Exchange Server Pro » Exchange 2007

Exchange Server 2010 and the Benefits of Commercial SSL Certificates

Paul Cunningham — Thu, 26 Aug 2010 09:00:26 +0000

Petri IT Knowledgebase has published my article on the merits of choosing commercial SSL certificates over self-signed or privately issued ones for Exchange Server 2010.

The business case is clear for purchasing SSL SAN certificates from a genuine commercial certificate authority to use with Exchange Server 2007 and 2010. For an outlay of as little as a few hundred dollars the business receives the benefits of:

Far less administrative effort to implement and maintain SSL for Exchange services

Compatibility with devices and applications that require connection to Exchange services over SSL

Access to Exchange services such as Outlook Web App for remote workers without undermining the security of the network or encouraging insecure behavior by users

Read the full article here.

I frequently encounter customers who request to (in some cases demand to) or have already deployed Exchange Server 2010 with a self-signed or a privately issued certificate. In 2007 it was possible though cumbersome and frustrating. In Exchange 2010 it is possible in some scenarios, equally frustrating, and in a few cases seems to be impossible to achieve 100% seamless integration and trust even for domain members (notably Exchange 2010 with Outlook 2010).

Any perceived cost savings by avoiding commercial certificates are a false economy. You spend far more on consultant and administrator effort to implement and maintain the environment with non-commercial certificates.

I generally recommend Digicert’s Unified Communications certificate for Exchange Server 2010 deployments, as I find them easy to deal with and good value.

Get more Exchange Server tips at ExchangeServerPro.com

COM Class Factory Error 8007007E Moving Mailboxes in Exchange Server 2007

Paul Cunningham — Wed, 28 Jul 2010 09:00:04 +0000

On an Exchange Server 2007 an error may occur when attempting to use the Mailbox Move Wizard or the Move-Mailbox cmdlet to move a user mailbox.

Retrieving the COM class factory for component with CLSID {08D1AA55-704E-4397-AB29-55D2A3972BCB} failed due to the following error: 8007007e.

The Application event log will contain a corresponding log entry.

Event Type: Error
Event Source: MSExchange Common
Event Category: General
Event ID: 4999
Date: 21/07/2010
Time: 4:07:01 PM
User: N/A
Computer: SERVER
Description:
Watson report about to be sent to dw20.exe for process id: 5312, with parameters: E12, c-RTL-AMD64, 08.02.0176.002, mmc, M.E.Management, M.E.M.R.MoveMailbox.CreateMigrationComObject, S.IO.FileNotFoundException, 911d, 08.02.0176.002. ErrorReportingEnabled: False

Notice the S.IO.FileNotFoundException part of the event log entry. This is a clue that there is a file missing. The question is, which file?

The answer is in the CLSID from the error message. By searching the registry for the CLSID we find the following entry.

The CLSID corresponds with the migbase.dll file in the Exchange Server binaries folder. On the server that was having this error the file was missing entirely, for reasons unknown.

There are three ways to recover the file:

Restoring from backup (may be difficult if you don’t know when it went missing)
Copying from another server (make sure you choose a server of the same Service Pack and Update Rollup version)
Applying/re-applying the latest Service Pack

Get more Exchange Server tips at ExchangeServerPro.com

Public Folders Not Replicating Between Exchange 2007 and 2010

Paul Cunningham — Tue, 06 Jul 2010 05:14:28 +0000

During a migration from Exchange Server 2007 to Exchange Server 2010 you may encounter a problem with the replication of public folders.

In this situation neither the public folder hierarchy or content will replicate from Exchange Server 2007 to a public folder database on Exchange Server 2010. This will usually occur in Exchange organizations that have previously run versions of Exchange Server 2003 or below.

No PF Hierarchy

The Exchange Server 2010 Application Event Log will have this error:

Log Name:      Application
Source:        MSExchange Store Driver
Date:          13/06/2010 2:08:36 PM
Event ID:      1020
Task Category: MSExchangeStoreDriver
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SERVER
Description:
The store driver couldn't deliver the public folder replication message "Status Request (PublicFolders@domain.com)" because the following error occurred: The Active Directory user wasn't found..

The cause of this error is a legacy container in Active Directory for the Exchange 2003 (or earlier) server objects.

Note: this only applies to organizations that no longer run any Exchange 2003 or earlier servers. Do not follow these steps if you still have Exchange 2003 or earlier versions running in your organization.

Launch ADSIEdit.msc and navigate to CN=Configuration , CN=Services, CN=Microsoft Exchange, CN=, CN=Administrative Groups, CN=, CN=Servers.

Navigate to the CN=Servers container

If you no longer operate any Exchange 2003 or earlier servers and the Servers container is empty then you can delete the container.

You should now be able to replicate the public folder hierarchy and content from Exchange Server 2007 to 2010.

Get more Exchange Server tips at ExchangeServerPro.com

Understanding the Exchange Server Spam Confidence Level

Paul Cunningham — Wed, 23 Jun 2010 14:05:47 +0000

If you have looked at Exchange Server’s anti-spam features or taken a peek at the headers of an email sent through an Exchange server you have probably encountered the term SCL before.

SCL stands for Spam Confidence Level. It is the “score” that Exchange Server anti-spam assigns to an email based on the email’s contents. This score is then used to make decisions as to how to handle suspected spam based on the thresholds that the Exchange administrator configures.

Having a detailed understanding of the SCL and how it is used in Exchange Server anti-spam will allow an email administrator to get good performance from their anti-spam deployment.

Exchange 2000 and Windows Server 2008 Domain Controllers

Paul Cunningham — Thu, 03 Jun 2010 09:00:04 +0000

A reader emailed me to ask how they can go about upgrading their current environment without breaking Exchange.

They are currently running Exchange Server 2000 with Windows Server 2000 domain controllers, and wish to transition to Exchange Server 2007 and Windows Server 2008 domain controllers.

Although you can transition from Exchange 2000 to 2007 the problem in this case is the move from Windows Server 2000 to Windows Server 2008. Exchange 2000 will not work with Windows Server 2008 domain controllers, and Exchange 2007 will not work with Windows Server 2000 domain controllers.

From Microsoft:

Exchange 2000 Server Service Pack 3 and all previous versions of Microsoft Exchange are not for use with Windows Server 2008 directory servers. The following restrictions apply with respect to Exchange 2000 Server Service Pack 3:

Exchange 2000 Server Service Pack 3 can exist in an Active Directory forest that contains Windows Server 2008 directory servers, but Windows Server 2008 directory servers should not be installed in Active Directory Sites that contain Exchange 2000 Server.

If Windows Server 2008 directory servers must be deployed Active Directory Sites that contain Exchange 2000 Server you must first hard-code directory service access (DSAccess) on the Exchange 2000 Server servers in the site to point to directory servers running Windows Server 2003 or Windows 2000 Server.

In other words, at some point the reader will need to install a Windows Server 2003 domain controller to make the whole transition possible.

My recommendation is to use these general steps:

Install a Windows Server 2003 domain controller into the site(s) that will be hosting Exchange Server 2007, so that the environment pre-requisites for Exchange 2007 are met (ie, Windows Server 2003 SP1 DC/GC in the AD Site hosting Exchange 2007, plus the Schema Master must be Windows Server 2003 SP1)
Transition from Exchange Server 2000 to Exchange Server 2007
Introduce Windows Server 2008 domain controllers into the environment where required (upgrading the temporary Windows Server 2003 DC to 2008 is supported too)

Get more Exchange Server tips at ExchangeServerPro.com

Error “Object is Read Only” During Exchange Server 2007 Public Folder Database Removal

Paul Cunningham — Tue, 01 Jun 2010 09:00:55 +0000

During a transition from Exchange Server 2007 to Exchange Server 2010 you may encounter an error removing a Public Folder Database from the Exchange 2007 server.

The error message tells you that the “Object is read only because it was created by a future version of Exchange”.

[PS] C:\>Remove-PublicFolderDatabase "EXCH07\Public Folder Database"

Confirm
Are you sure you want to perform this action?
Removing Public Folder Database "EXCH07\Public Folder Database".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help
(default is "Y"):y
Remove-PublicFolderDatabase : Object is read only because it was created by a f
uture version of Exchange: 0.10 (14.0.100.0). Current supported version is 0.1
(8.0.535.0).
At line:1 char:28
+ Remove-PublicFolderDatabase  <<<< "EXCH07\Public Folder Database"

The solution is to use the Exchange Server 2010 Management Shell to remove the Public Folder Database. From an Exchange Server 2010 server run the following command to retrieve the identity of the Public Folder Database you wish to remove.

[PS] C:\>Get-PublicFolderDatabase -Server EXCH07 | fl name, identity

Name     : Public Folder Database
Identity : EXCH07\Second Storage Group\Public Folder Database

Then run this command to remove the Public Folder Database, using the Identity that was retrieved in the previous command.

[PS] C:\>Remove-PublicFolderDatabase "EXCH07\Second Storage Group\Public Folder Database"

Confirm
Are you sure you want to perform this action?
Removing public folder database "EXCH07\Second Storage Group\Public Folder Database".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [?] Help (default is "Y"): y
WARNING: The specified database has been removed. You must remove the database file located in E:\Data\SG2\Public
Folder Database.edb from your computer manually if it exists. Specified database: Public Folder Database

The Public Folder Database is now removed from the Exchange 2007 server.

Get more Exchange Server tips at ExchangeServerPro.com

MapiExceptionCallFailed ec=-2147467259 Mounting Exchange Server 2007 Mailbox Database

Paul Cunningham — Fri, 28 May 2010 20:00:18 +0000

A new installation of Exchange Server 2007 may fail to mount the initial Mailbox Database. The server will display a “mapiexceptioncallfailed ec=-2147467259″ error, and the following events may be seen in the Application event log.

Log Name:      Application
Source:        MSExchangeIS
Date:          5/23/2010 1:39:28 PM
Event ID:      9518
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      EXCH07.domain.local
Description:
Error 0x80004005 starting Storage Group /DC=local/DC=domain/CN=Configuration/
CN=Services/CN=Microsoft Exchange/CN=Exchange Organization/CN=Administrative
 Groups/CN=Exchange Administrative Group (FYDIBOHF23SPDLT)/CN=Servers/
CN=EXCH07/CN=InformationStore/CN=First Storage Group on the Microsoft
 Exchange Information Store. MDB failed to start.

The problem may also occur for any other mailbox databases that are created, giving the same 2147467259 error.

The error code 2147467259 can indicate Active Directory problems are the cause of the database failing to mount.

Newly created mailbox databases can fail to mount due to Active Directory replication delays. If the database still will not mount after you have waited for the Active Directory replication interval to lapse, open an elevated command prompt and run the following command from the Exchange Server 2007 source file location:

C:\Src\Exchange2007>setup /preparedomain

Welcome to Microsoft Exchange Server 2007 Unattended Setup

Preparing Exchange Setup

No server roles will be installed

Performing Microsoft Exchange Server Prerequisite Check

    Organization Checks              ......................... COMPLETED

Configuring Microsoft Exchange Server

    Prepare Domain Progress          ......................... COMPLETED

The Microsoft Exchange Server setup operation completed successfully.

The mailbox database should now mount successfully without error.

Get more Exchange Server tips at ExchangeServerPro.com

Causes of MapiExceptionNotAuthorized Error Sending to Public Folders

Paul Cunningham — Thu, 22 Apr 2010 04:15:30 +0000

In some scenarios a mailbox user sending emails to a mail-enabled Public Folder may receive an undeliverable message in reply.

The message contains the following error details:

#550 5.2.0 STOREDRV.Deliver: The Microsoft Exchange Information Store service
reported an error.  The following information should help identify the cause
of this error: "MapiExceptionNotAuthorized:16.18969:57080000..."

This error can occur under a variety of configurations relating to Public Folder client permissions.

External Senders

External senders will receive the error if the Public Folder does not permit “Anonymous” to create new items.

[PS] C:\>Get-PublicFolderClientPermission \pftest

Identity                   User                       AccessRights
--------                   ----                       ------------
\pftest                    Default                    {FolderVisible}
\pftest                    mycompany.local/Users/A... {Owner}
\pftest                    Anonymous                  {None}

To grant this access run the following command in the Exchange Management Shell.

[PS] C:\>Add-PublicFolderClientPermission \pftest -User Anonymous -AccessRights CreateItems

Identity                   User                       AccessRights
--------                   ----                       ------------
\pftest                    Anonymous                  {CreateItems}

Internal Senders

Internal senders are able to be authenticated by the Exchange server, and so are not treated as Anonymous. For internal senders the user must have at least Create Items permissions on the Public Folder. For general use Public Folders this can be granted as the “Default” permission.

To grant this access run the following command in the Exchange Management Shell.

