I have been asked by one client of mine to do a redirection to their mail.domain.com to go directly to the Owa page but after applying the redirection configuration I faced an issue.
Whenever I try to go to the OWA page using only the FQDN mail.domain.com I get a 401 unauthorized access page.
Resolution:
The solution was to add authenticated users to wwwroot with full permission and restart the IIS with noforce parameter.
OFFLINE ADDRESS BOOK ISSUE AFTER MIGRATION FROM EXCHANGE 2003 TO EXCHANGE 2010
Error: event ID: 9360 OABGen encountered an error while generating the changes.oab file for version 2 and 3 differential downloads of address list
RESOLUTION 1
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
To resolve this issue, follow these steps on the server that is running Exchange Server 2003:
Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then right-click the following registry subkey:
Type OAL post full if diff fails to name the new value.
Right-click OAL post full if diff fails, and then click Modify.
In the Value data box, type 1, and then click OK.
Exit Registry Editor.
Dismount and then mount the Public Folder Store again. To dismount and then mount the public folder store, follow these steps:
Start Exchange System Manager.
Expand Servers, expand the server that you want, expand Storage_Group_Name, and then right-click Public Folder Store.
Note If administrative groups are defined, follow these steps:
Expand Administrative Groups.
Expand Administrative_Group_Name.
Expand Servers.
Expand the server that you want.
Expand Storage_Group_Name.
Right-click Public Folder Store.
Click Dismount Store, and then click Yes to continue.
Right-click Public Folder Store, click Mount Store, and then click OK.
A new parent Legacy Exchange DN container value ‘/o=HEMA/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients’ was found during generation of the differential update file for offline address list ‘\Global Address List’. This will force clients using this offline address list to do a full download of the offline address list.
– \Default Offline Address List
Resolution 2:
If the first resolution didn’t work, try to disable version 2 and 3 OAB, then update again and see if you get any errors.
To resolve this issue, check if the database which is having the issue is over 1TB and if that’s the case try to remove some users from this database to another database.
To view the users of this database using the following powershell cmdlet.
This guide will show you how to installing order to Install “Only” Trend Micro 11.0 on Exchange 2013 server
You will have to make sure that before you install Trend Micro you have enough resources on the mail servers or Edge servers depending on where you are intending to install it.
Prerequisites:
You will need to install Windows IIS CGI role.
Net Framework 3.5
Trend Micro Setup.
If you did not install CGI you will get the following error, so you must install it
To install it you will need to go to Add Roles and then choose and install it.
If Net Framework 3.5 is not install the setup won’t proceed unless you do so and you will get the following error:
To install Net Framework 3.5 , you can use the wizard or you can use the Powershell but you’ll need to attach Windows Server ISO File to the VM or the physical machine.
Setup will restart from the beginning
NetFrame work fails from the Server Manager
Instead, I imported the Windows 2012 r2 server ISO into the VM and ran the powershell command line
Restarted the Trend Micro Setup and the setup is working
I already have copied the setup files on my mailbox servers, in my scenario I have 2 mail box servers which I am going to install it on.
I will launch the setup and go through the following wizard
As I mentioned earlier, I am planning to install it on Exchange 2013 Mailbox servers, so I will go ahead and choose Mailbox servers
I will click Browse and Add exchange servers and as in the following snapshot it’ll show me total server count
Next I will type the Exchange Admin account which I used to setup Exchange with and login to the admin Center which is also a local admin.
This is set by default so you will need to leave it as it is.
You can keep the following default settings or change the port in case it’s already used or enable SSL.
In my case I will enable SSL as well as it’s more preferable for security purposes.
Trend micro setup will check if there’s any previous instance on the target Mailbox server in order to check if it’s an upgrade or a fresh install.
I have no proxy so I will proceed without it.
I’m planning to ignore this now and register later, so you can provide the key if you already have it and want to register.
When you continue without activating the product you will get the following warning.
Depending on if you wanna be useful or not, you can just to participate with this program or just ignore it.
In case you would like to direct or send all incoming spam messages to the user to take the decision him/her self you can choose to integrate with Outlook junk e-mail or integrate with End user’s quarantine. In this case incoming infected or suspicious mails will be delivered to the user’s Quarantine but can be restored from/with trend micro.
Trend Micro have also a control manager for centralized management, so if you have it you can configure it and manage all those scanmail from one location. If not then just click next
Click browse and choose your domain in order to select the domain admin groups to manage the trend micro scan mail application.
All server details and configuration is going to be listed in the next snapshot.
And now installation should start.
The credentials to login might be standard but you could also try your domain admin which you have assigned during the setup to login to the portal.
Any configuration that you do on the Mailbox server 1, you will have to re-do it on Server 2 since this is not centralized management.
So first thing I’ll do is update the product to the latest version.
After selecting the components to update click on Update and wait for the process to finish.
After setting and configuring couple of rules and restarting Exchange transport service on each server . I was able to test It and see that it works as in the following snapshot.
On the Certification Authority Server open Certification Authority Console (MMC)
Right click on Certificate Templates and click Manage
IN certificate templates console right click on Web Server and click Duplicate template
Select Windows Server 2003 Enterprise
Enable “Allow private key to be exported”
Under security tab Select Enroll for the Authenticated users
Back to the Certificate Authority Console, Right click on Certificate Templates and click New -> Certificate template to issue and add the certificate template you created to the list.
Web Server V2 is on top
Let’s check it on Certserv IIS
Certificate is generated for 5 years. The reason why the certificate is generated for 5 years is because the Certification Authority server’s Certificate is limited to 5 years.
So the CA certificate must be set to longer then the client’s requested Certificate limit.
Certification Authority Issuing Certificate validity period extending
To change the Validity Period for the Root CA you can configure a CAPolicy.inf. To create a CAPolicy.inf file that changes the lifietime of the certificate to 30 years, you would type the following into a text file, and save it with the name CAPolicy.inf in the C:\Windows directory,:
[Version]
Signature= “$Windows NT$”
[Certsrv_Server]
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=30
After this you will need to renew the CA certificate from the CA console : right click on your certification authority and choose All Tasks -> then choose -> Renew CA Certificate
When you click on Renew CA certificate you will get the following prompt asking you to stop the CA to renew its Certificate, Click Yes
Once you click on Yes the service will stop and you will get this window telling you if you would like to generate new public and private key it’s up to you to use a new or not but if you choose Yes the clients using the old Certificate might be provoked and you might need to install the new CA Certificate on all clients using GPO.
Click Ok
After clicking OK you will see that you were able to generate the new CA Certificate and then you can issue clients certificates
Note: I created another template with 30 years expiration date this time after I created the CA policy for 30 years too.
Now In order to allow the CA to issue certificates that has longer than the default age (2 years) you must run the following command line on the CMD on the CA server.
And here we go, after requesting the certificate from the server I got 30 years valid certificate.
In order to export mails from Exchange 2003 (should not exceed 2 GB) you will have to copy Administrator user into another user “admin” and give that user the rights to access all other mailboxes.
You will have to navigate to the Mailbox store
Right click the mailbox store and click on Properties
Go to Security tab and add the new user (Admin) and give it full control as below
Apply, then sign out of the windows session to the Exchange machine and use the newly added domain admin to login and then open the Exmerge application
Select the second step (Extract or Import)
Select step1
Select the Exchange name and the DC (They should be set automatically)
Select the users that you want to be exported (shouldn’t exceed 2 GB).
Select the local language
Select the destination folder (In my case I mapped a network drive)
Save settings for later use if you want or just click Next.
Once done, the mailbox will be exported.
Importing into Exchange 2013
In exchange 2013 Open the EMS as administrator
Before you start, you should move all the PST files into a shared folder in the network and add the “Exchange Trusted Subsystem” user to its permission.
The same user should be added to the security tab
Providing import and export permission on Exchange 2013
In order to import the PST files to Exchange 2013 users you will have first to assign the Exchange Admin account the capability of importing these PST files then sign out from the EAC portal and back in
To do so you will have to go to EAC then go to Permissions and double click on the Recipient Management
Click Add and select the Mailbox Import Export and click Add then OK
I will add members to this role group
After signing in back to the EAC with the administrator I got the Import PST options.
Step by Step Installing Exchange server 2013 from scratch (Part 1)
In this part, I will be demonstrate how to Install exchange 2013 and prepare new Databases along with preparing the servers for high availability (DAG).
Prerequisites:
– Two Microsoft Windows 2012 R2 servers with 16 GB ram and 200GB disk divided unto two partitions.
– Two NIC, one for MAPI and one for replication.
– Exchange 2013 CU8 setup to directly go to the latest available update.
Installing Prerequisites on all exchange servers
Launch Powershell as administrator and copy then paste the following.
You should download and install the following software prerequisites as per Microsoft’s TechNet article regarding the installation. the software is available the link I posted earlier above or through this link Exchange_Prerequesties
After running all the prerequisites , we can start installation of Exchange 2013
Here I am going to change Exchange’s default installation path and place it on a different partition to avoid any data loss in case of Windows server crash or booting issues.
Now we install the second Exchange server, that will hold the same roles on it as the first one (Mailbox and CAS).
The steps are going to be exactly the same except that you won’t have to prepare the schema or AD since it’s already prepared.
Installation has finished for both servers
Creating DATABASES:
NOTE:
It’s better to mount the database upon creation and not restart the IS instantly after that.
Now it’s time to create new Databases and replace them with the default ones that come with the Installation
First we’ll have to start off by creating our targeted databases which we want to use them. Note that for the standard version of Exchange 2013 you can only create up to 5 databases per mailbox server.
In order to demonstrate all benefits of Exchange 2013 and its features including DAG. I will create 2 databases. One database on each server.
The first database will be called DB1SRV1
As soon as we have created the Database, we faced the following error with event ID 106
Then another warnıng from MSExchangeFastSearch wıth event id 1006
This indicates that a database should not be mounted upon creation, you should untick the mount DB option when you create one.
After waiting a bit the following logs should appear and show a healthy indexing start.
Once the DB has been created, Exchange AC will require that you restart the IS (Information store Service) in order for replication to happen without an issue.
Database is showing healthy and no issues so far.
Now we’ll create a new DB on the second server without ticking the mount DB option.
Microsoft Exchange Server Locator Service failed to find active server for database ‘de5f3051-c202-4976-b8e4-65bbbe0c2395’. Error: The database with ID de5f3051-c202-4976-b8e4-65bbbe0c2395 couldn’t be found.
The same exact errors came after creating the Database without mounting it.
Now let’s restart the IS service and mount our database then see what happens..
Upon restarting the service, we get the following error which is related to the MS Exchange replication service . It noticed that the database that we have created has never been mounted in order to start the indexing.
Let’s mount the database and see the changes
Mounting the database have got the AM to report successfully and after couple of seconds the MSExchangeFastSearch will check out if the database have any indexing files.
No indexing state have been found and so the FastSearch service will give you a 1013 warning report. This is a good warning because it reports that the service is working properly and that it will create the indexing folder after couple of minutes as we’ll see later.
It takes approximately 3-5 minutes for the database to start the indexing.
Now on the EAC, the DB should report healthy. Let’s see
Removing Default databases
First step before deleting the default databases is to move any system mailboxes or arbitrary mailboxes in them to the newly created databases…
Paul Cunningham wrote a great article on how to do this using Powershell … in the following link
The warning above is apparently due to Exchange permission on AD. It has been described in detail on how to solve this warning by Nuno Mota in the following Link.