the web site hosting "ABS" virtual directory.
Check that the service for the web site is running. If it is not then start up the web site and refresh to verify the service stays online.
Next navigate to the "ABS" virtual directory, and open "Properties".
Under the "Virtual Directory" tab, look to see which application pool the virtual directory is using. (Default is LSGroupExpAppPool)
Click cancel to close the properties window
Navigate to the "Application Pools" directory within IIS.
Check the LSGroupExpAppPool (or whichever application pool was listed in step 4) and verify the service is running. If it is not, open the Properties of the Application Pool and select the "Identity" tab.
Verify that Configurable is selected and the Username and Password fields have values. Common issue here is that the Username is populated; however the password field is blank. This is usually a result of changed password for the service account listed. (Recommendation would be to make sure the service account listed is set within Active Directory as "Password Never Expires".
If the password is blank, enter the password for the account and start up the service.
Verify service stays online. Even if the password is blank or incorrect the service may start however the next time the ABS service is accessed the application pools will disable itself.
To test... Within IIS manager navigate to the ABS\ Int\Files directory and log down one of the address book service file names. This filename will be appended to the URL entered in the following step.
Open a browser and enter the URL to the address book server along with the full path the ABS file logged in the previous step. Example: Https://absserver.company.ad/abs/int/handler/F-0a2e3d.lsabs
If the Identity configured above is correct and password is valid then you will get prompt for the downloading of the file. It it was configured incorrectly you will receive the "Service Unavailable" page (listed below).

Address Book Authentication Issues

Authentication issues could range from multiple credential prompts for Address Book access, Synchronization errors, download failures, etc. The following procedures have resolved majority of the Address Book issues I have encountered

Sample images of common ABS issues:

Multiple Credential Prompts (MOC)
Synchronization errors (MOC)

Note: If you are experiencing Address Book issues ONLY on Windows VISTA machines and the XP or 2000 fine. Refer to my other article Address Book Download Issues (Vista machines).

Lets get started:

When starting Office Communicator, it will sign the user in but then present you with the following prompt to download the address book. Normally there is no prompt (Integrated Windows Authentication) and Communicator downloads the address book seamlessly.

When Office Communicator signs in it receives a referral from the OCS 2007 frontend to the address book URL. The default is a HTTPS URL which requires a valid certificate assigned to IIS. Before you begin troubleshooting, verify the Address Book URL that your clients are attempting to connect to.

Note: This document focuses solely on resolving issues related to Internal Address Book service connection issues. External connection issues to the Address Book service extend beyond this document, because many other factors can come into play (i.e. Reverse Proxy, Connectivity, Firewalls, etc.)

Check Internal Address Book URL and Output Location

Note: This example is retrieving the address book url for an Enterprise Pool deployment.

Open the Office Communication Server 2007 console and navigate the Enterprise Pool. You can see the address book URL and share location in the status page for the pool . Share Location is where the full and delta Address Book files are stored which MOC client downloads.

Address Book URL

https://adhc-01.contoso.com/abs/int/handler

Verify permissions to the Address Book Files

Verify the security configuration of the UNC path specified. Ensure that RTCUniversalGuestAccessGroup has the following permissions:

Share level: Read
NTFS level: Read & Execute, List Folder Contents, and Read.

After verifying the permissions on the share, review the IIS settings for the virtual directory. Below is an example of the structure for Abs. The Files virtual directory should be referring to the UNC path in its properties.
After permissions are verified, run a query or lookup the membership to the RTCUniversalGuestAccessGroup. Log the membership to the group, as they will be referenced in the following section.

Verify the "Connect As" Account to the Address Book Files directory.

Ensure that we have set the correct account that will be used to access the UNC share in the virtual directory properties as in the example below.

Referencing the same directory above "ABS\Int\Files", select Properties > Virtual Directory tab.
Click the Connect As button.
Verify that the account listed is a member to the RTCUniversalGuestAccessGroup. If another group was used in the previous section verify the "connect as" account is a member of that group.

Verify the Authentication Settings for the ABS Virtual Directory

Now that you have the actual location clients are attempting to access for Address Book downloads, open IIS manager and verify the Authentication Setting for that site.

Open IIS Manager and navigate to the Web Site (ex. default website) hosting ABS virtual directory.
Right click on the ABS virtual directory and select Properties.
Click Directory Security tab and click Authentication and Access Control button.
Check which authentication settings. (Internal ABS access would normally be set to Integrated Windows Authentication). We are going to assume that Integrated Authentication is selected. Continue to step 5.
Integrated Windows Authentication will use Kerberos as the primary method of authentication, and in order for this to work the Service Principal Name (SPN) must be configured correctly for the url clients access otherwise authentication issues will exist.

Check Service Principal Name (SPN) is registered correctly

To complete this test, you must have the Office Communication Server 2007 Resource kit is installed. The tool used to check the SPN registration is the CheckSPN.vbs script.

Kerberos authentication is not possible for services without properly set Service Principal Names (SPNs). SPNs are unique identifiers for services running on servers. Each service that uses Kerberos authentication needs to have an SPN set for it so that clients can identify the service on the network. It is registered in Active Directory under a user account as an attribute called Service-Principal-Name. The SPN is assigned to the account under which the service the SPN identifies is running. Any service can look up the SPN for another service. When a service wants to authenticate to another service, it uses that service’s SPN to differentiate it from other services running on that computer.

In general, only one SPN should be set for each service. Multiple SPNs can cause clients to connect to the wrong system or the ticket may be encrypted with the wrong key.

Note: Common configuration problems are the use of a virtual FQDN listed for the certificate subject name (ex. ocspool.company.com) and/or SPN is registered with multiple user accounts. Kerberos will choke when the name listed on the certificate is not an actual machine name within Active Directory and SPN is registered with multiple user accounts.

For this test you will first run the Checkspn.vbs tool against the name listed onthe ABS site's certificate subject name.

!!! The recommended configuration is one where the Subject Name on the certificate and the machine hosting ABS are one in the same. Most common configuration no,no is to use the same certificate used for the enterprise pool. This is a virtual machine name and kerberos will fail.

Open a command prompt and navigate to where the CheckSPN.vbs file is located (default directory: C:\Program Files\Microsoft Office Communications Server 2007\ResKit)
Run the checkspn script: /abs/int/handler">/abs/int/handler">/abs/int/handler">/abs/int/handler">/abs/int/handler">/abs/int/handler">/abs/int/handler">http://<serverFQDN>/abs/int/handler

> cscript checkspn.vbs /check /s:<serverFQDN>
Verify that you receive "SUCCESS" results. If you receive an error, reference the Office Communication Server 2007 Resource Kit Readme file for steps to resolve. This document will be located within the same directory as Checkspn.vbs.

In Addition to check modify SPNs you may have to use the SETSPN utility provide with the Windows 2Kx Support Tools. For how to use this tool reference the following site(s).

Service Logon Failures due to incorrectly set SPNs: http://technet2.microsoft.com/windowsserver/en/library/579246c8-2e32-4282-bce7-3209d1ea8bf11033.mspx?mfr=true

Below is an example of an incorrectly registered SPN. This error was generated because the name listed is a virtual name and not an actual machine name registered in AD. The following error was resolved by assigning the certificate Subject Name the name of the actual machine FQDN hosting ABS and changing the Address Book URL listed with OCS 2007 console. To change Address Book URL location, proceed to the next section.

IMPORTANT!

Typically the ABS location, Meeting Content download location, and distribution list expansion virtual directories fall under the same Web Site, which in turn use the same certificate. If for whatever reason the ABS URL Location is change, the meeting content download and distribution list expansion URL locations must also be modified to function properly.

Change ABS URL Location(s)

Reasons for changing the ABS URL:

Resolving SPN issues
Moving ABS location to another server
Incorrect URL entered during installation of OCS 2007

Note: ABS URL changes cannot be changed within the OCS console. They have to be modified through WMI (wbemtest.exe).

Logon to the Standard Edition or Enterprise Pool server with an account that is a member of the RTCUniversalServerAdmins group.
From a command prompt run wbemtest.exe
In the Windows Management Instrumentation tester window and click Connect
In the Connect dialog box, in Namespace, type root\cimv2, and then click Connect
In the Windows Management Instrumentation Tester dialog box, click Query button
Enter the following query
1. Standard Edition Server: In the Query dialog box, type the query, such as:
  
  Select * from MSFT_SIPAddressBookSetting where backend="(local)\\rtc"”
2. Enterprise Pool: In the Query dialog box, type the query, such as:
  
  Select * from MSFT_SIPAddressBookSetting where backend = ”BackendServerName\\DatabaseInstanceName”.
In the query results box double-click the results.
Select value you wish to edit. Example(ExternalURL), and then click Edit Property.
In the Property Editor dialog box, click to select the NOT NULL option.
In the Value box, type the external Web Farm URL in the following format, and then click Save Property and Save.
https://externalURL.domain.com/abs/Ext/Handler
Click Save Object and then click Close.
Click Exit.

IMPORTANT!

If the Address Book URL has been changed you most likely will have to modify the Meeting Content Download URL, and Distribution List Expansion URLs. To do this reference the following section.

Change WMI Setting for Meeting Content and Meeting Content Metadata folders

Logon to the Standard Edition or Enterprise Pool server with an account that is a member of the RTCUniversalServerAdmins group
From a command prompt run wbemtest.exe
In the Windows Management Instrumentation tester window and click Connect.
In the Connect dialog box, in Namespace, type root\cimv2, and then click Connect
In the Windows Management Instrumentation Tester dialog box, click Query button.
Enter the following query
- Standard Edition Server: In the Query dialog box, type the query, such as:
  
  Select * from MSFT_SIPDataMCUCapabilitySetting where Backend = “(local)file://///rtc”
- Enterprise Pool: In the Query dialog box, type the query, such as:
  
  Select * from MSFT_SIPDataMCUCapabilitySetting where Backend = ”BackendServerName\\DatabaseInstanceName”.
  
  Example (If default instance): Select * from MSFT_SIPDataMCUCapabilitySetting where Backend = "SQLServer"
  Note: When entering the sql statement make sure to have a carriage return following the command.
In the Query dialog box, click Apply.
In the Query Result dialog box, double-click MSFT_SIPDataMCUCapabilitySetting
In the Properties box select the property that you wish to change (i.e. MeetingMetadataLocation and MeetingContentLocation), edit the values and enter the correct UNC path and save property.
Click Save Object, and then click Close.
Click Exit

Change WMI Setting for Distribution List Expansion

Logon to the Standard Edition or Enterprise Pool server with an account that is a member of the RTCUniversalServerAdmins group.
From a command prompt run wbemtest.exe
In the Windows Management Instrumentation tester window and click Connect
In the Connect dialog box, in Namespace, type root\cimv2, and then click Connect
In the Windows Management Instrumentation Tester dialog box, click Query button
Enter the following query
1. Standard Edition Server: In the Query dialog box, type the query, such as:
  
  Select * from MSFT_SIPGroupExpansionSetting where backend="(local)\\rtc"”
2. Enterprise Pool: In the Query dialog box, type the query, such as:
  
  Select * from MSFT_SIPGroupExpansionSetting where backend = ”BackendServerName\\DatabaseInstanceName”.
In the query results box double-click the results.
Select value you wish to edit. Example(ExternalDLExpansionWebURL), and then click Edit Property.
In the Property Editor dialog box, click to select the NOT NULL option.
In the Value box, type the external Web Farm URL in the following format, and then click Save Property and Save. https://externalURL.domain.com/abs/Ext/Handler
Click Save Object and then click Close.

Address Book Download Issues (Vista machines)

2008-04-11T11:12:00.001-07:00

Let me see if this sounds familiar... Address Book service is configured correctly, and my Windows 2000/XP machines have no problem downloading the address, BUT my Windows Vista machines do. Below is a brief explanation of steps you can take to resolve the issues for Vista machines without tearing apart your server hosting ABS.

The OC client will inherit the proxy server configuration that is used by IE and cache the Abs/Ext/f-0901e.lsabs at the proxy and locally on the Windows client. The OC client configuration for automatic DNS lookup and manual TLS configuration can render different results in the HTTP URL that is used for accessing the ABS virtual folders. So there can be several different items that come into play that may cause issue with the creation or update of the galcontact.db file on the OC client.

The galcontacts.db file is located at %userprofile%\Local Settings\Application data\Microsoft\Communicator folder. Signing out of OC 2007 and moving or deleting this file then signing back into OC 2007 should import a new lsdabs file and a new galcontact.db should be created. For the Windows 2000/XP machines the GalContacts.db file will be present. Below are some steps to help resolve the address book download issue for Vista machines.

Procedure

Note: You could dive in further and start a network capture from the Vista machine while it signs however for simplicity lets just walk through these steps to see if they fix the issue.

Make sure this symptom is the same on all of your Vista clients.
Flush DNS by using ipconfig /flushdns on the client.
Verify within IE that 'Check for server certificate revocation* is disabled. To do this go to IE > Advanced > Security section > Check for sever certificate revocation*. Deselect the check box.
Now close Internet Explorer, close Communicator (Completely -- signout and close application)
Start Communicator| Signin
If your not presented with an error or the warning stating an issue accessing the Address Book, go to the %userprofile%\Local Settings\Application data\Microsoft\Communicator and verify that a GalContacts.db file exists. If it does exist, GREAT! Your done. If not then continue with the rest of the procedure.
Within IE add the Address Book URL that users will download the AB files. IE > Internet Options > Security > Trusted Sites > Add the URL to trusted sites (ex. https://absserver.company.com)
Repeat steps 4-6
If you still cannot download the address book try, move to step 10.
Verify that User Access Control is Off on the and then repeat steps 4-6.

Exchange Back Pressure

2008-04-11T11:11:00.003-07:00

After setting up an Exhange 2007 test environment on a Virtual Machine, I noticed an interesting issue with the routing of mail. Actually no mail routed at all, and the user connected whether it be via Outlook or OWA could not send any emails. No warnings, error messages or NDRs were evident to the user and the emails would simply remain within their "DRAFTS" folder.

During my investigation on the Exchange Mailbox server. I noticed a warning within the application log for an

EventID 1009 - warning event with the Source and Category Labeled as "MSExchangeMailSubmission". The description of the event was as follows "The Microsoft Exchange Mail Submission Service is currently unable to contact any Hub Transport Server in the local Active Directory Site. The servers may be too busy to accept new connections at this time".

After discover of the warning on the Mailbox Server I investigated the Hub Transport application log and discovered a warning EventID 15002, Source MSExchangeTransport, Category: ResourceManager. Although a warning this targeted the source of the problem, "Resources". More indepth look at the warning displayed the following information:

The resource pressure is constant at High. Statistics: Queue database and disk space ("C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Queue\mail.que") = 67% [High] [Normal=62% MediumHigh=64% High=66%] Queue database logging disk space ("C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Queue\") = 67% [Normal] [Normal=91% MediumHigh=93% High=95%] Version buckets = 1 [Normal] [Normal=40 MediumHigh=60 High=100] Private bytes = 19% [Normal] [Normal=71% MediumHigh=73% High=75%] Physical memory load = 83% [limit is 94% to start dehydrating messages.] Inbound mail submission from other Hub Transport servers, the Internet, the Pickup directory, the Replay directory, and the Mailbox server, if it is on a Hub Transport server, has stopped.Loading of e-mail from the queuing database, if available, continues.

Granted servers were not down and services were up and running; however mail was still not flowing. So I decided to do some research and I found a technet article that references this thing called "Back Pressure" for Exchange 2007. Basically Back Pressure is a resource monitoring feature built into Exchange 2007 Hub and Edge Transport server roles, which affects message delivery depending upon the current state of system resources available.

On a Hub or Edge Server the following three levels of system resource utilization are used:

Normal The resource is not overused. The server accepts new connections and messages.
Medium The resource is slightly overused. Back pressure is applied to the server in a limited manner. Mail from senders in the authoritative domain can flow. However, the server rejects new connections and messages from other sources.
High The resource is severely overused. Full back pressure is applied. All message flow stops, and the server rejects all new connections and messages.

All configuration options for back pressure are available in the EdgeTransport.exe.config application configuration file that is located in the C:\Program Files\Microsoft\Exchange Server\Bin directory. The EdgeTransport.exe.config file is an XML application configuration file that is associated with the EdgeTransport.exe file. EdgeTransport.exe and MSExchangeTransport.exe are the executable files that are used by the Microsoft Exchange Transport service. This service runs on every Hub Transport server or Edge Transport server. Changes that are saved to the EdgeTransport.exe.config file are applied after the Microsoft Exchange Transport service is restarted.

So in order to get my messages flowing referenced the warning EventID 15002 description and modified the "High" level values so that the calculation of my available resources would not exceed this value. Granted, you can increase the available resources (i.e. diskspace) by adding resources, however in my case this was a VM so I decided to go risky route and increase the EdgeTransport.exe.config file values to prove the concept.

In my case I modified the following line entry "PercentDatabaseDiskSpaceUsedHighThreshold" and increased it from 80 to 95.

Once I modified, saved the file and restarted the Transport service, messages were flowing out of the client "Draft" folders. Then I noticed that mail flow seized again, so I resorted to creating another drive/volume for messaging QUEUE and Logs then changed the Queue and Logs location. Of which can ALSO be performed by modifying the EdgeTransport.exe.config file. How to Change the Messaging Queues can be referenced HERE. Once I allocated enough space for the messaging queues, messages were flowing and Exchange was happy.

Reference Back Pressure
Reference Changing Messaging Queues

OCS - Changing Component UNCs, URLs, etc.

2008-04-11T11:11:00.001-07:00

How To Change OCS 2007 Meeting, ABS, Distribution Expansion… URLs and UNC paths

Let me see if this sounds familiar. You decide to configure or reconfigure the UNC paths or URLs for Meeting download location, ABS, Distribution List expansion urls…. However you cannot edit these fields within the GUI. So what now? Well this is where the wbemtest.exe tool comes into play.

This article will provide the procedure for changing the Meeting Content and Metadata UNC paths. The procedure for changing other settings such as URLs for these resources will be similar with respect to using wbemtest.exe however other provisions will have to follow for IIS modifications.

The location for the meeting content folder and the meeting metadata folder are specified during setup and cannot be changed using Office Communications Server 2007. However, those locations can be changed after Office Communications Server is deployed by using the manual steps described in the following sections.

Manually changing the folder location for meeting content and metadata requires completing the following four steps:

1. Creating and configuring the file folders and file shares for meeting content and metadata.

2. Changing WMI settings for meeting content and meeting content metadata folders.

3. Changing the IIS virtual directory to the presentation folder.

4. Restarting the Communications Server Web Conferencing service.

Note: First stop the Web Conferencing service before performing the following steps

To Configure shares for meeting content and metadata

1. If not already created, create the shares for meeting content .

Content Share: \\ServerName\Content

· Standard Edition: Permissions for folders (<contentShare> > Properties > Security)

User Group	Access Permissions
RTC Component Local Group	Read/Write
Users (Local Group)	Read-Only

· Enterprise Edition: Permissions for folders (<ContentShare> > Properties > Security)

User Group	Access Permissions
RTCUniversalGuestAccessGroup	Read Read and Execute List Folder Contents
RTCComponentUniversalServices	Read Read and Execute Modify Write

Metadata Share: \\ServerName\Metadata

· Standard Edition: Permissions for folders (<MetadataShare> > Properties > Security)

User Group	Access Permissions
RTC Component Local Group	Read/Write

· Enterprise Edition: Permissions for folders (<MetadataShare> > Properties > Security)

User Group	Access Permissions
RTCComponentUniversalServices	Read Read and Execute Modify Write

Change WMI Setting for Meeting Content and Meeting Content Metadata folders

1. Logon to the Standard Edition or Enterprise Pool server with an account that is a member of the RTCUniversalServerAdmins group

2. From a command prompt run wbemtest.exe

3. In the Windows Management Instrumentation tester window and click Connect.

4. In the Connect dialog box, in Namespace, type root\cimv2, and then click Connect

5. In the Windows Management Instrumentation Tester dialog box, click Query button.

6. Enter the following query

a. Standard Edition Server:
In the Query dialog box, type the query, such as:

Select * from MSFT_SIPDataMCUCapabilitySetting where Backend = “(local)file://///rtc”

b. Enterprise Pool:
In the Query dialog box, type the query, such as:

Select * from MSFT_SIPDataMCUCapabilitySetting where Backend = ”BackendServerName\\DatabaseInstanceName”.

Example (If default instance): Select * from MSFT_SIPDataMCUCapabilitySetting where Backend = "SQLServer"

Note: When entering the sql statement make sure to have a carriage return following the command.

7. In the Query dialog box, click Apply.

8. In the Query Result dialog box, double-click MSFT_SIPDataMCUCapabilitySetting

9. In the Properties box select the property that you wish to change (i.e. MeetingMetadataLocation and MeetingContentLocation), edit the values and enter the correct UNC path and save property.

10. Click Save Object, and then click Close.

11. Click Exit

Change WMI Setting for Distribution List Expansion

1. Logon to the Standard Edition or Enterprise Pool server with an account that is a member of the RTCUniversalServerAdmins group.

2. From a command prompt run wbemtest.exe

3. In the Windows Management Instrumentation tester window and click Connect

4. In the Connect dialog box, in Namespace, type root\cimv2, and then click Connect

5. In the Windows Management Instrumentation Tester dialog box, click Query button

Enter the following query

a. Standard Edition Server:
In the Query dialog box, type the query, such as:

Select * from MSFT_SIPGroupExpansionSetting where backend="(local)\\rtc"”

b. Enterprise Pool:
In the Query dialog box, type the query, such as:

Select * from MSFT_SIPGroupExpansionSetting where backend = ”BackendServerName\\DatabaseInstanceName”.

7. In the query results box double-click the results.

8. Select value you wish to edit. Example(ExternalDLExpansionWebURL), and then click Edit Property.

9. In the Property Editor dialog box, click to select the NOT NULL option.

10. In the Value box, type the external Web Farm URL in the following format, and then click Save Property and Save.
https://externalURL.domain.com/abs/Ext/Handler

11. Click Save Object and then click Close.

Change WMI Setting for Address Book Service URL

1. Logon to the Standard Edition or Enterprise Pool server with an account that is a member of the RTCUniversalServerAdmins group.

2. From a command prompt run wbemtest.exe

3. In the Windows Management Instrumentation tester window and click Connect

4. In the Connect dialog box, in Namespace, type root\cimv2, and then click Connect

5. In the Windows Management Instrumentation Tester dialog box, click Query button

Enter the following query

a. Standard Edition Server:
In the Query dialog box, type the query, such as:

Select * from MSFT_SIPAddressBookSetting where backend="(local)\\rtc"”

b. Enterprise Pool:
In the Query dialog box, type the query, such as:

Select * from MSFT_SIPAddressBookSetting where backend = ”BackendServerName\\DatabaseInstanceName”.

7. In the query results box double-click the results.

8. Select value you wish to edit. Example(ExternalURL), and then click Edit Property.

9. In the Property Editor dialog box, click to select the NOT NULL option.

10. In the Value box, type the external Web Farm URL in the following format, and then click Save Property and Save.
https://externalURL.domain.com/abs/Ext/Handler

11. Click Save Object and then click Close.

12. Click Exit.

To change the IIS virtual directory to the presentation folder

1. Log on to a server with Web Components installed as a member of the Administrators group or a group with equivalent user rights.

2. Open IIS Manager. Click Start, point to All Programs, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.

3. Expand the computer name, expand Web Sites, expand Default Web Site, expand Etc, expand Place, expand Null, right-click FileTree, and then click Properties

4. On the Virtual Directory tab, do one of the following:

· If the content for this resource is on the local computer, click A directory located on this computer, and then type the path to the meeting content folder that you created in the Local path box.

If the content for this resource is not on the local computer, click A share located on another computer, and then type the path to the meeting content folder that you created in the Network directory box

MSMXL installation error.

2008-04-11T11:04:00.001-07:00

While performing the "Add Server to Pool" operation during installation of OCS 2007 on an x64-bit platform with 64-bit Windows 2003 R2 you receive the following install error:

"MSXML6.0 Package Not supported on Processor Type"

more..info
Error Message 0xC3EC796A MSI installation was unsuccessful. Install MSXML Parser Error. The Error appears, when the system tries to install msxml6.0 with the message, MSXML6.0 package not supported on processor type.

While one would think that there must be fix for this, I later discovered that Office Communications Server 2007 will not install onto a 64-bit OS. Microsoft's UC SWAT team stated that Office Communication Server 2007 can only be installed on 32-bit Operating System, which of course can be installed onto a x32 or x64 machine. If you look within Microsoft's planning documentation there was mention of supported configurations; however 64-bit OS configurartions were not explicit. They have published an updated OCS support document, but of course for those of you who have been involved with deploying OCS for a while now, probably would not have gone back to verify anything as changed. Unless of course something like my particular issue surfaces... You live you learn I guess.. Below is a published list of supported configurations.

Supported configurations:

Supported Operating Systems for Enterprise Edition Office Communications Server 2007 Enterprise Edition requires one of the following operating systems. All operating systems are 32-bit editions.
• Windows Server 2003 R2 Standard Edition
• Windows Server 2003 R2 Enterprise Edition (recommended)
• Windows Server 2003 R2 Datacenter Edition
• Windows Server 2003 Service Pack 1 Standard Edition
• Windows Server 2003 Service Pack 1 Enterprise Edition
• Windows Server 2003 Service Pack 1 Datacenter Edition

Supported Operating Systems for Back End Database Server Office Communications Server 2007, Back-End Database, requires one of the following operating systems. All operating systems are 32-bit versions.
• Windows Server 2003 R2 Standard Edition (recommended)
• Windows Server 2003 R2 Enterprise Edition
• Windows Server 2003 R2 Datacenter Edition
• Windows Server 2003 Service Pack 1 Standard Edition
• Windows Server 2003 Service Pack 1 Enterprise Edition
• Windows Server 2003 Service Pack 1 Datacenter Edition

Supported Operating Systems for Communicator Web Access The following software must be installed on the computer on which you will be installing Communicator Web Access:
• Windows Server 2003 R2 or Windows Server 2003 SP1
• Windows Installer 3 (included in Windows Server 2003 SP1)
• IIS 6.0
• .NET Framework 2.0, including ASP.NET 2.0So until the next release plan for 32-bit OSs for all the server roles except for Backend Database server.

OCS 2007 - Authentication Issues [0xC2FC200D]

2008-04-11T11:03:00.001-07:00

Office Communication Server 2007: Authentication/Logon Issue
Failure [0xc3fc200D]

It is common to run across communication and authentication issues when deploying OCS. One of the tricks is trying to determine the root of problem. Failure codes and results are not always self explanatory and let’s just face it OCS 2007 being a new product does not have a whole lot of available support resources yet. This article addresses an authentication problem that generally stumps many implementers. The validation wizard usually picks up on this issue; however it does not scream out “here is the problem” fix me. Generally the results make no mention of a little thing called Server Principal Name (SPN), which is truly the underlying problem. The image below displays a typical authentication error during validation, that is a direct result of an incorrectly registered SPN for the Office Communication Server (Standard or Enterprise). The sections below will provide a brief explanation of the issue as well as troubleshooting and remediation of the problem.

Issue:
Failure [0xC3FC200D] One or more errors detected

Explanation:Registration failure upon authentication is attributed to the Server Principal Name (SPN). The Kerberos protocol authentication that is used by the Office Communications Server service for client authentication requires the proper configuration of service principal names (SPNs) within the Active Directory® Domain Services. The SPN is a string that identifies the service (Office Communications Server) that a client wants to access.
For proper operation of the Kerberos authentication, the SPN of the Office Communications Server must be registered in Active Directory under the name of the user account where the service runs, typically RTCService. If the SPN of the server is registered in multiple accounts, Kerberos authentication does not operate properly.

Solution:

To verify SPN is set correctly:
1. Install the OCSResourceKit for Office Communication Server 2007

OCS Resource Kit.
2. Open a command prompt and change directories to the OCS Resource kit directory.
3. The reskit contains the “CheckSPN” script that can be used to validate the SPN for the OCS Enterprise or Standard edition server.
4. First run the tool to find all SPNs registered under a specific user account. The default user account, where the Office Communications Server service runs, is RTCService.

>Cscript Checkspn.vbs /List /u:RTCService

Sample Error: ERROR: The SPN for is registered incorrectly

5. Next run a check to see whether the SPN for a specific Office Communications Server Standard Edition or Enterprise Edition server is registered under one account. The server is identified by its FQDN (fully qualified domain name). If there is more than one registration, the script prints the user accounts that have this SPN registered. This mode is useful for detecting that the servers SPN has been registered under multiple accounts. If this is the case, the duplicate SPNs must be deleted until there is exactly one account under which the SPN is registered. Having the same SPN registered under multiple accounts causes Kerberos protocol authentication to fail on the client.

>Cscript checkspn.vbs /check /s:ocsserver.contoso.com

If multiple entries are returned, an ERROR will be returned and that the SPN is registered incorrectly. To correct the duplicate account must be deleted.
6. Deletes the SPN for a specified Standard Edition server or Enterprise Edition server from a specified user account. This mode is useful for cleaning up duplicate SPNs

>checkspn.vbs /del /s: /u:

7. Once you think you have the SPN set correctly, rerun the scripts in step 4 and 5 to verify SPN.
8. Next rerun the Validation tool and verify authentication is working properly for Kerberos and NTLM.
9. Now you can test connectivity and functionality using Communicator client.

Latest Version of Communicator Mobile 2007 does not connect

2008-04-11T11:01:00.001-07:00

Ok, you have setup Office Communication Server 2007, MOC client connections work internally and externally; however now it comes to Communicator Mobile 2007 connectivity testing and the damn thing does not want to connect. Standard message presented upon sign-in is that your version of Communicator Mobile needs to be updated! What? "I just downloaded the most recent version, and there are no other hotfixes!" No need to worry this is merely the default "Client Version Filter" settings causing you grief. For some reason Microsoft decided to block versions of Office Communicator Mobile that are less than or equal to (<=) 2.0.6021.*. At the time of this post, the most recent version of Communicator Mobile is/was 2.0.387.*. Nice! Below is the procedure to modify the filter to get your version of CM connected.

Note: The OCS 2007 Admin Guide lists the COMO filter in the same manner as above (which makes sense) to be used for CM; however changing this filter did not do the trick. The key was to change the CPE filter to the filter listed above. After that was changed and services restarted, CM connected..

Step 1. Open Your Standard of Enterprise Pool

Step 2. Open your Client Version Filter (Option in your pool configuration.

Step 3. Change the CPE value to 2.0.387.* >= Allow and COMO value to 2.0.387.*

Step 4. Stop all started services

Step 5. Start all stopped services

Step 6. Connect to your Access Edge Server search your ClientVersionFilterConfig.exe
(C:\Program Files\Common Files\Microsoft Office Communications Server 2007)

Step 7. Change the CPE value to 2.0.387.* >= Allow and COMO value to 2.0.387.*

Step 8. Stop all started services (on your Access Edge Server)

Step 9. Start all stopped services ((on your Access Edge Server)

Step 10. Reconnect again and it should work.

Certificates - Unified Communications Certificate Packages

2008-04-11T10:59:00.001-07:00

Many issues with certificates in Exchange 2007 out there…. This page will provide helpful information regarding certificates…

ENTRUST (3rd party) has put together a Unified Communications certificates package!!!

Entrust Unified Communications Certificates provide greater flexibility to support powerful new communications products like Microsoft Exchange Server 2007 and Microsoft Office Communications Server 2007, without sacrificing security controls.
Pasted from <http://www.entrust.net/ssl-certificates/unified-communications.htm>
Entrust allows you to specify up to ten SAN in each "Unified Communications" certificate request.

Best Practices for Domain Names for a Client Access Server
When you create a certificate or certificate request for a Client Access server, the set of domain names that you should include in the request are as follows:
Local or NetBIOS name of the server, for example, owa1
All the accepted domain names for the organization, for example, contoso.com
The fully qualified domain name for the server, for example, owa1.contoso.com
The Autodiscover domain name for the domain, for example, Autodiscover.contoso.com
The load-balance identity of the server if you are using one, for example, owa.contoso.com

Pasted from <http://technet.microsoft.com/en-us/library/72048bc1-6d01-4279-8d21-4282b86b522c.aspx>

Wildcard Character Domain Names
Wildcard character domain names are a special type of domain name that represents multiple sub-domains. Wildcard character domain names can simplify certificates because a single wildcard domain name represents all the sub-domains for that domain. They are represented by an asterisk character ( * ) at the DNS node. For example, *.contoso.com represents contoso.com and all the sub-domains for contoso.com. When you use a wildcard character to create a certificate or a certificate request for all accepted domains, you can simplify the request significantly

Pasted from <http://technet.microsoft.com/en-us/library/72048bc1-6d01-4279-8d21-4282b86b522c.aspx>

OCS - Server Requirements

2008-04-11T10:58:00.003-07:00

Server Platform Requirements

Hardware for Standard Edition and Enterprise Edition Servers
Hardware requirements vary according to server role, configuration, and storage requirements. This topic summarizes the requirements for the following server configurations. Server roles not listed in this section are addressed in subsequent sections for the following server configurations.

Standard Edition Server configured as one of the following:

Front End Server, Web Conferencing Server, and A/V Conferencing Server
Director
Archiving and CDR Server
Edge Server (one or more of the supported edge server roles)

Enterprise Edition Server configured as one of the following:

Consolidated Enterprise Edition Server (Front-End Server, Web Conferencing Server, A/V Conferencing Server, and IIS collocated on server)
Front End Server in expanded configuration (conferencing servers and IIS installed on separate computers)
Web Conferencing Server in the expanded configuration
IIS Server in the expanded configuration
Archiving and CDR Server

Small or medium-sized Back-End Database server

CPU: Dual processor 3.2 GHz with HT
Disk: 2 x 18 GB
Plus 2 x 36 GB for collocated SE Server
15K rpm SCSI
Cache: 1 MB
Memory: 2 GB
Network: GBit NIC

Hardware for A/V Conferencing Servers and A/V Edge Servers
The following hardware requirements are required for A/V Conferencing Servers in an expanded pool configuration and all standalone A/V Edge Servers.

CPU: Dual processor, dual core 3.0 GHz
Disk : 2 x 18 GB 15K rpm SCSI
Cache: 1 MB
Memory: 4 GB
Network: GBit NIC (for A/V Conferencing Server)
2 × GBit NIC (for A/V Edge Server)

Hardware for Large Back-End Database for an Enterprise Pool
The only exception to this recommendation is for an Enterprise Edition Server deployed as a large Back-End Database server. For this role, the recommended hardware is as follows:

CPU: Quad processor, dual-core 3.0 GHz with HT
Disk: 2 × 18 GB
External Ultra 320 SCSI Array
4 × 36 GB (RAID 1 + 0)
Cache: 1 MB
Memory: 32 GB
Network: GBit NIC

Hardware for Mediation Server

CPU: Dual processor 3.2 GHz with HT for up to 120 concurrent calls
Dual processor, dual core 3.0 GHz for more than 120 concurrent calls
Disk: 1 × 30 GB 15K rpm SCSI
Cache: 1 MB
Memory: 2 GB
Network: 2 × GBit NIC

Operating System

The minimum and recommended operating system platform requirements for all Office Communications Server 2007 server roles are as follows:
Minimum: Microsoft Windows Server® 2003 SP1.
Recommended: 32-bit Windows Server 2003 R2.
OCS Server Roles will only install on 32-bit Windows 2003 operating systems. 64-bit OS is not supported. Microsoft's documentation is incorrect. Verified by Microsoft UC SWAT Team

Supported Operating Systems for Enterprise Edition Office Communications Server 2007 Enterprise Edition requires one of the following operating systems. All operating systems are 32-bit editions.
• Windows Server 2003 R2 Standard Edition
• Windows Server 2003 R2 Enterprise Edition (recommended)
• Windows Server 2003 R2 Datacenter Edition
• Windows Server 2003 Service Pack 1 Standard Edition
• Windows Server 2003 Service Pack 1 Enterprise Edition
• Windows Server 2003 Service Pack 1 Datacenter Edition

Supported Operating Systems for Back End Database Server Office Communications Server 2007, Back-End Database, requires one of the following operating systems. All operating systems are 32-bit versions.
• Windows Server 2003 R2 Standard Edition (recommended)
• Windows Server 2003 R2 Enterprise Edition
• Windows Server 2003 R2 Datacenter Edition
• Windows Server 2003 Service Pack 1 Standard Edition
• Windows Server 2003 Service Pack 1 Enterprise Edition
• Windows Server 2003 Service Pack 1 Datacenter Edition

Supported Operating Systems for Communicator Web Access The following software must be installed on the computer on which you will be installing Communicator Web Access:
• Windows Server 2003 R2 or Windows Server 2003 SP1
• Windows Installer 3 (included in Windows Server 2003 SP1)
• IIS 6.0
• .NET Framework 2.0, including ASP.NET 2.0

Active Directory
For all servers requiring Active Directory® Domain Services, the minimum supported configuration is the Microsoft Windows® 2000 SP4 operating system in Windows 2000 Native Mode.

SQL Server
For all servers requiring SQL Server, the minimum and recommended versions are as follows:
Minimum: SQL Server 2000 SP4 or SQL Server 2005, SP1 (32-bit or 64-bit versions of SQL Server SP1 or later are supported)
Recommended: SQL Server 2005, SP2

IIS
For all servers running IIS, the required version is 6.0.

.NET Framework
Office Communications Server 2007 requires .NET framework 2.0.

Supported Clients
The supported clients for Office Communications Server 2007 Public Beta are as follows:

Required: A version of Microsoft Office Communicator
Minimum: Office Communicator 2005 for IM and legacy presence.
Recommended: Office Communicator 2007 for IM, group IM, multimode conferencing, and enhanced presence.
Required: Microsoft Office Live Meeting 2007 client for meetings.
Required: the Conferencing Add-In for Microsoft Office Outlook for scheduling meetings.
Optional: Communicator Web Access for Office Communications Server 2007 for IM and enhanced presence.

Protocols - OCS Web Conferencing

2008-04-11T10:58:00.001-07:00

Conference Protocols

Office Communications Server 2007 multimedia conferencing uses a variety of protocols for signaling, conference management, data collaboration, multimedia, and communication among conference components.

SIP (Session Initiation Protocol). An IETF (Internet Engineering Task Force) standard signaling protocol for initiating, managing, and terminating sessions between one or more participants, including Internet telephone calls, multimedia distribution, and multimedia conference sessions.

HTTP (Hypertext Transfer Protocol). A standard Internet protocol that in Office Communications Server 2007 is for communication between the Focus and conferencing servers, downloading Address Book Server updates to clients, and downloading meeting content to users.
C3P (Centralized Conference Control Protocol). A custom protocol for communicating conference creation and control commands from clients to Office Communications Server 2007. C3P commands are carried as XML in SIP SERVICE or INFO messages.

PSOM (Persistent Shared Object Model). A custom protocol for transporting Web conferencing content.

SRTP (Secure Real-Time Transport Protocol). An IETF standard protocol that is used in Office Communications Server 2007 for securely transporting audio and video content to various media devices.

RTCP (Real-Time Control Protocol). An IETF standard protocol used in conjunction with SRTP to convey information about the signal quality of an audio-video conferencing session to various media devices.

Availability Service

2008-04-11T10:56:00.001-07:00

What is the Availability Service ?
Availability Service is a Web Service that is responsible for providing free/busy information to the Outlook 2007 client and OWA 2007. Ofcourse, since Availability Service(AS) is part of the Exchange 2007 Programming Interface, it will be available as a public web service to allow third-party tools to integrate with it and as a programming interface for interested developers.

The schema for the availability service can be found at:https:///ews/services.wsdl

Free/Busy Retrieval Method

more info to post.................