Exchange Server Pro » Exchange Management Shell

PowerShell Script: Check Exchange 2010 Database Backups

Paul Cunningham — Sun, 06 Nov 2011 11:23:58 +0000

In almost any Exchange Server 2010 environment there will be a good reason for adding some additional monitoring of backups.

Perhaps the environment is large enough that the backups are managed by a separate team to the Exchange administrators, and so the Exchange admins just want to keep an eye on their database backups. Or even in a smaller environment the administrators may just want to be sure that their backup software isn’t reporting successful backups when in fact they may be failing.

In this post I will demonstrate a PowerShell script that you can run in an Exchange Server 2010 environment to report on any databases that have not successfully backed up in the last 48 hours. Let’s take a look at how this works.

Firstly, backup time stamps are retrievable using the Get-MailboxDatabase cmdlet for mailbox databases, or Get-PublicFolderDatabase for public folder databases. Here is an example:

PS C:\Scripts> Get-MailboxDatabase -Status | ft name,last* -auto

Name     LastFullBackup       LastIncrementalBackup LastDifferentialBackup LastCopyBackup
----     --------------       --------------------- ---------------------- --------------
MB-HO-01 11/6/2011 1:40:19 PM
MB-HO-02
MB-HO-03
MB-BR-01

You can see that one of the databases above has been backed up, but the others have not. In a script that checks both mailbox and public folder databases we could use this code to generate the report.

$dbs = Get-MailboxDatabase -Status
$dbs = $dbs += Get-PublicFolderDatabase -Status
$dbs | ft name,last*

Now we can see both the mailbox and the public folder databases.

Name                    LastFullBackup          LastIncrementalBackup   LastDifferentialBackup  LastCopyBackup
----                    --------------          ---------------------   ----------------------  --------------
MB-HO-01                11/6/2011 1:40:19 PM
MB-HO-02
MB-HO-03
MB-BR-01
PF-HO-01                11/6/2011 1:40:20 PM
PF-BR-01

It would be a simple matter to run that command and read the output every single day, but that would not be the most efficient way of checking database backups. There could be dozens or even hundreds of databases in that output, and we’d have to mentally perform the calculations to determine whether the backup time stamp is within the last 48 hours or not.

Instead we want to only to see databases that have not been backed up within the 48 hour threshold. To do this we can use some date maths. Because we’ve already retrieved the database objects into a collection called $dbs we can loop through them to perform the date calculations like this. Note that in this example only Full and Incremental backups are being considered.

foreach ($db in $dbs)
{
	Write-Host -ForegroundColor Gray "Checking" $db.name"..."

	$lastbackup = @{}
	$ago = @()
	[bool]$alertflag = $false

	if ( $db.LastFullBackup -eq $nul -and $db.LastIncrementalBackup -eq $nul)
	{
		$lastbackup.time = "Never"
		$lastbackup.type = "Never"
		[string]$ago = "Never"
	}
	elseif ( $db.LastFullBackup -lt $db.LastIncrementalBackup )
	{
		$lastbackup.time = $db.LastIncrementalBackup
		$lastbackup.type = "Incremental"
		[int]$ago = ($now - $lastbackup.time).TotalHours
		$ago = "{0:N0}" -f $ago
	}
	elseif ( $db.LastIncrementalBackup -lt $db.LastFullBackup )
	{
		$lastbackup.time = $db.LastFullBackup
		$lastbackup.type = "Full"
		[int]$ago = ($now - $lastbackup.time).TotalHours
		$ago = "{0:N0}" -f $ago
	}
}

One of three possible scenarios will be true:

If the database has not been backed up at all then both Full and Incremental time stamps will be nul, so all of the resulting values are set to “Never”
If the most recent backup was an Incremental then the type is set to “Incremental” and the $ago variable is set to the number of hours that has passed since that Incremental backup finished
If the most recent backup was a Full then the type is set to “Full” and the $ago variable is set to the number of hours that has passed since that Full backup finished

Now, because we’re only interested in databases that haven’t backed up in the last 48 hours (or have never been backed up at all) we can compare the $ago variable to our threshold of 48 hours, and if an alert needs to be raised set the alert flag to True and create an object with all of the desired information for our report.

if ( $ago -gt $threshold -or $ago -eq "Never")
	{
		$alertflag = $true
		$dbObj = New-Object PSObject
		$dbObj | Add-Member NoteProperty -Name "Server/DAG" -Value $db.MasterServerOrAvailabilityGroup
		$dbObj | Add-Member NoteProperty -Name "Database" -Value $db.name
		$dbObj | Add-Member NoteProperty -Name "Database Type" -Value $dbtype
		$dbObj | Add-Member NoteProperty -Name "Last Backup Type" -Value $lastbackup.type
		$dbObj | Add-Member NoteProperty -Name "Hrs Ago" -Value $ago
		$dbObj | Add-Member NoteProperty -Name "Time Stamp" -Value $lastbackup.time
		$alerts = $alerts += $dbObj
	}

That code actually goes inside the ForEach loop for the $dbs collection.

The final piece of the script is the report itself. We output it based on whether the alert flag is set to True or False.

if ($alertflag = $true )
{
	Write-Host "The following databases have not been backed up in" $threshold "hours."
	$alerts | ft -AutoSize
}
else
{
	Write-Host "No backup alerts required."
}

This example outputs the report to the PowerShell window but you could write your PowerShell script to send an email report instead if you wish.

Here is an example report:

PS C:\Scripts> .\Check-DatabaseBackups.ps1
Getting database list...
Checking MB-HO-01 ...
Checking MB-HO-02 ...
Checking MB-HO-03 ...
Checking MB-BR-01 ...
Checking PF-HO-01 ...
Checking PF-BR-01 ...
The following databases have not been backed up in 48 hours.

Server/DAG     Database Database Type Last Backup Type Hrs Ago Time Stamp
----------     -------- ------------- ---------------- ------- ----------
dag-headoffice MB-HO-02 Mailbox       Never            Never   Never
dag-headoffice MB-HO-03 Mailbox       Never            Never   Never
BR-EX2010-MB   MB-BR-01 Mailbox       Never            Never   Never
BR-EX2010-MB   PF-BR-01 Public Folder Never            Never   Never

And here is the complete script.

#
#.SYNOPSIS
#Checks the backup timestamps for the servers
#and alerts if a database hasn't been backed up
#in the last 48 hours
#
#.EXAMPLE
#.\Check-DatabaseBackups.ps1
#

#...................................
# Variables
#...................................

$ErrorActionPreference = "SilentlyContinue"
$WarningPreference = "SilentlyContinue"

$alerts = @()
[int]$threshold = 48

$now = [DateTime]::Now

#...................................
# Script
#...................................

#Get all Mailbox and Public Folder databases
Write-Host -ForegroundColor Gray "Getting database list..."
$dbs = Get-MailboxDatabase -Status
$dbs = $dbs += Get-PublicFolderDatabase -Status

#Check each database for most recent backup
foreach ($db in $dbs)
{
	Write-Host -ForegroundColor Gray "Checking" $db.name"..."

	$lastbackup = @{}
	$ago = @()
	[bool]$alertflag = $false

	if ( $db.LastFullBackup -eq $null -and $db.LastIncrementalBackup -eq $nul)
	{
		$lastbackup.time = "Never"
		$lastbackup.type = "Never"
		[string]$ago = "Never"
	}
	elseif ( $db.LastFullBackup -lt $db.LastIncrementalBackup )
	{
		$lastbackup.time = $db.LastIncrementalBackup
		$lastbackup.type = "Incremental"
		[int]$ago = ($now - $lastbackup.time).TotalHours
		$ago = "{0:N0}" -f $ago
	}
	elseif ( $db.LastIncrementalBackup -lt $db.LastFullBackup )
	{
		$lastbackup.time = $db.LastFullBackup
		$lastbackup.type = "Full"
		[int]$ago = ($now - $lastbackup.time).TotalHours
		$ago = "{0:N0}" -f $ago
	}

	if ($db.IsMailboxDatabase -eq $true) {$dbtype = "Mailbox"}
	if ($db.IsPublicFolderDatabase -eq $true) {$dbtype = "Public Folder"}

	#If backup time stamp older than threshold set alert flag and create object for alerting
	if ( $ago -gt $threshold -or $ago -eq "Never")
	{
		$alertflag = $true
		$dbObj = New-Object PSObject
		$dbObj | Add-Member NoteProperty -Name "Server/DAG" -Value $db.MasterServerOrAvailabilityGroup
		$dbObj | Add-Member NoteProperty -Name "Database" -Value $db.name
		$dbObj | Add-Member NoteProperty -Name "Database Type" -Value $dbtype
		$dbObj | Add-Member NoteProperty -Name "Last Backup Type" -Value $lastbackup.type
		$dbObj | Add-Member NoteProperty -Name "Hrs Ago" -Value $ago
		$dbObj | Add-Member NoteProperty -Name "Time Stamp" -Value $lastbackup.time
		$alerts = $alerts += $dbObj
	}
}

#If alert flag is true output the report
if ($alertflag = $true )
{
	Write-Host "The following databases have not been backed up in" $threshold "hours."
	$alerts | ft -AutoSize
}
else
{
	Write-Host "No backup alerts required."
}

Get more Exchange Server tips at ExchangeServerPro.com

Using Test-ServiceHealth for Exchange Server Health Checks

Paul Cunningham — Tue, 18 Oct 2011 12:04:32 +0000

Exchange Server 2010 (and 2007 for that matter) ships with a useful PowerShell cmdlet called Test-ServiceHealth.

As the name suggests, Test-ServiceHealth checks the state of the services that should be running on the Exchange server. One of the best things about this cmdlet is that it checks the services depending on the Exchange server roles that are installed.

So for example, for a Hub Transport server only those services relating to the Hub Transport role will be checked. While for a “typical” Exchange 2010 server the services for the Hub Transport, Client Access, and Mailbox server roles will be checked.

Here is an example of the Test-ServiceHealth results.

[PS] C:\>Test-ServiceHealth br-ex2010-mb

Role                    : Mailbox Server Role
RequiredServicesRunning : True
ServicesRunning         : {IISAdmin, MSExchangeADTopology, MSExchangeIS, MSExchangeMailboxAssistants, MSExchangeMailSub
                          mission, MSExchangeRepl, MSExchangeRPC, MSExchangeSA, MSExchangeSearch, MSExchangeServiceHost
                          , MSExchangeThrottling, MSExchangeTransportLogSearch, W3Svc, WinRM}
ServicesNotRunning      : {}

Role                    : Client Access Server Role
RequiredServicesRunning : True
ServicesRunning         : {IISAdmin, MSExchangeAB, MSExchangeADTopology, MSExchangeFBA, MSExchangeFDS, MSExchangeMailbo
                          xReplication, MSExchangeProtectedServiceHost, MSExchangeRPC, MSExchangeServiceHost, W3Svc, Wi
                          nRM}
ServicesNotRunning      : {}

Role                    : Hub Transport Server Role
RequiredServicesRunning : True
ServicesRunning         : {IISAdmin, MSExchangeADTopology, MSExchangeEdgeSync, MSExchangeServiceHost, MSExchangeTranspo
                          rt, MSExchangeTransportLogSearch, W3Svc, WinRM}
ServicesNotRunning      : {}

As you can see that is a lot of useful information. But whenever possible I like to see just the minimum relevant information for my servers. In the case of Test-ServiceHealth the RequiredServicesRunning result is the thing I am most interested in.

So in this case I could run the following command to see just that information:

[PS] C:\>Test-ServiceHealth br-ex2010-mb | ft Role,RequiredServicesRunning -auto

Role                      RequiredServicesRunning
----                      -----------------------
Mailbox Server Role                          True
Client Access Server Role                    True
Hub Transport Server Role                    True

Much better.

Now suppose I wanted to run that for all of my Exchange servers. I could do that with the following command:

[PS] C:\>Get-ExchangeServer | Test-ServiceHealth | ft Role,RequiredServicesRunning -auto

Role                      RequiredServicesRunning
----                      -----------------------
Client Access Server Role                    True
Hub Transport Server Role                    True
Client Access Server Role                    True
Hub Transport Server Role                    True
Mailbox Server Role                         False
Mailbox Server Role                          True
Client Access Server Role                    True
Hub Transport Server Role                    True
Mailbox Server Role                          True
Client Access Server Role                    True
Hub Transport Server Role                    True

Interesting, especially the one that failed the test for the Mailbox server role. But in that output I can’t tell which server failed.

Let’s try this instead:

[PS] C:\>$servers = Get-ExchangeServer
[PS] C:\>foreach ($server in $servers) {
>> Write-Host "Checking" $server.name
>> Test-ServiceHealth $server | ft Role,RequiredServicesRunning -auto
>> }
>>

Now we get output that is a little more useful, and tells me which server failed the test.

Checking HO-EX2010-CAHT1

Role                      RequiredServicesRunning
----                      -----------------------
Client Access Server Role                    True
Hub Transport Server Role                    True

Checking HO-EX2010-CAHT2

Role                      RequiredServicesRunning
----                      -----------------------
Client Access Server Role                    True
Hub Transport Server Role                    True

Checking HO-EX2010-MB1

Role                RequiredServicesRunning
----                -----------------------
Mailbox Server Role                   False

Checking HO-EX2010-MB2

Role                RequiredServicesRunning
----                -----------------------
Mailbox Server Role                    True

Checking BR-EX2010-CAHT

Role                      RequiredServicesRunning
----                      -----------------------
Client Access Server Role                    True
Hub Transport Server Role                    True

Checking BR-EX2010-MB

Role                      RequiredServicesRunning
----                      -----------------------
Mailbox Server Role                          True
Client Access Server Role                    True
Hub Transport Server Role                    True

But it still isn’t quite enough, so let’s wrap this up into a handy script that will do the following:

Run Test-SystemHealth for all of the Exchange servers in the organization
Tell me which servers passed the test
Tell me which servers failed the test, and why

Here is the script code that will perform those steps.

#Get the list of Exchange servers in the organization
$servers = Get-ExchangeServer

#Loop through each server
ForEach ($server in $servers)
{
	Write-Host -ForegroundColor White "---------- Testing" $server

	#Initialize an array object for the Test-ServiceHealth results
	[array]$servicehealth = @()

	#Run Test-ServiceHealth
	$servicehealth = Test-ServiceHealth $server

	#Output the results
	ForEach($serverrole in $servicehealth)
	{
		If ($serverrole.RequiredServicesRunning -eq $true)
		{
			Write-Host $serverrole.Role -NoNewline; Write-Host -ForegroundColor Green "Pass"
		}
		Else
		{
			Write-Host $serverrole.Role -nonewline; Write-Host -ForegroundColor Red "Fail"
			[array]$notrunning = @()
			$notrunning = $serverrole.ServicesNotRunning
			ForEach ($svc in $notrunning)
			{
				$alertservices += $svc
			}
			Write-Host $serverrole.Role "Services not running:"
			ForEach ($al in $alertservices)
				{
					Write-Host -ForegroundColor Red `t$al
				}
		}
	}
}

The output from running the script will look something like this.

You can now see at a glance which servers have passed the test, which ones failed, and which services aren’t running for the servers that failed.

Get more Exchange Server tips at ExchangeServerPro.com

The Case of the 24,368 Read Receipts

Paul Cunningham — Thu, 25 Aug 2011 14:08:19 +0000

I often share real world examples of problems or scenarios that you might encounter with Microsoft Exchange Server, and how to avoid or resolve them.

In this article I want to share one such example that happened to me under a specific set of conditions.

The scenario begins with a mailbox migration project, in which I encountered a very large mailbox. The mailbox was too large to move without risking filling up the transaction log volume on the destination server. So I tracked down an owner of the mailbox to discuss options for removing some of the older items.

As it turns out they didn’t really need to keep any of the items in that mailbox that were older than about 30 days. So more than 2 years and 300,000 items in there were not required. We agreed to delete everything older than 6 months, just to be safe.

Side Note - keep an eye on your “large mailboxes” reports and you’ll often find these generic mailboxes that get set up as a place to catch copies of email “just in case” it is needed some time in the future. Often it isn’t.

So my next task was to delete the email content that was no longer needed. I considered using the Exchange 2007 Export-Mailbox cmdlet for this task, but decided to just use Outlook instead since I was already planning to use Outlook to take a look at some of the items before I deleted them.

I logged into a Citrix desktop, launched Outlook, and added the mailbox as a secondary mailbox. I had decided to use Outlook in a Citrix desktop because I expected it to hang for long periods of time as it enumerated or deleted the thousands of items I would be handling, and wanted to keep using Outlook on my laptop as normal.

So over the course of about two days in between other daily tasks I performed Outlook searches based on date ranges, and deleted the items in blocks of about 10,000 messages at a time. It is important to note at this stage that I was using Advanced Find to search the secondary mailbox.

After doing a search based on received date (ie, I started with the oldest mail and worked my way forward month by month) I would then select all the email that appeared in the results and delete them.

When you delete an email from a secondary mailbox it often gets moved to your own mailbox’s Deleted Items. However when you delete an email from a secondary mailbox via an Advanced Find dialog, it often goes into the Deleted Items of the secondary mailbox.

I say “often” because in at least one test the mail went to the Deleted Items of the primary mailbox, but in every other test it went to the secondary mailbox. It may be that Outlook behaves inconsistently in this situation, or that one test was different in some way that I can’t recall now.

As I said earlier I deleted around 2 years worth of unwanted email from the mailbox, in blocks of about 10,000 messages. When I had deleted everything up to the cut off date I’d agreed to with the mailbox owner I went ahead and simply emptied the Deleted Items of the secondary mailbox.

Job done. My plan was to wait for the deleted items to purge from the database itself overnight and then schedule a time to move what was now a much smaller mailbox.

A relevant bit of information at this point is that all of the email I deleted from the mailbox, and then emptied from the Deleted Items, was actually unread email. Nobody ever read these emails, they were there “just in case”.

That fact sprang immediately into my mind when about an hour later I was speaking with an external party who had received an email from our server that read something like this:

Subject: Not read: [subject line of original email]

From: [the large mailbox I'd been cleaning up]

Date: [right about the same time I emptied the Deleted Items]

I quickly learned that the person I was speaking to, when they originally sent their email to our server, had requested a read receipt.

The email had sat in the mailbox for several months unread, and then I came along and deleted it. The Exchange Server then honoured the receipt request, and sent the original sender the “Not read” message.

I had just deleted slightly over 150,000 email messages from that mailbox. How many of them had requested read receipts?

I ran message tracking log searches of the Hub Transport servers and got my first answer – a lot.

I dumped the log data to a file and filtered it a few different ways to discover that:

About 24,368 “Not read” read receipts had been generated (based on unique message ID)
They had gone out to about 1200 unique external email addresses

The horse had well and truly bolted on this one, and my team leader started calling and emailing different customer service teams to give them a heads up in case they received calls from confused people about a sudden burst of “Not read” emails. Meanwhile I started digging into the technical side of things to try and find out what had gone wrong, and more importantly how we could avoid this happening again.

After quite a bit of testing here is what I have determined so far.

Outlook 2003

When permanently deleting an unread item by emptying the Deleted Items of a secondary mailbox Outlook 2003, even if configured to prompt for sending of read receipts, will not warn or prompt the user and a “Not read” message will be generated to the original sender.

Outlook 2007

When permanently deleting an unread item by emptying the Deleted Items of a secondary mailbox Outlook 2007, if configured to prompt for sending of read receipts, will display a dialog box asking if the receipt should be sent.

If Outlook 2007 is configured to never prompt, and to always send read receipts, a receipt will be generated to the original sender as with Outlook 2003.

If Outlook 2007 is configured to never send a response, then no receipt is generated to the original sender.

Exchange Management Shell

So what about if I had gone with my original thought to use the Export-Mailbox cmdlet to do the job? It certainly would have taken less time to delete all of the email, but what about the “Not read” receipts?

As it turns out, according to my testing, the Export-Mailbox cmdlet will in fact cause a “Not read” receipt to be generated if it deletes an item that is unread and for which the original sender requested a read receipt.

So had I gone with my original thought it would have had the same outcome as the manual process I used instead.

In fact the only scenario in which the receipts would not have been generated is if I had used Outlook 2007 (our Citrix desktops still run Outlook 2003 unfortunately) and had first checked that the tracking options were set to “Never send a response”.

I’m curious whether the receipts would have been generated if I had used Export-Mailbox to export to PST first, and then simply deleted the PST file. That is something I still need to test.

I also have not tested Outlook 2010 though I suspect it will be the same as Outlook 2007.

Summary

The lessons I took away from this incident were:

Watch for creation of these types of “just in case” mailboxes that aren’t actually required
When they are required, make sure a maintenance routine is in place to manage their size
If using Outlook to delete bulk unread items, check first that read receipts are turned off in the tracking options

Get more Exchange Server tips at ExchangeServerPro.com

PowerShell Tip: Search for Commands by Keyword

Paul Cunningham — Tue, 16 Aug 2011 12:30:10 +0000

Here is a PowerShell tip that I rely on quite a lot. Sometimes I will have an admin task to perform but I can’t think of the exact PowerShell command to use. For example I know I want to perform some calendar administration, but I don’t remember the correct command.

Thanks to Get-Command I can quickly search for commands based on keywords. For example, to find all of the cmdlets with the keyword “calendar” in them:

[PS] C:\>Get-Command -Noun *calendar*

CommandType     Name                                                Definition
-----------     ----                                                ----------
Function        Get-CalendarDiagnosticLog                           ...
Function        Get-CalendarNotification                            ...
Function        Get-CalendarProcessing                              ...
Function        Get-MailboxCalendarConfiguration                    ...
Function        Get-MailboxCalendarFolder                           ...
Function        Set-CalendarNotification                            ...
Function        Set-CalendarProcessing                              ...
Function        Set-MailboxCalendarConfiguration                    ...
Function        Set-MailboxCalendarFolder                           ...
Function        Test-CalendarConnectivity                           ...

You can also search based on the “verb” of the commands, for example to find all commands that start with the “Test” verb:

[PS] C:\>Get-Command -Verb "Test"

CommandType     Name                                                Definition
-----------     ----                                                ----------
Function        Test-ActiveSyncConnectivity                         ...
Function        Test-AssistantHealth                                ...
Function        Test-CalendarConnectivity                           ...
Cmdlet          Test-ComputerSecureChannel                          Test-ComputerSecureChannel [-Repair] [-Server  [[-So...
Function        Test-EcpConnectivity                                ...
Function        Test-EdgeSynchronization                            ...
Function        Test-ExchangeSearch                                 ...
Function        Test-FederationTrust                                ...
Function        Test-FederationTrustCertificate                     ...
Function        Test-ImapConnectivity                               ...
Function        Test-IPAllowListProvider                            ...
Function        Test-IPBlockListProvider                            ...
Function        Test-IRMConfiguration                               ...
Function        Test-Mailflow                                       ...
Function        Test-MAPIConnectivity                               ...
Cmdlet          Test-ModuleManifest                                 Test-ModuleManifest [-Path]  [-Verbose] ...
Function        Test-MRSHealth                                      ...
Function        Test-OrganizationRelationship                       ...
Function        Test-OutlookConnectivity                            ...
Function        Test-OutlookWebServices                             ...
Function        Test-OwaConnectivity                                ...
Cmdlet          Test-Path                                           Test-Path [-Path]  [-Filter ] ...
Function        Test-PopConnectivity                                ...
Function        Test-PowerShellConnectivity                         ...
Function        Test-ReplicationHealth                              ...
Function        Test-SenderId                                       ...
Function        Test-ServiceHealth                                  ...
Function        Test-SmtpConnectivity                               ...
Function        Test-SystemHealth                                   ...
Function        Test-UMConnectivity                                 ...
Function        Test-WebServicesConnectivity                        ...
Cmdlet          Test-WSMan                                          Test-WSMan [[-ComputerName] ] [-Authenti...

So next time you’re scratching your head trying to think of the name of that PowerShell command, just give Get-Command a go.

Get more Exchange Server tips at ExchangeServerPro.com

How to Migrate a Relay Connector from Exchange Server 2007 to 2010

Paul Cunningham — Sat, 13 Aug 2011 13:09:42 +0000

In most organizations some applications or devices require the ability to relay email through Exchange servers.

The source IP addresses of applications and devices that integrate with Exchange using SMTP will need to be added to a Receive Connector that permits relay. Over time this can built up to quite a long list, which creates a tedious task of re-entering all of those IP addresses when you want to migrate this relay connector role, for example during a migration from Exchange 2007 to Exchange 2010.

However if you’d prefer a faster way of doing this you can effectively clone the remote IP address configuration from the existing Receive Connector to the new one by using the Exchange Management Shell.

On an Exchange 2010 server launch the Exchange Management Shell.

The first step is to retrieve the list of remote IP addresses from the existing receive connector by running the following command. This is a single line command, and you should replace the server name and connector name to suit your environment.

[PS] C:\>$ips = (Get-ReceiveConnector "HO-EX2007-HT1\Relay HO-EX2007-HT1").RemoteIPRanges

Next run the following command to create the new relay connector on the Exchange 2010 Hub Transport server with the same remote IP range. Again this is a single line command, and you should replace the server name and connector name to suit your environment.

[PS] C:\>New-ReceiveConnector -Name "Relay HO-EX2010-CAHT1" –Server HO-EX2010-CAHT1” -Usage Custom -AuthMechanism ExternalAuthoritative -PermissionGroups ExchangeServers -Bindings 0.0.0.0:25 -RemoteIPRanges $ips

Identity                                Bindings                           Enabled
--------                                --------                           -------
HO-EX2010-CAHT1\Relay HO-EX2010-CAHT1   {0.0.0.0:25}                       True

With that simple two step process the new relay connector has been created on the Exchange 2010 Hub Transport server with the same remote IP range as the original one.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2010: How to Report Who is Authorized to Send to a Distribution List

Paul Cunningham — Thu, 21 Jul 2011 10:50:29 +0000

In my article about restricting who can send to a distribution list Liz asked this question in the comments:

Is there a way to view a list of who is authorized to send to a distribution list once you have restricted it?

We have a good number of distribution lists within our company that are restricted and need a way to report on who is authorized to send without having to scroll and make screen shots every time HR wants to review them.

Exchange 2010 makes this easy thanks to the Exchange Management Shell. You can use Get-DistributionGroup to query a group for the message delivery restrictions.

Notice in this example that there are three attributes for AcceptMessagesOnlyFrom…

[PS] C:\>Get-DistributionGroup "All Staff" | fl name,accept*

Name                                   : All Staff
AcceptMessagesOnlyFrom                 : {exchangeserverpro.net/Company/Users/Branch Office/Aisha.Bhari}
AcceptMessagesOnlyFromDLMembers        : {}
AcceptMessagesOnlyFromSendersOrMembers : {exchangeserverpro.net/Company/Users/Branch Office/Aisha.Bhari}

If we look at the same group but this time configured to accept messages from members of a distribution list it looks like this.

[PS] C:\>Get-DistributionGroup "All Staff" | fl name,accept*

Name                                   : All Staff
AcceptMessagesOnlyFrom                 : {}
AcceptMessagesOnlyFromDLMembers        : {exchangeserverpro.net/Company/Groups/Administration Team}
AcceptMessagesOnlyFromSendersOrMembers : {exchangeserverpro.net/Company/Groups/Administration Team}

And now again the same group but this time configured to accept messages from both a single user and a distribution list.

[PS] C:\>Get-DistributionGroup "All Staff" | fl name,accept*

Name                                   : All Staff
AcceptMessagesOnlyFrom                 : {exchangeserverpro.net/Company/Users/Branch Office/Aisha.Bhari}
AcceptMessagesOnlyFromDLMembers        : {exchangeserverpro.net/Company/Groups/Administration Team}
AcceptMessagesOnlyFromSendersOrMembers : {exchangeserverpro.net/Company/Users/Branch Office/Aisha.Bhari, exchangeserver
                                         pro.net/Company/Groups/Administration Team}

As you can see the AcceptMessagesOnlyFrom attribute lists individual authorized senders, and the AcceptMessagesOnlyFromDLMembers attribute lists distribution lists that are authorized senders, and then both are shown in the AcceptMessagesOnlyFromSendersOrMembers attribute.

So for reporting purposes we can query the AcceptMessagesOnlyFromSendersOrMembers attribute.

[PS] C:\>Get-DistributionGroup "All Staff" | fl name,acceptmessagesonlyfromsendersormembers

Name                                   : All Staff
AcceptMessagesOnlyFromSendersOrMembers : {exchangeserverpro.net/Company/Users/Branch Office/Aisha.Bhari, exchangeserver
                                         pro.net/Company/Groups/Administration Team}

To list all distribution groups in the organization that are restricted for who can send to them you can run this command.

[PS] C:\>Get-DistributionGroup | where {$_.AcceptMessagesOnlyFromSendersOrMembers -ne $null} | fl name,acceptmessagesonlyfromsendersormembers

Name                                   : All Staff
AcceptMessagesOnlyFromSendersOrMembers : {exchangeserverpro.net/Company/Users/Branch Office/Aisha.Bhari, exchangeserver
                                         pro.net/Company/Groups/Administration Team}

Name                                   : Executives
AcceptMessagesOnlyFromSendersOrMembers : {exchangeserverpro.net/Company/Groups/Administration Team}

Get more Exchange Server tips at ExchangeServerPro.com

How to Modify Settings for Multiple Exchange 2010 Mailboxes

Paul Cunningham — Wed, 20 Jul 2011 12:58:51 +0000

When you are administering an Exchange Server environment one of the things you frequently need to do is change settings for multiple mailboxes that match specific criteria.

For example you may need to find all of the mailbox users in one office location so that you can add them all to a distribution group.

As another example you may need to find all mailbox users in a branch office to make sure that they are blocked from using non-cached mode Outlook.

The Exchange Management Console has a filtering feature that lets you create a view of mailbox that match a set of criteria. You can find this in the Recipient Configuration -> Mailbox node of the Exchange Management Console.

Filters can be created based on a pre-set series of attributes, and can also be created with multiple filter criteria.

You can select multiple mailbox users and then open the Properties of those mailboxes to perform bulk edits of some settings.

Although these filtered views are useful for some tasks there are also a lot of common administrative tasks that are not available to perform this way. Also, the Exchange Management Console does not allow you to filter by the complete set of mailbox attributes.

For more advanced Exchange administration you can use the Exchange Management Shell. For example to find the same list of mailboxes shown above you would run this Get-User command.

[PS] C:\>Get-User | where {$_.office -eq "Branch Office" -and $_.lastname -like "M*"}

Name                                                        RecipientType
----                                                        -------------
David.Marriott                                              UserMailbox
Dukh.Morgan                                                 UserMailbox
Sharnjit.Mcilroy                                            UserMailbox
Suki.Murray                                                 UserMailbox

But we can also use the shell to filter our queries on criteria that the management console does not give us access to. For example to list all mailboxes in the branch office that do not use the database default storage quota you would run this Get-Mailbox command.

[PS] C:\>Get-Mailbox | where {$_.office -eq "Branch Office" -and $_.UseDatabaseQuotaDefaults -eq $false}

Name                      Alias                ServerName       ProhibitSendQuota
----                      -----                ----------       -----------------
David.Marriott            David.Marriott       ex2010           unlimited
Dukh.Morgan               Dukh.Morgan          ex2010           unlimited
Kelly.Chatir              Kelly.Chatir         ex2010           unlimited
Neville.Sherwin           Neville.Sherwin      ex2010           unlimited
Sharnjit.Mcilroy          Sharnjit.Mcilroy     ex2010           unlimited
Suki.Murray               Suki.Murray          ex2010           unlimited

Because the shell gives us so much more flexibility in how we query Exchange it makes it a more powerful tool for performing bulk edits.

Taking the examples from the start of this article here is how you can achieve those outcomes.

The first example is adding all users in a particular office to a distribution group. We know that we can query Exchange for all users in “Head Office” with this command:

[PS] C:\>Get-Mailbox | where {$_.office -eq "Head Office"}

So here is how I would add them all to the “Head Office Staff” distribution group that already exists.

[PS] C:\>$headofficeusers = Get-Mailbox | where {$_.office -eq "Head Office"}

[PS] C:\>$headofficeusers.count
367

[PS] C:\>$headofficeusers | Add-DistributionGroupMember -Identity "Head Office Staff"

I can then quickly check the outcome.

[PS] C:\>$members = Get-DistributionGroupMember -Identity "Head Office Staff"

[PS] C:\>$members.Count
367

The second example is configuring branch office users to be blocked from connecting with non-cached mode Outlook clients. Here is how I would perform that task.

[PS] C:\>$branchusers = Get-Mailbox | where {$_.office -eq "Branch Office"}

[PS] C:\>$branchusers.Count
20

I want to filter them further down to only the users not currently blocked from using non-cached mode.

[PS] C:\>$branchusers = $branchusers | Get-CASMailbox | where {$_.MAPIBlockOutlookNonCachedMode -eq $false}

[PS] C:\>$branchusers.Count
19

Now to perform the bulk edit to disable non-cached mode Outlook for the 19 branch office users who are currently not blocked.

[PS] C:\>$branchusers | Set-CASMailbox -MAPIBlockOutlookNonCachedMode $true

As you can see the Exchange Management Shell is a very powerful tool for Exchange administrators especially when performing bulk administration tasks.

Get more Exchange Server tips at ExchangeServerPro.com

How to Calculate Exchange 2010 Mailbox Sizes with PowerShell

Paul Cunningham — Wed, 06 Jul 2011 11:00:09 +0000

The Exchange Management Shell, powered by PowerShell, makes it easy to collect size information for the mailboxes in an Exchange 2010 organization.

For example, to list the sizes of all mailboxes on a particular database we can use this command.

[PS] C:\>Get-Mailbox -Database MB-HO-01 | Get-MailboxStatistics | ft displayname,totaldeleteditemsize,totalitemsize

DisplayName      TotalDeletedItemSize    TotalItemSize
-----------      --------------------    -------------
Administrator    0 B (0 bytes)           85.42 KB (87,468 bytes)
Alan Reid        80.08 KB (82,000 bytes) 30.9 MB (32,400,667 bytes)
Alex Heyne       12.35 KB (12,644 bytes) 8.734 MB (9,158,159 bytes)
Aisha Bhari      0 B (0 bytes)           190.4 KB (194,983 bytes)
Aleisha Harrison 0 B (0 bytes)           142.4 KB (145,797 bytes)

If we wanted to know the total size of all of those mailboxes we could output the data to CSV file, import it into Excel, and use formulas to get the results. However that is time-consuming if all you are after is a quick answer.

So instead we can use the Measure-Object command in PowerShell to get the answers we’re looking for. However if we try to use it with the data shown above we’ll get this error.

Measure-Object : Input object "79.95 KB (81,870 bytes)" is not numeric.

So first we need to convert the data into numeric form.

For example, to see the sum, average, minimum and maximum size of the “total item size” for the mailboxes above we run this command.

[PS] C:\>Get-Mailbox -Database MB-HO-01 | Get-MailboxStatistics | %{$_.TotalItemSize.Value.ToMB()} | Measure-Object -sum
 -average -max -min

Count    : 5
Average  : 7.6
Sum      : 38
Maximum  : 30
Minimum  : 0
Property :

Get more Exchange Server tips at ExchangeServerPro.com

How to List all Users Who Have Access to Other Exchange Mailboxes

Paul Cunningham — Sat, 02 Jul 2011 11:27:59 +0000

While preparing for an Exchange Server 2007 to 2010 migration I needed to work out which users had been granted access to other mailboxes. This applied both to shared mailboxes (eg a Help Desk) and individual mailbox access (eg a personal assistant with access to the CEO’s mailbox).

Exchange 2007/2010 provide the Get-MailboxPermission cmdlet that can be used to query the permissions on a mailbox. For example:

Get-MailboxPermission helpdesk

Identity             User                 AccessRights        IsInherited Deny
--------             ----                 ------------        ----------- ----
exchangeserverpro... NT AUTHORITY\SELF    {FullAccess, Rea... False       False
exchangeserverpro... ESPNET\Alex.Heyne    {FullAccess}        False       False
exchangeserverpro... ESPNET\Debbie.Lisa   {FullAccess}        False       False
exchangeserverpro... ESPNET\Kevin.Douglas {FullAccess}        False       False

To get the same information about all of the mailboxes in the environment we could run this command.

Get-Mailbox | Get-MailboxPermission

Identity             User                 AccessRights        IsInherited Deny
--------             ----                 ------------        ----------- ----
exchangeserverpro... NT AUTHORITY\SELF    {FullAccess, Rea... False       False
exchangeserverpro... ESPNET\BR-EX2007-MB$ {ReadPermission}    True        False
exchangeserverpro... ESPNET\Exchange S... {FullAccess}        True        True
exchangeserverpro... ESPNET\Domain Admins {FullAccess}        True        True
exchangeserverpro... ESPNET\Enterprise... {FullAccess}        True        True
exchangeserverpro... ESPNET\Exchange O... {FullAccess}        True        True
exchangeserverpro... ESPNET\administrator {FullAccess}        True        True
exchangeserverpro... ESPNET\Exchange S... {FullAccess}        True        False
exchangeserverpro... ESPNET\Exchange P... {ReadPermission}    True        False
exchangeserverpro... NT AUTHORITY\NETW... {ReadPermission}    True        False
exchangeserverpro... ESPNET\Exchange S... {ReadPermission}    True        False
exchangeserverpro... ESPNET\Exchange V... {ReadPermission}    True        False
exchangeserverpro... ESPNET\Exchange O... {FullAccess, Del... True        False
exchangeserverpro... ESPNET\administrator {FullAccess, Del... True        False
exchangeserverpro... ESPNET\Enterprise... {FullAccess, Del... True        False
exchangeserverpro... ESPNET\Domain Admins {FullAccess, Del... True        False
.....

The problem with that is it gives us more information than we really need, with a lot of SELF permissions and inherited permissions that aren’t relevant to the task we’re trying to accomplish.

You could export the output to CSV and manipulate it using Excel to get just the permissions information you want, but another method is to filter the PowerShell output.

For example, to filter out all of the SELF permissions and the inherited permissions we can run this command.

Get-Mailbox | Get-MailboxPermission | where {$_.user.tostring() -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false}

That gives us a much smaller output that is more useful.

Identity             User                 AccessRights        IsInherited Deny
--------             ----                 ------------        ----------- ----
exchangeserverpro... ESPNET\Alannah.Shaw  {FullAccess}        False       False
exchangeserverpro... ESPNET\Payroll Team  {FullAccess}        False       False
exchangeserverpro... ESPNET\Alex.Heyne    {FullAccess}        False       False
exchangeserverpro... ESPNET\Debbie.Lisa   {FullAccess}        False       False
exchangeserverpro... ESPNET\Kevin.Douglas {FullAccess}        False       False

The Identity field contains long strings because it includes the full directory path to the mailbox user, so it may get truncated on your screen. In that case you could export the output to CSV file.

Get-Mailbox | Get-MailboxPermission | where {$_.user.tostring() -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false} | Export-Csv -NoTypeInformation mailboxpermissions.csv

The trouble you may notice with that is that the access rights do not appear correctly in the output CSV file.

AccessRights,Deny,InheritanceType,User,Identity,IsInherited,IsValid,ObjectState
Microsoft.Exchange.Management.RecipientTasks.MailboxRights[],False,All,ESPNET\Alannah.Shaw,"exchangeserverpro.net/Company/Head Office/Users/Mark.Patel",False,True,Unchanged
Microsoft.Exchange.Management.RecipientTasks.MailboxRights[],False,All,"ESPNET\Payroll Team","exchangeserverpro.net/Company/Head Office/Users/Payroll",False,True,Unchanged
Microsoft.Exchange.Management.RecipientTasks.MailboxRights[],False,All,ESPNET\Alex.Heyne,"exchangeserverpro.net/Users/Help Desk",False,True,Unchanged
Microsoft.Exchange.Management.RecipientTasks.MailboxRights[],False,All,ESPNET\Debbie.Lisa,"exchangeserverpro.net/Users/Help Desk",False,True,Unchanged
Microsoft.Exchange.Management.RecipientTasks.MailboxRights[],False,All,ESPNET\Kevin.Douglas,"exchangeserverpro.net/Users/Help Desk",False,True,Unchanged

So to fix that we need to use a slightly different command. This single-line command will export to CSV a list of any mailboxes where other users have permissions to access them, and will also list what level of access those users have.

Get-Mailbox | Get-MailboxPermission | where {$_.user.tostring() -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false} | Select Identity,User,@{Name='Access Rights';Expression={[string]::join(', ', $_.AccessRights)}} | Export-Csv -NoTypeInformation mailboxpermissions.csv

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2007/2010: How to Clone a Mailbox Database Configuration

Paul Cunningham — Fri, 17 Jun 2011 13:26:43 +0000

I was setting up a new Exchange Server 2007 cluster today and decided to share this technique I use to save time configuring the mailbox databases.

Since the clusters we build tend to have a lot of storage groups and databases on them (25 for the one I worked on today) some automation really speeds things up.

Firstly I always use a script to create the storage groups and mailbox databases. This is pretty easy, especially when you have naming standards that let you do a find/replace on the script as you use it from server to server.

The cmdlets for these operations are New-StorageGroup and New-MailboxDatabase. You’ll find a very old sample script of mine here that demonstrates how they can be scripted.

Secondly I use a few shell commands to clone the database configuration from an existing mailbox database. By that I mean settings such as the mailbox retention, deleted items retention, storage quotas, offline address book, and public folders. These are settings that we typically keep the same across all the Exchange clusters.

First I collect the settings from an existing mailbox database into an array.

$a = Get-MailboxDatabase  [name of database to clone]

The various settings can then be referenced in the array, such as $a.PublicFolderDatabase.

Once I’ve done that there are two ways to apply it to other mailbox databases. I can apply it to a single database like this.

Set-MailboxDatabase [new mailbox database name] -OfflineAddressBook $a.OfflineAddressBook -PublicFolderDatabase $a.PublicFolderDatabase -IssueWarningQuota $a.IssueWarningQuota -ProhibitSendQuota $a.ProhibitSendQuota -ProhibitSendReceiveQuota $a.ProhibitSendReceiveQuota -MailboxRetention $a.MailboxRetention -DeletedItemRetention $a.DeletedItemRetention

Or, as I did today, I can apply it to all of the mailbox databases on a given server.

Get-MailboxDatabase -server [new server name] | Set-MailboxDatabase -OfflineAddressBook $a.OfflineAddressBook -PublicFolderDatabase $a.PublicFolderDatabase -IssueWarningQuota $a.IssueWarningQuota -ProhibitSendQuota $a.ProhibitSendQuota -ProhibitSendReceiveQuota $a.ProhibitSendReceiveQuota -MailboxRetention $a.MailboxRetention -DeletedItemRetention $a.DeletedItemRetention

As you can see the Exchange Management Shell really does make it easy to administer Exchange 2007 and 2010 environments.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Exchange Management Shell

PowerShell Script: Check Exchange 2010 Database Backups

Related posts:

Using Test-ServiceHealth for Exchange Server Health Checks

Related posts:

The Case of the 24,368 Read Receipts

Outlook 2003

Outlook 2007

Exchange Management Shell

Summary

Related posts:

PowerShell Tip: Search for Commands by Keyword

Related posts:

How to Migrate a Relay Connector from Exchange Server 2007 to 2010

Related posts:

Exchange 2010: How to Report Who is Authorized to Send to a Distribution List

Related posts:

How to Modify Settings for Multiple Exchange 2010 Mailboxes

Related posts:

How to Calculate Exchange 2010 Mailbox Sizes with PowerShell

Related posts:

How to List all Users Who Have Access to Other Exchange Mailboxes

Related posts:

Exchange 2007/2010: How to Clone a Mailbox Database Configuration

Related posts: