Exchange Server Pro » Exchange 2003-2010 Transition

Export an Exchange Server 2010 Certificate to Exchange 2003

Paul Cunningham — Thu, 27 May 2010 09:00:48 +0000

During an Exchange 2003 to 2010 transition a legacy namespace is configured for users who are connecting to Exchange 2003 mailboxes. The Exchange Server 2010 SSL certificate includes the legacy name in its Subject Alternative Name (SAN) field, but this certificate then needs to also be installed on the Exchange 2003 server.

Export the Certificate from Exchange Server 2010

To export the certificate from Exchange Server 2010 launch the Exchange Management Shell and run the following commands.

First determine the thumbprint of the SAN certificate that is installed.

Get-ExchangeCertificate

Thumbprint                                Services   Subject
----------                                --------   -------
E8D129180C1334D50DBE17A26795BEE0A0AEA9B3  ...WS.     CN=mail.contoso.local, OU=IT Dept, O=Contoso Pty Ltd, L=Brisban...
C5C2B0F04397D1C2C2C9834C48B268EA53F835B4  IP..S.     CN=ex2010

In this example the thumbprint is “E8D129180C1334D50DBE17A26795BEE0A0AEA9B3”.

Next export the certificate to a file by running the following command.

$file = Export-ExchangeCertificate -Thumbprint E8D129180C1334D50DBE17A26795BEE0A0AEA9B3 -BinaryEncoded:$true -Password (Get-Credential).password

A popup dialog appears for you to enter a password to protect the private key. The username field is not important but requires something to be entered in it for the dialog to accept, so just enter “username” and then a strong password.

Next run the following command to generate the file.

Set-Content -Path "C:\Admin\ex2010cert.pfx" -Value $file.FileData -Encoding Byte

Copy the file to the Exchange Server 2003 server.

Import the Certificate on the Exchange 2003 Server

On the Exchange 2003 server launch mmc.exe and add the Certificates snap-in to the console, choosing the “Computer account” context.

Choose Local Computer and then click Finish, Close, and OK to return to the console.

Right-click Personal and choose All Tasks –> Import. Step through the Certificate Import Wizard choosing the certificate file that was copied from the Exchange Server 2010 server.

Enter the password that you used when the certificate was exported from Exchange Server 2010.

Place the certificate in the Personal certificate store.

Complete the wizard and confirm that the import was successful.

Get more Exchange Server tips at ExchangeServerPro.com

Configure an SSL Certificate for Exchange Server 2010

Paul Cunningham — Tue, 25 May 2010 09:00:06 +0000

Exchange Server 2010 like its predecessor Exchange Server 2007 makes heavy use of SSL certificates for various communications protocols. When you install a new Exchange server is comes pre-configured with a self-signed certificate. Before putting a new server into production you should create and assign a new SSL cert for the server.

In this example an SSL cert is being configured for the contoso.local organzation.

Generate a New Exchange Server 2010 Certificate

In the Exchange Management Console navigate to Server Configuration. Right-click the server and choose New Exchange Certificate.

Enter a friendly name for the new cert. In this example I have named it “Contoso Exchange Server”.

Although wildcard certificates are supported in Exchange Server 2010 it is recommended to use a SAN (Subject Alternative Name) cert instead.

Next we can configure the names for each of the Exchange 2010 services that are secured with the SSL certificate.

First is the Outlook Web App service. Enter the internal and external names of Outlook Web App. In this example I am using “ex2010.contoso.local” for internal, and “mail.contoso.local” for external.

Next configure the ActiveSync domain name. For ease of administration and configuration I am using the same name as for Outlook Web App.

Next are the Web Services, Outlook Anywhere and Autodiscover names. Once again I am using the same name of “mail.contoso.local”. For Autodiscover the additional names of “autodiscover.contoso.local” and “autodiscover.xyzimports.local” are also configured, for each of the accepted email domains in this example organization.

The Hub Transport server also requires SSL for secure SMTP communications. In this example I am using the name “mail.contoso.local”.

A legacy name for co-existence is required if you are planning to gradually transition services and data from Exchange 2003 to Exchange 2010. Configure legacy names for each of the namespaces in the organization, in this example “legacy.contoso.local” and “legacy.xyzimports.local”.

When all of the services have been configured proceed to the next step of the New Exchange Certificate wizard.

Confirm that all of the required names have been included in the cert request. You can add any additional names at this stage before proceeding.

Next configure the organization and location information for the certificate, and choose a location to generate the request file.

When you have finished filling out the wizard click the New button to generate the cert request file.

Confirm that the request file was successfully generated.

You will notice that the wizard makes a recommendation as to the type of certificate that is required for your Exchange organization. In most cases a “Unified Communications certificate” will be necessary, which is basically another name for a SAN certificate.

Although you can issue the certificate from a private Certificate Authority it is recommended to use a commercial Certificate Authority such as Digicert.

After you have acquired the new certificate return to the Exchange Management Console, navigate to Server Configuration, right-click the server and choose Complete Pending Request.

Browse to the location of the file you downloaded from the CA and complete the wizard. Confirm that the new SSL certificate was imported successfully.

The new certificate now appears in the list of valid certificates for the server.

Assign the New Certificate to Exchange Server 2010

With the valid SSL certificate installed it is now time to assign it to the Exchange Server 2010 services. Right-click the new certificate and choose “Assign Services to Certificate”.

Choose the new Exchange server and click the Next button.

Choose the services to assign to the certificate. In this example the IIS and SMTP services are being assigned.

Complete the wizard to assign the services to the new SSL certificate. You will be prompted to overwrite the existing self-signed certificate, so choose Yes to that prompt.

Get more Exchange Server tips at ExchangeServerPro.com

How to Configure the Exchange Server 2010 Product Key

Paul Cunningham — Fri, 21 May 2010 23:00:30 +0000

Your Exchange server will run for 120 days without a product key but you should enter one as soon as possible and certainly before placing the server into production.

Launch the Exchange Management Console from the Start Menu of the server. A warning will appear listing each Exchange server that is currently unlicensed. Click OK to clear the warning.

In the left pane of the Exchange Management Console navigate to Server Configuration. Right-click the server in the middle pane and choose Enter Product key.

Enter your Product Key in the field and then click the Enter button.

You will see a message when the Product Key has been applied warning you that the change does not take effect until the Information Store service is restarted. Close the warning dialog box.

Launch the Exchange Management Shell from the Start Menu of the server and run the following command.

Restart-Service MSExchangeIS

You can also use the Exchange Management Shell to enter the product key for multiple Exchange servers at once.

Get more Exchange Server tips at ExchangeServerPro.com

Installing Exchange Server 2010: The Typical Server

Paul Cunningham — Thu, 20 May 2010 09:00:01 +0000

A Typical Exchange Server 2010 is one that runs the Client Access, Hub Transport, and Mailbox server roles. This is the type of installation that would be performed in a single server organization.

There are two methods for performing the installation – command-line, or GUI.

Before beginning the installation make sure you have:

Verified your existing network environment is ready for Exchange Server 2010
Configured a Windows Server 2008 or Windows Server 2008 R2 server with the pre-requisites for Exchange Server 2010
Prepared Active Directory for Exchange Server 2010

Installing a Typical Server in Command-Line Mode

Launch an elevated Command Prompt and run Exchange Server setup with the following parameters. Note that the /LegacyRoutingServer parameter is only required if you have an existing Exchange 2003 server in the organization. Replace “exch2003.contoso.local” below with the name of your existing Exchange Server 2003 server.

setup /m:install /r:h,c,m,t /LegacyRoutingServer:ex2003.contoso.local

What did we just do? We ran the setup command with the following parameters:

/m:install – places setup in Install Mode
/r:h,c,m,t – installs the Hub Transport, Client Access, Mailbox, and Management Tools roles
/LegacyRoutingServer – tells setup to create a legacy Routing Group Connector to the specific Exchange 2003 server

Exchange Server 2010 setup will run in unattended mode.

Welcome to Microsoft Exchange Server 2010 Unattended Setup

By continuing the installation process, you agree to the license terms of
Microsoft Exchange Server 2010. If you don't accept these license terms,
please cancel the installation. To review these license terms, please go to

http://go.microsoft.com/fwlink/?LinkId=150127&clcid=0x409/

Press any key to cancel setup................
No key presses were detected.  Setup will continue.
Preparing Exchange Setup

    Copying Setup Files              ......................... COMPLETED

The following server roles will be installed
    Languages
    Management Tools
    Hub Transport Role
    Client Access Role
    Mailbox Role

Performing Microsoft Exchange Server Prerequisite Check

    Language Pack Checks             ......................... COMPLETED
    Hub Transport Role Checks        ......................... COMPLETED
    Client Access Role Checks        ......................... COMPLETED
    Mailbox Role Checks              ......................... COMPLETED
 If Microsoft Outlook 2003 is in use, you should replicate the free/busy folder
on this server to every other free/busy server in the organization. This step sh
ould be performed once Setup completes.

Configuring Microsoft Exchange Server

    Preparing Setup                  ......................... COMPLETED
    Stopping Services                ......................... COMPLETED
    Copying Exchange Files           ......................... COMPLETED
    Language Files                   ......................... COMPLETED
    Restoring Services               ......................... COMPLETED
    Languages                        ......................... COMPLETED
    Exchange Management Tools        ......................... COMPLETED
    Hub Transport Server Role        ......................... COMPLETED
    Client Access Server Role        ......................... COMPLETED
    Mailbox Server Role              ......................... COMPLETED
    Finalizing Setup                 ......................... COMPLETED

The Microsoft Exchange Server setup operation completed successfully.
Setup has made changes to operating system settings that require a reboot to tak
e effect. Please reboot this server prior to placing it into production.

Restart the server when unattended setup is complete.

Installing a Typical Server in Graphical Mode

From the location that you extracted the Exchange Server 2010 setup files launch the Setup.exe file.

Select Step 3: Choose Exchange language option, and choose to Install only languages from the DVD.

Select Step 4: Install Microsoft Exchange.

Step through the Exchange Server 2010 Setup wizard introduction, license agreement, and error reporting dialogs.

Choose “Typical Exchange Server Installation”. You can also choose a different path for the program files if you want to install to a different volume.

I’m going to walk through configuring internet facing services in a later article, but you can enter a public name here at this stage if you want to.

If you are installing into an existing Exchange Organization with Exchange 2003 servers, at the Mail Flow Settings dialog click Browse and choose the existing Exchange Server 2003 server to be configured as a routing group partner.

The Customer Experience Improvement Program is optional.

When the Readiness Checks are successful you can proceed with the install. Note: the Outlook 2003 free/busy warning is normal and does not prevent you from proceeding with the install.

Restart the server when setup has completed, and then run Windows Update to ensure that the latest updates are installed before proceeding further.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2010 Deployment: Preparing Active Directory

Paul Cunningham — Fri, 14 May 2010 11:15:23 +0000

The first step when installing Exchange Server 2010 is to prepare the Active Directory schema.

Applying the Exchange Server 2007 SP2 Schema Update

When installing to an existing Exchange 2003 organization, and to retain backward compatibility with Exchange Server 2007, the Active Directory schema updates for Exchange Server 2007 are applied first.

You must perform these steps with an account that is a member of the Enterprise Admins and Schema Admins groups.

Exchange Server 2007 setup will not run on Windows Server 2008 R2, even just to perform the schema update. If you have installed Windows Server 2008 R2 to run Exchange Server 2010 you will need to run the Exchange Server 2007 schema update from a different server that runs either:

Windows Server 2003 Service Pack 2 with
Windows Server 2008 with Windows Installer 4.5, or
Windows Server 2008 Service Pack 2

Note that the server you run the schema update from cannot be an existing Exchange server.

If you have installed Windows Server 2008 to run Exchange Server 2010 you can run the schema update on that server.

The server must reside in the same Active Directory Site as the Schema Master, and you will need to use the 32-bit or 64-bit Exchange Server 2007 setup files to match the operating system of the server you will run the schema update from.

Download the Exchange Server 2007 files from Microsoft and extract them the server. Launch a Command Prompt and run the Exchange Server 2007 schema update.

setup /PrepareAD

Applying the Exchange Server 2010 Schema Update

You must perform these steps with an account that is a member of the Enterprise Admins and Schema Admins groups. The server that you run the update from must reside in the same Active Directory Site as the Schema Master.

Download the Exchange Server 2010 files from Microsoft and extract them the server. Launch a Command Prompt and run the Exchange Server 2010 schema update.

setup /PrepareAD

If you have an Active Directory with multiple Domain Controllers you should wait for the new schema to replicate throughout the network before proceeding.

Get more Exchange Server tips at ExchangeServerPro.com

Installing Exchange Server 2010 Pre-Requisites on Windows Server 2008 R2

Paul Cunningham — Wed, 12 May 2010 11:01:31 +0000

Exchange Server 2010 can be installed on either Windows Server 2008 64-bit with Service Pack 2, or Windows Server 2008 64-bit R2, and either Standard or Enterprise editions.

In this post I’ll walk through installing the pre-requisites for Exchange Server 2010 on Windows Server 2008 R2.

Servers that will host the Hub Transport or Mailbox server roles require the Microsoft Filter Pack which can be downloaded here: http://go.microsoft.com/fwlink/?linkid=137042

After installing the Filter Pack run the following command from an elevated Windows PowerShell console.

Import-Module ServerManager

To install a “Typical” Exchange server running the Client Access, Hub Transport, and Mailbox server roles, run the following command from an elevated Windows PowerShell console.

Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy -Restart

Note that other combinations of server roles require different groups of pre-requisites. You can see a complete list of these options here.

You can also check out Pat Richard’s script for automating the installation of pre-requisites for different servers roles.

The server will require a restart, which will occur automatically by using the –Restart switch on the command above.

After the restart launch another elevated Windows PowerShell console and run the following command.

Set-Service NetTcpPortSharing -StartupType Automatic

After installing the pre-requisites run Microsoft Update to verify the latest updates and patches are applied to the server before proceeding with the Exchange Server 2010 install.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2010 Planning: Verifying Your Existing Network Environment

Paul Cunningham — Mon, 10 May 2010 10:52:36 +0000

Before you can deploy Exchange Server 2010 into an existing Exchange organization you must verify that your existing network environment meets the pre-requisites.

Active Directory Pre-Requisites

Active Directory requires the following to support Exchange Server 2010.

Component	Requirement
Schema Master	The Schema Master must be running one of the following operating systems: Windows Server 2003 Standard/Enterprise with SP1 (x86 or x64) Windows Server 2003 R2 Standard/Enterprise with SP1 (x86 or x64) Windows Server 2008 Standard/Enterprise (x86 or x64) Windows Server 2008 R2 Standard/Enterprise
Global Catalog	In each Site that will contain an Exchange server there must be at least one Global Catalog running one of the above operating systems.
Domain Controller	In each Site that will contain an Exchange server there must be at least one writable Domain Controller running one of the above operating systems.
Functional Level	Windows Server 2003 Functional mode or higher.

Exchange Organization Pre-Requisites

The existing Exchange Organization must be at least Exchange 2003 Native Mode, and all Exchange servers must be at least Exchange Server 2003 with Service Pack 2.

Exchange Pre-Deployment Analyzer

The Microsoft Exchange Pre-Deployment Analyzer is used to scan existing environments to verify their readiness for Exchange Server 2010.

Download the Exchange Pre-Deployment Analyzer tool from Microsoft and install it on your Exchange Server 2003 server.

Step through the wizard to perform a scan of your Exchange Organization, and address any outstanding issues that it reports.

Exchange Server 2007 Compatibility

When you are transitioning from Exchange Server 2003 to Exchange Server 2010 it is recommended to first run the Exchange Server 2007 Active Directory schema update. This ensures that if the need arises later on that an Exchange Server 2007 server can be installed into the environment.

If only the Exchange Server 2010 schema update is applied you can never add an Exchange Server 2007 server to the environment.

Link State Suppression

The Exchange Pre-Deployment Analyzer report may warn you that Link State Suppression is not enabled on the Exchange Server 2003 servers. Link State Suppression is only required if you plan to add more than one connector between the Exchange Server 2010 server and existing Exchange Server 2003 servers.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Exchange 2003-2010 Transition

Export an Exchange Server 2010 Certificate to Exchange 2003

Export the Certificate from Exchange Server 2010

Import the Certificate on the Exchange 2003 Server

Related posts:

Configure an SSL Certificate for Exchange Server 2010

Generate a New Exchange Server 2010 Certificate

Assign the New Certificate to Exchange Server 2010

Related posts:

How to Configure the Exchange Server 2010 Product Key

Related posts:

Installing Exchange Server 2010: The Typical Server

Installing a Typical Server in Command-Line Mode

Installing a Typical Server in Graphical Mode

Related posts:

Exchange 2010 Deployment: Preparing Active Directory

Applying the Exchange Server 2007 SP2 Schema Update

Applying the Exchange Server 2010 Schema Update

Related posts:

Installing Exchange Server 2010 Pre-Requisites on Windows Server 2008 R2

Related posts:

Exchange 2010 Planning: Verifying Your Existing Network Environment

Active Directory Pre-Requisites

Exchange Organization Pre-Requisites

Exchange Pre-Deployment Analyzer

Exchange Server 2007 Compatibility

Link State Suppression

Related posts: