If Exchange can’t access the CRL, the certificate status is returned as RevocationCheckFailure by the shell. In EMC this is displayed as The certificate status could not be determined because the revocation check failed.

When a certificate fails a revocation check due to any of the above reasons, the EMC prevents you from assigning the certificate to any Exchange service. Note, this does not impact certificates that have already been assigned to Exchange services. The services will continue to function.

- Source

Two of the causes of this are listed as:

# Network or proxy misconfiguration, or a firewall rule preventing Internet access

# Intentional blocking of Internet connectivity from the server

In a comment on the post I mention using proxy settings to work around the issue.  In other words, if you can use a proxy in Internet Explorer to browse the web when you’re logged onto the server, then you can use this workaround.  However, you need to proceed with caution or you may inadvertently break your management connection to the Exchange server.

Firstly, you can check the server’s proxy settings using the netsh command (proxycfg is no longer available in Windows Server 2008 R2).

C:\>netsh winhttp show proxy

Current WinHTTP proxy settings:

    Direct access (no proxy server).

Note: if you can resolve the direct access issue at your proxy/firewall then that is going to be easier than using this procedure. Otherwise, read on.

If you have the correct proxy settings configure in Internet Explorer then netsh lets you import that configuration to the server.

C:\>netsh winhttp import proxy ie

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  (none)

Depending on your environment you may find that this breaks you connection to the Exchange server using either the Exchange Management Console or Exchange Management Shell.

VERBOSE: Connecting to ex1.exchangeserverpro.local
[ex1.exchangeserverpro.local] Connecting to remote server failed with the following error message : The client cannot c
onnect to the destination specified in the request. Verify that the service on the destination is running and is accept
ing requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonl
y IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and co
nfigure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportExc
   eption
    + FullyQualifiedErrorId : PSSessionOpenFailed

The reason for this is that the Exchange Management Shell is trying to make a remote connection to the server, even when you are logged on to the server that you want to manage. This is known as Remote Shell and you can read more about it here.

You can see here that when I launch the Exchange Management Shell on my lab server there are corresponding entries in the IIS log files for the connection that I just made to the /powershell virtual directory.

The reason that this breaks your management connectivity to the server is that the proxy you are using is not correctly configured to let you access local websites. Fortunately you can resolve this by using proxy exceptions on your local Internet Explorer settings.

If I configure Internet Explorer to automatically bypass for local sites, and then re-import the settings to the server with netsh, I see different output.

C:\>netsh winhttp import proxy ie

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  < local >

In some cases this still might not work if Internet Explorer is not correctly detecting local sites and bypassing the configured proxy. In that case you can manually specify the proxy exceptions in Internet Explorer.

Again when you re-import using netsh you see a different result.

C:\>netsh winhttp import proxy ie

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  *.exchangeserverpro.local;< local >

Alternatively, you can set a proxy configuration for the server that is different to that of your own Internet Explorer settings.

C:\>netsh winhttp set proxy proxy-server="http://10.10.10.10:80" bypass-list="*.exchangeserverpro.local"

Current WinHTTP proxy settings:

    Proxy Server(s) :  10.10.10.10:80
    Bypass List     :  *.exchangeserverpro.local

Again you need to make sure you set the correct exceptions so that management connectivity to the server isn’t broken in the process.

If you can get the proxy settings configured with the right proxy and exceptions you should be able to connect to the server with the console and shell, and also have the server successfully perform CRL checks for your SSL certificates.

Related posts:

• Browsing Mailbox Databases in Exchange 2007 and 2010
• SSL Certificate Trust Errors for New Thawte Certificates
• Exchange Server 2010 and the Benefits of Commercial SSL Certificates
• How to Issue a SAN Certificate to Exchange Server 2010 from a Private Certificate Authority
• Exchange Server 2010 “The Certificate is Invalid for Exchange Server Usage” Error

This article Exchange 2010 Certificate Revocation Checks and Proxy Settings is © 2010 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

((Alias -ne $null -and RecipientType -ne 'MailUser') -and ((((ObjectClass -eq 'user' -or ObjectClass
-eq 'Contact' -or ObjectClass -eq 'msExchSystemMailbox') -or ObjectClass -eq 'msExchDynamicDistributi
onList') -or ObjectClass -eq 'group') -or ObjectClass -eq 'publicFolder'))

You can see that the following object classes are included:

• User
• Contact
• System Mailbox
• Dynamic Distribution Group
• Group
• Public Folder

In some environments it may be desirable to exclude Mail Users.  Mail Users are similar to Contacts in that they do not have a mailbox in the local Exchange organization, however unlike Contacts they do have a user account in Active Directory.

In other words, Mail Users are mail-enabled user objects that use an external email service.

Mail Users are displayed in the same area of the Exchange Management Console as regular Contacts, which may lead you to think that excluding them from the Global Address List is as simple as removing this part of the recipient filter:

-or ObjectClass -eq ‘Contact’

However that is not correct, and will not remove Mail Users from the Global Address List.  To understand how to actually do this take a closer look at the attributes of a Mailbox User and a Mail User.

[PS] C:\>get-mailbox "John Smith" | fl objectclass, recipienttype

ObjectClass   : {top, person, organizationalPerson, user}
RecipientType : UserMailbox

[PS] C:\>get-mailuser "Peter Banes" | fl objectclass, recipienttype

ObjectClass   : {top, person, organizationalPerson, user}
RecipientType : MailUser

Notice that both are the same ObjectClass of ‘user’, which would still be included in the recipient filter if you were to simply remove the ‘Contact’ object class.

Instead, to remove Mail Users from the Global Address List you should exclude them by Recipient Type. You can do this by including the following condition in your recipient filter:

RecipientType -ne ‘MailUser’

For example:

Set-GlobalAddressList "Default Global Address List" -RecipientFilter {(Alias -ne $null -and RecipientType -ne 'MailUser' -and (ObjectClass -eq 'user' -or ObjectClass -eq 'Contact' -or ObjectClass -eq 'msExchSystemMailbox' -or ObjectClass -eq 'msExchDynamicDistributionList' -or ObjectClass -eq 'group' -or ObjectClass -eq 'publicFolder'))}

If you’re making this change to the default Global Address List see my previous post with the solution to the error that occurs when modifying the default Global Address List.

Related posts:

• Unable to Modify Default Global Address List
• How to Enter the Exchange Server 2010 Product Key for Multiple Servers
• How to Use a Specific Domain Controller in Exchange 2010 Management Shell
• Exchange 2010 Certificate Revocation Checks and Proxy Settings
• Error “Object is Read Only” During Exchange Server 2007 Public Folder Database Removal

This article How to Remove Mail Users from the Global Address List is © 2010 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

You can’t peform this operation on default global address list “Default Global Address List”.

The recipient filter of the default Global Address List can be modified once during conversion from Exchange 2003 but not after that.  If you want to change the default Global Address List recipient filter after that you must either:

• Create a new Global Address List with the desired recipient filter
• Temporarily modify the Global Address List so that it isn’t the default

For the second option you can refer back to my earlier post on fixing  the issue where there is no default Global Address List in the organization.  This is determined by the msExchRecipientFilterFlags attribute of the object.

Simply use ADSIEdit.msc to modify the attribute from 3 to 0, apply the change to the Global Address List recipient filter, then return to ADSIEdit.msc and set the flag back to 3.  For more detailed instructions check out my previous post.

Related posts:

• How to Remove Mail Users from the Global Address List
• How to Enter the Exchange Server 2010 Product Key for Multiple Servers
• How to Use a Specific Domain Controller in Exchange 2010 Management Shell
• Exchange 2010 Certificate Revocation Checks and Proxy Settings
• Error “Object is Read Only” During Exchange Server 2007 Public Folder Database Removal

This article Unable to Modify Default Global Address List is © 2010 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

If you are attempting the removal via the Exchange Management Shell the same warning is presented.

[PS] C:\>Remove-MailboxDatabase "Mailbox Database"
Remove-MailboxDatabase : This mailbox database contains one or more mailboxes.
To get a list of all mailboxes in this database, run the command Get-Mailbox -D
atabase . To disable a mailbox so that you can delete the mailbox
database, run the command Disable-Mailbox
At line:1 char:23
+ Remove-MailboxDatabase  <<<< "Mailbox Database"

A similar warning will appear if you attempt to uninstall the Exchange Server product from the server while it still hosts active mailboxes in one of its databases.

Click to enlarge

However in some scenarios the Exchange server will not warn of active mailboxes, and will allow you to remove the database or the entire Exchange Server product from the server.  This behaviour can occur in multi-Domain Forests.

Example Multi-Domain Forest and Exchange Organization

In this example the mycompany.com Forest consists of two domains:

• mycompany.com (the Forest root domain)
• branch.mycompany.com

The Exchange server EX2007 is installed in the Forest root domain.  In the real world this might also be installed in a resource Domain in the Forest, fairly common for large enterprises especially those that have undergone mergers, domain consolidations, or have multiple subsidiaries.

There are mailbox users in both Domains in the Forest, and for the purposes of this demonstration they have been deployed onto two mailbox databases:

• “Mailbox Database 1″ contains mycompany.com mailbox users
• “Mailbox Database 2″ contains branch.mycompany.com mailbox users

Administrative Tasks and Recipient Scope

Logged on to the Exchange server EX2007 as a mycompany.com administrator the following Exchange Management Shell command is run to view a list of mailboxes.

[PS] C:\>Get-MailboxDatabase | get-mailbox

Name                      Alias                ServerName       ProhibitSendQuo
                                                                ta
----                      -----                ----------       ---------------
headoffice user           headoffice.user      ex2007           unlimited

The command does not display all mailboxes within the Exchange Organization. The same command run a second time with the -IgnoreDefaultScope parameter has different output.

[PS] C:\>Get-MailboxDatabase | get-mailbox -IgnoreDefaultScope

Name                      Alias                ServerName       ProhibitSendQuo
                                                                ta
----                      -----                ----------       ---------------
branch user               branch.user          ex2007           unlimited
headoffice user           headoffice.user      ex2007           unlimited

The same situation occurs when listing mailboxes on the “Mailbox Database 2″ database. Note how the first command returns no results, but the second command returns the expected results.

[PS] C:\>get-mailbox -database "mailbox database 2"
[PS] C:\>
[PS] C:\>get-mailbox -database "mailbox database 2" -IgnoreDefaultScope

Name                      Alias                ServerName       ProhibitSendQuo
                                                                ta
----                      -----                ----------       ---------------
branch user               branch.user          ex2007           unlimited

This is due to the concept of Recipient Scope. From Microsoft Technet:

Recipient scope refers to the specified portion of the Active Directory directory service hierarchy that the Exchange Management Console and the Exchange Management Shell will use for recipient management. When you set the recipient scope to a specific location within Active Directory, you can view and manage all recipients stored in that location and all of the containers under it.

When you set the recipient scope, the management interface you are using operates within the recipient scope that you specified.

Recipient scope can be controlled on a per-cmdlet basis using the -IgnoreDefaultScope parameter as demonstrated above.  It can also be applied to an entire Exchange Management Shell session using the $AdminSessionADSettings variable.

[PS] C:\>$adminsessionadsettings

ViewEntireForest              : False
DefaultScope                  : mycompany.com
PreferredGlobalCatalog        :
ConfigurationDomainController : ex2007.mycompany.com
PreferredDomainControllers    : {}

Changing the ViewEntireForest field to $true expands the recipient scope to be Forest-wide, and overrides the DefaultScope field. If ViewEntireForest is left as $false the DefaultScope value applies.

Within a single Exchange Management Shell session the field an be modified as desired:

[PS] C:\>$adminsessionadsettings.viewentireforest = $true

The shell command run earlier to view mailboxes on “Mailbox Database 2″ now returns the expected result without requiring the -IgnoreDefaultScope parameter.

[PS] C:\>Get-MailboxDatabase "Mailbox Database 2" | Get-Mailbox

Name                      Alias                ServerName       ProhibitSendQuo
                                                                ta
----                      -----                ----------       ---------------
branch user               branch.user          ex2007           unlimited

Changes made to $AdminSessionADSettings within the shell are applicable only to that session. Once the shell window is closed and reopened the previous values are restored. To make the change permanent, edit the Bin\Exchange.ps1 file in the Exchange installation folder.

Open the file in a text editor and look for this line. Change the value from $false to $true and then save the file again.

$global:AdminSessionADSettings.ViewEntireForest = $true

The next Exchange Management Shell window you launch will now have this setting configured.

[PS] C:\>$AdminSessionADSettings

ViewEntireForest              : True
DefaultScope                  :
PreferredGlobalCatalog        :
ConfigurationDomainController : ex2007.mycompany.com
PreferredDomainControllers    : {}

[PS] C:\>Get-MailboxDatabase "Mailbox Database 2" | Get-Mailbox

Name                      Alias                ServerName       ProhibitSendQuo
                                                                ta
----                      -----                ----------       ---------------
branch user               branch.user          ex2007           unlimited

As you can see, the command issued to list all mailboxes on “Mailbox Database 2″ again returns the expected results.

The modification to Exchange.ps1 also applies to the Exchange Management Console.  Here a newly launched console session is shown to already be set to “Entire Forest” scope.

Recipient Scope Not Applicable to all Administrative Actions

Despite the Forest-wide scope for the shell and console sessions, “Mailbox Database 2″ containing active mailboxes in the branch.mycompany.com domain can still be removed.  Note how the server prevents removal of “Mailbox Database 1″, but not “Mailbox Database 2″.

[PS] C:\>remove-mailboxdatabase "Mailbox Database 1"
Remove-MailboxDatabase : This mailbox database contains one or more mailboxes.
To get a list of all mailboxes in this database, run the command Get-Mailbox -D
atabase . To disable a mailbox so that you can delete the mailbox
database, run the command Disable-Mailbox
At line:1 char:23
+ remove-mailboxdatabase  <<<< "Mailbox Database 1" [PS] C:\>

[PS] C:\>remove-mailboxdatabase "Mailbox Database 2"

Confirm
Are you sure you want to perform this action?
Removing Mailbox Database "ex2007.mycompany.com\Mailbox Database 2".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help
(default is "Y"):y
WARNING: The specified database has been removed. You must remove the database
file located in C:\Program Files\Microsoft\Exchange Server\Mailbox\Third
Storage Group\Mailbox Database 21.edb from your computer manually if it exists.
 Specified database: Mailbox Database 2

The impact of this is the mailbox users in branch.mycompany.com that were on “Mailbox Database 2″ now have corrupted Exchange attributes.

Click to enlarge

Recipient Scope Not Applicable to Exchange Server Uninstall

Similar to the database removal process, the removal of the Mailbox Server role also generates a warning for active mailboxes in the same domain as the Exchange server, as seen in the screenshot at the beginning of this post.

However, even with the shell and console defaulting to Forest-wide scope for some administrative actions, this does not always apply to removal of the Mailbox Server role.

In this example the mailbox users in mycompany.com have been removed or migrated to another server, but mailbox users in branch.mycompany.com remain on “Mailbox Database 2″.  Despite this, the Exchange server will permit the removal of the Mailbox Server role.

Click to enlarge

As you can see the setup routine has passed its pre-requisite checks and is ready to proceed with the uninstall, even though active mailboxes are shown to still be on “Mailbox Database 2″.

The Exchange setup log records that the Active Directory session settings are Forest-wide, and that a status check is performed on “Mailbox Database 2″, but the active mailboxes are not detected.

[2/17/2010 3:48:32 PM] [1] Beginning processing.
[2/17/2010 3:48:32 PM] [1] Administrator Active Directory session settings are:  View Entire Forest: 'True', Configuration Domain Controller: 'ex2007.mycompany.com', Preferred Global Catalog: 'ex2007.mycompany.com', Preferred Domain Controllers: '{ ex2007.mycompany.com }'
[2/17/2010 3:48:32 PM] [1] Searching objects "EX2007\Third Storage Group\Mailbox Database 2" of type "MailboxDatabase" under the root "$null".
[2/17/2010 3:48:32 PM] [1] Previous operation run on domain controller 'ex2007.mycompany.com'.
[2/17/2010 3:48:32 PM] [1] Verifying that there is no associated mailbox user on the mailbox database "EX2007\Third Storage Group\Mailbox Database 2".
[2/17/2010 3:48:32 PM] [1] Establishing the Admin RPC connection with Server "ex2007.mycompany.com".
[2/17/2010 3:48:32 PM] [1] Checking the status of database "EX2007\Third Storage Group\Mailbox Database 2".
[2/17/2010 3:48:32 PM] [1] Ending processing.

Checking for Active Mailboxes Before Removing Databases

With the above behaviour in mind it is wise to perform manual checks before removing mailbox databases.  You can check the status of an individual mailbox database with this command:

[PS] C:\>Get-MailboxDatabase "Mailbox Database 2" | Get-Mailbox -IgnoreDefaultScope

Or if the $AdminSessionADSettings are set to Forest-wide:

[PS] C:\>Get-MailboxDatabase "Mailbox Database 2" | Get-Mailbox

Before uninstalling the Mailbox Server role you can also check the entire server for active mailboxes with this command:

[PS] C:\>Get-Mailbox -Server EX2007 -IgnoreDefaultScope

Or again, if the $AdminSessionADSettings are set to Forest-wide:

[PS] C:\>Get-Mailbox -Server EX2007

Notes on Testing Environment

These scenarios were tested with Exchange Server 2007 Service Pack 2, with Update Rollup 2, on Windows Server 2008 servers.  The Forest topology was configured per the diagram earlier in the post.

Related posts:

• COM Class Factory Error 8007007E Moving Mailboxes in Exchange Server 2007
• MapiExceptionCallFailed ec=-2147467259 Mounting Exchange Server 2007 Mailbox Database
• Browsing Mailbox Databases in Exchange 2007 and 2010
• How to Enable AutoAccept on Multiple Exchange 2007 Room Mailboxes
• How to Modify Recipient Scope in the Exchange Management Shell

This article Exchange Server 2007 May Not Warn of Active Mailboxes When Removing Databases is © 2010 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

The nearest equivalent feature in the Exchange Management Console is using filters in the Recipient Configuration/Mailboxes section of the console.

However this feature does not expose mailbox statistics such as item count and total size.  For those types of details we can use the Exchange Management Shell instead.

For example, we can view the mailbox databases in the organization.

[PS] C:\>Get-MailboxDatabase

Name                           Server          Recovery        ReplicationType
----                           ------          --------        ---------------
Mailbox Database 1             EXCH2010-TEST   False           None
Mailbox Database 2             EXCH2010-TEST   False           None
Mailbox Database 3             EXCH2010-TEST   False           None
Mailbox Database 4             EXCH2010-TEST   False           None

Or to look at the mailboxes within a given database we can pipe one shell command into another.

[PS] C:\>Get-MailboxDatabase "Mailbox Database 1" | Get-Mailbox -ResultSize 15

Name                      Alias                ServerName       ProhibitSendQuota
----                      -----                ----------       -----------------
Administrator             Administrator        exch2010-test    unlimited
Aisha.Bhari               Aisha.Bhari          exch2010-test    unlimited
Alan.Reid                 Alan.Reid            exch2010-test    unlimited
Alannah.Shaw              Alannah.Shaw         exch2010-test    unlimited
Aldith.Walker             Aldith.Walker        exch2010-test    unlimited
Aleisha.Harrison          Aleisha.Harrison     exch2010-test    unlimited
Alex.Heyne                Alex.Heyne           exch2010-test    unlimited
Alice.Mullins             Alice.Mullins        exch2010-test    unlimited
Alison.Pugh               Alison.Pugh          exch2010-test    unlimited
Alison.Lindsay            Alison.Lindsay       exch2010-test    unlimited
Almaz.Duggan              Almaz.Duggan         exch2010-test    unlimited
Amanda.Watters            Amanda.Watters       exch2010-test    unlimited
WARNING: There are more results available than are currently displayed. To view them, increase the value for the
ResultSize parameter.

We can also look at statistics such as item count and total mailbox size of all mailboxes in a given database.

[PS] C:\>Get-MailboxDatabase "Mailbox Database 1" | Get-MailboxStatistics | Sort totalitemsize -desc | ft displayname, totalitemsize, itemcount

DisplayName                             TotalItemSize                                                         ItemCount
-----------                             -------------                                                         ---------
Administrator                           1.402 GB (1,505,666,188 bytes)                                            72179
EXCH2010-TEST 4FE1F90C-LGU000009        84.46 MB (88,567,215 bytes)                                                2977
EXCH2010-TEST 4FE1F90C-LGU000012        77.23 MB (80,986,155 bytes)                                                2568
EXCH2010-TEST 4FE1F90C-LGU000011        71.99 MB (75,483,699 bytes)                                                2489
EXCH2010-TEST 4FE1F90C-LGU000010        70.77 MB (74,204,704 bytes)                                                2523
EXCH2010-TEST 4FE1F90C-LGU000019        54.73 MB (57,390,302 bytes)                                                1917
EXCH2010-TEST 4FE1F90C-LGU000001        51.48 MB (53,980,482 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000020        51.15 MB (53,634,243 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000015        50.92 MB (53,394,939 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000008        50.69 MB (53,153,806 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000016        50.68 MB (53,138,572 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000014        50.62 MB (53,079,853 bytes)                                                1741
EXCH2010-TEST 4FE1F90C-LGU000017        50.58 MB (53,035,273 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000005        50.53 MB (52,980,645 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000004        50.35 MB (52,795,218 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000000        50.31 MB (52,755,053 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000002        50.06 MB (52,490,485 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000023        50.05 MB (52,486,337 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000022        50.03 MB (52,464,722 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000003        49.87 MB (52,292,132 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000021        49.75 MB (52,170,805 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000007        49.6 MB (52,006,854 bytes)                                                 1725
EXCH2010-TEST 4FE1F90C-LGU000024        49.44 MB (51,841,314 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000018        49.31 MB (51,709,283 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000006        48.64 MB (50,999,424 bytes)                                                1725
EXCH2010-TEST 4FE1F90C-LGU000013        29.46 MB (30,886,139 bytes)                                                 995

Alternatively, we can take a closer look at the mailbox statistics for one specific mailbox.

[PS] C:\>Get-MailboxStatistics -identity Administrator | fl

RunspaceId              : c3678368-5798-4340-8a0a-ab3f721b1a97
AssociatedItemCount     : 131
DeletedItemCount        : 0
DisconnectDate          :
DisplayName             : Administrator
ItemCount               : 72179
LastLoggedOnUserAccount : DOMAIN\Administrator
LastLogoffTime          :
LastLogonTime           : 1/14/2010 2:19:58 PM
LegacyDN                : /O=TEST ORG/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=ADMINISTRATOR
MailboxGuid             : 9658e261-c681-40ac-ad6d-515791e28203
ObjectClass             : Mailbox
StorageLimitStatus      : BelowLimit
TotalDeletedItemSize    : 0 B (0 bytes)
TotalItemSize           : 1.402 GB (1,505,666,188 bytes)
Database                : Mailbox Database 1
ServerName              : EXCH2010-TEST
DatabaseName            : Mailbox Database 1
MoveHistory             :
IsQuarantined           : False
IsArchiveMailbox        : False
Identity                : 9658e261-c681-40ac-ad6d-515791e28203
MapiIdentity            : 9658e261-c681-40ac-ad6d-515791e28203
OriginatingServer       : exch2010-test.domain.local
IsValid                 : True

One of the common tasks that the Exchange Server 2003 System Manager was used for was exporting lists of mailbox users into CSV format for reporting in Excel. We can still achieve this in the Exchange Management Shell by exporting output to a CSV file.

[PS] C:\>Get-MailboxDatabase "Mailbox Database 1" | Get-MailboxStatistics | Sort totalitemsize -desc | ft displayname, totalitemsize, itemcount | Export-CSV C:\mailboxes.csv

The CSV output is formated correctly for easy import into Microsoft Excel.

As you can see although it may seem less intuitive than the previous method of browsing through a GUI the Exchange Management Shell actually makes it much simpler and easier to gather information about the mailboxes in your organization.

Related posts:

• Exchange 2010 Certificate Revocation Checks and Proxy Settings
• How to Modify Recipient Scope in the Exchange Management Shell
• Error “Object is Read Only” During Exchange Server 2007 Public Folder Database Removal
• Which Version of Exchange Am I Running?
• How to Add Remote IP Addresses to Existing Receive Connectors

This article Browsing Mailbox Databases in Exchange 2007 and 2010 is © 2010 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Most Exchange environments will include at least one Receive Connector that is configured to allow certain hosts and applications to relay email. Over time this may build up a lengthy RemoteIPRanges IP address list. When it comes time to add additional IP addresses to the list it seems logical to use Set-ReceiveConnector, however this cmdlet will overwrite the existing setting with the new IP address specified.

For example, look at the current IP addresses:

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.21, 10.0.0.23, 10.0.0.22, 10.0.0.14, 10.0.0.20, 10.0.0.19, 10.0.0.18, 10.0.0.17, 10.0.0.16, 10
                 .0.0.15, 10.0.0.10, 10.0.0.9, 10.0.0.8, 10.0.0.7, 10.0.0.6, 10.0.0.5, 10.0.0.4, 10.0.0.13, 10.0.0.12,
                 10.0.0.11, 10.0.0.3, 10.0.0.2, 10.0.0.1}

Note: if the list of IP addresses is too long and is being truncated in the shell output see this tip for extending the enumeration limit.

Now use Set-ReceiveConnector with a new IP of 10.0.0.99:

[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges 10.0.0.99

And whoops, we’ve overwritten all of the previous IP addresses!

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.99}

If you were just adding one new IP address the Management Console would do the job, but that can be slow for remote servers and is not as efficient if the change is being applied to multiple servers or involves adding multiple IP addresses.

Fortunately with the Exchange Management Shell we can easily add IP addresses to existing Receive Connectors.

To add a single IP address to an existing Receive Connector:

[PS] C:\>$RecvConn = Get-ReceiveConnector "Relay Connector"
[PS] C:\>$RecvConn.RemoteIPRanges += "10.0.0.99"
[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges $RecvConn.RemoteIPRanges

Now we can see that 10.0.0.99 has been added to the Receive Connector.

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.99, 10.0.0.23, 10.0.0.22, 10.0.0.21, 10.0.0.1, 10.0.0.2, 10.0.0.3, 10.0.0.11, 10.0.0.12, 10.0.
                 0.13, 10.0.0.4, 10.0.0.5, 10.0.0.6, 10.0.0.7, 10.0.0.8, 10.0.0.9, 10.0.0.10, 10.0.0.15, 10.0.0.16, 10.
                 0.0.17, 10.0.0.18, 10.0.0.19, 10.0.0.20, 10.0.0.14}

To add multiple IP addresses at once use this command sequence:

[PS] C:\>$RecvConn = Get-ReceiveConnector "Relay Connector"
[PS] C:\>$RecvConn.RemoteIPRanges += "10.0.0.99", "10.0.0.100", "10.0.0.101"
[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges $RecvConn.RemoteIPRanges

Sometimes the list of IPs being added is too long to type out. To add multiple IP addresses from a text file called newips.txt use this command sequence instead:

[PS] C:\>$RecvConn = Get-ReceiveConnector "Relay Connector"
[PS] C:\>Get-Content .\newips.txt | foreach {$RecvConn.RemoteIPRanges += "$_"}
[PS] C:\>Set-ReceiveConnector "Relay Connector" -RemoteIPRanges $RecvConn.RemoteIPRanges

Related posts:

• How to Configure a Relay Connector for Exchange Server 2010
• Exchange 2010 Certificate Revocation Checks and Proxy Settings
• Browsing Mailbox Databases in Exchange 2007 and 2010
• How to Prevent Truncation of Long Output in Exchange Management Shell
• How to Enter the Exchange Server 2010 Product Key for Multiple Servers

This article How to Add Remote IP Addresses to Existing Receive Connectors is © 2009 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.14, 10.0.0.20, 10.0.0.19, 10.0.0.18, 10.0.0.17, 10.0.0
                 .16, 10.0.0.15, 10.0.0.10, 10.0.0.9, 10.0.0.8, 10.0.0.7, 10.0.
                 0.6, 10.0.0.5, 10.0.0.4, 10.0.0.13, 10.0.0.12...}

The reason this happens is that the default Powershell environment for Exchange has an enumeration limit. This is controlled by the $FormatEnumerationLimit variable in the ..\bin\Exchange.ps1 file. This variable has a default value of 16.

[PS] C:\>$FormatEnumerationLimit
16

You can modify the variable to a larger value, or set it to -1 for “unlimited”.

[PS] C:\>$FormatEnumerationLimit =-1

Now when we run the same command the output is no longer truncated.

[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges

RemoteIPRanges : {10.0.0.14, 10.0.0.20, 10.0.0.19, 10.0.0.18, 10.0.0.17, 10.0.0
                 .16, 10.0.0.15, 10.0.0.10, 10.0.0.9, 10.0.0.8, 10.0.0.7, 10.0.
                 0.6, 10.0.0.5, 10.0.0.4, 10.0.0.13, 10.0.0.12, 10.0.0.11, 10.0
                 .0.3, 10.0.0.2, 10.0.0.1}

Related posts:

• Exchange 2010 Certificate Revocation Checks and Proxy Settings
• Browsing Mailbox Databases in Exchange 2007 and 2010
• How to Add Remote IP Addresses to Existing Receive Connectors
• How to Enter the Exchange Server 2010 Product Key for Multiple Servers
• How to Use a Specific Domain Controller in Exchange 2010 Management Shell

This article How to Prevent Truncation of Long Output in Exchange Management Shell is © 2009 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

For multiple servers in the organization this can be achieved using the Exchange Management Shell.  First identify which servers are currently in trial mode.

[PS] C:\>Get-ExchangeServer | where {$_.IsExchange2007TrialEdition -eq "True"}

Name                Site                 ServerRole  Edition     AdminDisplayVersion
----                ----                 ----------  -------     -------------------
EX1                 exchangeserverpro... Mailbox,... Standard... Version 14.0 (Bu...

To enter the product key use the Set-ExchangeServer cmdlet with the -ProductKey switch.

[PS] C:\>$trialservers = Get-ExchangeServer | where {$_.IsExchange2007TrialEdition -eq "True"}

[PS] C:\>$trialservers | Set-ExchangeServer -ProductKey 12345-12345-12345-12345-12345
WARNING: The product key has been validated and the product ID has been successfully created. This change won't take effect until the Information Store service has been restarted.

Restart the Information Store on the servers and they are no longer in trial mode.

[PS] C:\>Get-ExchangeServer | fl name,*trial*

Name                              : EX1
IsExchange2007TrialEdition        : False
IsExpiredExchange2007TrialEdition : False
RemainingTrialPeriod              : 00:00:00

Related posts:

• How to Use a Specific Domain Controller in Exchange 2010 Management Shell
• Exchange 2010 Certificate Revocation Checks and Proxy Settings
• How to Remove Mail Users from the Global Address List
• Unable to Modify Default Global Address List
• Browsing Mailbox Databases in Exchange 2007 and 2010

This article How to Enter the Exchange Server 2010 Product Key for Multiple Servers is © 2009 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Any Exchange Management Shell cmdlet will permit you to specify a domain controller using the -DomainController switch.  But you can also set a preferred domain controller for your entire session.

Note the cmdlet to use here – Set-AdServerSettings. This cmdlet configures the session settings such as the preferred Domain Controller and other settings such as the recipient scope.  Check out the full list of Set-AdServerSettings parameters here.

First take a look at the current session settings. In this example dc1.exchangeserverpro.local has been automatically selected.

[PS] C:\>Get-ADServerSettings | fl

RunspaceId                                 : 15e4d968-032b-4cd8-bc66-bf0b665c4161
DefaultGlobalCatalog                       : DC1.exchangeserverpro.local
PreferredDomainControllerForDomain         : {}
DefaultConfigurationDomainController       : DC1.exchangeserverpro.local
DefaultPreferredDomainControllers          : {DC1.exchangeserverpro.local}
UserPreferredGlobalCatalog                 :
UserPreferredConfigurationDomainController :
UserPreferredDomainControllers             : {}
RecipientViewRoot                          : exchangeserverpro.local
ViewEntireForest                           : False
Identity                                   :
IsValid                                    : True

Using Set-ADServerSettings we can specify the preferred server for the current session with the -PreferredServer switch.

[PS] C:\>Set-ADServerSettings -PreferredServer dc2.exchangeserverpro.local

Now Get-ADServerSettings shows this change has occurred.

[PS] C:\>Get-ADServerSettings | fl

RunspaceId                                 : b15cbfd9-5144-442e-bc74-c00a3216b864
DefaultGlobalCatalog                       : dc2.exchangeserverpro.local
PreferredDomainControllerForDomain         : {}
DefaultConfigurationDomainController       : dc2.exchangeserverpro.local
DefaultPreferredDomainControllers          : {DC1.exchangeserverpro.local}
UserPreferredGlobalCatalog                 : dc2.exchangeserverpro.local
UserPreferredConfigurationDomainController : dc2.exchangeserverpro.local
UserPreferredDomainControllers             : {dc2.exchangeserverpro.local}
RecipientViewRoot                          : exchangeserverpro.local
ViewEntireForest                           : False
Identity                                   :
IsValid                                    : True

Related posts:

• How to Enter the Exchange Server 2010 Product Key for Multiple Servers
• Exchange 2010 Certificate Revocation Checks and Proxy Settings
• How to Remove Mail Users from the Global Address List
• Unable to Modify Default Global Address List
• Browsing Mailbox Databases in Exchange 2007 and 2010

This article How to Use a Specific Domain Controller in Exchange 2010 Management Shell is © 2009 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

This is useful when you have just created a bunch of new Room Mailboxes for a new environment and want to save time configuring the meeting processing settings.

get-mailbox | where {$_.RecipientTypeDetails -eq "RoomMailbox"} | Set-MailboxCalendarSettings -AutomateProcessing AutoAccept

Related posts:

• Browsing Mailbox Databases in Exchange 2007 and 2010
• Exchange Server 2007 Transition Script
• EMS – Exchange 2007 Public Folder item count
• Enable/disable Exchange Server 2007 circular logging
• Exchange 2010 Certificate Revocation Checks and Proxy Settings

This article How to Enable AutoAccept on Multiple Exchange 2007 Room Mailboxes is © 2009 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com