Ehlo Tech - Focusing on Exchange Server & Technology

Recommended Exchange Deployments are Multi-role Now

2011-12-24T01:49:00.000-05:00

At the last free "Tech Ed style" event in NYC held at the Microsoft Offices, we had Ross Smith IV present on

Exchange 2010 High Availability/Database Availability Groups. If you don't know Ross, he's a VERY senior Microsoft employee who wrote the Exchange Storage and Server Role Calculator. He knows Exchange, period. End of story. So, when he said that everyone should deploy Exchange 2010 in a multi-role configuration to improve performance and not break apart the roles, you need to take his recommendation seriously. This was the 1st time I had heard this. I had a long conversation with him about this in NYC, and he explained that for performance and the ability for leveraging failover capacity it is better to keep all the roles together. In theory, you could deploy less. Since if you were going to deploy 2 CAS and 2 Mailbox, you could in theory just deploy 3 consolidated roles. Well, Microsoft TechNet finally released some guidance on this. That only took 6 months. Don't forget to use a hardware/VM load balancer when deploy your multi-role Exchange Servers.

TechNet article title: Understanding Multiple Server Role Configurations in Capacity Planning
http://technet.microsoft.com/en-us/library/dd298121.aspx

-Ben

Hackers & Malware - Dangers Everywhere - Not Just Scare Tactics

2011-12-24T00:10:00.000-05:00

Hackers and malware were busy this week at clients of REEF Solutions.

Good news first, we identified a serious denial of service vulnerability during a network infrastructure review for a financial firm. So bad, a simple command would reboot a core network device. That was a highlight of the review. And this was not even a security audit, I am sure it'll be only worse.

Bad news now

A client's system was infected with TDSS, one of the nasty [known] malware products (think encryption, p2p command and control, http/https tunneling, malware competition removal, and MBR infection). Malware vendors even offer a Firefox plug-in to allow paying customers to surf via infected machines to provide anonymous cover. To summarize, TDSS is extremely dangerous. More technical details here. As of now, the only tool that can remove it or most of it is Kaspersky. Ideally, we should have wiped the system, but the client would not permit this.
A hacker attacked via RDP and compromised a system. We detected the compromise and took immediate action to isolate and remediate the attack. If we had not caught it faster, this could have been a serious issue. The key is to have an Intrusion Detection System in place, even if it's just a firewall based solution. You need to be aware of what is happening on your network. I recommend additional policies such as resetting all administrator passwords, not permitting "administrator" usernames, requiring 15+ characters passwords, email alerting w/3rd party logging tool on administrator level logins, and layered security products (firewall based scanning, servers based, proxy based, DNS scanning, etc).

Sadly, malware and attackers are not sitting idly by. There are some real threats out there. Stay safe...

-Ben

Sprint 4G appears to be hacked at DEFCON

2011-08-12T13:17:00.001-04:00

Hello All,

It appears there could have been a successful man in the middle attack (MiTM) on Sprint 4G at DEFCON. Numerous Android devices were attacked during this period. I hope Android users didn’t "upgrade" or re-enter "their passwords" during the multiple day event. Dangerous, but there is a solution that the carriers and handheld manufacturers could implement to protect against this (see solution below).

News from:
http://www.extremetech.com/computing/92370-4g-and-cdma-reportedly-hacked-at-def-con
http://seclists.org/fulldisclosure/2011/Aug/76

A friend and I were discussing this and this what his response was:

I'm betting that they did it one of two ways on 802.16/ClearWire/Sprint4G.

They gained physical access to the local tower, and did MiTM from the tower. WiMax is Mobile IP from the tower to the provider edge. It would be a lot easier to do MiTM on at a Mobile IP tower, rather than a LTE network.

The other way is, someone in the group worked for / had access to enough of the parts to make a fake WiMax base station. Based on the signal strength reports, and slow speeds, this is what I bet they did. WiMax uses either EAP-TLS or EAP-TTLS. I'm guessing either they had access to the certs to appear valid, or the end devices did not properly implement EAP-TLS and EAP-TTLS, and just accepted any certificate

A pretty cool hack if they did. Hopefully it can be shown, and the 4G devices can implement proper security.

Update to above.....

After further research, it definitely looks like the latter method (fake WiMax Base station). They talk about signal strength and upload speeds. Those wouldn't be affected by the first method (getting into a valid tower).

Unfortunately the supplicate (client) is probably just configured to accept any client.

For example in the Cradlepoint, you just specify the carrier / realm, but that's it. No username, etc. No certs. No other options.

Another example, the Sprint SmartView client, it doesn't have the ability to specify anywhere anything related to authentication and certificates.

One would need a fake WiMax base station (that can do 2.6ghz) in order to test to see if the supplicate takes any certificate.

Side note: certain applications offer the ability to register against a specific TLS certificate serial number such as Apple Mail. I hope other devices/applications allow this in the future.

The MiTM Attack Solution

If phones only accepted carrier based certs and had a proper implementation of EAP-TLS or EAP-TTLS this would protect against this sort of attack.

Sadly, the solution is going to take a bit of work and time. So, don't automatically "trust" voice over data. Protect your data and it can be more secure than your data.

-Ben

New Microsoft ActiveSync Compatibilty Program fails on helpfulness

2011-04-28T17:07:00.000-04:00

Ehlo All,

Curious about knowing...

what ActiveSync functionality is available with which version of Exchange?
which mobile devices have higher Active Functionality?

Well, this new Microsoft ActiveSync compatibility program for OEMs won't help, but read on about it.
Microsoft recently announced the Exchange ActiveSync (EAS) Logo Program for OEMs (think HTC, Google, Apple, Motorola, Microsoft, etc) which should have been used to identify and bring clarify to the level of EAS support a mobile device included. Sadly, it does not do this since there is 1 level for EAS Logo Program and it includes very basic functionality. So, if the device says "ActiveSync", this is pretty much equal to the EAS Logo Program. BK (author of post below) had it right that there should be multiple levels. For example, "basic", "enhanced", "ultimate". So, if an ActiveSync device said "Ultimate", you would know it supports every feature under the sun for EAS against Exchange 2010. Oh well, maybe version 2 of the program will get this improvement.

Windows IT Pro Post about new EAS Logo Program by BK Winstead

-Ben

Message Dehydration isn't a good thing for Exchange!

2011-04-25T18:05:00.000-04:00

Ehlo All,

Quote of the week: "limit is 94% before message dehydration occurs."

A normally very stable client's Exchange Server 2007 stopped processing inbound emails and this was the issue above. Client reported all internal email was working though. I logged into their Exchange Server and reviewed the normal issues inside the Exchange Management Console and nothing jumped out (e.g. databases mounted, 3GB free space on C, 700GB+ free space on database partition (D), no quota limits, receive connectors present/enabled, etc). Strange. I decided to check the email filtering solution in front of the Exchange Server. Since I always recommend clients use my company's email filtering service (SpamCop - I'll discuss this is another post) since it allows me to quickly troubleshoot issues and provide very secure email service. Reviewing SpamCop outbound queue to the client's Exchange Server illuminated the error:

Deferred: : host 55.55.55.55 said: 452 4.3.1 Insufficient system resources (in reply to...

More details about this error can be found on this posting. Checking the client's Application Event Log for this error, I found it "The Microsoft Exchange Transport service is rejecting message submissions because the available disk space has dropped below the configured threshold.". Which was surprising since the C drive had a decent amount of space available (3GB+). What changed? Good old SBS's Windows Server Update Services had downloaded every update under the sun and the storage space threshold was passed and triggered back pressure. I uninstalled WSUS and that eliminated 10GB and back pressure was eased and email flow started. I plan to remove some other functionality as well and plan to do a scheduled reboot as well to free up more space. To sum up, SBS causes more problems than it's worth for Exchange deployments. I prefer clean Exchange installs over Exchange SBS installs.

-Ben

Fixing ActiveSync on an Exchange 2007 Server

2011-04-24T01:04:00.000-04:00

Ehlo All,

So, a client's iPhone with ActiveSync stopped working with their Exchange Server 2007. If rebooting and deleting and setting it back up doesn't fix it, confirm your server's AS is working. An good way to do this is to test with Microsoft Exchange test website found here. So after some investigating, it turned up that the IIS Virtual Directory for "ActiveSync" wasn't responding correctly. One can test this by "https://myservername/Microsoft-Server-ActiveSync" and make sure it prompts for a username and pwd. My client's server didn't do that. It reported 501 service unavailable error. I therefore deleted the ActiveSync virtual directory and re-created it and it fixed the issue. A great blog posting to explain this can be found here. To clarify, the "XXXXX" in his example for normal Exchange installs is "Default Web Site".

Handy URLs:
Detailed instructions on deleting and recreating virtual directories for Exchange 2007
http://my.opera.com/RavenOverride/blog/2009/06/17/how-to-recreate-all-virtual-directories-for-exchange-2007

Microsoft's Test Website for Exchange/ActiveSync/Outlook/SMTP
https://www.testexchangeconnectivity.com

-Ben

Techstravaganza Event with amazing Exchange Speakers (free)

2011-03-10T21:46:00.000-05:00

Ehlo All,

My user group (NYExUG) and 4 other UGs are organizing an amazing event that is a free Tech-Ed type event which has 5 tracks (Exchange, SharePoint, PowerShell, Server/Office, Ask the Experts) and 5 sessions in each.

For those who attended this past week’s NYExUG meeting, I mentioned that at the upcoming Techstravaganza event we might have an Exchange Superstar presenting. Well, that has happened! Ross Smith (Microsoft) will be presenting (thanks to Bob Hunt). You do NOT want to miss this event! Just to give you an idea, this guy frequently presents at major conferences and even runs a session called “Stump the Experts”. With “Stump the Experts”, if you’re able to ask an Exchange question that Ross can’t answer, you win an Xbox. He’s never given away an Xbox. This guy knows Exchange. Period. Learn from a superstar. He’ll be presenting on Exchange 2010 High Availability / DAGs.

Techstravaganza

Held at Microsoft’s NY office

Friday, March 18 (8am-5pm).

This event will have 5 tracks of Exchange, PowerShell, SharePoint, Windows/Client Server, and Ask The Experts.

Register asap since spots are limited

http://techstravanganzanyc.eventbrite.com/

Main Website

http://www.techstravaganza.com

Hope to see you at the event...

-Ben

1st Known Spamming from the "Cloud"

2011-01-18T01:59:00.000-05:00

Ehlo All,

This is my 1st confirmed spam (mid 2010) I have ever seen come from the "Cloud". The "winner" of this honor goes to Amazon. Congratulations (sarcasm). According to my latest research Amazon still does not allow PTR (rDNS) records which is typically required/strongly recommend to avoid outbound email being labeled as spam. How do the many mail servers running on Amazon's Cloud handle it? They relay their email from Amazon's environment onto another host (e.g. authsmtp, google "smtp relay service", etc) and then the other service forwards.

Background on me
I see a LOT of spam since my firm handles filtering for most of our clients via our geographically diverse clustered anti-spam/virus/DoS solution. Our clients on an average day get a total of about 300-400k connections a day (spam/real). This provides me a lot of experience/exposure with spam filtering. If you are wondering why we run our own systems it is because it offers more flexibility, significantly lower latency for email messages (aka delay), and faster response than the big guys.

View from my Spam Filtering Solution which Quarantines Suspect Email Like This.

Spam Header Details
Received: from mm-notify-out-209-61.amazon.com (mm-notify-out-209-61.amazon.com [72.21.209.61])

by mail.rbkgroup.com with ESMTP id 67cz6639988tcu.19.20100625083501;

Fri, 25 Jun 2010 11:35:01 +0200

Date: Fri, 25 Jun 2010 11:35:01 +0200

X-Barracuda-BBL-IP: 72.21.209.61

X-Barracuda-RBL-IP: 72.21.209.61

From: "Buy.com"

Reply-To: Nobody

To:

Message-ID: <02630844.67618272250016768122.JavaMail.em-build@na-mm-relay.amazon.com>

Subject: Thanks for your order!

X-AMAZON-CLIENT-HOST: digital-docs-dope-5002.iad5.amazon.com

X-ASG-Orig-Subj: Thanks for your order!

Bounces-to: 20100625083501q4b3332ggg949lm9p0629fm7g208en6r@bounces.amazon.com

X-AMAZON-CLIENT-SENDTIME: Fri, 25 Jun 2010 11:35:01 +0200

X-AMAZON-MAIL-RELAY-TYPE: notification

X-AMAZON-RTE-VERSION: 2.0

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit

--------------------------------------------

Any questions, let me know.
-Ben

DoS of DNS by an Exchange Focused Backup Software (AppAssure Replay)

2011-01-15T17:29:00.000-05:00

Ehlo All,

Imagine to my surprise that my favorite Exchange & Windows backup solution (AppAssure Replay 4.5.1.27532) was attempting to cause a denial of service (DoS). This version has a major problem with it's use of DNS lookups within the problem. Within 3 days, one Replay Server had performed over 450,000 queries of the hostname I used for Replay replication. This is almost 100 queries every minute 24 hours a day. That's what the product is doing. This is a serious issue. I've alerted the vendor, so I'm sure a fix will be included in a future release. In the mean-time, see below for the work-around until that happens.

The Issue
Inside AppAssure's Replay for replication, you specify a "Replication Target Host Name". This can be a hostname or IP address. See below for setting within Replay.

This "Select Replication Target" configuration is per protected server (e.g. your Exchange Server, etc). I normally use a hostname for these types of settings since I'm a big fan of using DNS instead of IPs when possible (saves time when changing IPs & saves brain memory space for Exchange Server things). So, when you add your Replication Target hostname, the Replication target and source perform lookups more often than the snap-shot period (x min/hrs). In reality, Replay should only perform a DNS lookup when a replication needs to occur and NOT almost a 100 per minute.

AppAssure's Replay abusing DNS lookups. View from my Firewall hostname query logs.

The Workaround Until a Permanent Fix is Released by AppAssure
If you use a hostname within the Replication option, make sure you add the corresponding information inside the hosts file (c:\windows\System32\drivers\etc\hosts - format is IP address space and hostname - use notepad to open the "hosts" file) on the source AND target Replay Replication Server. This avoids the use of an external DNS query and the query is handled by the operating system. So, this speeds up the process of performing a lookup and reduces your hostname's name server load. Otherwise prepare for your DNS to be attacked by your Replay environment.

Sadly, this isn't the first time I have seen a product mis-use DNS, but it's one of the worst in recent memory.

-Ben

Article - Constitution Finally is Defended over illegal email searches by US Government

2010-12-27T00:04:00.000-05:00

Hello All,

Glad to see someone cover this topic and that this "piece of paper" above means something. "This topic" is about defending our rights (4th Amendment which is unreasonable searches) from the US government illegal intrusions into email. US Dept of Justice illegally had an ISP copy someone's email and was slapped on the wrist, thank goodness for a Court of Appeals. See the Windows IT Pro article from Paul Robichaux discuss this. I hope this ISP get's sued as well now.

-Ben

Article - HA for Exchange 2010 is more costly than Exchange 2007

2010-12-26T01:10:00.000-05:00

Ehlo All,

This is an excellent article especially if you're using or considering deploying Exchange 2007 in an HA configuration with SCR,. Also, the new HA mailbox solution in Exchange 2010 is called Database Availability Groups (aka DAGs). This requires the Enterprise Edition for Windows Server 2008, and we do not know if it requires Exchange 2010 Standard or Enterprise. Either way, the requirement of Server Enterprise Edition makes it costly.

Excellent website (Exchange-Genie.com) that explains with pictures the following HA solutions for Exchange 2007 & 2010, CCR, LCR, SCC, SCR, and DAG. In this case, a picture is worth a thousand words.

Information is power,
-Ben

Intro to Exchange 2007 & SSL Certificates

2010-12-26T01:09:00.000-05:00

[Written in December 2008. Not sure why I didn't post it back then. Found in my drafts.]

Ehlo All,

SSL Certificates (aka SSL certs, certs) are complicated. Exchange is complicated. Quick story... during my research, I read about a Microsoft employee (Exchange admin) who thought a bug existed with a SSL cert vendor's special "Exchange 2007" cert. So he contacted an Exchange Team PM about the issue and it turned out he didn't properly configure the Exchange SSL cert generation. Moral of the story, add SSL certs & Exchange 2007 together, and it can be a real challenge. So, I recommend you read this intro if you're considering or even using Exchange 2007 & real SSL certs especially since many things have changed.

First, the good news with Exchange 2007. Microsoft now includes self-signed certs on install. So, you're secure out of the box. Meaning, everything is encrypted, but you'll get errors each time you access a SSL protected site with it. So, you'll want to fix this.

Well, everything you know about Exchange 2003 SSL certificates can be thrown out, or that's what I've learned so far. You can use wildcard SSL certs, but you'll run into issues in the future (Outlook auto-discovery has issues, Windows Mobile 5 has issues, etc), so I would recommend you embrace the new SSL cert that Microsoft wants you to use OR learn about a special DNS configuration that lets you avoid this (thanks to a MS June 07 update for Outlook 2007).

As per the new certs, they are best described by DigiCert (I liked their explanation & enhanced it some) is:

Exchange 2007 Certificates Definition
The new SSL certificates are called Unified Communications Certificates (aka UC Certificates, UCC Certificates, or SAN certificates) which give you full control of the Subject Alternative Name field so you can secure as few or as many host names as you like with just one SSL certificate. These are NOT wildcard certs since they secure specific hostnames you define within this one cert. Wildcard certs secure any subdomain (e.g. *.mydomain.com), while UCC certs secure (autodiscover.mydomain.com, webmail.mydomain.com, mail.mydomain.com, exchsrv.mydomain.local, etc).

Microsoft's Recommended List of UCC Cert Providers as of 12/08
Comodo - http://www.comodo.com/msexchange/index.html
DigiCert - http://www.digicert.com/unified-communications-ssl-tls.htm
Entrust - http://www.entrust.net/ssl-certificates/unified-communications.htm
Microsoft's Recommended List of UCC Cert Providers

Special DNS Configuration to Avoid UCC Certs
So, you decided you didn't want to spend about $250-300 on a UCC cert for one year. I can understand. There is another option I hinted to above that relates to a June 2007 Outlook 2007 update that added a special feature to avoid the need for a UCC cert for autodiscovery or complex admin configuration. It involves setting a special DNS record to get around this. The DNS record is a SRV record. Once you have this SRV record set, the Exchange 2007 server's externl adn internal URLs need to be this one server as identified in the SRV DNS record.

Learn more about this in Microsoft White Paper on Auto-Discovery in Exchange & Outlook 2007. http://technet.microsoft.com/en-us/library/bb332063.aspx

MS Article on how to setup DNS SRV record for auto-discovery functionality
MS KB article about auto-discovery issues and fixes

-Ben

"Cheating" on an Exchange 2003 Hardware Upgrade

2010-12-26T01:08:00.000-05:00

[Project completed in June 2008. Figured this was in my drafts, I should post it.]

Hello Everyone,

I "cheated" on an Exchange 2003 hardware upgrade I did last weekend (Fri-Sat), or that's at least how I feel since this was hands down the fastest and easiest upgrade I've ever done (and it was about 80GB of db's on an older server with direct attached storage). At the end of the weekend, I started to think maybe I should carry around one of these "things" for my clients for upgrades. I'll share what this "thing" was later in the posting. I don't want folks to think I'm pushing products. My role in the project was to insure the replacement of the Exchange Server hardware went smoothly. The client was in production 24/7 and literally the office was staffed 6 days a week. So, I was concerned originally how to insure minimal downtime.

Background on existing hardware & performance
We were upgrading from an Exchange 2003 Server that was installed with 3 hard drives in a RAID 5 hard drive configuration (direct attached storage) for the OS, transaction logs, and Exchange databases. Company had about 60 users and 30 BlackBerrys or so. 1 BES user adds a load similar to 2 Outlook users. So, total company usage was about 120 users. Performance was an issue, so some users were configured for cached mode to "improve" performance. Cached mode should not be required for LANs, unless Outlook end users are receiving "retrieving data from network". Recommended another DAS server that used RAID 1 for the OS, RAID 1 for transaction logs, and RAID 10 for the Exchange databases.

The Migration
So, I checked the OS install (another admin handled that), Exchange install (using the /disasterrecovery switch for setup and service pack 2), Exchange config, and insuring the email & public folder migration completed successful. Only catch was during this server replacement, there was to be no downtime and no use of Exchange clustered services. Hmmm, that's a challenge. Or so one would think.

The Cheat
The client I was working for happened to have a 3rd party product (keeping read to find out) for Exchange that in essence allowed the "cheating". And I mean this in a very good way. It saved me a LOT of time. Meaning, we told the 3rd party product to take over all the existing Exchange services (MAPI, SMTP, OWA, IMAP, etc) and data for the Outlook, OWA, ActiveSync, & BlackBerry was available to all users. All their data was still available. This took a few minutes (3 or 4 minutes) on the switch-over. Now everyone was operating off the appliance and end users didn't know this besides restarting Outlook and re-authenticating to OWA (ActiveSync & BES users had a slight delay. BES users could be out of service for up to 15 minutes, but that's a limitation of BES). Once the appliance took over, we copied over the Exchange databases (.edb/.stm's) using robocopy to the new Exchange 2003 Server. We considered upgrading to 2007, but the appliance and all the associated Exchange applications would have had to been upgraded, and it wasn't cost effective (TCO reminder). So, after we started robocopy-ing, we went home.

Day 2 of the Migration & Failback
I'm not going to go into the details, but migrating took a few hours including getting the SSL certs for OWA and handling all that. Once the new hardware was setup with Exchange, it was time to bring back all the new email. As I previously said, the reason to copy over the databases to the new server, was the appliance then doesn't need to copy over all data, and just new email/data. Once we copied over the databases and transaction logs, we were able to get the Exchange Server fully operational and enable the failback from the appliance. We then failed back from the appliance to the new Exchange Server. This took a lot longer to check that all data was copied from the appliance to the new Exchange Server. This took 10 hours or so and then everyone had to relaunch Outlook and re-authenticate against the new server.

Appliance Details
The "cheat" was an Exchange high availability appliance from Teneros. For the record, this company has been bankrupt and while still in operation as of 7/10, I do NOT recommend purchasing this product. Even though this appliance runs 2 operating systems, Linux and Windows, the entire configuration is on 2 web pages. Meaning, the Teneros support team is really what runs this product, not the Exchange admin. As per the web interface, to say the amount of information and configuration is sparse, is putting it lightly. Overall the product worked well and we ran into 2 glitches due to permissions and resetting process of the AD name due to poor documentation. And the migration process took longer than expected since the status of synchronization is not very accurate. Not a big deal, since end users are working during the failover and failback. Overall solution is very impressive, but I have some doubts since I'm not a big fan of trusting secret functionality of a black box type solution. I like to know how applications work and I do have concerns over Exchange updates or patches breaking the Teneros functionality. If you are curious, pricing is around $10k, give or take a few thousands. If you wanted to see the demo, Teneros did present at the NY Exchange User Group meeting back in November of December of 2007 or check out their website.

-Ben

Microsoft (online/print) and My Photos

2010-12-26T00:21:00.004-05:00

Hello All,

Think you've seen me on the Microsoft website, you have! A couple of people have asked me about this. So, yes, it's true. Microsoft hired me about 9 months ago for a photo shoot. So, you'll see me online and in print media. Here's an example someone sent me recently.

I was hired for the look of an "IT manager". One of the coolest scenes was inside the train control center in Newark Penn Station. Anyone sees that, let me know and take a screen-shot.

Thanks,
-Ben

The Truth Behind ActiveSync & Enterprise Licensing

2010-12-25T23:57:00.005-05:00

Hello All,

Sadly I see this happen more often than it should. A potential client was lied to by another IT vendor's sales team. They claimed that for "iPhone ActiveSync remote wipe functionality, the Enterprise Client Access Licenses were required for Exchange Server 2010". Turns out this is a lie! Oops... caught by me.

The Enterprise Client Access License (aka eCAL) does not relate/control remote wipe for ActiveSync. The eCAL adds the following control for ActiveSync clients that support these features. Both server and client side need to support these ActiveSync policies for them to be in effect. Make sure you read that last sentence twice. I've put that in bold for you. This is critical in your understanding of ActiveSync device features. Pretty much each device that includes ActiveSync offers varying levels of ActiveSync capabilities.

iPhone support remote wipe (they also offer a limited capabilities for ActiveSync). The available ActiveSync functionality on the iPhone is documented here.

List of Exchange Server 2010 Enterprise Client Access License (eCAL) Functionality Abilities (screen-shots below)
Allow removable storage
Allow camera
Allow Wi-FI
Allow infrared
Allow Internet sharing from the device
Allow remote desktop from the device
Allow synchronization from a desktop
Allow Bluetooth
Allow browser
Allow consumer mail
Allow unsigned applications
Allow unsigned installation packages

-Ben

SBS Admins - Exchange 2010 is coming in January 2011

2010-12-25T23:36:00.003-05:00

Ehlo All,

For those admin's running SBS (Small Business Server), SBS 2011 Standard Edition will include Exchange Server 2010 SP1. This is great news! SBS 2011 was recently released to manufacturing, and is estimated to be released in January 2011. Read more about SBS 2011 from the Microsoft Technet website here. Just make sure you get SBS 2011 Standard Edition and NOT Essentials. Essentials lacks Exchange Server. Oops...

-Ben

Attack Against Outlook Anywhere - SSL Man-In-The-Middle (thanks to Verizon Online)

2010-12-25T16:54:00.005-05:00

Hello All,

Recently while setting up a client's Verizon DSL connection, the Verizon DSL connection did an attack technique on all network traffic and attempted to capture my Outlook Anywhere username and password. The attack is called a man-in-the-middle. It tricks the end user to provide information to an unauthorized server. So, my Outlook 2010's Outlook Anywhere secure connection was redirected to a Verizon server. Since I require the SSL certificate to match my server for Outlook 2010's Outlook Anywhere (formerly called RPC over HTTPS), I was able to detect and not proceed. Be warned when you see this on networks. Never proceed when you see this. Or better approach is close all applications until the Verizon DSL is setup. If you are wondering, Verizon should NOT be doing this during the setup, but they are!

Screen-shot below includes the Outlook Anywhere SSL certificate warning and the "unauthorized SSL cert" from Verizon.

Stay safe...
-Ben

Tip - Needing to move 10GB+ files use ESEUTIL

2010-12-08T22:58:00.002-05:00

Ehlo All,

ESEUTIL utility is not just for Exchange Servers. Consider it for your large (think 10GB+ files) copies/moves. I'm preparing for an Exchange Server storage expansion (removing some existing hard drives and replacing them with larger ones) which requires I move a client's Exchange databases to another storage location and then move them back. We're talking about over 270GB of databases. So, when you move large files you do not want to use copy/paste, robocopy, richcopy, xcopy, etc since those buffer read/writes (aka caching) and is significantly slower than unbuffered read/writes (non-caching). For big files, you want to use an application that uses unbuffered read/writes which is (you guessed it), eseutil.

Microsoft Windows Server Performance Team Blog Article about using ESEUTIL for faster copies.

Notes from article:
"There are x86 & x64 versions of ESEUTIL, so make sure you use the right version for your operating system. The syntax for ESEUTIL is very simple: eseutil /y /d . Of course, since we're using command line syntax - we can use ESEUTIL in batch files or scripts." Once I test the scripts, I'll edit and update these article to help everyone.

Enjoy,
-Ben

Which Version are you running (SPx w/Rollup x?) - Easily Tell Now!

2010-09-18T14:17:00.003-04:00

Ehlo All,

Ever wonder if you have Rollup 6 or 7 installed on Exchange 2007 SP1. It can be very complicated since Exchange just lists a build version # 8.1.340.1 or 8.1.359.2. I work with Exchange a lot, and I can't remember them. So, thankfully Microsoft has a handy wiki page that does.

http://social.technet.microsoft.com/wiki/contents/articles/exchange-server-and-update-rollups-builds-numbers.aspx

Enjoy,
-Ben

Exchange 2010 SP1 Released...

2010-09-05T23:11:00.003-04:00

Ehlo All,

Exchange 2010 SP1 was released on August 24. This is not just a "service pack", but adds a # of features. Any "service pack" that upgrades the AD schema is more than just a few bug fixes. Before you upgrade to this, confirm your software applications for Exchange will support this since there are a LOT of changes with SP1.

Some note worthy changes
- server-side archiving (aka Online Archives) can now be stored in a separate database from mailbox
- OWA changes (UI changes)
- new management UI & features
- import/export on Exchange Server w/o need for Outlook

2 good postings for more information.

Windows IT Pro - Tony Redmond posting
http://www.windowsitpro.com/article/outlook/Exchange-2010-SP1-Upgrade.aspx

Microsoft - What's New in Exchange 2010 SP1
http://technet.microsoft.com/en-us/library/ff459257.aspx

-Ben

Multiple Exchange Accounts Supports in next Windows Mobile 7

2010-06-03T10:13:00.004-04:00

Ehlo All,

This posting of an interview with Charlie Kindel [Microsoft Program Manager for a Windows phone group] should excite the hard core Exchange users, support for multiple Exchange accounts on one mobile device. No other device can currently do this except for the planned Windows Phone 7. Sadly, ETA is most likely Q4 of 2010. Will I jump from my BlackBerry, unlikely, but competition is good since RIM is resting on their development laurels.

-Ben

TechNet Article - Some Gotcha's for Exchange 2010 and Outlook 2003 Environments

2010-06-03T10:06:00.004-04:00

Ehlo All,

This TechNet article has some good tips and fixes for scenario's involving Exchange 2010 and Outlook 2003. I recommend you review this if you are considering deploying 2010 and run Outlook 2003. Having said that, if you deploy Terminal Services and Exchange 2010, think Outlook 2007 and higher since there's still no fix for Outlook 2003.

-Ben

Tip - To make OWA URLs easier for your end users

2010-04-21T09:25:00.004-04:00

Ehlo All,

Did you always want to know how to get your OWA to be http://mail.domain.com? Well, now you can. This is called IIS redirection (all Exchange versions supported). There are 2 major methods to achieve. Option 1 (article below) modifies IIS to do it, and Option 2 is a very short html file. I prefer option 2 (this is what I use for my clients).

1) SearchExchange article explaining the IIS redirection technique. They fail to mention when you enable this it asks if you want to change the configuration for all sub-folders. The answer is NO!
http://searchexchange.techtarget.com/generic/0,295582,sid43_gci1363286,00.html

2) Simple html code on your Exchange Server. How I deploy for all my clients.
- within the inetpub directory (default is C:\inetpub\wwwroot), open with notepad "iisstart.html" on your OWA server (front-end, Client Access, all-in-one, etc).
- replace the contents with the following code (blog doesn't allow html code, hence the screen shot below or download it):
- save file and you're done. This URL I used obviously requires an SSL cert, but if you don't (you should), you could make the URL http://mail.domain.com/owa or http://mail.domain.com/exchange depending on your Exchange version.

Enjoy,
-Ben

Article - Quick Tip to improve OWA caching on Exchange 2007

2010-04-21T09:20:00.002-04:00

Ehlo All,

Quick tip to improve OWA caching on Exchange 2007. Most admins have plenty of CPU on their Exchange Server and not enough bandwidth. So, this enables more compression (gzip baby) and reduces bandwidth usage. A win win for the vast majority of us.

OWA 2007 configuration tricks to boost performance
http://searchexchange.techtarget.com/generic/0,295582,sid43_gci1371540,00.html

-Ben

Blog Post - Quick Look at Exchange 2010 SP1 OWA Differences

2010-04-08T09:28:00.003-04:00

Ehlo,

Came across a good blog post comparison of a few improve views of Exchange Server 2010 OWA versus SP1 OWA. I'm not running 2010 yet (on 2007) since the CDP backup application (AppAssure Replay) I use does not support it yet, but should when Outlook 2010 ships (or I can hope).

Enjoy,
-Ben

Article - Discussing cleaning up AD for Exchange 2010

2009-12-16T21:56:00.003-05:00

Ehlo All,

If you plan to upgrade to Exchange 2010 from 2007, read this good article by Exchange MVP Brien Posey to learn how to clean up your Active Directory during the upgrade process.

Article - SearchExchange AD Clean-up from Exchange 2007 to 2010

I'm planning an Exchange 2010 deployment for a client in January, but it's a clean install with no pre-existing Exchange, so I won't need this, but for my own upgrade from 2007 to 2010, this would come in handy.

-Ben

Exchange 2010 is now supported by BlackBerry Enterprise Server

2009-12-16T21:44:00.002-05:00

Ehlo All,

There was talk RIM would not release a BES compatible version for Exchange Server 2010 until Q1 2010. Well, RIM & Microsoft released updates to make it happen sooner. 3 updates are needed, 2 from Microsoft (MAPI update and Exchange Roll-up) and 1 from RIM (MR update). Specific details are here. Enjoy your BlackBerry functionality on 2010 now.

RIM Details on Exchange 2010 Support
http://na.blackberry.com/eng/services/server/exchange/2010support.jsp

Microsoft's Exchange Team's Exchange 2010 BES Support
http://msexchangeteam.com/archive/2009/12/09/453486.aspx

-Ben

Exchange 2010 DAG has a weakness and it's Public Folders

2009-11-22T14:11:00.007-05:00

Ehlo All,

One of Exchange Server 2010's best new features is Database Availability Groups. This is a high availability solution for mailbox servers. So, while Microsoft advertises how you can use JBOD and no RAID for disk subsystems for Exchange Server 2010 Mailbox Servers (see the Microsoft User Group presentation on this topic), there is one weakness with this. DAG does not work for Public Folders. So, do not put your Public Folder database on a non-RAID Mailbox Server. Plan on deploying a mailbox server that runs the Public Folder database with a well protected and appropriate disk subsystem. This is unfortunate especially since every Exchange environment deployment I've seen and worked on uses Public Folders. Maybe a future service pack or E15 can fix this. This isn't an easy fix though due to how Outlook clients communicate with Exchange 2010 though. Stay tuned.

-Ben

Exchange Server 2010 OWA - Missing Feature (adding notes) and Clarifcation of Multi-Browser Support

2009-11-11T12:20:00.016-05:00

Ehlo All,

During last night's NY Exchange Server User Group meeting after Angi Livermore's excellent Exchange Server 2010 HA technical presentation and demo, I gave a demo comparing Exchange 2007 Outlook Web Access to Exchange 2010 Outlook Web App and found a missing feature. I initially called it a bug, but I bet you Microsoft omitted the feature to release the product sooner. So, while 2010 OWA add some new features (below), the loss of adding notes is a major pain point. Also, a clarification of the multi-browser support.

Some New Features for OWA 2010

Premium mode for non-IE browsers. Firefox on Windows, Mac, and Linux. Safari on the Mac. Safari does NOT work on Windows. I tested this with Safari 4.0.3 (531.9.1) on XP SP3. Safari on Windows is OWA Light only.
Favorite Folders. Ability to add a Favorite folder. These are shown in the top left. Favorite Folders from Outlook to OWA are not shared.
Ability for end user's to view email delivery reports. No more end users saying "did my email arrive yet?". The delivery report shows date and time the email left the Exchange Server organization and was delivered to an outside email server.
Threaded email message conversations. All related emails are saved under one message (thread) in your Inbox. This is similar to how gmail's email conversation work or will exist in Outlook 2010 when it's released.
Multiple Calendars. You can view multiple calendars in OWA and send a calendar share request from within OWA.
Ability for the end user to change AD attributes [phone #, address, etc]. As per Angi, admins can disable this functionality.

Missing Feature for OWA 2010

Unable to post a note. This existed in OWA 2003 and 2007. Below are screen shots showing this. This was tested using Microsoft's Exchange Server 2010 UC Trial Service. I debated replicated this with the RTM, but haven't had a chance. I mentioned this to a Microsoft rep to confirm this issue. If you notice, the only 2 drop-down options when in the Notes folder is to create an email message or meeting request.

Exchange 2010 OWA Premium Mode - attempting to add a Note. Click to view full image.

.

Exchange 2007 OWA Premium Mode - adding a Note is possible. Click to view full image.

I'm a big fan of OWA and the new support for Firefox, but the lack of adding notes is a pain since I heavily use notes. Hopefully Microsoft fixes this as soon as possible.

-Ben

Recap from November NY Exchange Server User Group Meeting - Exchange 2010 High Availability Technical Presentation and Demo

2009-11-11T11:31:00.006-05:00

Ehlo All,

[UPDATED 11/18/09: Added PPTX presentation. See URL below.]

If you missed last night's NY Exchange Server User Group meeting presented by Angi Livermore of Microsoft and official presenter at the NYC Launch Event for Exchange Server 2010 a few weeks ago, you missed one of our best of all time.

Here are some highlights:
- Exchange Server 2010 technical demo of High Availability (called Database Availability Groups). Presentation by Angi can be found here [PDF] or here [PPTX - more clear version].
- most number of attendees (50) at a meeting ever!
- standing room only (we ran out of chairs)
- during my demo of OWA 2007 versus 2010, I found a bug in Exchange 2010 OWA relating to posting Notes. It's not possible based on the 2010 OWA provided by Microsoft for UC Trials. Oops. I'll blog about this later.

Other Notes from the meeting
- OS requirements to run Exchange Server 2010 DAG feature is Windows Server 2008 and later AND Enterprise Server or higher.
- Clone a VM, no need to change the SID. The application we all know called NewSID is not necessary anymore. Turns out it was a myth! NewSID developer (who now works for Microsoft) explains in this blog posting.
- Exchange 2007 will be supported on Windows 2008 R2. Microsoft reversed course on this. Microsoft Exchange Team stating such on this blog posting.

-Ben

Article - Discussing Leapfrogging from 2003 to 2010

2009-11-10T09:33:00.003-05:00

Ehlo All,

This is a good non-technical article from SearchExchange.com that discusses IT admins that have gone from Exchange Server 2003 to 2010 and others that are considering it. Hence bypassing Exchange 2007. I would agree with this, since the biggest change involved in moving to 2007 or 2010 is the x64 operating system. Once you have planned for x64, make the jump if you can to 2010. Jumping from 2003 to 2007 improves I/O by 70%, while going from 2003 to 2010 improves I/O by 90%. So, this will allow you to support more users on a single server than before. One of the big cost savings in upgrading.

The only word of caution is make sure your Exchange eco-system software is supported (e.g. backups, spam filtering, archiving, replication, mobile messaging [aka BlackBerry], etc). Jumping Exchange versions typically requires software upgrade especially for a x64 operating system.

-Ben

Windows Server 2008 Core Supports VMware Tools Installation

2009-11-07T22:01:00.004-05:00

Ehlo All,

Quick question. Do you think you can install a GUI app on a Core install. Answer is sometimes. I found out tonight while I installed a newer operating system for my Terminal Services environment (Windows Server 2008 R2) that one can install VMware Tools on Windows 2008 Server Core. It's very easy. Details can be found on this website. Jens also discusses how to configure the video driver as well. I tested it under ESX(i) 3.5 and it worked quite well.

http://it-experts.dk/blogs/jjonsson/archive/2009/05.aspx

Enjoy the tip,

-Ben

Exchange 2007 will support Windows 2008 R2

2009-11-04T21:18:00.003-05:00

Hello All,

The Microsoft Exchange Team announced today (11/4/09) that Exchange 2007 will be supported under Windows Server 2008 R2 once an update is released for this. Originally, it was not going to be supported, but MS changes their mind. Full details can be found here.

http://msexchangeteam.com/archive/2009/11/04/453026.aspx

Enjoy,
-Ben

Testing out Microsoft's Hyper-V R2 for uptime comparison to VMware's Hypervisor

2009-11-04T20:52:00.003-05:00

Ehlo All,

I believe that virtualizing Exchange and other servers has more advantages than disadvantages. So, while VMware is the leader in the space (w/ESX and ESXi) and this is what I deploy clients using, I realize the Microsoft virtualization solutions (w/Hyper-V) will gain a significant market share in the coming years. So, I decided it was time to start to test it out. Specifically, I wanted to see how often it needed a reboot due to Windows updates and the stability of the OS.

Since a hypervisor reboot requires pausing all VMs, it's a real distruption. I realize you could move all the VMs, but that means you need 2 hypervisor servers. Sometimes clients do not have this. So, I wanted to see the stability/uptime of just the hypervisor. I know my ESX(i) can go easily months if not years without a reboot since it's a hardened OS and there are very few security updates. Curious to see how Hyper-V would fare compared to this. Keep in mind, if you loaded the full Windows 2008 Server and then added the Hyper-V Role, it would need to be rebooted a LOT due to all the extra software loaded inthe OS. So, I feel this is more of an apples (Hyper-V R2 standalone hypervisor version) to apples (ESX/ESXi) comparison.

Since it's a free product (similar to ESXi) and anyone can download it. I downloaded the free Microsoft Hyper-V Server 2008 R2 on 11/4/09. It was released on 8/28/09.

Download Microsoft Hyper-V Server 2008 R2
http://www.microsoft.com/downloads/details.aspx?FamilyID=48359dd2-1c3d-4506-ae0a-232d0314ccf6&displaylang=en

Installed it in a VM on my ESXi 3.5 host and then ran the Hyper-V R2 updates. It found 4. 2 were important, and the other 2 were worthless (application compatibility for games, etc). I installed these 2 below. Both updates required reboots.

http://www.microsoft.com/technet/security/bulletin/MS09-059.mspx
KB975467 - Important - DoS via magic packet

http://www.microsoft.com/technet/security/bulletin/MS09-056.mspx
KB974571 - Important - Spoofing attack

I modified the resource allocation on my ESXi deployment, since this VM doesn't need to be a normal/high priority for ram and cpu. We shall see what happens.

-Ben

TimeOutNY rates NY Exchange User Group as one of the best...

2009-11-02T11:11:00.007-05:00

Ehlo All,

In this week's print & web issue of TimeOutNY, they rated NYExUG as one of "the best IT Techie groups for socializing and networking in NYC". Join us at one of our upcoming meetings to learn why. Article URL below.

Amazingly, they made an error on the article even though it was fact checked by a separate person who called me. This TimeOutNY error required me to do some email admin work. So, they listed the email as register@nyexug... when in reality it should have been rsvp@nyexug or join@nyexug. So, I added the incorrect alias to my mail gateway (email hits this before my Exchange Server) to auto-reply with a thank you email and some URLs pointing people to the correct place to RSVP for the meeting. And then I ran a query on my clustered spam filtering solution to see the # and email addresses of people who emailed the wrong address so I could notify them. All for a single email address error. Then again, I could have ignored it and let people fall by the way side, but that's not my style.

TimeOutNY Article
http://newyork.timeout.com/articles/i-new-york/79899/the-best-it-techie-groups-for-socializing-and-networking-in-nyc

Our Upcoming November Meeting
November 10 Meeting Topic - Our Exchange 2010 Launch Party (e.g. Major New Feature Explained in detail [Database Availability Groups, etc])

Speaker: Angi Livermore (Principal Technology Specialist) of Microsoft. Full BIO below.

Register Now (open to the public & free pizza dinner / click to attend RSVP - by Mon November 9th at 3pm EST)
https://www.clicktoattend.com/invitation.aspx?code=141309

Meeting Topic Details - Launch Party for Exchange 2010. We have already had an "intro to 2010", so this meeting will focus on digging deeper into the new product. We'll have a presentation and demo for the following features.
- Database Availability Group (the new HA functionality that replaces CCR, SCR, & LCR)
- multi-mailbox search (ability to search content across numerous mailboxes)
- new OWA premium capabilities (premium support for 3 browsers instead of just IE)
- core store enhancements (better I/O)
- transport improvements (redundancy in transport of messages so transport server failures will not affect message delivery)
- admin audit logging (know what changes are done to your Exchange environment)

Full Speaker BIO
Angi Livermore is a UC Core Technology Specialist for Microsoft and has over 20 years’ experience in the technology industry with a strong background in messaging and collaboration technologies. Prior to this role, she worked in Microsoft Consulting Services for 4 plus years working in various Financial Services and NY district accounts.

Previously, Angi held several different positions with Merrill Lynch for five years and the latest was a Vice President of Product Delivery Services. Her last assignment was as an individual contributor focusing primarily on facilitating the release of Global Private Client (GPC) initiatives, (“Trusted Global Advisor”, also known as TGA) with a heavy emphasis on technology enhancements that reduced the total cost of ownership.

Prior to coming to Microsoft in August of 2001 and working for Merrill Lynch, Angi also worked for several Microsoft partners working with MS Mail, Exchange, Windows, Active Directory, and Mobile technologies. She is very passionate about helping customers achieve their full potential by using Microsoft technologies.

Angi lives in West Windsor, NJ with several four legged friends and her hobbies include: golf, golf, and more golf…

---------------------------------------------------------------------

Test your Exchange Restore Capability - Tips for Restoring

2009-11-01T23:33:00.007-05:00

Ehlo All,

So, I've been using AppAssure's MailRetriever (part of Replay product) on Exchange 2007 (& other types of servers) for about 9 months now, and have been impressed for it's ability for continuous data protection (aka snapshots) and ability to natively write VM files (e.g. VMware Workstation, VM Server, VM Player, ESX, ESXi, and Hyper-V). I've used it numerous times to restore individual Exchange items and traditional files. BUT, a major concern has arisen recently. I've been working with AppAssure support for over a week to resolve a significant issue with item level restores and no good news yet. My major concerns are that the Replay product reports a restore success, but it's not. I've replicated the issue 3 times and support has been notified and working on it. Restoring an entire user's mailbox folder (e.g. Sent Items) results in almost 500 missing items (from about 85k). Yet, OWA/Outlook/exmerge to PST report about 500 more items that the restore and matches the correct folder item count.

During this time, I needed a way to test restores. So, originally, I would create a test AD (Test Account1) and email account (taccount1@somefake.addomain.com) and then restore my data to this account. And then I would delete the AD and email account, and re-create on the next restore. So, I've gotten good at deleting AD accounts and purging mailboxes. But, I found a better approach. Just delete the email account and purge it from the database and then re-create it for your next test. Why delete the AD account, it's not necessary. Some helpful sites to learn the commands.

1) Delete Exchange attributes from AD User (disconnects mailbox from AD user)
http://technet.microsoft.com/en-us/library/aa997210.aspx
Here is what you need to type in bold.
[PS] C:\Windows\System32>disable-mailbox bserebin@somefake.addomain.com

Confirm
Are you sure you want to perform this action?
Disabling Mailbox "bserebin@somefake.addomain.com" will remove the Exchange
properties from the Windows user object and mark the mailbox in the database
for removal.
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help
(default is "Y"):y
-------------------------
2) Deletes disconnect mailbox(es) in Exchange Server 2007
Type the following 3 commands found on this page (skip option "Removing a single entry")
http://msmvps.com/blogs/andersonpatricio/archive/2007/10/08/removing-disconnected-mailboxes-in-exchange-server-2007.aspx

Also, In my testing of this issue, I made a full export (copy) of my DC & Exchange 2007 servers. And then I run them (NIC configured) via VMware Server to host only mode. This makes the servers visible to only the VMware Server. I then have a full shadow production environment. So, now I can test against the backup software. I originally detected the issue when I did a full mailbox restore to another AD account on my Exchange Server and compared sizes & item count and noticed the large discrepancy. I'm also in the process of getting Backup Exec 12.5 and ARCserve (r12.5) to test restores via those products as well. Curious to see how well they work.

So, far my Backup Exec 12.5.2231A x64 testing has been painful since the default install on Windows 2008 from a demo downloaded via their website does not show the Exchange Server databases. Same problem using 12.5.2231A x86 on 2003 occurred. I followed the support solution (document ID 315712) but it didn't resolve it. I'll continue troubleshooting later this week. I'll report my feedback on ARCserve later this week too.

-Ben

How a Turkish mobile provider's BlackBerry firmware helped save my BlackBerry Bold.

2009-10-09T09:52:00.006-04:00

Hello All,

I've been dealing with dropped calls and signal issues since I initially switched to AT&T in Dec 08. Surprisingly, the problem was the device (BlackBerry Bold) & 3G, and not AT&T. Now, I'm a big of BlackBerry technology, but it's to blame! The Bold is a great device except for one thing, 3G. It seems the 3G driver has a problem switching cell towers in heavily used areas and other random places. So, I would experience dropped calls (many places) and "lock" on EDGE or GSM (heavily used areas) which a quick reboot would fix. Thankfully the Bold reboots quickly (I use an app called QuickPull). The reason for the post was it looks like I finally found a more permanent "solution" to this issue, disabling 3G. I'll explain how later on.

Before I switched to AT&T I tested out the service with a BlackBerry 8820 running OS 4.2 during the end of 2008. It worked great. So, I bought a Bold and switched to AT&T and then the problems started. Initially I thought this was "normal" AT&T service people complained about. Then I noticed a pattern. Certain areas would cause the "problems" above. So, my resolution testing began.

- SIM swap did nothing (that was the 1st and last idea by AT&T support I listened to).
- borrowed another Bold, same issues.
- retested with the 8820 and loaded 4.5, no issues.
- ran a variety of cutting edge (unauthorized) BlackBerry OSes on my Bold in attempts to fix the dropped call problem. They varied from Singapore, Latin America, & UAE. All are developed by RIM, but released to different mobile phone providers for support. AT&T supports 1 version of the BlackBerry OS currently, and it has problem. So, I would load the latest BlackBerry OS I could find and see what would happen.

And then I finally had the idea, it could be the Bold & 3G. So, AT&T did release an OS with the ability to select "2G" or "2G/3G" networks, but due to a serious bug, it was pulled from the market days after release. I decided I didn't want to run that, but finally.... another OS (4.6.0.301) with this capability was released by a Turkish mobile vendor, AVEA. So, I'm running it and so far it's been working as I hoped.

This is the URL that listed it.
http://forums.crackberry.com/f83/newest-9000-os-v4-6-0-301-official-avea-multilanguage-315322/

Enjoy,
-Ben

Windows 2008 R2 and Exchange 2007? Microsoft says no.

2009-10-06T15:02:00.006-04:00

Hello All,

Anyone who has not deployed Exchange Server 2007 and wants to do it on Windows 2008 R2 (it'll be launched this month), the answer is it is NOT supported. Not a big deal, since I would just wait a bit longer and have the benefits of I suspect to be the hands down best Exchange version yet, Exchange 2010. If you are wondering, 2003 is still the king. Some articles discussing this R2 rejection: Windows IT Pro and the Microsoft Exchange Team postings.

Server OS Support
Exchange Server 2003 supports Window Server 2000, Windows Server 2003, & Windows Server 2003 R2. (3 OSes supported)

Exchange Server 2007 supports Windows Server 2003, Windows Server 2003 R2, & Windows Server 2008. (3 OSes supported)

Exchange Server 2010 supports Windows Server 2008 & Windows Server 2008 R2. (2 OSes supported currently)

Microsoft decided against QA and supporting Exchange 2007 on Windows Server 2008, which is understandable since supporting 4 OSes is a time consuming process and 2010 is getting launch within the month. So, wait a little longer, and try and deploy Exchange Server 2010 once your eco-system is supported (e.g. BES, GFI, AppAssure, Backup Exec, etc).

-Ben

Learning about the services Exchange 2007 installs?

2009-09-29T15:46:00.003-04:00

Ehlo All,

Quick question. The "Microsoft Exchange File Distribution" Service gets installed on which Exchange Server 2007 roles? The answer is Client Access and Unified Messaging server roles. This Microsoft TechNet article that explains all the services installed by Exchange setup for 2007 which can help in case of troubleshooting. If an issue occurs, you'll know where to look first which can be helpful since there are 21 services that Exchange installs depending on the server role. That's a lot services. This article can help you understand them.

-Ben

Article - Domain Controllers are critical to Exchange, Know Which DC is Used for Communication

2009-09-28T14:22:00.010-04:00

Hello All,

A working Active Directory foundation is required for Exchange Server, so have you ever wondered which Domain Controller (DC) was being used by your Exchange Server. Now you can. Read on if you're interested.

I recently read an article about how Exchange Server knows what Active Directory servers are available. For Exchange 2000, 2003, and 2007, the answer lies with an Exchange process called "Directory Services Access", aka DSAccess. It polls all DC every 15 minutes and makes optimizations based on the results. You can read the summary article here (via SearchExchange.org) or a full detailed technical article here (via MSExchange.org) or another one from SearchExchage.org here. Start with the summary, and then the technical articles.

Tidbit - Under 2000 and 2003, DSAccess ran under the Exchange service called System Attendant. Exchange 2007 changed that, and now it runs under a separate Windows service running on your Exchange Servers called "Microsoft Exchange Active Directory Topology Service".

Until next time... may your email flow well.
-Ben

Virtualization and Exchange - It's Microsoft Supported and Works Well!

2009-09-11T14:24:00.004-04:00

Ehlo All,

Sadly, there is a LOT of marketing non-truths (aka lies) being spread about Virtualization and Exchange Server (e.g. it doesn't work, Microsoft won't support it, bad performance, etc). I was so tired of hearing this, I finally decided to give a presentation at the NY Exchange Server User Group Meeting this past week that discussed an intro to virtualization and Exchange and exactly what is supported (Exchange 2003 & 2007 is VM supported, VMware ESX and Exchange 2007 SP1 is supported, and much more). My Exchange environment is fully Microsoft PSS (Professional Support Services) supported since it's Exchange 2007 SP2, Windows 2008, and VMware ESX 3.5 U2. Amazing, I know. I've included the topics presented in the evening, and feel free to spend sometime reading through PDF. I've included referenced footnotes as well.

Presentation Topics
- intro to virtualization
- pro's / con's of virtualization
- what servers work with virtualization
- Microsoft's Exchange Support Policy explained in detail
- different Exchange version support
- VM performance comparison to old school hardware deployments (and yes, it's old school)
- why virtualization is more important than performance
- what Exchange Server really needs

Review the September 8, 2009 NYExUG presentation by Ben Serebin, and post any questions you have on the blog and I'll happily answer them.

.
QUIT

An example of what not to do. Article published on setting up an Edge 2007 Server without EdgeSync.

2009-07-30T23:29:00.005-04:00

Ehlo All,

Yes, you read the title correctly, an Edge 2007 Server without EdgeSync. Why would anyone ever deploy an Edge 2007 Server without EdgeSync, the synchronization functionality? You got me. But, Neil Hobson published on msexchange.org an article how to set it up. You can check it out here, but I do not recommend this configuration, and would be very curious to know why the quoted organization couldn't use it. He really should have elaborated why it was done, since this is NOT recommended.

For some background, check out this MSDN blog which has the pro's/con's for EdgeSync. Check it out here. To summarize you lose gateway based recipient filtering, safelist block/accept, config and admin is easier on setup, and traffic is encrypted by default. If you do without EdgeSync, do not spend the money on an Exchange license. Save it for another mail gateway product. Sometimes, msexchange.org publishes article of questionable value, this is one of them until they elaborate the purpose of runnings without EdgeSync.

.
QUIT

Great Time Saving Tip for Installing Exchange 2007 SP1 on Windows 2008

2009-07-24T01:49:00.006-04:00

Ehlo All,

Want to safely speed up install times and make less mistakes (e.g. forgetting to install a prerequisite, role, or feature) on your installs of Exchange 2007 SP1 on Windows 2008. The smart creators of Exchange (aka Microsoft Exchange Server Team) via their blog announced and released a GREAT tool. Normally, you have to separately install numerous prerequisites, roles, and features which can take a while. So, they released an all-in-one way to do this via XML files for each role option. Here are the 6 options with 2 clarified. Or you can manually install the needed software via this Microsoft TechNet article.

Exchange-Base = installs Server Manager, PowerShell, and RSAT-ADDS
Exchange-CAS
Exchange-ClusMBX = clustered mailbox
Exchange-Edge
Exchange-MBX
Exchange-UM

.
QUIT

Exchange 2007 SP2 is coming soon (before Oct)

2009-07-24T01:34:00.004-04:00

Ehlo All,

According to the official Microsoft Exchange Server Team Blog posting, Exchange 2007 SP2 is arriving before October 2009. Technically, they said Q3 2009, but easier to say before October, than July, August, or September. 3 biggest changes will be:

1) ability to backup with an OS provided tool within Windows 2008 (right now you can't w/o 3rd party)
2) auditing Exchange events (e.g. configuration changes, etc)
3) interoperability with Exchange 2010 (I plan to jump as quickly as I can to 2010 once my 2 critical Exchange add-on apps work)

.
QUIT

Exchange 2007 SP1 Update Rollup 9 Released

2009-07-24T01:29:00.004-04:00

Ehlo All,

MS Exchange Server Team Blog announced on 7/17/09 that the Exchange 2007 SP1 update rollup 9 was released. You can read more about it here. I've downloaded it and loaded it on my own production server and no issues to report. I did notice when I installed it, I had skipped rollup 8, and even on reboot, Windows Updates wanted rollup 8 installed. Which is wrong, since rollups are cumulative. I hide rollup 8. Oh well, don't make a mistake and install a downgraded version.

.
QUIT

Field Notes - Exchange 2007 Edge Troubleshooting

2009-07-23T23:34:00.011-04:00

Ehlo All,

So, I figured I would share more of my daily work from the field. That means more troubleshooting, upgrade issues, successes, and all around adventure. A client of REEF Solutions (using REEF Solutions' hosted clustered spam, virus, and DoS protection solution which has handled about 550,000+ messages a day over the past month) with their own in-house IT staff was working on an Exchange 2007 migration from 2003 that had email flow problems and almost 9,000 valid messages were stuck in the Edge queue. I was called in to assist after the client's IT was on the phone with Microsoft Professional Support Services for over 3 hrs and there was no solution and they were considering reinstalling Edge. Client was restless, since email downtime was suppose to end after 7 days or so, but it didn't.

Background
The client had migrated to 2 new servers, an Exchange 2007 Mailbox/CAS/Hub & Edge both on Windows 2008 Server 64 bit. During the upgrade they implemented an Exchange 2007 Edge Server. This was to replace an existing non-Exchange smtp gateway server. They previous had a single Exchange 2003 environment. After the Edge implementation, email would flow from the Mailbox Server to Edge to Internet, but not the reverse. Client IT had tested and telneting between the Edge and Mailbox worked, and vice versa, but email would not flow. Edge was in a DMZ. MS PSS had done a lot of things, but the email was still not flowing. During the the entire week long downtime, REEF Solutions had queued up email off-site (9k of valid non-spam messages) for the client.

Troubleshooting and Solution
1) Running the built-in Exchange troubleshooting analyzer reported errors on both servers. Running it on Mailbox reported not seeing Edge, and vice versa. This was because the DMZ didn't have those ports open for RPC and other ports. Not a big deal, but makes troubleshooting harder.
2) pinging the Mailbox and Edge servers NETBIOS name worked from both servers.
3) from Mailbox and Edge, telneting via port 25 to generate "homemade" email both ways was successful.
4) on Mailbox ran "Test-EdgeSynchronization" and it passed with flying colors.
5) on Mailbox ran "Test-EdgeSynchronization -VerifyRecipient bgates@yourdomain.com" and it was successful. Obviously, pick an email in your domain. This is testing the AD Application Mode (ADAM) replication [1 way from AD -> Edge] for storage of configuration and recipient information. This is because Edge is a non-domain computer and doesn't have access to AD like a normal domain based server.
6) checked the hosts files on both servers. And added due to a known IPv6 issue, the NETBIOS and FQDN of each server and the other server in their hosts file. So, if your mailbox server was called "mailboxsrv", in the hosts file would say "192.168.1.2 mailboxsrv" and then line 2 would be "192.168.1.2 mailboxsrv.corp.yourdomain.com" and comment out the ::1 localhost entry to "#::1 localhost".
7) on Mailbox server in EMC - Organization Configuration - Hub Transport - Send Connectors - EdgeSync - Inbound to Mailbox Server - Route mail through the following smart hosts: {your mailbox server IP})
8) on Edge, saw an Event log error for a non-valid SSL cert, so on the Mailbox and Edge server, if I recall, under EMC - Hub Transport - Send Connectors - Network - unchecked "Enable Domain Security (Mutual-Auth TLS)". This is an excellent article by MVP Elan Shudnow that discusses transport layer security between Edge and Transport.
9) on Mailbox, ran "Start-EdgeSynchronization" and the configuration changes I made replicated to the Edge server.
10) since all inbound port 25 is restricted from REEF's clustered email filtering solution, I generated email from their and tested inbound flow from cluster - edge - mailbox, and it was successful. And then I tested outbound email and it worked. Then the 9k message queue quickly reduced down to 0.

FYI: if you need to reinstall the Edge or Transport Server and have messages in your queue, you can backup it up, re-install Edge or Transport services, and then restore the database. Edge queue database is ESE based, like Exchange. An excellent article by explaining the backup and restore process by Joshua Raymond is here.

Problem solved.
.
QUIT

Exploring iSCSI for the 1st Time - An Easy Intro for new beginners

2009-07-20T22:48:00.007-04:00

Ehlo All,

So, I have to admit it. I'm an iSCSI SAN newbie. While people are afraid to repair an Exchange database via eseutil, install and configure the SSL certificate for Exchange 2007's Outlook Anywhere, routing groups, and configure DNS TTLs, I'm very comfortable with all that. On the other hand, iSCSI, that's a foreign language to me. With terms like target IQN, LUN mapping, SCSI Serial No, SCSI ID, blockio, etc, it's understandable, at least to me. To summarize, iSCSI target means iSCSI sharing server, iSCSI intiator means client.

So, I finally had 2 scenarios that warranted that I setup an iSCSI environment. I needed more storage capacity in my ESXi environment and one of my "traditional" Windows 2003 Server. Traditional meaning a physical server. So, while adding internal storage is possible, it would have been a real pain since all the slots were filled. So, I had an existing Windows 2003 Server with a LOT of extra storage (4.4 trillion bytes, or 4.4 TB). I made a BIG mistake when quoting storage for it, so I have way to much storage on one server. So, how could I reliabily share storage over the network and appear as a locally connected drive letter on boot, iSCSI!

I considered 3 options, since I needed it to run on top of an existing Windows Server OS.
1) formerly LeftHand Networks (aka LHN) SAN VSA (VMware appliance). LHN was a hardware and software SAN vendor. They use to offer a free* VSA 8.0 which included a management application to configure the SAN solution. *I searched, and could not find the free unlimited usage VSA option anymore, so I would not recommend this approach.
2) open-source/free OpenFiler (aka OF) SAN (Linux, VMware, 2 Xen options, and more). This is really designed for the Linux crowd, some experience SAN users, or diligent admins.
3) Starwind (Windows). Designed for the SAN newbie and offers a free option.
[updated Starwind URL to correct one as per below comment.]

LHN VSA: I had LHN's VSA working in a cluster replicating file data, but decided I only wanted one VSA running for this. But for some odd reason when I removed it from the cluster, it would not let me add volumes to it. I spent a few hours troubleshooting this, but it looks like HP (which acquired LHN) dropped the free VSA option and the great support website. So, I decided to "drop" VSA as an option as well.

OF: I downloaded the OF 2.3 VMware VMDK, unzipped it, and placed it in a VM directory and it booted right up within VMware Server 2.0.1. Changed the IP and password via the web interface and ran the web based updater. Very clean interface, but very few wizards and little documentation. They also charge $60 for the manual. I guess the manual is not open-source. A bit frustrating especially since this is a community product. I would normally donate to the cause, but I'm not a fan of their business model approach. So, I used the following 2 websites and 1 OF forum posting to understand what I needed to do. Not surprisingly, that forum poster left OF and went to Starwind. OF is really designed for bare metal computer installs with your own hardware RAID already setup. But if you know the limitations, it can work for other purposes.

Overview with screenshots of OF iSCSI configuration
http://www.petri.co.il/use-openfiler-as-free-vmware-esx-san-server.htm

Overview with screenshots of ESX iSCSI connection to OF
http://www.petri.co.il/connect-vmware-esx-server-iscsi-san-openfiler.htm

Bonus - Good Overview of iSCSI and OF (connecting with Windows Server iSCSI initator)
http://www.montanalinux.org/openfiler-iscsi.html

At the end of the day, OF is serving iSCSI storage in my environment.
- Windows 2003 R2 Server running 3Ware 9550SXU-4LP hardware with RAID 5 configuration
- VMware Server 2.0.1 running on above Windows 2003 R2 Server
- OpenFiler VM configured for 2 additional virtual hard drives, each 100GB which are in a OF software RAID 1 setup. Protect against software corruption.
- ESXi handling the iSCSI initator to the above server (but you could easily make Windows the iSCSI initator which I plan to do in a few weeks. Microsoft offers for free the iSCSI initator.)

-Ben

Exchange 2007's Outlook Anywhere Overview Article

2009-07-14T17:19:00.003-04:00

Ehlo All,

Here is a good overview and refresher article about Exchange 2007's feature of Outlook Anywhere. I added my 2 cents via the comments about not needing expensive SAN/UCC SSL certificates for auto-discovery functionality. There's a lot of mis-information about this on the internet. Which reminds me, an upcoming blog posting will discuss Exchange 2007's auto-discovery feature and how it's not the answer to the holy grail which many make it out to be.

-Ben

In Q3 2009 - Exchange 2007 SP2 will bring backup to Windows 2008

2009-05-22T00:42:00.004-04:00

Ehlo All,

For Windows 2008 Server admins running Exchange 2007, Microsoft never provided a backup utility similar to ntbackup.exe for Windows 2003 Exchange admins. FYI: Exchange 2007 on Windows 2003 can be backed up, just not on Windows 2008. BK Winstead of Windows IT Pro posted about Microsoft plans in Q3 2009 to release an Exchange 2007 SP2 update that will allow backups. Microsoft's Exchange Team blogged about this and additional features (e.g. Exchange change auditing, Public Folder quotas, etc) found in SP2.

-Ben

Exchange Server Virtualization Intro Articles

2009-05-22T00:37:00.002-04:00

Ehlo All,

Here is a good starting (index) point article for learning about running Exchange Server in a virtualized environment on SearchExchange's website. Only issue is it's skewed toward Hyper-V. I would strongly recommend looking to run Exchange in VMware ESx. I run my production Exchange 2007 in ESXi 3.5. I plan to organize an upcoming NYExUG meeting to discuss virtualization, since it's important.

-Ben

A How-To Configure SCR for Exchange 2007 SP1

2009-05-22T00:33:00.002-04:00

Ehlo All,

This is an excellent how-to article to configure SCR (standby continuous replication) for Exchange 2007 SP1. Includes the scripts for easy copying and implementation. Article posted on Windows IT Pro by Tony Redmond.

-Ben

Learn about Microsoft's DPM 2007 & Exchange

2009-05-22T00:25:00.003-04:00

Ehlo All,

So, if you know what DPM is, you're ahead of the game already. It's Microsoft backup product called Data Protection Manager, and it's available for Exchange & SharePoint. I don't know a SINGLE tech that runs it, but don't let that stop you. Here's a SearchExchange article about DPM 2007 and Exchange by Brien Posey (MVP). Oh, and if you run it, reply to this article via the comments about why you like it over other backup products (e.g. Backup Exec, ARCserv, CommVault, etc).

Another SearchExchange article by Brien about how to deploy DPM 2007's agent on Exchange Server.

Best of luck,
-Ben

Exchange 2010 Beta Articles (Good and Bad News)

2009-05-08T15:33:00.005-04:00

Ehlo All,

I know it's beta, but I'm all worked up over the OWA Premium mode for non-IE browsers (e.g. Firefox and Safari will support Premium mode). Don't worry, I'll still focus on 2003 & 2007 on the blog.

The good news guy, a Tony Redmond article called "A First Look at Exchange 2010" from Windows IT Pro about all the new features. Excellent for an overview of how 2007 to 2010 has changed. Tony is technical is he dives right in.

And the bad news guy, a B.K. Winstead articled called "Exchange 2010, Problems, Problems, Problems" from Windows IT Pro about why did Microsoft force so many things on us via Exchange 2010 (e.g. Windows 2008, 64 bit, no upgrade path, no LCR, no 32 bit evaluation version, etc). It's beta, but he has valid points. Good so you know what's missing and you can plan accordingly.

Until next time, keep you're eye on your mail server.

-Ben

Pigs are flying, Pigs are flying!!! Exchange 2010 will support premium mode for IE, Firefox, and Safari.

2009-04-16T23:26:00.006-04:00

Ehlo All,

While I love (yes, I really do) Exchange Server, I haven't been this excited in a while. And everytime I think about OWA, I'm unhappy since when I jumped from 2003 to 2007, I lost a # of important features (most important, lack of access to Public Folders [aka PF] from Light/Basic Mode). Now, 2010 has me very excited (PF access is fixed) and I plan to run the beta and will jump to 2010 in production even if it's in beta once my "near-time" backup solution I use supports it. I've already downloaded it, and plan to install it in my ESX VM environment very soon. I'll post my comments when I do.

Welcoming Exchange 2010 - 1st 20 seconds are good.

http://edge.technet.com/Media/Introducing-Outlook-Live/

Good Overview of Exchange 2010 - screen shots and a handy chart

http://www.infoworld.com/d/applications/first-look-exchange-2010-beta-shines-485?page=0,0

Exchange 2010 System Requirements.

- to summarize, it's Windows 2008 x64.

http://technet.microsoft.com/en-us/library/aa996719(EXCHG.140).aspx

MS tech (Scott Schnoll) on how to install Exchange 2010.

http://blogs.technet.com/scottschnoll/archive/2009/04/15/how-to-install-exchange-server-2010.aspx

Go download it.....

http://www.softpedia.com/progDownload/Microsoft-Exchange-Server-Download-59862.html

Let me know your thoughts on it.....
-Ben

Exchange Server 2007 SP1 Rollup 7 Released

2009-03-31T11:06:00.002-04:00

Ehlo All,

Microsoft released Exchange Server 2007 SP1 rollup 7 on March 18, 2009. I have not installed it yet, but plan to in the next 1-2 days. Windows restart is not necessary, and the update automatically restarts the necessary services. Also, this is ONLY for Exchange 2007 SP1, NOT Exchange 2007 RTM. There is a big difference between the 2 versions.

My blog posting about the difference between RTM and SP1 versions. Each has there own line of updates and there are not applicable to either. You will break your Exchange install if you load the wrong rollup on your version of Exchange. A colleague did that by mistake.

Enjoy,
-Ben

A $100,000 Question. Which Exchange 2007 roll-up is on your system?

2009-03-31T10:54:00.003-04:00

Ehlo All,

So, how do you confirm which Exchange 2007 roll-up is on your system when running Windows 2008? Uninstall or change a program (formerly called Add/Remove Programs), nope! Exchange System Console, nope! Windows file version #'s, nope! Windows Update, nope! That'll only show you if an update is available. Microsoft didn't make it easy, but someone did. Answer is a very handy PowerShell script that Paul Flaherty wrote. You literally, just need to run it, and bang, it does it's magic and you have your answer. In 3 simple steps.

1) Download and unzip it here, let me know if it goes offline, and I'll post my copy. Unzip and copy to a directory (e.g. c:\temp)
2) open Exchange Management Shell, and cd to the directory with the script.
3) type the following in bold (inside the quotes and there is no space between the . & \ characters) ".\Get-ExchangeServerPlus.ps1"

Results will say:
[PS] C:\Temp>.\Get-ExchangeServerPlus.ps1
EX [Mailbox, ClientAccess, HubTransport] [Standard] 8.0.535.0
- 20081209: Update Rollup 4 for Exchange Server 2007 Service Pack 1 (KB952580)
8.1.311.3
- 20090212: Update Rollup 6 for Exchange Server 2007 Service Pack 1 (KB959241)
8.1.340.1
- 20081217: Update Rollup 5 for Exchange Server 2007 Service Pack 1 (KB953467)
8.1.336.1

Now you know which rollup you have.

Enjoy,
-Ben

Free Microsoft Internet Tool for Verifying Exchange is setup correctly

2009-03-29T23:14:00.005-04:00

Ehlo All,

"Have you ever installed an Exchange server and wanted to verify your Internet facing services were setup and configured properly? Things like Exchange ActiveSync, AutoDiscover, Outlook Anywhere (RPC/HTTP), and inbound email." Well, the Microsoft Exchange Team Blog finally announced an Exchange testing website I used in a presentation months ago. It's a great time saver. It's called Exchange Remote Connectivity Analyzer (ExRCA) tool which can be accessed at https://www.TestExchangeConnectivity.com.

This is a great free resource. Available for:
- Exchange 2003
- Exchange 2007
- Windows Mobile 5
- Windows Mobile 6.1+

Enjoy,
-Ben

OT - Economics of watching TV with a DVR (aka TiVo Economics)

2009-03-29T14:39:00.004-04:00

Ehlo All,

OT = off-topic from Exchange Server.

I am a big believer in efficiency, so when I saw this blog posting about the economics of watching TV with a DVR (e.g. lack of commercial, time shifting, etc), I couldn't help myself. I run a DVR from SnapStream called BeyondTV and it's the adult version of TiVo. Tons of features and runs on Windows. And yes, I have it email me alerts.

Enjoy
-Ben

Why you can't VM your Exchange 2007 UM Server!

2009-03-29T14:35:00.004-04:00

Ehlo All,

This brief posting from Windows IT Pro explains why you can't VM (virtualize) your Exchange 2007 Unified Messaging role server. Otherwise, virtualize away assuming you have enough disk I/O for it.

-Ben

Exchange Server 2007 High Availability strategies explained

2009-03-29T14:29:00.003-04:00

Ehlo All,

This is a good technical introduction article to Exchange 2007 HA options (SCR, LCR, CCR) and options with SANs written by Mark Arnold. Mark is a rock-star in the Exchange world and you can read more about him at the article link above. That's enough acronyms for one blog posting.

-Ben

SearchExchange Top 10 Tips for 2008

2009-03-29T14:20:00.003-04:00

Ehlo All,

SearchExchange (of TechTarget) posts their top 10 tips for 2008 for Microsoft Exchange Server (primarily 2007) article. I would call it 5 tips, but there are 10 listed. :-)

-Ben

Need to copy an .edb/.stm, use eseutil, it's a lot faster!

2009-03-29T14:06:00.003-04:00

Ehlo All,

This from msexchange.org, an interesting article about how it's a lot faster to copy .edb/.stm's using the eseutil copy. In their test, 400% faster. No more robocopy/xcopy commands, or copy/paste. How can it do it, it has to do with an I/O buffering technique which eseutil is better at not using it. Yes, not using it.

-Ben

My Grand Plans for the EhloTech Blog....

2009-03-29T14:02:00.004-04:00

Ehlo All,

I've decided, that it's more important for me and others to share more of the Exchange Server related news I read about than to create original content. There's too much information already out there, so better I expand it's reach. So, I'm going to start posting shorter and make it more of a clearing house for Exchange Server related news (a la /. style). This should be a win-win for all.

I also changed the layout and many of the fonts. If folks don't like them, let me know.

I'm also considering letting others post Exchange Server related news at some point in the future.

-Ben

Microsoft's Support Policy on VMware Virtualization

2009-03-17T00:31:00.006-04:00

Ehlo All,

An attendee at our March NY Exchange User Group meeting asked about Microsoft's support policy on the industry leader of virtualization which is running at 100% of all Fortune 100 companies, VMware. There is a lot of fear, uncertainty, and doubt in this realm. So, let me make it crystal clear! Microsoft WILL SUPPORT VMware's SVVP (explained below) solution which is ESX 3.5 update 2. Microsoft virtualized support is for over 30+ server applications & operating systems as per KB ID 957006. Just to clarify, for Exchange 2003 & 2007 SP1 are supported.

Quoted from MS KB # 897615
Additionally, for vendors with whom Microsoft has established a support relationship that covers virtualization solutions, or for vendors who have Server Virtualization Validation Program (SVVP) validated solutions, Microsoft will support server operating systems subject to the Microsoft Support Lifecycle policy for its customers who have support agreements when the operating system runs virtualized on non-Microsoft hardware virtualization software. This support will include coordinating with the vendor to jointly investigate support issues. As part of the investigation, Microsoft may still require the issue to be reproduced independently from the non-Microsoft hardware virtualization software. Where issues are confirmed to be unrelated to the non-Microsoft hardware virtualization software, Microsoft will support its software in a manner that is consistent with support provided when that software is not running together with non-Microsoft hardware virtualization software.

VMware's Exchange support information for ISV support.

VMware Press Release about ESX 3.5 update 2 support Exchange, SQL, SharePpint, and more. They even quote a 50k seat install on ESX with Exchange by the University of Plymouth in England.

Just to be clear, make sure your issue is non-virtualization related. e.g. not performance or other, and more a configuration or those types of problems. If you have an I/O issue, it could easily be a VM issue, so make sure those subsystems working well and you're 100% sure it's not VM related.

Now, you know the real story behind Microsoft support for virtualization and you can now rest easy. Or the other solution is to have a very good back process running on non-virtualized hardware. That's what I do. Sleep is over-rated.

-Ben

Microsoft Addresses a MAJOR Issue I have with Exchange 2007's OWA

2009-03-17T00:09:00.005-04:00

Ehlo All,

I heard great news last week that addresses the reduced set of functionality in Exchange 2007's Outlook Web Access. Exchange 14's OWA will be support 3 browsers, Internet Explorer, Firefox, and Safari. I did a triple-take when I read it the first time. Y-E-S. 3 browsers supported in E14's OWA. No decision on which platform for these browsers since they are dual platform apps.

I actually lost functionality in upgrading to the latest greatest version of Exchange 2007 from 2003. OWA Basic in 2003 supported access to Public Folders, in OWA Lite (aka Basic mode), access disappeared. Thankfully enough people complained that Microsoft is planning according to a Exchange rockstar Paul Robichaux, aka Exchange MVP. You can read the full article by Paul here & his reference to the MS blog that announced this amazing information.

I'll definitely be upgrading to E14 when it's released. And adios to ActiveX for OWA. There won't be a wet eye in my house for this loss.

-Ben

Easy access to .edb/.stm files via Ontrack PowerControls

2009-03-16T23:44:00.007-04:00

Ehlo All,

So, I recently upgraded to Exchange 2007, and realized one day I might need access to my old Exchange 2003 data. Even though I performed move mailboxes for most accounts, I didn't did it for all. I figured, I should save the databases, .edb & .stm files "just in case". Well, the "just in case" time came almost one month later after my upgrade.

So, while I run AppAssure's MailRetriever which is designed to mount offline Exchange 2003/2007 databases, it's at my datacenter and I had the .edb/.stm files at my home office. I considered transfering the files, but they are close to 40GBs, so I decided to test out under a virtual machine Ontrack's PowerControls. So, I fired up my handy VMware Workstation 6.5 & XP Pro w/Office 2003 and mounted over a 100Mb network via UNC/drive the folder share containing the files. Once mapping to a drive letter, the .edb/.stm files quickly and easily exported the data (some task items) to a PST. Opening the 23GB .edb w/o logs took about 15 seconds which was mindblowing which was OVER a network connection. I then tested the PST data in Outlook which looked good and compressed it and emailed the 1.3Mb off to the user that needed it. That's it. It was so easy, I was shocked. It literally took me maybe 10 minutes if that long.

Overall, Ontrack's PowerControls software package is very impressive.

-Ben

Non-Windows Mobile Issue relating to ActiveSync with Exchange 2007 SP1

2009-01-27T10:02:00.003-05:00

Ehlo All,

If you attended the October 08 meeting of the NY Exchange Server User group (NYExUG), you would have learned that ActiveSync is a different beast for Windows Mobile (e.g. HTC Touch, iPAW Hwxxx, etc) & licensed ActiveSync devices (e.g. iPhone, Palm Treo, etc). So, when I recently upgraded from Exchange 2003 to Exchange 2007 SP1 (on Windows 2008 - I like pain), I was hoping ActiveSync would just work. Nope, I was out of luck. End user Palm 700p error of AirSAMStateMachine.c 1913 4628. But the fix was pretty easy IF you know the PowerShell command. IF is the key word there.

So, as always, first step of troubleshooting, is to Google the error and see what comes up. I quickly found that ActiveSync's default security policy was probably the cause of the issue. And I crossed my fingers and ran the following command (bold italics on 1 line) below. Also, don't just run commands like I recklessly did, but find out what exactly it's doing and how to reverse it in case all hell breaks loose. This is a mission critical application.

Start --> Programs --> Microsoft Exchange Server 2007 --> Exchange Management Shell
Remove-ActiveSyncMailboxPolicy -Identity "Default"

Then magically, ActiveSync started working. Just so you know, below is the Microsoft TechNet article that explains the various options available in ActiveSync policies. There are many more settings that can be controlled in Exchange 2007. I'm not sure which setting caused the issue, but at least I have 1 less screaming user which makes exploring and research the options more enjoyable.

http://technet.microsoft.com/en-us/library/cc182294.aspx

-Ben

OWA Light Comparison from Exchange 2003 to 2007

2009-01-19T15:22:00.007-05:00

Ehlo All,

So, I upgraded to Exchange 2007 this past week. The primary focus of this blog post is OWA Light difference between 2003 and 2007. Reason is, I frequently use OWA on non-IE browser to access Public Folders and was surprised to see existing features in OWA 2003 removed. So, I wondered what else was missing in action (or added) from OWA Light on 2007. Here is the list. [-] means feature is missing from new version. [+] means feature is added in 2007.

If you have a lot of OWA Light users, I would seriously consider staying on Exchange 2003 or leaving OWA users on Exchange 2003 while having other users on Exchange 2007.

What others talked about....
Exchange Product Team Discussing OWA Light 2007 - it seems OWA Light only gained feature according to the Exchange Team.

Figured I would share since OWA is discussed...
Exchange Product Team Discussing Exchange 14 (aka E14). Not much detail except talk about the 3.5 million beta testers and "empowering" end users with distribution list & GAL control. Not very sexy.

OWA 2007 OWA Light - to summarize, is the bare essential in webmail. So, that's email, calendar, & contacts. Nada mas.
[-] Calendar (Daily View Only)
[-] NO Public Folders Access
[-] NO Tasks
[+] Quickly jump to a subfolder (via drop-down)
[+] Easily rename/move/delete folders
[+] Ability to search in Address Book
[+] Ability to change AD password
[+] View a partnered Windows Mobile device

OWA 2003 OWA Light
[+] Calendar (Daily & Weekly)
[+] Public Folders
[+] Tasks

To say I'm disappointed would be an understatement. Come on Microsoft, add features, don't remove otherwise folks will jump to other web based email products like GMa... you know what I'm talking about. :-)

I'll blog more about differences in the future and the migration in general.

-Ben

Handy Free Tool to Test Connections to other Mail Servers - Time Saver Tip

2009-01-05T01:52:00.005-05:00

Ehlo All,

When you need to test another mail server connection, to make sure it's accepting emails, I normally do the following: RDP to mail server, open telnet, open some ip:25 and then enter in smtp commands and make sure the other mail server accepts the email. I recently heard about a tool that expedites this process by handling DNS lookups, smtp commands, etc. It's called TestMX.

About TestMX. It's a very small free Windows application (command line, but don't be afraid, it's very easy). All you need to do is enter the domain to test, and it handles everything for you. The download is 2 files, help file and the .exe program. Below is what I did. I downloaded TestMX, and ran it against my domain (testmx -dreefsolutions.com). See, so easy. So, let's see what happens.

Play by Play
1) it performs a DNS lookup. It shows my local PC's DNS is 4.2.2.2 and 4.2.2.3.
2) it shows the MX records for reefsolutions.com, which are 3 servers.
3) attempts to connect to the lowest preference number (lower is priority connection). If it fails, the tool is suppose to attempt to connect to next preference number.
4) creates a connection to the MX record it found and is successful since the servers responds with "Spam Be Afraid" which indicates my server would be willing to accept more commands to send an email. This does NOT guarantee an email will be accepted though. It simply is testing that the other server is alive and responding.
5) quits connection.

D:\>testmx -dreefsolutions.com
Testing MX connection with domain reefsolutions.com
Using nameserver 4.2.2.2 4.2.2.3

MX for reefsolutions.com is spamcopcluster1.reefsolutions.com [69.31.40.115]
MX for reefsolutions.com is b.reefsolutions.com [72.68.143.91]
MX for reefsolutions.com is spamcopcluster2.reefsolutions.com [72.68.143.92]
Connecting with spamcopcluster1.reefsolutions.com [69.31.40.115]
Connection established with spamcopcluster1.reefsolutions.com [69.31.40.115]
< 220 Spam Be Afraid
> HELO BlackThunder
< 250 spamcopcluster1.reefsolutions.com Hello static-xx-xx-xx-xx.nycmny.fios.ve
rizon.net [xx.xx.xx.xx], pleased to meet you
> QUIT
< 221 Bye
Connection closed with spamcopcluster1.reefsolutions.com [69.31.40.115]

D:\>

Or, if you want to actually test sending of email you'll need to use an email client or perform the smtp commands by telnet. I recently found a better smtp command site than my old favorite (Microsoft's KB article on the process). Like I said before, the TestMX is only to insure the other mail server responds.

Old School way to test smtp (command by command). Favorite site to explain smtp command sending and is more accurate than the one below.
http://exchangeninjas.com/SpeakSMTP

Old Favorite for testing via smtp commands (XFOR: Telnet to Port 25 to Test SMTP Communication)
http://support.microsoft.com/kb/153119

-Ben

A free gift for BES admins. Do you know about a "knife-edge cutover"? You now do!

2009-01-01T14:16:00.009-05:00

Ehlo All,

I've been involved (meaning supporting) BlackBerry Exchange Servers (BES) for 5 years or so, and I just found out about the failover process of BES 4.0 & 4.1. RIM calls it "knife-edge cutover". This is a pretty cool capability that's not too difficult to implement.

I'm a big believer in reading documentation, and didn't know about this until another IT tech casually mentioned this in passing while we discussed virtualization. To summarize, it allows you to quickly failover to a new BES without the need to reactivate BlackBerry devices for end users. So, it allows you to upgrade server hardware, replace a virtual machine (which we recently did and used this approach), or test fail-overs. It worked flawlessly. BlackBerry users didn't even know we failed over to a new vm (virtual machine) since it took only a few minutes. A client's BES vm was having issues, so we used a base vm image and setup BES capability, and then perform a knife-edge cutover. Problem solved, and I'm sure we won't be touching that image for many more years.

Enjoy this gift.... RIM's KB10278 instructions about knife-edge cutover for BES 4.0 & 4.1

-Ben

Favorite URLs for my Exchange & Admin Work Posted...

2008-12-28T21:56:00.001-05:00

Ehlo All,

I figured I would share the websites I use for my Exchange and other admin work so other admin's would benefit. So, enjoy. Any comments or suggestions for other sites, let me know in the comments.

-Ben

Exchange Server 2007 Rollups Existing for SP1 & non-SP version

2008-12-10T15:04:00.005-05:00

So Everyone,

Question: which is the latest Update Rollup for Exchange Server 2007, 5 or 7? That was last night at the Exchange User Group meeting (nyexug.com). We had a discussion of the latest update for Exchange Server 2007. Some folks said roll-up 7 was the latest, and I said roll-up 5 was the latest. Turns out everyone was right. How can that be you may ask? Exchange Server 2007 is a DIFFERENT product than Exchange Server 2007 SP1 so they have different updates. Which explains why the tech who installed a rollup for non-SP1 broke his SP1 Exchange. He smartly do a snapshot before upgrading and disconnected the server from the network, so he quickly reverted to the pre-patch state. So, pay attention which updates are for your version of Exchange.

As of December 10, 2008, here are the latest updates for each version of Exchange Server 2007. I don't know why folks would stay on base version 2007 due to all the gains in SP1, but obviously many folks are and MS is paying attention to them.

Exchange Server 2007 - Update Rollup 7
http://support.microsoft.com/kb/953469

Exchange Server 2007 SP1 - Update Rollup 5 (not on Windows Update yet, will be posted in 1-2 weeks, so you must know about it to download it)
http://support.microsoft.com/?kbid=953467

-Ben

NYExUG Member Review of PowerShell Book

2008-12-09T00:02:00.003-05:00

At one of our last NY Exchange User Group meeting which was focused on PowerShell and Exchange presented by PowerShell MVP Brandon Shell, Manning Publications provided us a copy of their Windows PowerShell in Action book to review. One of the winners of the book provided me this review.

-Ben

Here is my review of the PowerShell book:

There are usually two different types of sysadmin who script: the ones who will find a script online, modify it for their needs (hopefully test it) and deploy it, and one that will figure out all the methods and procedures and write a script from scratch. This book while it says is geared to all beginner’s is really written for the later type of sysadmin. The book does a wonderful job of explaining in detail how the pipeline works but for most sysadmins they would want a more finished example of doing something versus how the pipeline itself works.

--Tracy

In pursuit of my Exchange 2007 deployment - the ugly of VMware ESXi 3.5 and hard drive resizing for Windows Server 2008

2008-12-07T10:43:00.019-05:00

Hello All,

How do you resize partition sizes in VMware ESXi 3.5 (version 110271, VI 2.5 build 103682, VCenter 2.5.0 build 104215) and Windows Server 2008 (these were MBR and Simple volumes)?

1) VI client built-in functionality (VI 2.5 build 103682)
2) DISKPART (as included with Windows 2003)
3) GParted (gparted-livecd-0.3.4-11.iso)
4) VMware Converter (3.0.3 build 89816)
5) vmkfstools (VMware ESXi 3.5 (version 110271)
6) none of the above. Re-install the OS.

Spoiler plot... this does NOT have a happy ending. The answer is 6. If you think you can prove me wrong with the versions above, please let me know how.

If you're a reader of my blog skip to the next paragraph, since this is an executive summary for the non-regulars. I'm in the process of finally upgrading to Exchange 2007 from 2003. I've decided to make it a challenge and do it on a platform I have had no experience with, Windows Server 2008. All my clients and all my servers are Windows 2003 or a variation (e.g. R2, x64, etc). To make it even more difficult, even though I have extensive experience with VMware Server and Workstation, I'm running it under VMware ESXi 3.5 [embedded & w/virtual center]. ESXi is a different beast than other VMware products. It contains a WHOLE lot more functionality especially when you add Virtual Center.

After a few months of planning on functionality & redundancy desired, hardware sizing, migration plans, and a number of other factors, I took the plunge into testing. So, I created my base OS images of Windows 2003 (x32) and Windows 2008 (x64) to test for 1 month which turned into 4 months. After I was done testing installs and configurations, I deleted all those images and started again. The party began.

So, I setup base OS images with 30GB partitions since I was planning on adding a minimum of 14 images & 12 virtual machines (aka vm's). Space is a concern since it is 6 x 300GB SAS 10k hard drives in direct attached storage (DAS) in a RAID 10 config. Problem was I mistakenly made the 2008 system partition size 30GB. I figured, it would be large enough. I'm blogging about this, so obviously it was not and the attempted fix wasn't a quick 1-2-3 or even a 2-3 hour fix.

Attempt #1 - How VMware hard drive resizing is suppose to work
So, after making my 2008 partition size 30GB, I figured the beauty of VMware would show of it's skills. Similar to VMware Server & Workstation, you right-click and enter the new larger hard drive size, and click OK, and a few seconds later it would be increased to 50GB. No such luck. Attempting this resulted in ESXi simply ignoring my request to enlarge the partition. No error, nothing. It stayed on 30GB. A bit of research indicated that Windows Server 2008 is NOT supported for hard drive increases via the VMware Infrastructure Client (aka VI). So, I looked into the other options.

Attempt #2 - Diskpart
This techtarget.com article talks about Diskpart, but all the screenshots are 2003 related, so I didn't even bother, since I figured since diskpart shipped with Windows 2003 SP1, it probably was a dead-end solution. Diskpar was Windows 2003 related, diskpart was 2003 SP1 related. You can find a good article about Exchange 2003 and align your partitions for database storage here.

Attempt #3 - GParted
As per attempt #2, that same techtarget article talks about using an open-source partition tool. I uploaded the ISO to the datastore, did the booting, and attempted to modify the partition to 50GB. It reported no additional space execpt for one more 1MB. Obviously, that isn't correct. Next....

Attempt #4 - VMware Converter
I tried this 2 different ways since some sites including the above techtech article here talked about running VMware Converter directly on the server you are attempting to modify the hard drive partition size, and via a remote server. In my case I attempted via Virtual Center. Both ways failed with the same error "Unable to determine Guest Operating system". Problem: Windows Server 2008 is not supported. Oops. Next attempt.

Attempt #5 - vmkfstools
Run a single command to enlarge your partition ("vmkfstools -X 50g ExchangeSrv.vmdk" ["50g" is for 50GB the size you want, and "ExchangeSrv.vmdk" is for the server name]) and all your troubles go away. Or that's how all the documentation sounded. Problem is, you can't run this command via VI or a command line on ESXi out-of-the-box. A number of advanced functionality for ESX require run command line based commands. The only way to do this with ESXi, is to enable console access. This is NOT supported on ESXi by VMware and use your judgement (similar warnings when using regedit). So, to gain console access, I found this handy blog posting that gave a summary how to enable SSH access for ESXi (I found it better than the VMware KB tech article). This is when I had to remember my days back on AIX with the vi editor. Since you need to modify a configuration file, and it's a bit tricky. You'll need to google "vi" if you need help. I then had ssh root access to my ESXi server.

So, I ran the command and then issued a "ls -l" and noticed the server vmdk had increased to 50GB. Awesome, I figured I was done. Nope. So, I then had to run the process in attempt #3, GParted. I ran that and it saw the extra 20GB and enlarged the partition. Almost there. Until I rebooted the server and it failed to boot with a non-bootable error of "winload.exe is missing or corrupt." I started the repair process and then realized I didn't want a base image to be off a corrupt partition or possible issues with files. So, at this point I scrapped the process and did a re-install of 2008.

The best part of Windows Server 2008 is I can install it under 40 minutes on the hardware I'm running. So, this makes it very fast. Also, I recommend you make OS partitions at least 40-50GB. I plan on using a secondary partition for Exchange databases, but I still wanted extra space on the 1st partition. Here are the Microsoft Windows Server 2008 System Requirements. So, I have my 50GB OS partition and a 2nd for the Exchange databases. I return to installing Exchange now.

Good site to explain VMware's resizing of Virtual Disks (primarily for Windows 2003)

Side Notes
- Windows Server 2008 annoyance, why is hibernation enabled on a server OS. I quickly noticed storage was being used up faster than it should. I found out a hibernate file is created on the root of c:\. To delete it and disable this "very useful" [note sarcasm] server feature, open a command prompt and enter "powercfg -h OFF". And it'll delete the file and disable the feature.

- thin provisioning capability (means, create a 50GB partition, and have it dynamically grow. So, only use what you need). Only downside of this, is a reduction in performance. It's only available to SAN based storage. I'll need to explore that in the future.

- I tend to recommend folks avoid Dynamic Disks and GPT based partitions unless there is a requirement to select these since compatibility can easily become a problem with these types of disks. GPT is used when you want partitions over 2TB, as per Dynamic disks, for online resizing (I think) and use of OS based RAID types.

Until next time,
-Ben

Emptying Those Pesky OLK Folders (Outlook design flaw)

2008-12-02T16:38:00.009-05:00

Hello All,

This came up on the New York Exchange Server User Group (aka NYExUG) Google Group mailing list. See below to download the script to empty those pesky Outlook 2003 OLK folders.

Down Here: Magical Script to Purge the Outlook OLK Folder

Background on the issue. When an Outlook 2003 (not sure if Outlook 2007 has the same problem) user opens an attachment, Outlook creates a cached copy (with a similar name and a few digits) in a hidden OLK folder (random folder name) in the user's profile. Now, the issue is, if the user opens up the same file name (e.g. scanner creates PDF files named Scanned.pdf", eventually the random digits run out and user will not be able to open the new file due to a same file name error. Of course the error message isn't so clear cut. The reason I call this a design flaw, there isn't a way to clear the Outlook "cache" without manually doing this. I've looked for Group Policy adm add-ons, and a number of other solutions, but in the end, a co-worker of mine at REEF Solutions found and configured a script to empty all OLK folders on Startup. Now, we simply place that script in the startup folder, and "BANG!" every login solves the problem. I'm sure there's a better way to deploy it, but this was a quick and easy solution. If you know how to handle this via GP, post it in the comments.

Until next time.
-Ben

Feedback on my 1st Exchange 2007 Install running on Windows 2008

2008-11-07T11:47:00.021-05:00

Hello Everyone,

So, I decided to really challenge myself. Not only had I never used or installed Exchange 2007, but I decided to do it on an OS I have had no experience with, Windows 2008 Server (I have a test Vista laptop but rarely use it). So, this was a completely new beast to me. Overall, even though Exchange 2007 has a brand new interface, requires more work on user creation, more complicated install requirements, & Microsoft pushes for you to learn PowerShell scripting, Exchange 2007 has a well laid out interface for configuration and the use of wizards makes learning this product easier than Exchange 2003. Yes, you heard that right. This is easier to setup and manage than Exchange 2003 out of the box. Anyone who is familiar with Exchange 2003, should not have an issue learning Exchange 2007. The learning curve is a lot easier than expected. Remember, I've never seen Exchange 2007 nor have I used Windows 2008 and was able to get the Exchange Server functionality up and running fairly quickly. Good job Microsoft!

My complaints seeing it for the first time, are minor issues, such as copying text from dialog boxes is either not possible or limited, fancy GUI is a waste of CPU processing [View -> Visual Effects -> Never resolves that], and wizards take longer to execute than the old ESM or setting the configuration yourself. But Microsoft has made your life a lot easier with a one stop article (below) to install it. So, would I recommend everyone go out and upgrade, no. I'll address who should upgrade in a future post.

Well, it's taken me a while to finally get to the point of testing Exchange 2007 since performance has not been an issue so far with all the Exchange 2003 environments I've worked on (maybe after a hardware upgrade though). Which is a compliment to Exchange 2003. It's a great product since it's rock solid and scalable when you properly size your Exchange Server.

So, I'm testing Exchange 2007 SP1 (remember, SP1 is the full software code so you don't need to install the base and then SP1, just install the full version via SP1) on the following:
- Windows 2008 Server x64
- OS running under VMware ESx 3i 3.5
- VM configured for 2 CPUs (up to 3GHz/cpu, 8192MB, 30GB OS partition, 240GB Exchange install partition [not needed, but plan to deploy my "production" environment in this configuration].
- non-internet based network (in VMware speak, it's called a "virtual switch")

Recommend you read the following Microsoft article for pre-requisites for Windows 2008 or Vista. This article is excellent and includes the command line code needed to load the necessary software (e.g. Roles, Features, etc).

This URL is a gold mine of information. Save this!!!
http://technet.microsoft.com/en-us/library/bb691354.aspx

I ran the typical install (all roles minus Unified Messaging on a single server) of Exchange Server 2007 SP1 setup on a Windows 2008 Server after running the pre-requisites as per Microsoft above, I received the following error:

The Active Directory Schema is not up-to-date and Ldifde.exe is not installed on this computer. You must install Ldifde.exe by running 'ServerManagerCmd -i RSAT -ADDS' or restart setup on a domain controller.

Turns out I missed the following command (on the above URL) which I promptly ran on the planned Exchange server and rebooted. My AD is based on Windows 2003 Native Mode environment.

-------------------------
C:\Users\administrator.domaintest>ServerManagerCmd -i RSAT-ADDS
.

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Remote Server Administration Tools] Active Directory
Domain Services Tools.
Warning: [Installation] Succeeded: [Remote Server Administration Tools] Active D
irectory Domain Controller Tools. You must restart this server to finish the ins
tallation process.

Warning: [Installation] Succeeded: [Remote Server Administration Tools] Server f
or NIS Tools. You must restart this server to finish the installation process.

<100/100>

Success: A restart is required to complete the installation.

C:\Users\administrator.domaintest>
------------------

Next issue was the following SMTP detection issue. The answer to create a "Send Connector" as per http://support.microsoft.com/kb/556055 .

---------------
Hub Transport Role Prerequisites
Completed

Warning:
Setup cannot detect an SMTP or Send connector with an address space of '*'. Mail flow to the Internet may not work properly.

Elapsed Time: 00:00:14
---------------

On to the install. When the Exchange setup runs the pre-requisites, it attempts to connect to Microsoft for the latest requirements. Since there is no internet, it fails but it's not reported. This is the setup dialog as it continues. Technically you could disable this auto-internet check using ExBPA and configuring some xml files, but I don't think it's worth the time.

Process took 50 minutes to complete. No errors reported. The next steps are presented by the Exchange Management Console. Here are the more important configuration steps to get up and running in order of importance.

- configure domains for which you will accept e-mail
- configure internet mail flow
- configure the E-mail Address Policies (formerly known as Recipient Update Policy) to automatically change all your users "from" address
[optional/recommended] - configure OAB public folder distribution for Outlook 2003 and earlier
[optional/recommended] - configure SSL for CAS (Client Access Server)
[optional] - configure ActiveSync
[optional] - configure offline address book (OAB) for Outlook 2007
[optional] configure an external postmaster recipient to receive mails from our systems (e.g. NDRs, etc)

I performed the following:

"Configure Domains for which You Will Accept E-mail"

Clicking on the link inside the wizard pointed me to the correct location and then I selected the Actions "New Accepted Domain". You type the "Accepted Domain" which is your emailed domain, and then you probably want to leave it as "Authoritative Domain". If you don't know what this means, this is most likely your correct setting. The other 2 options are Internal Relay Domain and External Relay Domain. Then you're done while you wait for the wizard to run the command which took 15 seconds on my server.

After completing the above, you probably want to make that domain your default. So, highlight the domain you added, and on the Actions, click "Set as Default".

Now, you can receive if you've configured your firewall and DNS for this domain, but you need to be able to send email.

Next step - configuring sending email. In Exchange 2007 speak, "Configure internet mail flow"

Exchange Management Console -> Organization Configuration -> Hub Transport -> Send Connectors tab -> click "New Send Connector..." Actions.

Now you have 4 options
Custom - for sending via non-Exchange servers (e.g. relay servers, your smtp gateway server, etc)
Internal - for sending email to other Exchange servers
Internet - use DNS to route email out. Connect to our domains servers directly.
Partner - for sending to domains with TLS encryption that are listed on the "domain-secure domains".

I selected custom, and for the Address space, listed the accepted domain as entered above, and left all settings as is. Network settings (Use domain name system) which means your Exchange Server will communicate to a variety of other servers on the internet or "Route mail through the following smart hosts". I selected a smart host and entered the LAN IP of it (I never allow my Exchange Server to communicate on the internet. All mail inbound and outbound is routed via another smtp server). Now, under "Configure smart host authentication settings", I left this to "None" since I whitelist the Exchange Server on the smtp relay server. "Source Server" lists this Exchange Server.

Configuring the E-mail Address Policies to change the "from" address
Organization Configuration -> Hub Transport -> E-mail Address Policies -> right-click Default Policy and select Edit.
- add an additional domain entry under "E-Mail Addresses". This is typically your new accepted domain.
- I left the default "E-mail address local part" to "Use alias"
- check "Select accepted domain for e-mail address:" and Browse and select domain used above for "new accepted domain"
- highlight newly added SMTP e-mail address, and select "Set as Reply". It should become bold now.

Adding your First Email User Account
- Now this is back to the good ol' days of Exchange 5.5, somewhat, but not as bad as when Exchange 2007 was first released. You can add the user account in AD, and then head over to the EMC (Exchange Management Console in 2007, formerly ESM in 2003, Exchange System Manager) and under Recipient Configuration -> Mailbox -> New Mailbox... under Actions. You want the basic User Mailbox (there are numerous other options). For User Type, select Existing Users, and select the user(s). Select the Mailbox database and "Exchange ActiveSync mailbox policy" if you plan to use that and then click Next. Or you can have EMC create the AD account and then go to the container called "Users" and move it to the correct OU. Hopefully SP2 or an update allows you to select the OU to place the user(s) being created.

And that's it. I logged into Outlook Web Access, and thanks to Microsoft for loading a SSL certificate so out of the box, OWA can be secure & support forms based authenication (major difference from 2003). Some screen shots of OWA and OWA Light. Enjoy.

Initial OWA Login Screen

Your 1st Login Screen and Prompt to Set Time Zone and Language - this is an improvement from Exchange 2003/2000 which the end user had to know to click Settings and set this information.

Logged in OWA on Exchange 2007 running IE 7

Logged in OWA Light on Exchange 2007 running IE 7. This would be similar to Firefox, Safari, and other non-IE browsers.

Comments, feedback, etc.
-Ben

How To Article on Virtualization for Exchange 2003 & Office Communications Server Support for the BlackBerry

2008-10-20T10:19:00.004-04:00

This is a how to article on the process to virtualize Exchange 2003 with Hyper-V writing by an Exchange MVP, Brien Posey. Good walk-through of the process. And, since this is Hyper-V vm'ed, this is supported by Microsoft Support.

http://searchexchange.techtarget.com/tip/0,289483,sid43_gci1334779,00.html?track=NL-359&ad=667516&asrc=EM_NLT_4749386&uid=1446997

And BlackBerry now supports Office Communication Server 2007.
http://na.blackberry.com/eng/services/server/exchange/ocs2007.jsp

Enjoy,
-Ben

Continuing on our NYExUG Meeting - PowerShell Education

2008-09-21T21:55:00.004-04:00

Hello Everyone,

For those who attended the past September 2008 NY Exchange User Group meeting, we had a great intro to PowerShell by Brandon Shell (a PowerShell MVP). If you missed this or are interested in learning more PowerShell that is Exchange specific, see this SearchExchange article. It's a good start and provides many examples. Article was written by Brien M. Posey, MCSE (& former Exchange MVP).

SearchExchange's Primer on PowerShell for Exchange.

-Ben

New Formula: Exchange + Virtualization = Microsoft Support

2008-08-28T13:09:00.005-04:00

Yes, the new formula is correct. And I did not expect to see this so soon. Microsoft has announced that you can run Exchange 2003/2007 in a Virtual Server 2005 R2/Hyper-V virtualized environment and get Microsoft Professional Support Services. Here is the official Microsoft release about this. http://technet.microsoft.com/en-us/library/cc794548.aspx There are a details for each configuration (e.g. all 2007 roles supported except Unified Messaging), but this is a step in the right direction.

Also, Windows ITPro's article on this mentions that Microsoft has created a Server Virtualization Validation Program (SVVP) and that VMware is in the process of attempting to achieve certification. This is not a show stopper in my eyes since VMware supports clients Windows & Exchange hosts currently.

-Ben

First Experiences with VMware 3i

2008-08-23T11:37:00.010-04:00

Overall, I love it. I'm might start drinking the VMware 3i koolaid. And if you're familiar with VMware Server, this will be an easy transition. Or if you are new, you'll need to hover over icons until you remember what they are. This is pretty easy though. If you don't know, 3i is now free. 3i is a slimmed down version of 3.5 which cuts multiple host type features (e.g. VMotion, Update Manager, etc).

So, I finally had some time today, and after reading all the documentation that came with my new server (Dell PowerEdge 2900 III) and inspecting the inside & removing the USB flash drive (Kingston 1GB) I fired it up. And yes, I normally read all documentation before I start to use a product. And boy, do I like the purr of a dual quad core, six 15k hard drive, & dual power supply server. After about 30 minutes, I actually turned off the music since it was bothering me and listened to the humming of the server.

Some notes on the 3i setup on my Dell. I quickly ran through the BIOS configuration and realized even though I had (read: paid / I don't have enough time in my life with my new daughter) Dell to pre-load 3i on this server, they did not enable the internal USB port to allow VMware 3i booting and on the CPU instructions, VT was disabled. If you recall from my previous blog posting, Intel's VT or AMD-V is a requirement. Nice touch Dell. After that, I booted it up, and 3i just loaded. I changed the root password and set the DHCP IP to static and then used another PC's web browser to download the VMware Infrastructure Client (aka VI Client) which is used to manage your ESx host. The only aspect of 3i I had to configure was storage. So, I gave all 6 hard drives in a RAID 10 configuration to VMware (file system is called VMFS, and I set the block size to 1MB, since I don't expect to have a single file over 256GB) to 3i. So, it handled the formating and everything. So, I now had 836GB of space.

After that, my first OS to install on my new VMware server was Windows 2008 Standard 64 bit. You run through adding a new virtual machine, and I select a CPU, 1GB of ram, and 20GB of hard drive space and place the install CD on your local PC and then select "Connect DVD" and your local DVD/CD automatically appears on the "server vm". I was running this via a 10/100 network, and the install proceeded very quickly compared to Windows 2003. Keep in mind, I had never installed 2008 before. It went very smoothly the install. No issues on install or setup. But, little did I know, the new server OS takes over 10.5GB of space. Holy smokes. I guess I'll be re-installing Windows 2008 again. Oh well.

The management console shows quite a number of performance related statistics (e.g. overall memory usage, network, hard drive, etc) for all virtual machines. Like I initially said, anyone with any VMware Workstation/Server experience will feel right at home, otherwise it's still fairly easy to get around. I'll post again once I dig deeper in the product.

-Ben

P.S. Comments or feedback is always welcome.

Virtualization Performance is better than you think for Exchange Server

2008-08-18T18:08:00.003-04:00

Hello Everyone,

The common thought is Exchange Server does not get virtualized. But, I'll tell you what, Exchange should be virtualized. Applications that are mission critical should be protected using a number of backup, high availability, and fail-over type solutions. I consider virtualization a method of fail-over.

The biggest concern I frequently hear about Exchange is performance (after complexity - I would disagree on that one). Well, the performance difference between virtual and physical environments (at least VMware ESx, haven't seen performance benchmarks of Hyper-V) is a lot closer than one would expect when properly configured (I don't want to hear about the single SATA hard drive configuration you are running with 1GB of ram). I'll summarize the technical details of a performance test of Exchange 2003, VMware ESx 3.0 on fibre channel on Dell/EMC hardware (all 32 bit, 2GB of memory only). URL for the report is here in PDF.

Close Ball-Game
1) a single virtual CPU could obtain 76% performance of a physical CPU (clocked at 1300 heavy user profiles with acceptable performance using LoadSim, Microsoft's Outlook/Exchange testing tool)
2) 2 virtual CPUs could obtain 71% performance of a 2 physical CPU solution (support for up to 2200 heavy user profiles)
3) CPU Utilization - 30% difference in utilization, but not an issue. Exchange is not a heavy CPU user. More important to focus on I/O and memory.
4) VMware's memory sharing technology did not show any performance degradation.

One of the biggest surprises for me was the VMware memory sharing technology had no effect. I'll be taking a closer look at this in other benchmarks and personal testing since it's hard to believe that there was no difference. Just to re-cap the memory sharing technology, if you run 4 virtual machines (aka vm) with Windows 2003 Server, you're running many of the same services (e.g. netlogon.exe, explorer.exe, etc) which consume the same memory, so VMware does a "single instance" type memory sharing between all 4 vm's.

To summarize, if you have the I/O capabilities and want to improve your business continuity solutions, I would consider looking into this further. I wouldn't just count this out. And I plan to run my Exchange Server in ESx very soon. Hope to see you there...

-Ben

Serious DNS Vulnerability (Kaminsky) Can Affect Email Services

2008-08-11T09:03:00.004-04:00

Hello All,

This is the beginning of shorter posts, but more often.

This recently released serious DNS vulnerability (found by Kaminsky) can affect email services, so while hackers are spoofing DNS for web site attacks, the same could be done for email attacks. See the US-Cert for an overview of the issue. This effects dozens of DNS implementations including Windows DNS.

Official US-Cert Posting on the DNS Vulnerability
http://www.kb.cert.org/vuls/id/800113

An Illustrated Guide to the Problem
http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html

There is some discussions about what the best approach is to fix it (e.g. DNSSEC, increase Query ID, randomize the source port, IPv6, SSL, etc). So, it at the moment, the easiest fix is increase the query ID and randomize the source port. For your servers, use (at least for Windows Server DNS), the root based hints included in the operating system. "Man in the middle" attacks are a lot more common and dangerous than people realize, hence why I prefer using my EVDO card than some random WiFi hotspot. Stay safe.

-Ben

When is 64 bit not really 64 bit?

2008-07-22T08:22:00.004-04:00

Hello Everyone,

My journey, and I can call it that, for deploying a test environment (running multiple OSes, 32 & 64 bit OSes) based on VMware ESx 3.5 has taken a LOT longer than I expected and has taught me a thing or two about 64 bit. This also explains the bigger problem affecting the uptake of "64 bit" products and how with an idea if adopted can hopefully help dramatically increase admins buying into "64 bit".

There is a lot of talk about 64 bit applications, 64 bit operating systems, 64 bit hardware and all the wonderful things it brings. Well, that might be true, but the current software & hardware state of affairs is that 64 bit is not really 64 bit and can cause a lot of headaches, delays, and stress. Most vendors do not seem to be ready for it. Many "64 bit" applications are coded to run using an emulator (WoW64) for insuring "64 bit" compatibility, a software package might have some 64 bit apps but not all, lack of what level of 64 bit hardware is required, and others. Why? My guess is lack of clear standards and documentation. There is an answer though! 64 bit needs an easy to understand marketing association that can help insure end users that when something says 64 bit, it really is. Something similar to the hugely success compatibility standard called Wi-Fi (aka 802.11b). When someone bought a Wi-Fi card by one manufacturer and an access point by another, there was no doubt it would work. Why? The Wi-FI Alliance tested for compatibility and worked with vendors to insure everything "just worked". This is what we need for "64 bit" if we think it's going to take off. Otherwise, everyone will stick with "32 bit" until it simply does not exist anymore and based on that, that will be a long time. So, Microsoft, Intel, AMD, IBM, etc need to create a 64-bit alliance or call the Wi-Fi Alliance for some marketing assistance. Let's call it "64 bit-Tested for Performance" and a check-mark. Plaster that logo on everything that is fully 64 bit developed & supports Intel's VT or AMD-V.

Now, back to my story about my journey of ESx starting around January 2008 with no end in sight yet. The first step for VMware ESx 3.5 or Hyper-V 1.0 is a foundation based on a quality server. I considered a generic box, but realized, that ESx has a compatibility list (aka Systems Guide http://www.vmware.com/pdf/vi35_systems_guide.pdf) for servers due to the drivers since it installs on bare metal (no Windows here folks). So I strongly strongly recommend you read that to insure the server, cpu, and RAID card are all compatible. Hyper-V's requirements are a lot easier since if Windows 2008 installs and it support Intel VT or AMD-V, you *should* be good to go. I've included below all the CPUs that support virtualization.

On to my VMware sage. The first server hardware I attempted to use was an IBM x346. I purchased all the components (e.g. dual core CPUs, 16GB of ram, 6 x Fijitsu U320 300GB 10k HDs) and was ready to start the process. To make a long story short and summarize, the IBM server I was using does not like end users using non-IBM hard drives and a serious bug causing HDs to go offline which affected an entire line of RAID controllers card which prevented the use of the server. I did quite a bit of research and in the end the only answer I found was to replace the HDs with same Fujitsu model # HDs but IBM branded for $1300/each (about $1k more than I paid per drive) or use other IBM branded HDs. Another major flaw in the design of the IBM branded RAID card 7k is the need to boot an IBM RAID CD to gain access to almost any functionality (put a HD back online, replace it, config change, etc). This is horrible and slow process compared to Adaptec, Dell, or HP cards where you simply enter into the card BIOS by pushing a key combination and you make all your changes there. I was not impressed with my first foray with an IBM server. So, I will not be upset if it's my last. Goodbye IBM Servers.

Further reading on my battle with the IBM x346 Server.
To read the issue in more detail, check this out. I'm Benx346 if you're in doubt.
http://www.ibm.com/developerworks/forums/thread.jspa?threadID=207574&tstart=0
A "friend" suggested that I try and replace the IBM RAID card with an Adaptec (on VMware compatibilty list) and then connect the new RAID card to the backplane connector with my replacement SCSI cable. Well, a month or so later and trying to get SCSI cabling companies to custom manufacturer a SCSI cable simply isn't possible unless I plan to buy 1000 units. Feel free to look at the rare SCSI connector (micro centronics 80 female SCA) I was dealing with.
http://photos.serebin.com/gallery2/v/ben/temp/ibmx346-cable
Content Alert: anyone who can find me an 18" micro centronics 80 female SCA to LVD high density 68 pin male with ultra 320 data speeds will get a $100 reward.

The 2nd server was a Dell PowerEdge 2850 which supports 2 x dual core 64 bit 2.8GHz CPUs, 6 x UltraSCSI 320 HDs, and 16GB of ram. The unit arrived dead on arrival. So, the vendor only had one unit since it was off lease and ended up credit-ing me back for it. Still no server after 6 months. One of the major downsides of eBay. Things frequently take longer.

3rd Server was a Dell PowerEdge 2850 from another vendor I found via eBay which arrived operational (there are many companies that work with companies giving up servers on leases). I took the 6 HDs from the IBM x346 and installed them and configured them for RAID 10. Moved over 12GB of the memory (only 6 slots versus the 8 on the IBM) and powered it up. Still good and very fast. So, I installed Windows 2003 32 bit, and it went smoothly. I then reinstalled with Windows 2003 R2 64 bit and started my 48 hour burn-in. This burn-in stresses the hard drives, CPU, & ram. The application I use is PassMark's BurnInTest (http://www.passmark.com/products/bit.htm). Make sure you buy the "Pro" version for 64 bit support. Then I started looking at upgrading the ram to 4GB chips to hit the magic 16GB of ram of which I had calculated to need. I'm not sure what caused me to look at this, but something caught my eye. It turns out ESx 3.0 & 3.5 does not support 64 bit OSes without hardware assisted virtualization (e.g. Intel's VT or AMD-V). I was shocked. I wondered why does VMware Workstation, VMware Server, Microsoft Virtual Server support 64 bit OSes without hardware assistance? The reason was performance. VMware felt performance was too big of an issue, so it was removed. But at least 64 bit was an option under those applications. To be honest, CPU performance is rarely the bottleneck for VMware Workstation/Server or Microsoft Virtual Server, it's I/O which is all hard drive based bottlenecks. So, now I'm back in search of another server. I'll probably bite the bullet and purchase a new Dell Server 2950 Series III or 2970 since I'm familiar with them. Once I start my environment, I'll definitely share it with the blog.

As per the lesson, make sure you know what is required for "64 bit" support. Is this a full 64 bit application (as opposed to a 64 bit application with 32 bit components), 64 bit operating system without 32 bit legacy support, or need for what I refer to as v2 of 64 bit CPU which is the CPU virtualization feature called Intel's VT or AMD-V. Or check and make sure it contains the logo of "64 bit-Tested for Performance" or I can only hope for that.

Best of luck with your "64 bit" projects,
-Ben

CPUs Support Virtualization with the Intel VT or AMD-V Feature.
Intel's Website for it as well
http://compare.intel.com/PCC/default.aspx?familyid=5&culture=en-US

Intel Quad-Core CPUs Series supporting VT
- Xeon 7300, 5400, 5300, 3000, X3200, LV

Intel Dual-Core CPUs Series supporting VT
- Xeon 7000, 5200, 3070, 3065, 3060, 3050, 3040, E3100 (fyi: not all 3000 series are supported)

AMD CPUs Series Supporting AMD-V (Virtualization)
- Opteron 1000, 2000, 8000
AMD does not have a website that I've found as easy to use.
------------------------------------------

A Solid Lie on Solid State (Hard) Drives

2008-07-04T09:40:00.009-04:00

Hello Everyone,

Happy July 4th. Quick multiple question test. A Solid State Drive includes which features?

A) Flash-based storage
B) Rugged and reliable
C) Low power consumption
D) High performance
E) Silent operation
F) Lightweight
G) All of the Above

If you answered "G", you're wrong! It turns out that low power consumption is not correct (only mistake above). SSDs actually use MORE power and so they reduce battery life on laptops compared to traditional hard drives. Many of the SSD vendors claim battery life is improved, but this is not the case. Crucial as of 7/4/08 listed the above features as benefits of SSDs. Sadly marketing cannot be trusted without independent tests. The folks at Tom's Hardware uncovered this little "lie" in an article called "The SSD Power Consumption Hoax: Flash SSDs Don't Improve Your Notebook Battery Runtime - they Reduce It". That title alone illuminates the issue, but dig into the article and testing and you see performance gains of about 10% for SSDs but battery life differences of an hour (15-20% difference)! How can that be possible? Turns out SSDs don't have an idle power mode like traditional hard drives do. So, they you're traditional hard drive is not working, it's using very little power, but not SSDs. They are always on. Whoops.

Also, the tests would have been a lot worse for SSDs if Tom's hardware had picked a 4200 or 5400 rpm drive. They used a power hungry 7200 rpm drive, and the difference was still as clear as night and day. Don't select SSDs for power savings, but for durability and speed. I was considering a Mtron SSD back in Feb 08 for performance and power reasons on my ultra-portable semi-rugged Panasonic Toughbook W5, luckily I decided against it since I wanted a 64GB SSD, and they were still too costly. Mtron does make excellent SSDs, so I would recommend folks look into them if battery life isn't an issue.

Summary of SSDs
- overall, for improved laptop performance and keeping battery life acceptable, I would stick with 7200 rpm HDs (10% performance difference)
- battery is a serious issue for SSDs (15-20% loss), right now. I suspect due to the Tom's Hardware article, this will draw attention to the issue and the next versions (6-12 months) will improve dramatically
- be aware there are 2 types of SSDs, SLC and MLC. SLC is faster and more durable. So, stick with SLC for the moment if you want to consider SSDs.

Comments and feedback is welcome...
-Ben

"Cheating" on an Exchange 2003 Hardware Upgrade

2008-06-30T23:33:00.002-04:00

Hello Everyone,

I "cheated" on an Exchange 2003 hardware upgrade I did 2 weekends ago (Fri-Sat), or that's at least how I feel since this was hands down the fastest and easiest upgrade I've ever done (and it was about 80GB of db's on an older server with direct attached storage). At the end of the weekend, I started to think maybe I should carry around one of these "things" for my clients for upgrades. I'll share what this "thing" was later in the posting. I don't want folks to think I'm pushing products. My role in the project was to insure the replacement of the Exchange Server hardware went smoothly. The client was in production 24/7 and literally the office was staffed 6 days a week. So, I was concerned originally how to insure minimal downtime.

Background on existing hardware & performance
We were upgrading from an Exchange 2003 Server that was installed with 3 hard drives in a RAID 5 hard drive configuration (direct attached storage) for the OS, transaction logs, and Exchange databases. Company had about 60 users and 30 BlackBerrys or so. 1 BES user adds a load similar to 2 Outlook users. So, total company usage was about 120 users. Performance was an issue, so some users were configured for cached mode to "improve" performance. Cached mode should not be required for LANs, unless Outlook end users are receiving "retrieving data from server". Always a bad sign to see unless you have poor network connection. Recommended another DAS server that used RAID 1 for the OS, RAID 1 for transaction logs, and RAID 10 for the Exchange databases.

The Migration for a hardware refresh
So, I checked the OS install (another admin handled that), Exchange install (using the /disasterrecovery switch for setup and service pack 2), Exchange config, and insuring the email & public folder migration completed successful. Only catch was during this server replacement, there was to be no downtime and no use of Exchange clustered services. Hmmm, that's a challenge. Or so one would think.

The Cheat
The client I was working for happened to have a 3rd party product (keeping read to find out) for Exchange that in essence allowed the "cheating". And I mean this in a very good way. It saved us a LOT of time. Meaning, we told the 3rd party product to take over all the existing Exchange services (MAPI, SMTP, OWA, IMAP, etc) and all data for the Outlook, OWA, ActiveSync, & BlackBerry was available to all users. This took a few minutes (3 or 4 minutes) on the switch-over. Meaning the appliance takes some time to take control. Once that was done, everyone was operating off the appliance and end users didn't know this besides restarting Outlook and re-authenticating to OWA (ActiveSync & BES users had a slight delay. BES users could be out of service for up to 15 minutes, but that's a limitation of BES). Once the appliance took over, we copied over the Exchange databases (.edb/.stm's) using robocopy to the new Exchange 2003 Server. We considered upgrading to 2007, but the appliance and all the associated Exchange applications would have had to been upgraded, and it wasn't cost effective (TCO reminder). So, after we started robocopy-ing, we went home.

Day 2 of the Migration & Failback
I'm not going to go into the details, but migrating took a few hours including getting the SSL certs for OWA and handling all that. Once the new hardware was setup with Exchange, it was time to bring back all the new email. As I previously said, the reason to copy over the databases to the new server, was the appliance then doesn't need to copy over all data, and just new email/data. So, this is a huge time saver. Once we copied over the databases and transaction logs, we were able to get the Exchange Server fully operational and enable the failback from the appliance. We then failed back from the appliance to the new Exchange Server. This took a lot longer to check that all data was copied from the appliance to the new Exchange Server. This took 10 hours or so and then everyone had to relaunch Outlook and re-authenticate against the new server.

Appliance Details
The "cheat" was an Exchange high availability appliance from Teneros. Even though this appliance runs 2 operating systems, Linux and Windows, the entire configuration is on 2 web pages. Meaning, the Teneros support team is really what runs this product, not the Exchange admin. As per the web interface, to say the amount of information and configuration is sparse, is putting it lightly. Overall the product worked well and we ran into 2 glitches due to permissions and resetting process of the AD name due to poor documentation. And the migration process took longer than expected since the status of synchronization is not very accurate. Not a big deal, since end users are working during the failover and failback. Overall solution is very impressive, but I have some doubts since I'm not a big fan of trusting secret functionality of a black box type solution. I like to know how applications work and I do have concerns over Exchange updates or patches breaking the Teneros functionality. If you are curious, pricing is around $10k, give or take a few thousands. If you wanted to see the demo, Teneros did present at the NY Exchange User Group meeting back in November of December of 2007 or check out their website.

There are many other software solutions on the market that do this, and so I'll blog about when I work with them. My user group has had demo's and presentation on a # of them, but this was the first real world usage of one.

Let me know your thoughts on this.

-Ben

2 Outlook Add-ons / Improving TCO for Exchange 2007

2008-06-20T00:09:00.005-04:00

Hello All,

I feel I owe an apology to my blog readers for the long period between blog posts. I've thought about my blog each time I read about a mail related topic. It's time to share my insight into Exchange and life as a ehlo tech. I've committed myself to post shorter if necessary postings, just to insure folks are kept up to date.

So, 3 things that I've wanted to share for a few months (actually a few years for one tool).

1) I personally use and recommend to all clients the best Outlook searching tool I've found for performance, ease of use, stability, and cost for Outlook 2003 (it's been around for years, and is still rock solid). The tool is called Lookout. A bit of background on the tool. The creators of this amazing tool were hired (software company was bought by Microsoft) and now this functionality has been incorporated into MSN Desktop Search. When I reviewed MDS, I still thought Lookout was better based on my 4 criteria above. It might have changed, but Lookout is pretty close to perfect. For clients, the easiest way to explain Lookout, is to refer to Lookout as Google for Outlook. Very fast and easy to use. You can download the latest version 1.30 before they closed shop to work for Microsoft via this URL. If you have any issues, drop me an email or add a comment and I'll post it since I still have a copy of both latest versions (1.30 & 1.28).

2) There has been a lot of talk about Xobni for it's built-in searching, stats functionality for Outlook usage, and handy access to recent attachment. I love the idea of stats (reporting how much email sent/received, etc), unfortunately, I don't need searching and can't afford to give up so much real estate in Outlook (it adds a side panel similar to the 3 paneled look) for very cool usage "stats" and UI change for attachments. But, let me know in the comments area any feedback on it. I'm curious. I'll probably need to fire up a virtual machine (VM) to take a look at this.

Joys of Lookout and Xobni by Windows IT Pro. (Site was done when I posted this, so I wanted to confirm no login was required for it. Not sure.)
http://windowsitpro.com/article/articleid/99326/new-add-on-changes-the-way-you-work-with-outlook.html

Xobni's Outlook 2003/2007 Tool for Improving UI, Searching, and Stats. Company's website of their FAQ URL .

3) My background in economics and accounting has always played a major role in insuring technology upgrades and improvements are cost effective. So, having said this, I was a bit surprised when I heard the UI had been changed dramatically in Exchange 2007. One feature that increased TCO was the requirement of using 2 UIs to create new users. The single ADUC (AD Users and Computers) is not adequate anymore. So, a vendor realizing the concern for companies created a single UI for AD and Exchange user creation and modifications. They also plan to add a # of very useful features. I think this is a great idea even though it's 3rd party software, especially considering they'll probably add a lot more functionality than MS would.

Product is called Exchange Tasks 2007 and is from U-BSmart. http://www.u-bsmart.com/WWW/ExchangeTasks/ExchangeTasks.html

Demo of Exchange Tasks 2007 by 3rd party (improving TCO for Exchange 2007)
http://www.msexchange.org/articles_tutorials/exchange-server-2007/management-administration/managing-exchange-2007-recipients-active-directory-users-computers-mmc-snap-in.html

Quote from MS Exchange.org about U-BSmart's Exchange 2007 Tasks

Besides what we covered here, the guys behind the Exchange 2007 Tasks utility have plans on adding features such as Export to PST, Export to Mailbox, a fully integrated Active Directory property page for valid recipient objects, the ability to handle and manage Dynamic Distribution Groups, a Hide Group Members task, the ability to handle and manage Resource Mailboxes, improved management of Unified Messaging and more to future versions of the product.

If you use any of the products above, post some comments and let me know your results.

-Ben

Microsoft's Unified Communication Solution

2008-04-11T00:02:00.006-04:00

Hello Everyone,

Our April 8th, NY Exchange User Group meeting featured Stephen Chirico, Sr. Tech. Solutions Professional presenting the details beyond the technical deployment needs of Microsoft Unified Communications (aka UC, which is Microsoft's VoIP, IM, video conferencing, and more solution).

1 word for the meeting, Wow. That's how I would sum up our last meeting and "Star Trek visits NYExUG". Also the concept of a "Communicator Call" is definitely forward thinking, see the highlights below for explanations. This meeting is one for the record books. Great topic, great hardware and software demo-ed, and fun.

It really helped in determining what was required for deployment of Microsoft's UC technology. I've listed some highlights from the slides. Stephen did 2 presentations in one (UC Vision & OCS Architecture). So, you'll see 2 PDFs posted online in addition to the sponsor's (Azaleos) presentation. I would recommend you review both in detail if you're interested in UC.

This Presentation and Past Meeting Presentations

http://meetings.nyexug.com

Highlights

Access Edge Proxy - DMZ based server that proxies all traffic. No AD or authentication done on this box unlike an Exchange Edge Server that uses ADAM or a Windows RODC.
PBX Integration Options - 1) PBX supports mediation server w/o gateway (new PBX), 2) use of an Advanced Media Gateway w/existing PBX, or 3) use of an OCS mediation server w/Basic Media Gateway w/existing PBX. Slide 16 explains this. In essence, the Advanced Media Gateway eliminates the needs for a Windows OCS Mediation Server while the other 2 options require that.
Identity and Presence - available, on call, in meeting, etc. Your status available in Office, SharePoint, Live Communicator, etc.
Communicator Call - call's an identity (not a method/location such as mobile, work, home, IM, email, etc).
MOS = Mean Opinion Scores (what a user thinks of the voice quality).
Star Trek and Microsoft's UC - We saw the Star Trekish Round Table in action. It's a 360 degree audio/video conferencing system that mere mortals can afford as opposed to other 360 degree audio/video solutions out there. See Slide 23 for what attendees saw demo-ed. Speaker is shown on video based on triangulation of voice. Very cool.

URLs to assist users with deploying Unified Communications.

Supported gateways:

http://technet.microsoft.com/en-us/library/bb123948(EXCHG.80).aspx

IP PBX and PBX Support

http://technet.microsoft.com/en-us/library/aa996831(EXCHG.80).aspx

Office Communication Server 2007 Partners:

http://www.microsoft.com/uc/partners_hardware.mspx

Microsoft Unified Communications: Phones and Devices Optimized for Microsoft Office Communicator

http://technet.microsoft.com/en-us/bb970310.aspx

Don't miss our next meeting or the following ones... here are the summaries of the upcoming meetings.

May - Microsoft's Behind the Scenes Look at Exchange Hosting Services by Keith Keeler. (fyi: they don't host Exchange). Don't miss this, I expect this to be like our Dogfood lab backup meeting.

RSVP: http://www.clicktoattend.com/invitation.aspx?code=126627

June - Technical details between 2003 & 2007 & Why Companies Upgrade. Speaker Keith McCall.

July - Presentation/Sponsor of AppAssure's Replay for Exchange. (fyi: this is a interesting solution that offers the ability to backup direct to a virtualized file format [vmdk].)

-Ben

They are back from the dead... Exchange's next version will "re-emphasis" Public Folders

2008-04-08T10:52:00.005-04:00

Hello Exchange Folks,

Microsoft reversed course and now Exchange's Public Folders will stay a major component in Exchange Server. This is good news for all. I was a bit worried about the loss of such and the removal of the GUI for Public Folders management in Exchange 2007. Microsoft fixed this in SP1, adding such functionality. Now, Microsoft outlined the following at the URL below... (fyi: this is the Exchange team blog, and has a wealth of great information).

http://msexchangeteam.com/archive/2008/03/31/448537.aspx

Scenario
Use Public Folders Currently?
Document Sharing - SharePoint may be better option.
Calendar Sharing - No need to move
Contact Sharing - No need to move
Discussion Forums - No need to move
Distribution Group Archive - No need to move
Custom Applications - SharePoint may be better option
Organizational Forms - No need to move (or look into use of InfoPath)

From my experience, Public Folders are most frequently used at companies for Calendar Sharing, Contact Sharing, and Distribution Group Archive. So, the need to add SharePoint with it's entire line of support applications (e.g. backup agents [that's plural for SQL and SharePoint], anti-virus, server(s), is a great thing for everyone. Exchange is a great product, so obviously removing and then trying to convince existing users to add more products (e.g. SharePoint) and increase TCO (total cost of ownership) to have the same functionality was a bad idea. Thank you Microsoft for seeing this and making sure Public Folders stayed in Exchange Server.

-Ben

My "Enterprise Class" Home Theater Media Center

2008-03-15T00:25:00.008-04:00

At the last NY Exchange User Group meeting (March 2008 - StealthBITS Exchange auditing software), the topic of DVRs came up before the meeting. Not sure how, but it did. So, I figured I would share how I built the ultimate DVR for me. And this ain't your run of the mill DVR (e.g. cable company, TiVo, Replay, etc). This IS art to me. See the in construction HTPC photos.

The home theater media center (aka home theater pc, htpc) journey started about one and a half years ago, back in August 2006. A buddy of mine dropped me an email and literally told me he was building a "media center PC" due to a Maximum PC article and wanted to know if I was interested. Little did I know when I responded and told him "Cool. Until they can record HD off cable, I'm not building. I'd love to see yours." Well, I've learned quite a lot since then, and that the holy grail is not HD, but commercial skip and portability (think iPod/streaming/burning).

The journey, and it was one since it took over a year from start to finish involved determining what media center software to run, what hardware, and managing the whole process. So, we quickly determined that the media center software was going to be SnapStream's BeyondTV which is probably the most feature complete (e.g. multiple tuners, commercial skip, multi-format support on record [MPEG2, DIVX, WMV, H.264], no monthly fees [sorry TiVo], burn shows/films to DVDs, download them) and stable solution (runs on Windows and works - sorry MythTV) on the market.

The bigger and more complicated process was selecting what hardware to run this on. We quickly determined this could not be a standard PC (e.g. Dell, HP, laptop, etc) due to noise levels, looks, and functionality. We wanted more than those could provide. So, we quickly realized we must build a custom PC. This was something, I gave up in 2000 due to time constraints and deciding that once multi-processor computers were widely available, I'd be willing to accept an OEM one (fyi: main stream desktop OEMs started providing SMP support back in 2000). But, not on this. This HTPC was going to be in my living room so it was going to be very visible and so it needed to be unique and eye-catching. This was going to be our art work center piece.

So, before we could select the exterior case, we had to figure out which "heart" was going to run this. This was the most critical piece of the entire project, since a motherboard which is not stable or has not been sufficiently tested with hardware for compatibility, can easily derail a stable environment (e.g. lockups, hangs, reboots, etc). So, we spent months reading, discussing, and evaluating which motherboard to go with. In the end we decided on a Asus P5B Deluxe w/o WiFi motherboard. This was going to be the heart of our future HTPC.

Realizing that "just" selecting the motherboard was very difficult and time consuming, I realized we were going to need some help maintaining and managing this entire project. So, we quickly embraced and started using Google Docs (Spreadsheets). It's a great free web based collaboration tool. This made keeping track of parts #'s, comments, URLs, notes, etc a whole lot easier than the original back and forth email and phone calls.

Once we had selected the motherboard, we spent a few months repeating this process for the case (roomy for all the components and works with the motherboard), hard drives (they had to be quiet, fast, and reliable), the video card (had to be passive, no fans on this one), and the CPU heat sink (quiet and efficient). The rest of the components were figured out in a matter of mere weeks. I know, sometimes one of my flaws is I'm too thorough and detail oriented. My buddy didn't help me on that since there were times he was performing calculations on sizing of the CPU heat sink and case.

In the end, I purchased the following hardware components:
1 x Asus P5B Deluxe w/o WiFi, Intel LGA775
1 x Zalman HD160XT HTPC Enclosure with 7" LCD Touchscreen LCD
1 x XFX GeForce 7600GS 256MB DDR2 PCI-E GPU (PV-T73P-UMH4) RoHS, HDTV ready, HDCP Ready, SLI ready, Vista ready
2 x Samsung HD080HJ, 80GB, SATA, 8MB - 8.9ms, 2.5/2.9bel
2 x SAMSUNG SpinPoint T Series HD501LJ 500GB 7200 RPM 16MB SATA 3.0Gb/s Hard Drive
1 x Pioneer DVR-112D IDE, 18x DVD+R, 10x DVD+DL
1 x Processor, Core 2 Duo E6550 2.33GHz, 4MB L2 Cache, 1333MHz FSB
1 x Artic Cooling Freezer 7 Pro for All Pentium D
1 x OCZ OCZ2G8002GK 2GB Kit DDR2-800 PC2-6400 Gold Gamer eXtreme XTC Edition Dual Channel Memory
1 x Antec NeoHE 500W Power Supply
1 x SnapStream Beyond TV PCI Bundle (Digital)
1 x 3ware 8006-2LP SATA RAID Card
1 x Hauppauge PVR-500 for 2 tuner support (Ben only). Card supports 2 inputs. My buddy purchased the PVR-150.
1 x Adesso WKB-4000US, wireless SlimTouch Mini 2.4GHz USB Touchpad Keyboard (Ben only)
1 x APC 1500VA UPS (Ben only)

So, after waiting 2-3 weeks and getting all the equipment, we started the process to unpack and build one HTPC. The reasoning behind building one at a time, was to see what issues we might run into, and to limit the confusion of having duplicate items out. Our first issue was getting the CPU (w/ brand new 1333 FSB support) working on the motherboard (Asus P5B Deluxe). The motherboard had a sticker claiming support of 1333 FSB, but this took a few hours of upgrading the BIOS firmware 2 or 3 versions later and doing this only via a USB memory stick (we didn't have a floppy drive of course - make sure all servers you buy have a floppy drive). The next issue was getting the BIOS configured in the correct RAID configuration. The RAID configuration we wanted to run was two RAID 1 configuration. One RAID 1 for the operating system and one RAID 1 for the media files. Who wants to lose their TV shows/movies or all that configuration? This is a mission critical application like Exchange, hence the need for redundancy. ;-) More on that later. So, we ran into a problem that the motherboard only supported 1 array (this took hours to figure it out since you needed to plug the SATA HDs into different ports on the motherboard to get the RAID array working versus standard SATA ports, the technical writers for the documentation first language is probably not English, and none of the folks we read using this motherboard on the internet were running/writing about 2 arrays difficulties). So, you could not configure 2 separate arrays of RAID 1, but a single RAID 1 array. This would have meant combining our OS and media drives, which was unacceptable. So, we ended up purchasing the 3ware SATA RAID card above. This obviously delayed the HTPC build by another week. Once we had this, we configured all 4 HDs off the RAID card to two separate RAID 1 arrays.

After this, we connected the motherboard up and connected all the cables for the Zalman case. This turned out to be an issue, since when we installed Windows XP Pro w/SP2 (pre-applied), the SD/CF/Memory Stick and those ports took drive letter C and forced XP to install the boot onto drive letter D. So, back to powering off and disconnected those ports and then another re-install. Once this was done we shutdown all the extra services and tweaked it for speed. This HTPC will not get Windows Updates, anti-virus, or any firewall above the XP one. Speed and stability are too important for this. Hence the importance of running a locked down XP for the HTPC.

One would think we are done, but we still had a full day of work ahead of us. I had bought special heat resistant tubing (www.wirecare.com, F6 - self wrapping braided sleeving) for the best cabling job one could do. Cabling is very important when designing an ultra quiet PC. So, we spent about 7 hours dedicated to just cabling the inside of one of the HTPC's. A bit excessive, but it's a master piece in increasing airflow which reduces fan noise. Keep in mind, this is for the living room, so you don't want to hear it at all.

Current Configuration
HTPC is connected via HDMI (audio + video on this single cable) to a Sony Bravia 40" LCD.
Switched from RF Firefly remote for BeyondTV control to an IR Firefly remote (Firefly is the BeyondTV remote). Using an IR remote for the Sony TV.
7" touchscreen LCD on Zalman is used for performance monitoring and photo showing.

Planned Upgrade
Convert both IR remotes (TV & BeyondTV) to a single unified Logitech Harmony One Universal Remote
Connect second cable box connect to second TV tuner card already installed.

Redundancy and Data Protection on the HTPC
One would think two RAID 1 arrays for the operating system and media files would be sufficient, but not in Ben's book. So, I run Symantec Ghost 12 (image the entire OS volume) before any major configuration changes (e.g. software changes, version updates, hardware additions, etc). I run a Ghost Server on my home network which makes it easy for backups and have prepared the boot CD in case of the need for a bare metal restore. And I have already prepared (slip streamed) the Ghost boot CD for the RAID and motherboard drivers for the HTPC.

So, in the end, we spent about 1 1/2 years from brain storming in the beginning to completed product. During this time, about 3 or 4 full days (7-12 hrs) over a period of about a month building the base configuration of the hardware and getting Windows installed. It was weeks longer to get all the software (e.g. BeyondTV, video card, remote software, etc) and hardware configured correctly. As of Fall of 2007, the HTPC has been fully operational, and it's a pleasure to look at it and use it (even my wife uses it, it's that easy). Will I get my money's worth out of subscription fees, no, but sometimes in life folks work on something because they love it. This is what I love.... computers, technology, and increased productivity.

Any questions, drop me an email.

-Ben

My Research into dimmable compact fluorescent lights

2008-03-05T19:41:00.004-05:00

Hello All,

I figured I would share this with everyone. I spent a few hours over a few weeks researching compact fluorescent lights (CFLs) that are dimmable (versus standard on/off CFLs). And in the end, I've decided not to purchase or recommend dimmable CFLs yet. The best dimmable solution I found was from TCP though.

There are 2 major issues with the current dimmable CFL technology. First is only mechanical dimmers (e.g. sliders with a switch, or slider which clicks when power is off) are supported. Meaning, electronic (e.g. touchpad's, LEDs, etc) will cause pre-mature* failure since most electronic dimmers always have a small amount of electricity flowing to the bulb. This causes the ballast (analogy is the engine of a car) to cycle on and off rapidly constantly which is very bad for the longevity of ballast. And the mechanical dimmers are fine if you can configure them to cut-off all electricity to the CFL at 20% power. Power of 0-20% is bad for a ballast similar to the way a electronic dimmer is. It causes it to experience that on-off problem as well. So, if you ever see any flickering on a CFL, that's a bad sign. The second issue is some dimmable CFLs need to be used in non-enclosed fixtures due to heat generation. In other words, open lamps, sconces, etc. And the CFLs that can be used in closed fixtures tend to be significantly longer (up to 2" for a 23 watt CF dimmable) than dimmable CFLs & even traditional incandescent light bulbs. Due to these issues, I've decided to re-visit this towards the end of the year. Planned fixes within about a year according to the tech at TCP was addressing the 0-20% issue for mechanical dimmers, low voltage for electronic dimmers even in off position, and reduced size.

* I spoke with a technician (customer service rep was not helpful since I knew more about the products then she did) at one of the major lighting manufacturers (TCP) and he amused me with the term "pre-mature" failure. He explained that dimmers w/o 20% cut-off would cause the ballast to go into that on/off mode when within 0-20% and result in a failure sooner than normal. The ballast would just fail (versus a lamp failure). Which would be a problem especially since the TCP 161 Series is probably going to be discontinued since it has not sold well (it's 25% more costly than the 101 series). So, there will be a point in the future you will not be able to buy either the ballast or the lamp.

Good website for dimmable CF bulbs (they also talk about 3 way, and more)

http://www.edf.org/page.cfm?tagID=633&fixture=0&shape=0&feature1=1&brightness=0&color=0

Considered the following before deciding not to proceed with the replacements.

TCP, 161 Series - enclosed fixtures

2 piece dimmable SpringLamp

Item # 16120L - 20 watt, 6.1"

Replacement Lamp - 36020

$19.30 http://www.lightbulbemporium.com/proddetail.asp?prod=TCP16120L

TCP 101, SpringLamp CF - open fixtures

# 10120 - 20 watt, 5.28"

# 10123 - 23 watt, 5.4"

20-100%

$14.90 - http://www.lightbulbemporium.com/proddetail.asp?prod=TCP10120

-Ben

Attended the NYC Launch Event for Windows Server 2008

2008-03-05T12:19:00.004-05:00

Hello All,

I attended the NYC Launch Event for Windows Server 2008 and while it was interesting (RemoteApp & beta look of Hyper-V), the venue really brought down the entire experience due to organization and layout. Some examples were finding different things (e.g. user group areas, hands on demo, etc) and making my way through the vendor areas. Microsoft should realize this is not the venue to use in the future. Also, the NFR software provided was a let-down. The only real piece of software provided that was non-crippled was Vista Ultimate w/SP1 & Visual Studio 2008 (I'm not a dev, so this isn't very useful to me). Nice, but we all received Vista a year ago or so at the Vista Launch. Oops. :-) So, a copy of Windows 2008 Server was expected. I'll be donating the NFR software to the user group at our upcoming meeting. On that note....

Our upcoming meeting for Tue, March 11 is a vendor presented Exchange auditing solution by StealthBITS. Keep track of Exchange Server changes via this solution. They are also sponsoring the meeting. Another major announcement for the meeting is my company donated an Xbox 360 Arcade System (includes 5 games) to be raffle off. So, you don't want to miss this meeting. Visit www.nyexug.com to RSVP to the meeting.

-Ben

Performance Testing your Disk Subsystem for Exchange

2008-02-07T00:17:00.000-05:00

Hello All,

So, I've spent some time (a few months) researching a major upgrade to provide a client higher performance for Exchange, near real time disaster recovery, and ability to quickly restore large Exchange databases (50-100GB). I just want to touch on the higher performance aspect of my research.

One of the major issues with Exchange 2003, is when users have large mailboxes (think 5-15GB (yes, GB) mailboxes, and they attempt to sort a column in Outlook that has thousands of items, Exchange has to work very hard to accommodate this request. This will stress an Exchange subsystem to handle this. So, in my quest to recommend a higher performing disk subsystem (they were using direct attached storage [aka SCSI], I proposed a scaled storage area network solution). So, one of my first tasks to determine how to get the best performance out of the SAN will be to use the following 2 Microsoft tools for performance testing of Exchange when I attempt to configure the SAN disk subsystem for RAID 1, 5, and 10. Also, these tools can highlight network related issues, so make sure to examine your networking especially if you are running on a SAN (e.g. MPIO, jumbo frames, teaming, etc). These can make a very big difference in performance as well.

1) Microsoft Exchange Server Jetstress
http://technet.microsoft.com/en-us/library/bb643093.aspx
*** Summary ***Microsoft Exchange Server is a disk-intensive application that requires a fast, reliable disk subsystem to function correctly. Jetstress is a tool that helps administrators verify the performance and stability of the disk subsystem before putting their Exchange server in a production environment.

Jetstress works with Exchange Server Database Storage Engine to simulate the Exchange database and log disk I/O load. If you run Jetstress and have missing libraries, you will receive a message that states that you must copy any missing DLL files from Exchange 2000/2003/2007 installation CD/DVDs to the Jetstress installation directory and rerun Jetstress.

2) Microsoft Exchange LoadSim

http://technet.microsoft.com/en-us/library/aa996207.aspx#LoadSimulator2003

*** Summary ***
Use Microsoft Exchange Server 2003 Load Simulator (LoadSim) as a benchmarking tool to simulate the performance load of MAPI clients. LoadSim allows you to test how a server running Exchange 2003 responds to e-mail loads. To simulate the delivery of these messaging requests, you run LoadSim tests on client computers. These tests send multiple messaging requests to the Exchange server, thereby causing a mail load. LoadSim is a useful tool for administrators who are sizing servers and validating a deployment plan. Specifically, LoadSim helps you determine if each of your servers can handle the load to which they are intended to carry. Another use for LoadSim is to help validate the overall solution.

-Ben

Upcoming Meeting for NY Exchange User Group

2008-01-28T20:17:00.001-05:00

I am looking forward to this meeting, since I had the opportunity to test out Good Technology's wireless sync solution, and found it very impressive and better than my BlackBerry in a number of ways except for the hardware's battery life it ran on (Palm Centro). This caused me to abandon the use of it since my BlackBerry can go 3-4 days without a recharge, while my Centro w/Good could barely go a day. So, I'm back to using ActiveSync and a BlackBerry. Here is information regarding the upcoming meeting.

I'll also post a TechEd presentation that compared all 3 solutions as well (Good, BlackBerry, ActiveSync) in the next day or so.

Tuesday, February 12, 2007 Meeting Topics
Doors Open 6pm
Meeting Begins 6:30pm

Visit www.nyexug.com for more information.

Partner Sponsor is The Never Fail Group
Meeting Sponsored by Motorola's Good Technology Group

Presentation Topics
1) Good Technology will be presenting Good Technology's PDA wireless synchronization solution compared to Research In Motion's Blackberry Exchange Server & Microsoft's ActiveSync. See how one of the upstarts has one of the most feature complete solutions behind BlackBerry and ActiveSync. Speaker is Scott Davenport.

Folks attending will be able to win a various raffle items including Microsoft software. Free food, and open to all simply by RSVPing. We'll also run a LiveMeeting session for folks who cannot attend the meeting at the NY Microsoft office

IMPORTANT RSVP DETAILS
Visit www.nyexug.com for details.

Thoughts on Upcoming Presentations at NY Exchange User Group Meeting (Tue 1/8)

2008-01-08T00:11:00.000-05:00

Vendor Thoughts
The NY Exchange (Server) User Group (nyexug.com) is having a vendor presentation meeting by The NeverFail Group on Tue Jan 8, 2008 at 6pm start. I'm curious to see how NeverFail's solution handles Blackberry Exchange Server (aka BES) replication since there is a "license key" (aka SRP) that is not allowed to be released on the internet via more than 1 BES server (if it does, it disables both until you contact RIM & ask for forgiveness). So, we'll see how that works & I'll post back. This meeting follows a few other replication solutions we have recently seen at the public monthly meetings for NYExUG (e.g. DoubleTake [software], Teneros [hardware], & Asempra [hardware]). This unintentional focus on replication definitely has allowed members to be more informed and know what to look for in an Exchange replication solution. I know some folks might not classify the Asempra BCS solution as replication, but it has the capability to replace such, so I figured I would classify under that.

My Presentation
I'll be presenting on "Tips to fix Exchange 2003 database problems". This will be a case study on the steps used to solve a serious Exchange database corruption problem that a law firm experienced. It affected the entire company until it was resolved, so there was a lot of pressure to resolve it as quickly as possible with minimal downtime.

First Hand Feedback of ActiveSync, Blackberry, and Good Wireless Syncing

2008-01-06T21:36:00.000-05:00

I'm a heavy email user. Maybe heavy isn't accurate, excessive/addicted email user/admin. So, I'm always looking for the best client side PDA email solution for my needs (since Outlook is on my desktop and laptop).

Digress
I digress for 1 paragraph.... on the PDA side of things, my 1st PDA (Kyocera 6035) was Palm OS based and the concept of replacing/upgrading a PDA/phone and simply syncing it and watching all the contacts re-appear was such a great idea, I swore never to go back to a "simple" phone (e.g. Razor, etc). My current (as of Jan '08) phone is still based on Palm OS (I don't need to get into the religious wars on why now), but I recently upgraded from the Palm 700p to Palm Centro). If you're wondering why, the hardware & software is the same, it's the form factor. Oh, back to the point of the post.

Intro to syncing
When I first started using the Palm OS, Palm (technically a 3rd party) had licensed the ActiveSync functionality to allow syncing of one's calendar, contacts, and email to an Exchange Server. So, I tested that out, and it was fine until I started running into other problems when one adds SSL and make sure other security enhancements to IIS. This broke ActiveSync, and after spending many hours troubleshooting it, I resolved it. But, in the past few years, every so often an IIS update or other weirdness just happens and I need to troubleshoot what's broken (delete my IIS config and reload it [what a pain]). The other thing I didn't like was typing was too slow on the Palm hardware. On Research in Motion's side, the Blackberry (aka BB), I can touch type and type faster on my BB than many folks on a standard computer keyboard. In other words, the keyboard is excellent on the BB. It's simple designed for typing emails. My first jump onto the BB ship was the Blackberry 6750. Excellent BB, even though it's a bit tall, allows for a lot of email to show. I know it's B&W, but who cares when it's email (I have a color BB 7250 now, I don't need any donations ;-). Then about 3 months ago (Oct or so) I had the opportunity to test out Motorola's Good Technology. I've know about Good and have heard it's the most feature complete out of the BIG 3. I refer to those as Microsoft ActiveSync, RIM's Blackberry Exchange Server (aka BES), and Motorola's Good Technology's Mobile Messaging (aka GMM).

Testing out GMM (Good's Mobile wireless sync solution)
Most folks would probably watch a flash demo and read the product datasheet. I decided it was worth the time to see if I could combine all my needs on 1 device, my Palm Centro running the Palm OS and replace my Blackberry (FYI: Palm hardware can run Palm OS or Windows Mobile OS. Palm is now a hardware vendor. It's confusing, I know). Many folks are amazed I carry 2 devices, then again they probably think about productivity & efficiency like I do. So, I fired up VMware Workstation on my test computer and powered on an available Windows 2003 Server OS and started the install of GMM (there were a # of steps in between, such a VPN site a site to site link so I could connect to my Exchange Server at the colo facility it's housed in and test to insure the latency was low enough, it all passed). Then I started testing GMM on my Centro. The GMM functionality is impressive but you need to use the Good applications which are loaded on the handheld (Pro & Con) wirelessly of course. They run a bit slower (e.g. switching between views, opening, closing, etc) than the built-in ones (e.g. calendar, contacts, etc), but have features that BES & ActiveSync 5 with an Exchange 2003 server don't (e.g. flagging, searching, etc). I was very impressed with GMM except for the fact the hardware's battery usage on EVDO (on Sprint) can barely handle a day of usage & password protected units take about 2 seconds to unlock (not sure why it's so slow, but that's AFTER you enter the password and click OK). So, after almost a whole day of syncing (I receive about 150 messages and send about 100 messages a day), battery life was almost dead on a new fully charge Centro. Based on that usage, the battery life was a serious issues. So much, I had to give up the Good functionality and returned to the basic ActiveSync on my Palm for quick reviewing of email on weekends when I might step out without my Blackberry.

Summary
- the GMM is an excellent synchronization solution for devices & users usage that can handle the always on network needs. I would consider it the most feature complete solution among the big 3.
- Good has better documentation than Microsoft & RIM on implementation (it's so detailed they explain how to uninstall and remove GMM, impressive)
- RIM's Blackberry hardware is a generation ahead of Palm & Windows hardware for battery usage on always on email
- RIM's Blackberry hardware allows for the fastest typing and I would consider it the gold standard for email synchronization
- ActiveSync is a good solution for low usage and companies not willing to pay for additional functionality besides the basic email, calendar, contacts, etc sync (e.g. more support, functionality, logging, etc).
- Good's sync is partnered with Palm & Windows Mobile hardware, which is a strength & weakness as I explained above. Good previously had RIM similar hardware, not sure when they stopped offering it.

My Final Thoughts
GMM is excellent, the probably is the hardware. So, if and when a hardware solution is smaller than a Blackberry with full keyboard and offer similar or battery battery life, I'll consider returning. Until then, I'll be waiting since I'm not a big fan of the current Mobile devices. I consider them too large or with keyboards that simply don't match those of the efficiency of RIM's Blackberrys.

Here is a photo comparison of my wife's Blackberry Pearl and my Palm Centro. I had originally hoped this Centro would be the sole device I carry. No thanks, I'll happily carry both (Centro & BB).

Ever wondering what happened with an Exchange Server database corruption?

2008-01-06T13:20:00.000-05:00

I presented this blog entry (ways to solve Exchange database corruption) at the upcoming NY Exchange User Group meeting on Tuesday, 1/8/08 at 6pm (see www.nyexug.com for more info).

Symptoms
Since I work with numerous clients and every client of mine uses an Exchange Server (in-house or hosted), I see a lot of things relating to Exchange most typical IT techs do not see. So, about a month ago, a client's Exchange 2003 Server starting showing signs of being non-responsive. The server would take an hour or so to boot-up if it did, and then when it did, logging in remotely was extremely difficult (it would hang after user/pwd login, or extremely slow refresh periods) via RDP (aka MS Terminal Services). My first thought was hard disk failure or other disk related problem. It was running on a RAID 1 setup with SAS 15k drives but those showed no signs of issues.

Found Issue
After reviewing the Event Logs, I saw reports of disk non-responsiveness. So, I checked the Dell OpenManage status for the disk subsystem, and it reported everything as fine. So, nothing there. I then performed a basic search with last modified date to last day, and reviewed all the recently modified files. Everything looked good until I saw that the 20 person's company's Public Folder Store had grown to 12GB from about 114MB. Yes, 114MB to 12GB! Information Store database files looked fine. So, I started reviewing the backup logs and noticed the Public Folder Store database was growing hundreds of MBs a day. Something was out of definitely wrong with it.

Approaches to Solve Corruption Problem
Before you do anything. Dismount the database in question. Then shutdown the Information Store service and copy the .edb & .stm to another hard drive or at a minimum to another folder. Then attempt to use the Microsoft's utility of Eseutil. Eseutil is a dangerous tool, so please make sure you thoroughly read the documentation & before a backup before proceeding. Sometimes, you can't make a simply copy/paste of the database. If so, you don't have much choice, but to proceed. As I warned above, you could lose data performing this. And only run if your databases are experiencing problems.

Commands to run from your bin directory and pointing to your databases.
"eseutil /g" - Integrity check in read only mode.
"eseutil /k" - Checksum check for header damage.
"eseutil /p" – Repairs table and page. Perform isinteg next.
"eseutil /d" - defrags db's and reduce the size based on empty space. You can safely run this if you dismount the databases.
"isinteg -s emailsrv -fix -test alltests" - emailsrv = name of server. Used to test and insure all corruption is solved.

After I ran these commands, the Public Folder store was reduced to 114MB and the server was responsive again.

Resources to Review Before Proceeding
MS Exchange Team Blog about database fixing with eseutil
http://msexchangeteam.com/archive/2004/06/18/159413.aspx

MS Support - Ramifications of running the eseutil /p or edbutil /d /r command in Exchange
http://support.microsoft.com/kb/259851

MS Exchange.org - isinteg & eseutil demo-ed
http://msexchange.org/tutorials/Exchange-ISINTEG-ESEUTIL.html

MS Support - eseutil checksum feature
http://support.microsoft.com/default.aspx?scid=kb;en-us;823167

MS Support - eseutil file header damage
http://support.microsoft.com/default.aspx?scid=kb;en-us;825088

MS Exchange Team Blog on 2007 SP1 Changes for ESE
http://msexchangeteam.com/archive/2007/11/30/447640.aspx

A warm helo & ehlo to everyone...

2007-12-26T23:30:00.000-05:00

On my first blog posting.... I realize, most people do not know what "helo" and "ehlo" mean. So picking a blog name with this might not be the smartest marketing idea, but I'm not so concerned with that (more important to educate folks at least a little bit). So, Without either term (helo & ehlo), email would not work as it does. Meaning, no email would be sent or received. So, maybe you should read the next paragraph to under a bit more.

All email servers communicate using either term (technically, this is how the initiating server starts communicating with another mail server). "helo" is the term for saying hello to another server when the initiating server is not very sophisticated and just wants to perform a basic email send communication. More sophisticated servers that support more features (aka extensions) and wish to use them (e.g. security, reliability, speed, etc), start off with "ehlo", also meaning hello, but also "tell me what commands" you support. This allows the other server to know, that this server can support x feature and will respond to handle it and perform the email communication in the enhanced manner.

So, of course my favorite email server, Microsoft Exchange Server (2003 currently) supports this feature & so does my favorite email gateway server (IceWarp's Merak Mail Server v.8.x). Unfortunately, some folks use firewalls to block (aka proxy) smtp commands, which can slow down email flow and prevent the use of ehlo. So, I recommend disabling such smtp firewall features (e.g. Cisco's fixup protocol) since this is a false sense of security and slows down communication. I've also had not heard of a security risk for smtp or other used commands on Exchange & Merak. So, this is not a real risk in my book (I tend to error on the side of security, so if I thought it was a danger, I would not suggest it). The benefits of "ehlo" outweigh any theoretical risk. So, enough of the soap box for this blog posting. I'll step down...

So, my plans for the future: the blog will tend to focus on a number of topics since I am interested in such, email in general in relation to server-side spam filtering techniques, email security, and performance, Microsoft Exchange Server, wireless (e.g. 802.11a/b/g/n), physical security, and other technology related things I get involved with.