Sembee Blog of Exchange MVP Simon Butler

Approving Quarantined ActiveSync Devices with Exchange Management Shell

For some reason, the act of approving a quarantined device using EMS isn't immediately obvious. It took me a little while to work out how to do it. 

This command will show you what devices are quaranted:

Get-ActiveSyncDevice -filter {deviceaccessstate -eq 'quarantined'} | select identity, deviceid | fl

Therefore it would seem that set-activesyncdevice would be the correct command to use to approve the device. 

Not so. 

It is actually set-casmailbox. 

Take the device ID from the first command, you use it to complete this second command: 

Set-CASMailbox –Identity user@example.com –ActiveSyncAllowedDeviceIDs DEVICEID

Give it about 15 minutes and the device will start to get email. 

Kemp Release Free Load Balancer Virtual Appliance

Kemp have released a free load balancing virtual appliance. If you have a small environment and don't need the high availability of two load balancers, then this could be an ideal solution. 


There are some limitations, particularly around the throughput (only 20mps) but if you are using a small environment or a lab, then it could be all that you need. Absolutely no reason to use Windows Network Load Balancing any more. 

If you have Kemp load balancers in your production environment, then it is an ideal way to have the same in your test environment. It will also make this a valuable learning tool for Exchange and server administrators. 

No support included, but that is to be expected. 

It looks like it is pretty much the complete feature-set from Kemp, including:

Layer 4/7 load balancing
Content switching
Caching, compression engine
MS Exchange 2010/2013 optimized
Pre-configured virtual service templates

The only thing it is missing features wise is Active/Hot Standby redundant operation.

If you are going to use this in a production site, then I would watch that maximum throughput though. 

Outlook 2010 MAPI over HTTPS Support

15. January 2015 20:15 by Simon Butler in Exchange 2013, MS Exchange Server, Outlook
The hotfix for MAPI over HTTP support for Outlook 2010 has been released at last. 

Currently requiring a manual request and installation, no word on whether it will be available through any of the automated distribution methods. 


(This replaces kb2899591 released in December which was withdrawn). 

On the server, MAPI over HTTP requires Exchange 2013 SP1 (aka CU4) or higher. It is a new communication protocol for Exchange/Outlook communication which will eventually replace RPC over HTTP. 

For the client the hot fix requires Outlook 2010 SP2 to be installed. 

Lots more background on MAPI over HTTP on the Exchange team blog: http://semb.ee/mapi-http-blog

Changes to SSL Certificates

There have been a lot of changes to the way that SSL certificates are issued and the impact of those changes are now being particularly felt within the Exchange community. 

What has changed?

The CA/Browser forum (made up of the companies that issue the certificates and the browser developers who use them) decided that that all certificates issued with an expiry date after 1st November 2015 will be restricted to internet resolvable FQDN's only. 
This means that you cannot have an SSL certificate with:
- Single name hosts - such as intranet, server, exch01
- Internal only domains - such as server.example.local
- Internal IP addresses (both Ipv4 and Ipv6). 
This applies to both the common name and any additional names on the certificate. 

Furthermore, if you have a certificate that is still in force with an invalid name from the list above, then it will be revoked on 1st October 2016. 

How does this affect Exchange?

Exchange 2003 isn't really affected by this, because most people simply purchased standard single name SSL certificates. 

Exchange 2007 and later however are being impacted. 
During the early life of Exchange 2007 the advice for SSL certificates was to include both the internal and external host names of the Exchange server. This was because the default configuration of Exchange uses the server's real name and therefore did not require additional modification.

However it quickly became apparent that this wasn't the best way to deploy Exchange web services, as end users were entering the same address internally as they were externally. Split DNS was the answer there http://semb.ee/splitdns

Following the changes to the guidelines for issuing certificates, the changes to Exchange, including setup of a split DNS system is almost mandatory.
I have instructions on how to do that on my main web site at http://semb.ee/hostnames 

Going Forwards

With this change, you can now get away with just two host names on an SSL certificate for full client support:
- host.example.com
- autodiscover.example.com
With our own certificates coming with five "names" available by default, and unlimited server licence, this means you can use the other slots to secure additional services. Once the certificate has been installed on the Exchange server, export it and then import the certificate in to other servers that need it - along side the required intermediate certificate. 
If your DNS provider supports SRV records, then you can even use a standard single name SSL certificate. However mobile devices in particular seem to have some problems with the SRV autodiscover method, so if you are going to deploy mobile devices, stick with a UC (Unified Communications) type certificate. One of the cheapest sources for those is our own site CertificatesforExchange.com http://semb.ee/certs

If you have a certificate with internal names that expires after 1st October 2016, then you should get it rekeyed with the internal names removed, so the certificate is not revoked. 

What else is changing?

From April 2015, the maximum period a certificate can be issued for is being reduced to 39 months. This is to ensure that the names on certificates are checked frequently that they still belong to the original purchaser.

SHA-1 certificates are being phased out very quickly and in 2017 Microsoft will stop trusting them. However a lot of browsers will start showing warning messages on these kinds of certificates in 2016. Therefore to protect yourself, ensure that you are requesting SHA-2 certificates and have replaced any SHA-1 certificates by the end of 2015.

Action Points

What should you do about your own SSL certificates?

  1. Check whether they are SHA-1 or SHA-2. 
    To do that, browse to the SSL site, then open the SSL certificate. Click on the Details tab and then look for Signature Hash Algorithm. It should NOT say SHA1. 
    Do not confuse with Thumbprint Algorithm, which will always say SHA1, no matter the type of the certificate.
    If they are SHA1, then get them rekeyed to SHA-2. If your provider doesn't allow that, then change provider. http://semb.ee/certs

  2. Check your server configuration and start to move everything over to use the same host name internally and externally. This is easily done by setting up a split DNS system, then changing the Exchange configuration. If your certificate still contains the internal names they will continue to work until you change the SSL certificate, providing a time to educate the end users about the names to use. 
Remember if you replace a certificate before it has expired, revoke the old one. This will often happen automatically when you get a certificate rekeyed, but it does no harm to do that yourself anyway. 

Exchange 2010 Service Pack 2 End of Life

17. April 2014 10:45 by Simon Butler in Exchange 2010, MS Exchange Server

Completely forgot to mention last week that as well as Exchange 2003 going end of life, so did Exchange 2010 Service Pack 2. Therefore to continue to receive updates and support for Exchange 2010, you need to be on Exchange 2010 Service Pack 3. 

This follows Exchange 2010 RTM going end of life in October 2011 and Service Pack one in January 2013.

You can see the full list of Microsoft Exchange end of support dates on the Microsoft Lifecycle web site. http://semb.ee/enddates

Farewell Exchange 2003

8. April 2014 14:55 by Simon Butler in Exchange 2003, MS Exchange Server

Today is the day that support for Windows XP ends, but it is also the end of another product that was much loved in its day and even now is still in widespread use, and that is Exchange 2003.

 

Exchange 2003 was where I really got heavily involved with the Exchange product. I had played around a bit with Exchange 5.5 and 2000 at previous employers, but it was around the time of Exchange 2003 SP1 release that I really started to spend time with it.

 

I was thrown in to a migration from Exchange 2000 to 2003 within weeks of starting a new job, and having built my first server, interest in the product grew very quickly. It was working on Exchange 2003 problems within the community that first got me recognition from Microsoft via their MVP programme - which I have just been received for the ninth year.

 

Getting RPC over HTTPS to work was my first major achievement, and it became one of the most popular articles on my web site. Documentation wasn't great and it required manual registry changes to work correctly.

 

I remember the joy of having the 16gb database limit increased to 18gb initially, up to 75gb with a registry change that was introduced with one of the service packs.

 

By the time we got to service pack 2, Exchange 2003 was a pretty rock solid product. Reliable, with plenty of third party support. The introduction of ActiveSync over HTTP was particularly important, as just a short time later the iPhone was released which took advantage of it. Until that point, mobile sync support was limited to Windows Mobile devices or Blackberry.
There was a version of ActiveSync at RTM, but until the HTTP version came out, it only really worked for users in the USA, who had free email to text services.

 

Looking at it now, Exchange 2003 is a fairly basic email application, but for many companies it does all that they need. However it is starting to show its age. There are problems with some modern ActiveSync devices and OWA does not like the modern browsers and unless you are using Internet Explorer, the OWA experience is pretty painful. The limitation of 75gb on a database in standard edition is very limiting for all but the smallest of companies.

 

It was also the last version of Exchange that was administrated purely through a GUI. However with email platforms becoming bigger all the time, a GUI only approach quickly showed its weaknesses and the move to a modern scripting language like PowerShell was overdue.

 

 

As with many things, it was good for its time, but the more modern versions of Exchange, particularly Exchange 2010 are simply much better, more feature rich and a lot more suitable for the demands of a modern IT infrastructure. 

Exchange 2007/2010/2013 Outbound SMTP Banner Testing

Back in 2009 I posted that automated tools like those at mxtoolbox will return false negative results on the SMTP banner tests. (http://semb.ee/banner2007)

 

This is because the SMTP banner presented for inbound email is different to outbound email.

 

This is still the case with Exchange 2010 and 2013. You shouldn't try and change the Receive Connector configuration to "fix" this problem as will cause further issues with Exchange.

 

However with those tools providing false information, it raises the question of how do you easily test the banner so that you can see how a remote server will see your server?

 

Of course one way is to simply send an email to a remote server which you have control over, and check the headers. That isn't always practical and if you don't have your own server, using something Gmail or Hotmail might mean the message gets block because you haven't configured things correctly.

 

One of the blacklist operators has setup a system that will show you exactly what you are sending back, in the form of an NDR.

The details are here:

http://cbl.abuseat.org/helocheck.html

 

After sending the message, you will get an NDR back similar to this:

 

 

helocheck.abuseat.org rejected your message to the following e-mail addresses:

 

helocheck@helocheck.abuseat.org (helocheck@helocheck.abuseat.org)

 

 helocheck.abuseat.org gave this error:

*** The HELO for IP address 123.123.123.123 was 'mail.example.co.uk' (valid syntax) ***

 

 A problem occurred during the delivery of this message to this e-mail address. Try sending this message again. If the problem continues, please contact your helpdesk.

 

Diagnostic information for administrators:

 

Generating server: server.example.co.uk

 

helocheck@helocheck.abuseat.org

helocheck.abuseat.org #550 *** The HELO for IP address 123.123.123.123 was 'mail.example.co.uk' (valid syntax) *** ##

 

Original message headers: 

 

 

This service is a quick and easy way to verify the server is configured correctly. 

Stopping Auto Deletion in Mailbox Converted From a Resource

Recently at a client we configured some mailboxes as Resources. 
It was then decided that they would be better off as shared mailboxes, as they could be used for other tasks. Therefore the mailbox was converted to shared:

 

set-mailbox mailboxname -type:shared

 

However any emails sent to the new Shared mailbox were continuing to go in to the Deleted Items folder. This is the standard behaviour for a resource mailbox, as it is only expecting to get calendar items. 

The key is to disable the Calendar processing. You can see the current setting thus:

 

get-calendarprocessing mailboxname | select identity, AutomateProcessing

 

To disable it completely, you need to change the value of AutomateProcessing to none

 

set-calendarprocessing mailboxname -AutomateProcessing None

 

In this case, the folder still needed to accept and process calendar entries, so we changed it to AutoUpdate.

 

set-calendarprocessing mailboxname -AutomateProcessing AutoUpdate

 

The full parameters are discussed in the Technet article:

http://technet.microsoft.com/en-us/library/dd335046(v=exchg.141).aspx

 

Kudos to Holly at the client for finding the value which I had completely forgotten about!

Cross Site DAG Issue When Using A Load Balancer

18. November 2013 22:20 by Simon Butler in Exchange 2010, MS Exchange Server, Kemp

Just deployed a new Kemp Load Balancer with a client which promptly broke their cross site DAG.

Usual horrible error:

[PS] C:\Windows\system32>Get-DatabaseAvailabilityGroup -Status

WARNING: Unable to get Primary Active Manager information due to an Active Manager call failure. Error: An Active

Manager operation failed. Error The Microsoft Exchange Replication service may not be running on server XXX-3. Specific

 RPC error message: Error 0x6ba (The RPC server is unavailable) from cli_AmGetDeferredRecoveryEntries.

 

(server xxx-3 is the remote server).

Discovered that the problem was due to an option enabled on the Kemp called Enable Server NAT (SNAT). You can find this under System Configuration, Miscellanious Options, Network Options. Disabling that corrected the issue almost immediately. Seems that the NAT broke the DAG. 

A New Take on the Exchange Management Shell Startup - Keberos Error

I was recently asked to look at an Exchange server giving the common PowerShell connection failure due to Kerberos authentication. 

The following error occurred while attempting to connect to the specified Exchange server 'rpi-exchange.rp.local':

"The attempt to connect to http://rpi-exchange.rp.local/PowerShell using "Kerberos" authentication failed: Connecting to the remote server failed with the following error message: The connection to the specified remote host was refused. Verify that the WS-Management service is running on the remote host and configured to listen for requests on the correct port and HTTP URL. For more information, see the about_Remote_Troubleshooting Help topic. "

The usual reasons for this error are well documented and I am not covering them here. After spending an hour going through the usual suspects, I started to look for anything else, as this was giving a Connection Refused error, which wasn't hugely documented past the Remote PowerShell permission. 

I then had a brainwave. I was working on a system in a school. Schools have pretty restricted Internet access in most cases. This usually means a proxy. 

Netsh winhttp show proxy 

That command immediately showed there was a proxy, running

Netsh winhttp reset proxy

Cleared the proxy settings and allowed the Exchange Management Console to start correctly. 

The client was then advised to check their proxy configuration settings, specifically the exceptions list so that the correct ones were in place, as I feared that next time Group Policy applied the proxy settings, the change would be reset.