[PS] C:\>Add-PublicFolderClientPermission \pftest -user Default -AccessRights CreateItems

Identity                   User                       AccessRights
--------                   ----                       ------------
\pftest                    Default                    {Contributor}

Internal Senders Alternate Scenario

Because internal senders are being authenticated by the Exchange server their group membership is taken into consideration. When the Exchange server receives a new item from an internal sender it takes the following basic steps:

Maps the sender address to a user account object (this occurs even if the email was not sent by the user themselves, eg was sent via Telnet)
Enumerates the user’s group membership
Assesses the group membership against the ACLs on the Public Folder
Permits or denies the mail item depending on the ACL

Because of this process the Exchange server must have Read access to the groups that the sender is a member of, including direct membership and indirect membership (eg by nested groups).

If the Exchange server cannot read a group object it will deny the mail item and the user will receive the undeliverable message with “MapiExceptionNotAuthorized”. The reason for this is that it is designed to fail in a secure way (ie, “I can’t verify your access therefore I will deny you”), rather than an insecure way (ie “I can’t verify your access therefore I will permit you”).

With that in mind you would need to investigate all of the direct and indirect group membership for the user and try to locate a group object that does not have the Exchange Servers group with Read access in its ACL. Most commonly this will occur when the group is in a Domain in the Forest that has not been prepped for Exchange, or is in an OU where permissions inheritance has been disabled.

Correcting the ACL on the group objects should resolve the undeliverable “MapiExceptionNotAuthorized” error in those cases.

Get more Exchange Server tips at ExchangeServerPro.com

How to Migrate Public Folders from Exchange 2003 to Exchange 2007

Paul Cunningham — Wed, 07 Apr 2010 13:58:20 +0000

A recent project I worked on involved the simultaneous upgrade and expansion of the messaging environment from a single Exchange Server 2003 server to multiple Exchange Server 2007 servers.

In the new topology there were to be two Exchange 2007 mailbox servers, one at each of the two main sites. This required that a Public Folder database be deployed at each site which would then be replicated with one another.

Migrating the content from a single Public Folder database to multiple databases was achieved with just a few simple steps.

First migrate the public folders from Exchange 2003 to Exchange 2007. I posted the step by step process here.

Next we simply enable the second server as a replica for all of the public folders themselves. Microsoft provides a script with Exchange 2007 that can do this. The script is located in the \scripts folder of your Exchange Server install path, eg C:\Program Files\Microsoft\Exchange Server\Scripts.

In this example there are two available PF databases.

[PS] C:\>Get-PublicFolderDatabase

Name                           Server               StorageGroup
----                           ------               ------------
Public Folders (server1)       SERVER1              SG02
Public Folders (server2)       SERVER2              SG02

A look at one of the public folders shows only SERVER1 as containing a replica.

[PS] C:\>Get-PublicFolder "\Sales Contacts" | fl replicas

Replicas : {SERVER1\SG02\Public Folders (server1)}

Using the script we can add SERVER2 as a replica for all of the public folders.

[PS] C:\> .\AddReplicaToPFRecursive.ps1 -Server "SERVER1" -TopPublicFolder "\" -ServerToAdd "SERVER2"

Note that specifying the top public folder of \ will generate an error, because that folder cannot be modified in this way, however the script will then continue down the public folder tree and modify all of the other public folders.

Depending on how complex your public folder tree is this might take some time.

After is has finished the public folder replication schedule for your PF databases will replicate the content between the two servers. Again this might take some time, and in this example SERVER2 will not show any content until it is replicated for each folder. With that in mind, you should perform this task outside of business hours, or stage it by adding the replica to one main folder at a time instead of the entire tree at once.

Also be aware that this initial replication can generate a lot of transaction logging, so you either need to ensure a lot of logging disk space is available, run regular backups to truncate the logs, or use circular logging temporarily.

Get more Exchange Server tips at ExchangeServerPro.com

The Ultimate Exchange Server 2007 Toolkit

Paul Cunningham — Tue, 30 Mar 2010 05:02:04 +0000

If you are regularly deploying or administering Exchange Server 2007 environments then chances are there are some pieces of software and documentation that you regularly need to make use of. Today I thought I would share with you what is in my own Exchange 2007 toolkit.

Software

Operating Systems

Naturally it pays to have copies of the Windows Server CD media on hand. If you don’t like carrying CD’s then having ISOs that you can mount is usually just as good.

Windows Server 2003 32-bit and 64-bit (both Standard and Enterprise, and R2) CD media, slipstreamed with SP2.
Windows Server 2008 32-bit and 64-bit DVD media (includes all the bits for both Standard and Enterprise on it) with SP2.

Exchange Pre-Requisites

When deploying Exchange 2007 on Windows Server 2003 there are several pre-requisites needed. Having these ready to copy to the server saves a lot of time finding and downloading them:

.NET 2.0 with Service Pack 1 (x86 and x64)
MMC 3.0 (x86 and x64)
PowerShell (x86 and x64)

Even though production Exchange systems are only deployed on 64-bit servers I include both the 32-bit and 64-bit pre-requisites in my toolkit for situations where the Exchange 2007 schema extension is performed on a 32-bit domain controller.

Windows Server 2008 deployments don’t need any special software because all of the Exchange 2007 pre-requisites can be installed via the command line.

Exchange Installation Source

The latest build of Exchange 2007 is SP3 and is available as a complete install (ie, doesn’t require you to install RTM and then apply SP3). Again even though only 64-bit is used for production Exchange servers I still carry the 32-bit version with me for schema extensions and for installing the management tools on administrative workstations.

You can download both 32-bit and 64-bit install source here.

Planning, Deployment and Troubleshooting Tools

When you are planning or testing a new Exchange Server 2007 deployment these tools are are essential.

Exchange 2007 Mailbox Server Role Storage Requirements Calculator (download here)
Microsoft Exchange Server Jetstress Tool (x86 and x64)
Exchange Load Generator (x86 and x64)
Exchange Server Stress and Performance Tool (x86 and x64)
Microsoft Exchange Server Profile Analyzer (x86 and x64)
Microsoft Exchange Best Practices Analyzer v2.8
2007 Office System Converter: Microsoft Filter Pack here, plus the reg script here
FBA Editor, for customizing ISA/TMG logon forms
DNSLint, for AD replication troubleshooting
Microsoft Active Directory Topology Diagrammer for generating Visio diagrams
ADmodify for bulk object editing, useful in GAL segregation scenarios
Microsoft Exchange Server Public Folder DAV-based Administration Tool
Microsoft Exchange Troubleshooting Assistant v1.1
Exchange 2007 Anti Spam Migration Tool
MFCMAPI
Automatic Fix-It package for installing Exchange on Domain Controllers

Documentation

Microsoft provides downloadable help files for Exchange 2007 that are invaluable when out in the field, especially if you happen to be without internet access and need information fast.

While there are many good Exchange 2007 books around most of them are too big and heavy to carry out in the field. That is why I carry the Administrator’s Pocket Consultant with me. However will also list here the other books that I keep in the office for reference:

Want to work with Exchange Server 2007?

If you’re interested in working with Exchange Server 2007 you may want to:

Get certified. I’ve completed both the MCTS certification, and MCITP certification for Exchange 2007 using these two books.
Download my Exchange Server 2007 Transition Guide to learn how to migrate from Exchange 2003 to Exchange 2007.
Read my Project Coconut series, a real world Exchange 2007 deployment I recently worked on.
Subscribe to my RSS feed, so you can keep up to date with all of my Exchange related blog posts.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Exchange 2007

Exchange Server 2010 and the Benefits of Commercial SSL Certificates

Related posts:

COM Class Factory Error 8007007E Moving Mailboxes in Exchange Server 2007

Related posts:

Public Folders Not Replicating Between Exchange 2007 and 2010

Related posts:

Understanding the Exchange Server Spam Confidence Level

Related posts:

Exchange 2000 and Windows Server 2008 Domain Controllers

Related posts:

Error “Object is Read Only” During Exchange Server 2007 Public Folder Database Removal

Related posts:

MapiExceptionCallFailed ec=-2147467259 Mounting Exchange Server 2007 Mailbox Database

Related posts:

Causes of MapiExceptionNotAuthorized Error Sending to Public Folders

External Senders

Internal Senders

Internal Senders Alternate Scenario

Related posts:

How to Migrate Public Folders from Exchange 2003 to Exchange 2007

Related posts:

The Ultimate Exchange Server 2007 Toolkit

Software

Operating Systems

Exchange Pre-Requisites

Exchange Installation Source

Documentation

Want to work with Exchange Server 2007?

Related posts: