Exchange Server Pro » Schema

Exchange Best Practices Analyzer Reports Unrecognized Exchange Signature

Paul Cunningham — Fri, 23 Jul 2010 09:00:17 +0000

After the transition to Exchange Server 2010 the Exchange Best Practices Analyzer will report a critical error of “Unrecognized Exchange signature”.

ExBPA may report the unrecognized signature as 12639. The error may lead you to believe that the Active Directory Schema has not been properly prepared for Exchange Server 2010.

Unfortunately Microsoft Technet has contradictory advice on this error.

The Exchange Server 2010 planning and deployment documentation stats that 12640 is the correct schema version for Exchange 2010 RTM.

The objectVersion property is in the CN=, CN=Microsoft Exchange,CN=Services,CN=Configuration,DC= container. The objectVersion value for Exchange 2010 RTM is 12640.

However the ExBPA documentation says that 12639 is the correct schema version for Exchange 2010 RTM.

For Exchange Server 2010, the objectVersion value is 12639

As it turns out the error is the result of a bug in ExBPA, according to Jetze Mellema (an MVP).

I just received feedback from the ExBPA team, this is a known issue now and will be fixed in SP1 for Exchange 2010.

So the error can be ignored and will be fixed with Service Pack 1. Beta testers of SP1 are already saying that the problem no longer occurs in that build of the ExBPA. It would be useful to backport the fix to the current ExBPA version, and shouldn’t be all that difficult considering the ExBPA has its own builtin update feature, but it seems we just need to wait instead.

Get more Exchange Server tips at ExchangeServerPro.com

Security descriptor error during Exchange Server 2007 schema extension

Paul Cunningham — Thu, 25 Feb 2010 03:19:00 +0000

During Exchange Server 2007 schema extension you may encounter a security descriptor error which will cause setup to fail. The error may occur specifically during the “setup /PrepareAD” stage.

>setup /preparead

Welcome to Microsoft Exchange Server 2007 Unattended Setup

Preparing Exchange Setup

No server roles will be installed

Performing Microsoft Exchange Server Prerequisite Check

    Organization Checks              ......................... COMPLETED

Configuring Microsoft Exchange Server

    Organization Preparation         ......................... FAILED
     You do not have permissions to read the security descriptor on CN=Deleted O
bjects,CN=Configuration,DC=domain,DC=com,DC=au.

The Exchange Server Setup operation did not complete. For more information,visit
http://support.microsoft.com and enter the Error ID.

Exchange Server setup encountered an error.

To resolve this issue use the following steps for Windows Server 2003. For Windows Server 2008 skip to step 3, and be sure to launch an elevated privileges command prompt to run the commands.

Download and install the ADAM tools from Microsoft.
Go to Start -> Programs -> ADAM and launch ADAM Tools Command Prompt.

In the command prompt, run the following command (substitute your domain name where appropriate):

C:\WINDOWS\ADAM>dsacls "CN=Deleted Objects,DC=domain,DC=com,dc=au" /takeownership
Owner: DOMAIN\Domain Admins
Group: NT AUTHORITY\SYSTEM

Access list:
{This object is protected from inheriting permissions from the parent}
Allow BUILTIN\Administrators  SPECIAL ACCESS
                              LIST CONTENTS
                              READ PROPERTY
Allow NT AUTHORITY\SYSTEM     SPECIAL ACCESS
                              DELETE
                              READ PERMISSONS
                              WRITE PERMISSIONS
                              CHANGE OWNERSHIP
                              CREATE CHILD
                              DELETE CHILD
                              LIST CONTENTS
                              WRITE SELF
                              WRITE PROPERTY
                              READ PROPERTY

The command completed successfully

Re-run Exchange setup. It should now successfully extend the schema.

Link: http://support.microsoft.com/default.aspx?scid=kb;EN-US;892806

Updated: 25/2/2010 with Windows Server 2008 information.

Get more Exchange Server tips at ExchangeServerPro.com

Windows Server 2003 32-bit R2 media needed to prep a non-R2 domain before first 64-bit R2 DC can be promoted

Paul Cunningham — Thu, 19 Feb 2009 10:00:00 +0000

In one of life’s “chicken and egg” situations I recently encountered the issue of promoting a Windows Server 2003 64-bit R2 server to be a Domain Controller in an environment with only Windows Server 2003 32-bit (non-R2) servers as existing Domain Controllers.

DCPromo will tell you that the Forest has not been prepared for the version of Windows you are trying to promote (ie, R2). This would normally not be a problem, the R2 media contains an adprep.exe to update the schema for R2 Domain Controllers.

Of course if you take your new 64-bit R2 disc 2 media and try to run adprep on the 64-bit server you will receive this error:

C:\WINDOWS\CMPNENTS\R2\ADPREP>adprep /forestprep
Adprep cannot run on this platform because it is not a domain controller.
[Status/Consequence]
Adprep stopped without making any changes.
[User Action]
Run Adprep on a domain controller.

Makes sense, so of course you put the disc into your existing Domain Controller and run adprep again.

Z:\>adprep /forestprep
The image file Z:\ADPREP.EXE is valid, but is for a machine type other than the
current machine.

Thats right, you can’t use your 64-bit media to run adprep on a 32-bit Domain Controller. This is where the chicken and egg scenario kicks in – how do you get your 64-bit R2 server to be a Domain Controller with no pre-existing 64-bit or R2 Domain Controllers available for the required schema update? Its not like Microsoft ships you a 32-bit copy of the OS when you buy the 64-bit edition.

The solution is to get your hands on the 32-bit R2 media. If you don’t have a friend or colleague with a copy the next easiest way to get it is from the trial software downloads on Microsoft.com. Go here and jump through the ridiculous hoops to “buy” a $0.00 trial edition so that you can download the ISO files. You only need to download and burn the ISO for disc 2 which contains the R2 adprep.exe and schema files.

Update: you can also download this hotfix that contains only the R2 adprep files.

Get more Exchange Server tips at ExchangeServerPro.com

Installing Exchange Server 2007 pre-requisites on Windows Server 2008

Paul Cunningham — Wed, 26 Mar 2008 20:58:31 +0000

The Windows Server 2008 ServerManagerCmd.exe tool makes installing the Exchange Server 2007 pre-requisites a snap. In this example I am installing the pre-requisites for a typical Exchange Server 2007 installation (Mailbox Server, Client Access Server, Hub Transport Server).

The components are installed using ServerManagerCmd.exe. The following commands can be executed in a command shell to install each of the components.

Firstly, if you are intending to use the Windows Server 2008 server to extend the Active Directory Schema for Exchange Server 2007 you must install the Active Directory Domain Services remote management tools. This usually requires a server restart.

C:\>ServerManagerCmd -i RSAT-ADDS
...........

Start Installation...
[Installation] Succeeded: [Remote Server Administration Tools] Role Administrati
on Tools.
[Installation] Succeeded: [Remote Server Administration Tools] Active Directory
Domain Services Tools.
Warning: [Installation] Succeeded: [Remote Server Administration Tools] Server f
or NIS Tools. You must restart this server to finish the installation process.

Warning: [Installation] Succeeded: [Remote Server Administration Tools] Active D
irectory Domain Controller Tools. You must restart this server to finish the ins
tallation process.

<100/100>

Success: A restart is required to complete the installation.

Once the server is restarted you can install the remaining components. You could install them by entering the commands one at a time, but I prefer to run them all at once like this.

ServerManagerCmd -i PowerShell Web-Server Web-ISAPI-Ext Web-Metabase Web-Lgcy-Mgmt-Console Web-Basic-Auth Web-Digest-Auth Web-Windows-Auth Web-Dyn-Compression RPC-over-HTTP-proxy

The commands will execute in sequence and display output similar to this.

.

Start Installation...
[Installation] Succeeded: [Windows PowerShell].
<100/100>

Success: Installation succeeded.
....................

Start Installation...
[Installation] Succeeded: [Web Server (IIS)] Management Tools.
[Installation] Succeeded: [Web Server (IIS)] Web Server.
[Installation] Succeeded: [Web Server (IIS)] Common HTTP Features.
[Installation] Succeeded: [Web Server (IIS)] Health and Diagnostics.
[Installation] Succeeded: [Web Server (IIS)] Security.
[Installation] Succeeded: [Web Server (IIS)] Performance.
[Installation] Succeeded: [Windows Process Activation Service] Configuration API
s.
[Installation] Succeeded: [Windows Process Activation Service] Process Model.
[Installation] Succeeded: [Web Server (IIS)] IIS Management Console.
[Installation] Succeeded: [Web Server (IIS)] Request Monitor.
[Installation] Succeeded: [Web Server (IIS)] Static Content.
[Installation] Succeeded: [Web Server (IIS)] HTTP Logging.
[Installation] Succeeded: [Web Server (IIS)] Static Content Compression.
[Installation] Succeeded: [Web Server (IIS)] Request Filtering.
[Installation] Succeeded: [Web Server (IIS)] Default Document.
[Installation] Succeeded: [Web Server (IIS)] Directory Browsing.
[Installation] Succeeded: [Web Server (IIS)] HTTP Errors.
<100/100>

Success: Installation succeeded.
............

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] Application Development.
[Installation] Succeeded: [Web Server (IIS)] ISAPI Extensions.
<100/100>

Success: Installation succeeded.
............

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] IIS 6 Management Compatibility.
[Installation] Succeeded: [Web Server (IIS)] IIS 6 Metabase Compatibility.
<100/100>

Success: Installation succeeded.
............

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] IIS 6 Management Console.
<100/100>

Success: Installation succeeded.
............

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] Basic Authentication.
<100/100>

Success: Installation succeeded.
............

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] Digest Authentication.
<100/100>

Success: Installation succeeded.
............

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] Windows Authentication.
<100/100>

Success: Installation succeeded.
............

Start Installation...

[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] Dynamic Content Compression.
<100/100>

Success: Installation succeeded.
............

Start Installation...
[Installation] Succeeded: .
[Installation] Succeeded: .
[Installation] Succeeded: .
[Installation] Succeeded: [Web Server (IIS)] Client Certificate Mapping Authenti
cation.
[Installation] Succeeded: [Web Server (IIS)] Tracing.
[Installation] Succeeded: [Web Server (IIS)] Logging Tools.
[Installation] Succeeded: [Web Server (IIS)] HTTP Redirection.
[Installation] Succeeded: [RPC over HTTP Proxy].
<100/100>

Success: Installation succeeded.

Your Windows Server 2008 host is now ready to install Exchange Server 2007.

References:

How to Install Exchange 2007 SP1 Prerequisites on Windows Server 2008 or Windows Vista

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Schema

Exchange Best Practices Analyzer Reports Unrecognized Exchange Signature

Related posts:

Security descriptor error during Exchange Server 2007 schema extension

Related posts:

Windows Server 2003 32-bit R2 media needed to prep a non-R2 domain before first 64-bit R2 DC can be promoted

Related posts:

Installing Exchange Server 2007 pre-requisites on Windows Server 2008

Related posts: