EzCloudInfo

Microsoft cloud · Identity · AI security

Author: Sathish Veerapandian

  • Enable Office 365 External Sharing

    In this article we will have a look at enabling the office 365 external sharing option

    Following services can be shared externally from your office 365 tenant.

    1) SharePoint Sites.

    2) Calendar free/busy sharing.

    3) Lync – You can add people outiside your organizations , skype and  can communicate provided the following conditions are met.

    Login to the office 365 portal with admin privilige

    Click on Admin and click on external sharing

    E1

    Now we have external sharing options for 3 of the services

    When we click on SharePoint we get the below option as shown below

    E2

    Also we have an option to share individual site by selecting them and then it gives us the same option.

    When we click on the Calendar we have the below option

    C3

    C4

    Once sharing is enabled, users can use Outlook Web App to share their calendars with anyone inside or outside the organization. People inside the organization can view the shared calendar side-by-side with their own. People outside the organization will be sent a URL that they can use to view the calendar. Users decide when to share, how much to share, and when to keep their calendars private

    Note: If you want to share calendars with an organization that uses Exchange Server 2013 (an on-premises solution), the Exchange administrator will need to set up an authentication relationship with the cloud.

    Below is the option that we have for enabling external sharing for lync

    Online2

    The organization you’re communicating with must also allow communication with your domain. If the other organization has Lync Server on premises, refer them to the TechNet article Configuring Federation Support for a Lync Online Customer.

    When you’re communicating with someone in a federated domain, you can only use Lync features (for example, video conversations or desktop sharing) that are turned on in both organizations.

    If the external access setting is changed from “On only for allowed domain” to “On except for blocked domain”, the domains that are listed won’t be kept.

    Thanks 

    Sathish Veerapandian

  • All about enterprise vault services and its tasks

    I Just went through Enterprise Vault services, Tasks and its functionality. I have collected few points about its functionality and would like to share the same.

    In this article we will have a look at the enterprise vault version 11 services and its tasks.

    Basically EV version 11 has 4 services . The previous version 10 had 6 services and they have reduced it to 4 from 6 in EV11.

    Below are the functionality of the 4 services.

    Enterprise vault storage service

    The Enterprise Vault Storage Service reads the objects from the Storage Archive queue and stores the associated mailbox items to the Storage Device.

    What is storage archive queue?

    This is the actual  queue which EV server queues the messages from the end users mailbox for archival.

    It actually holds the emails that EV needs to archive in its storage.

    It integrates and works with the windows message queuing service (MSMQ) and that’s the reason it needs to be installed on the OS during EV installation.

    Once the items are copied to this storage queue the below process takes place

     

    • The copied file from the user will be marked for archive pending.
    • The copied item will be added as .EVSQ file in the Storage queue location. Usually the storage queue location should be redundant path (SAN Storage)
    • Once when all the items are archived this .evsq file is emptied and keeps only the empty .evsq file(not sure why it leaves this file trace).

    Below are the different types of queues

     

    Enterprise Vault Exchange Mailbox task for server queue A1

    This queue holds the Enterprise Vault Exchange Mailbox Pending items to update in the corresponding users archive. It also has the  failed operations.

     

    Enterprise Vault Exchange Mailbox task for server queue A2

    This queue holds the Individual items that needs to process. Used for end user manual archive requests and whenever Enterprise Vault cannot directly communicate with the Storage Archive queue of the Storage service.

     

    Enterprise Vault Exchange Mailbox task for server queue A3

    This queue is  Used if you start archiving using the Run Now option in the Administration Console. If the administrator forces the task to run then it comes in this queue.

     

    Enterprise Vault Exchange Mailbox task for server queue A4

    This queue is used during the retry of the failed archive.

     

    Enterprise Vault Exchange Mailbox task for server queue A5

    This queue is used during scheduled archive runs. This queue is not processed outside the scheduled archiving times, so you cannot use Run Now to clear a backlog on this queue.

     

    Basically this enterprise vault storage service  has 3 tabs as shown below

    ee

    General Tab

    Just tells us about the site and the computer name and doesn’t hold much information

     

    Storage Queue Tab

    Tells the queue status open or closed, queue location free space and available space, queue total length and pending length.

     

    Advanced Tab

    This queue contains archive processes and restore processes.

    ee1

     

    Archive processes

    It’s about the number of archiving task that this service can handle at time (can be exchange archive, SharePoint archive, etc..,)

     

    Restore processes

    It’s the same as archive and it is the number of the restoring task that this service can handle at a time

     

    Restore thread per process

    It’s the number of threads that the restore process must handle while restoring the items. We need to ensure that this value is increased when you increase the value of the number of processes else the restore will take long time.

    Note:

    We need to make sure that we are aligning the values for archive process and threads correctly else there will be some issues and will take time in the restore

     

    EV Shopping service

    This service manages the selected items to be restored when the end user manually chooses to archive few items through browser search and archive explorer. As the name indicates that this service is used only when the user tries to manually archive any items to EV from his end.

     

    ee2

    This service will log events in the event log whenever it starts and then stops. So it’s better to monitor this service events once in a while on every day.

    Apart from this I do not find any much more information on this service

     

    Enterprise Vault Task Controller Service

    The Enterprise Vault Task Controller Service controls all provisioning, archiving, and retrieval tasks for Enterprise Vault. At the completion of every task it records an event about the status (whether it’s completed or its failure) of the task that was completed.

    The Enterprise Vault Indexing Service:

    This service is responsible to handle the indexing part for the archived data.

    The Indexing Service will index items once they are being archived. Each archive will have its own index

    It keeps the index all up to date.

    Also it fetches the search results for the end users that they are searching for any emails from their EV archive

    It’s better to have this functionality enabled as the end users will search for their archived emails for sure.

     

    Tasks

    Now we will start looking into the tasks functionality.

    So these tasks will be working depending upon all the above services.

    Below are the list of tasks that can be created from EV server for the applications as shown below.

    ee4

     

    And after we create a task these tasks have options to schedule and run on a timely basis which I find it to be very useful.

    There are few more options to explore apart from the schedule

    ee5

    Note: We would be able to  set only one task for one server.

    Example for one mailbox server we can set only one archive task schedule  and that task can be configured.

    There are more topics to know on Enterprise Vault since it’s a pretty much complicated big product with more features and functionalities. We will discuss about the rest of the features in the upcoming blogs.

    Thanks 

    Sathish Veerapandian

  • Steps to export/import enterprise vault archive mailbox as PST

    In this article we will have a look at the steps to export/import the enterprise vault archive as a PST.

    Log in to the Enterprise Vault server and open Enterprise vault admin console

    Select the node and select the archives

    EV1

     

    Now right click on the archives icon and you have an option to export and import as a PST/NSF files.

    Now we will see the steps to export as PST.

    EV2

     

    Now we have 3 options as shown below for the export of PST file

    EV3

     

    Now choose the archive mailbox for the export

    Ev4

     

    Select the source archive file

    ev5

     

    We have an option to export items in a specific date range which i find to be very useful

    ev6

     

    Choose the folder path and we have an option to split the PST files

    ev7

     

    Confirm the PST export settings

     

    ev9

     

    Once we click on next we have the status of the export and

     

    there is a report file of the export as well

    ev10

     

     

    These steps  can be useful to export/import the PST to enterprise vault archive for the end users.

    Hope this helps.

    Thanks

    Sathish Veerapandian

  • Steps to create/identify the list of public Ip’s used by exchange services

    In this article we will look at the steps to create and identify the list of public Ip’s used by exchange

    In this article we will have a look at the steps to set all Outgoing SMTP from 1 IP address and to see all the ip address from the Exchange server.

    First you have to run Get-SendConnector SourceIPAddress x.x.x.x from the EMS in order to see the source IP address of the exchange server

    Note:

    By default this value will be set only to 0.0.0.0 and exchange hub will take its default assigned ip to send emails to the smart host (firewall/spam filter/Spam cloud). However you can check this if there is any value set to be on the safer side.

    Now how the mail flow will go from your Exchange server

    From your Exchange – to your firewall – then its gets NAT’ed from local ip to public ip and to internet

    We need to NAT our local IP to one public IP.

    Inorder to do that Follow the below steps:

    Now you need to accomplish this with a router/firewall with a feature called Policy Based Routing.

    1)      Create a firewall/NAT rule to NAT outbound traffic from exchange ip address to your preferred public ip address.

    2)      With this you could make a rule like: When traffic is coming from my mail server AND the destination port is 25, send the traffic through your ISP from one of your public IP.

    To be more precise you will have to do many to one NAT in your firewall as below:

    For Example below is your server

    Server name      Private IP (Server)     (Public IP on firewall)               Port

    Server1:               192.168.0.1          –> 65.55.33.118                           Port 25

    Server2:               192.168.0.2          –> 65.55.33.118                           Port 25

    If your servers configured as above your source public will be 65.55.33.118 from both the servers.

    Also you should have PTR created for your external IP. If not please inform your ISP to create PTR for your external IP’s.

    How to identify which Public IP your exchange services are using

    There are multiple ways to identify the public ip address used by exchange server

    The easiest way to identify them is through MX lookup

    You can query all the Exchange url’s through nslookup to see the results

    Things you need to query through nslookup:

    1)      Query external autodiscover url

    2)      Query webmail external url

    3)      Query outlook anywhere external  url

    Below is an example of mxlookup for Microsoft  records

    This steps can be useful during the migration scenarios of exchange servers as well as firewall.

    Thanks
    Sathish Veerapandian

  • Steps to perform a extended message trace in Office 365

    In this article we will look at the steps to perform a extended message trace in Office 365.

    What is Message Trace ?

    Message trace is same like  same message tracking in Exchange 2010 . By using this we would be able to track/trace an email which was already sent  through a mailbox which resides in the office 365 cloud.

    In-order to perform a message trace perform the following action.

    Login to office 365 Admin portal and click on Admin Icon

    Track1

     

     

    Scroll down all the way down to  Admin and click on Exchange

    Track2

     

     

    Navigate to mail flow and select message center as shown below

     

    Track3

     

    Now it will take you to message tracking center.Now Specify the start date and end date

    Track4

    Select the date range.

    Note: The tracking results through EAC will be displayed only for the last 7 days.

    If you want to see the message tracking results for more than 7 days then we can export them in csv file and see the results.

    Track5

     

    Also we have an option to trace the emails based upon the message delivery  status which i find this to be very useful.

    Track6

     

    The final result will be displayed as below

    Track7

     

    Track8

     

    Also we have an option to see the pending and already completed traces that can be viewed.

    Track9

     

    Note:

    By default the message tracking logs will be available only for the past 90 days. If at all your organization will like to extend this period then its better to open a case with Microsoft and extend the tracking period for the same.

     

    Thanks 

    Sathish Veerapandian

    MVP – Exchange Server

  • Tech Tip of the Day – What is a federated exchange solution ?

    In short, federation is when two Company trust each other and when federation is enabled between them they can share their user’s presence, calendar and global address list.

    In a short description  below things needs to be done in order to enable a federation between to organizations

    Setup two AD-FS Servers (for company A and company B)

    Setup AD FS federated trust between company A and company B

    Choose a Server for Authentication Certificate for SSL Encryption (only 1)

    Configure the resource server (web server, Application server to which resources clients access) for company A and company B

     

    It’s always recommended that all Exchange organizations use the business instance of the Microsoft Federation Gateway for federation trusts. Before configuring federated delegation between the two organizations, you need to verify which Microsoft Federation Gateway instance each Exchange organization is using for any existing federation trusts.

     

    Inorder to identify the instance  run the following command

     

    Get-FederationInformation -DomainName <the hosted Exchange domain namespace>

     

    For exchange to “Configure Federated Delegation” you need to remember the below

     

    Domain Namespace Requirements:

     

    Step 1: Create a federation trust with the Microsoft Federation Gateway.

     

    https://technet.microsoft.com/en-us/library/dd335198(v=exchg.141).aspx#Shell

     

    Step 2: Create TXT records for federated delegation

    https://technet.microsoft.com/en-us/library/ee423548(v=exchg.141).aspx

     

    Step 3: Configure the domains for federated delegation

    Add-FederatedDomain -DomainName contoso.com

     

    Step 4: Create an Autodiscover DNS record

     

    https://technet.microsoft.com/en-us/library/cc772053(WS.11).aspx

     

    Step 5: Create an organization relationship

    New-OrganizationRelationship -Name “Contoso” -DomainNames “contoso.com”,”northamerica.contoso.com”,”europe.contoso.com” -FreeBusyAccessEnabled $true -FreeBusyAccessLevel LimitedDetails

     

    Thanks & Regards

    Sathish Veerapandian

    MVP- Exchange Server 

  • RBAC error – Disable-Mailbox isn’t within your current write scopes can’t perform save operation

    I just recently ran into this problem and thought of sharing this which might be helpful to others in similar situations.

    I just created a RBAC  Role group and a write scope for a group of admins to create and mange mailboxes in few mailbox databases.

    All the role group was created successfully and role entries seems to be working fine without any issues except for the disable-mailbox and enable-mailbox.

    So when the assigned role admins were able to create, modify , remove mailboxes, mail universal distribution groups , mail contacts , mail universal security groups , dynamic distribution groups but they weren’t able to enable or disable any of the objects on their own.

    When they tried to enable  or disable any mailboxes  that they get the below error

     

    RBAC_no_Enable-Mailbox_error

     

    I ran the command Get-ManagementScope Scopename | Fl to see the recipient filter types

    I was able to see the recipient type user mailbox, mail enabled contacts, mail contacts , mail universal security groups  and dynamic distribution.

    But still it was not working.

    later i identified the problem. Enable-Mailbox and Disable-Mailbox will remove only the exchange attributes from the user account and leaves the user account and the mailbox in the retention.

    For this functionality to work we will need to have AD permission for the user in the RBAC to perform this operation.

    So we need to add the recipient filter  (recipientType -eq ‘user’ ) which will grant AD permission to the desired RBAC custom group which will grant permissions to those RBAC admins.

    So i have added list of possible entries below that would be helpful for the help-desk team since by running only the above will remove the other permissions.

    So for helpdesk to manage the normal daily operations the below entries will be sufficient along with  (recipientType -eq ‘user’ ) added.

    Set-ManagementScope “ENTER THE RBAC GROUP” -RecipientRestrictionFilter {(RecipientType -eq ‘usermailbox’) -or (recipientType -eq ‘user’) -or (recipientType -eq ‘mailuser’) -or (recipienttype -eq ‘mailcontact’) -or (recipienttype -eq ‘mailuniversaldistributiongroup’) -or (recipienttype -eq ‘mailuniversalsecuritygroup’)}

     

     

    Once after the above i was successfully able to come out of the error 🙂

    Thanks 

    Sathish Veerapandian

    MVP – Exchange Server 

     

     

  • Quick bites – Things to consider during cross forest migration from Exchange 2010 to 2013

    In this article we will look at the readiness to be done during cross forest migration from exchange 2010 to 2013.

    There are multiple ways to perform this and this is again one of the best practices that can be followed.
    The first and the foremost thing is that we need to ensure that DNS is setup properly vice versa between the source and the target forest.

    Steps to ensure for DNS setup:
    1) Check if you have the same root DNS for both of the forest DNS namespaces. Make sure that the root zone contains delegations for each of the DNS namespaces.
    Also, update the root hints of all DNS servers.
    To Update root hints on the DNS server follow this article –  http://go.microsoft.com/fwlink/?LinkId=92717
    If there is no shared root DNS server for both of the forests and the root DNS servers for each forest DNS namespace are running a Windows Server operating system, configure DNS conditional forwarders in each DNS namespace to route queries for names in the other namespace.
    To Configure DNS server forwarders follow this article http://go.microsoft.com/fwlink/?LinkId=92718
    IMP :  If there is no shared root DNS server and the root DNS servers for each forest DNS namespace are not running a Windows Server operating system, configure DNS secondary zones as well in each DNS namespace to route queries for names in the other namespace.
    To Add a secondary server for an existing zone follow this article http://go.microsoft.com/fwlink/?LinkId=92719

    After above steps are done validate the DNS configuration through nslookup . You can follow the below article as well if you are having doubt in verifying through NSLOOKUP

    https://technet.microsoft.com/en-us/library/977fa8ed-ec71-4d39-9f9e-9facd5a61364
    Create a new forest trust:

    2. Create a forest trust
    a. Use account which belongs to Domain Admins or Enterprise Admins of domain. Open Active Directory Domains and Trusts on a DC of domain. To open Active Directory Domains and Trusts, click Start , click Administrative Tools , and then click Active Directory Domains and Trusts .
    To open Active Directory Domains and Trusts in Windows Server® 2012, click Start , type domain.msc .
    b. In the console tree, right-click the domain that you want to administer, and then click Properties .
    c. On the Trusts tab, click New trust , and then click Next .
    d. On the Trust Name page, type the Domain Name System (DNS) name (or NetBIOS name) of the domain, and then click Next .
    e. On the Trust Type page, click Forest trust , and then click Next .
    f. On the Direction of Trust page, do one of the following:
    o To create a two-way, forest trust, click Two-way .
    Users in this forest and users in the specified forest will be able to access resources in either forest.
    o To create a one-way, outgoing forest trust, click One-way:outgoing .
    Users in this forest will not be able to access any resources in the specified forest.
    g. Continue to follow the instructions in the wizard.

    Validate the created trust.

     

    Once the above is completed you can run prepare new request by following the below article

    https://technet.microsoft.com/en-us/library/ee861103%28v=exchg.150%29.aspx

    Once prepare move request is completed run the new move request

    Also set the move request large item limit to minimum to 50 so that large mailboxes move will not create an issue during migration by running the below command

    Get-MoveRequest | Set-MoveRequest -LargeItemLimit 50
    Rollback Plan if in case of anything went wrong:

    Delete trust accordingly. To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority.
    To remove a trust using the Windows interface
    1. Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click Start , click Administrative Tools , and then click Active Directory Domains and Trusts .
    To open Active Directory Domains and Trusts in Windows Server® 2012, click Start , type domain.msc .
    2. In the console tree, right-click the domain that contains the trust that you want to remove, and then click Properties .
    3. On the Trusts tab, under either Domains trusted by this domain (outgoing trusts) or Domains that trust this domain (incoming trusts) , click the trust to be removed, and then click Remove .
    4. Do one of the following, and then click OK :
    o Click No, remove the trust from the local domain only .
    If you select this option, we recommend that you repeat this procedure for the reciprocal domain.
    o Click Yes, remove the trust from both the local domain and the other domain .
    If you select this option, you must type a user account and password with administrative credentials for the reciprocal domain.

    Also you can follow the below excellent write up about cross forest migration by exchange server MVP Prabhat Nigam

    http://msexchangeguru.com/2013/11/03/e2013crossforestmigration/

    Thanks & Regards

    Sathish Veerapandian

    MVP – Exchange Server

  • Back Pressure in Exchange in 2013

    Back-pressure is used to monitor resources like hard disk space , availability of memory and version buckets to give an advance notification to the administrator before the email server is totally down.This feature was introduced from Exchange 2007. The concept of back-pressure in Exchange 2013 is the same as it was in Exchange 2010.
    Basically high level of hard drive space utilization is calculated by using the following formula in Exchange 2013:
    100 * (hard disk size – fixed constant) / hard drive size
    The value of fixed constant is 500 megabytes (MB)

    A list of changes that are made to the message queue database is kept in memory until those changes can be committed to a transaction log. Then the list is committed to the message queue database itself. These outstanding message queue database transactions that are kept in memory are known as version buckets.

    If normal level isn’t reached for the entire version bucket history depth, then edgetransport.exe config file is coded to take the following actions:

    1) Reject incoming messages from other Exchange servers ( could be internal exchange servers as well as external exchange servers)- initially

    2) Reject message submissions from mailbox databases by the Mailbox Transport Submission service on Mailbox servers – End users sent email received from their respective databases to transport submission service will be rejected. Which means that these messages will not reach till the categorizer level and all the messages will be rejected at the precategorizer level itself.
    3) Reject incoming messages from non-Exchange servers – Could be notes,zimbra etc.,
    4) Reject message submissions from Pickup and Replay directories – Messages from applications dropped in the pickup directory

    Similarly following event logs will be logged in the affected server:

    Event log entry for an increase in any resource utilization level
    Event Type: Error
    Event Source: MSExchangeTransport
    Event Category: Resource Manager
    Event ID: 15004
    Description: Resource pressure increased from Previous Utilization Level to Current Utilization Level.

    Event log entry for a decrease in any resource utilization level

    Event Type: Information

    Event Source: MSExchangeTransport

    Event Category: Resource Manager
    Event ID: 15005
    Description: Resource pressure decreased from Previous Utilization Level to Current Utilization Level.
    Event log entry for critically low available disk space
    Event Type: Error
    Event Source: MSExchangeTransport
    Event Category: Resource Manager
    Event ID: 15006
    Description: The Microsoft Exchange Transport service is rejecting messages because available disk space is below the configured threshold. Administrative action may be required to free disk space for the service to continue operations.
    Event log entry for critically low available memory
    Event Type: Error
    Event Source: MSExchangeTransport
    Event Category: Resource Manager
    Event ID: 15007
    Description: The Microsoft Exchange Transport service is rejecting message submissions because the service continues to consume more memory than the configured threshold. This may require that this service be restarted to continue normal operation.

    So the above event logs will help you to identifying the back-pressure on the affected server

    Solution:

    Use the Command Prompt to move the existing queue database and transaction logs to a new location.
    In a Command prompt window, open the EdgeTransport.exe.config file in Notepad by running the following command:

    Notepad %ExchangeInstallPath%Bin\EdgeTransport.exe.config

    Change the drive letter in which you wish to have the new location by changing in the below add key values

    <add key=”QueueDatabasePath” value=”D:\Queue\QueueDB” />
    <add key=”QueueDatabaseLoggingPath” value=”D:\Queue\QueueLogs” />

    Thanks 

    Sathish Veerapandian

    MVP – Exchange Server

  • Quick Bites – Deploy Edge server in Exchange 2010/2013 coexistence scenarios

    If you deploy Exchange 2013 servers in your Exchange 2010 organization and you have external mailflow configured to pass emails through exchange 2013 Edge Transport servers, you should configure subscription for Exchange 2013 edge servers to your existing Exchange 2010 hub servers.

    You can subscribe an edge server in a site to multiple HUB servers if it is(Exchange 2007/2010) and CAS & Mailbox Combined together if it is Exchange 2013 servers.

    You can subscribe a 2007/2010 edge to 2013 Exchange CAS & HUB combined servers. This can be done vice versa as well.

    You can import the Edge Subscription file and run EdgeSync on a standalone Exchange 2013 Mailbox server, or on a server where the Mailbox server and the Client Access server are installed on the same computer.

    Note :

    You can’t import the Edge Subscription file or run EdgeSync only on a standalone Exchange 2013 Client Access server.
    You cannot subscribe an edge servers to multiple site since edge servers are bounded to site specific and can be subscribed to multiple mailbox & CAS servers in a single site

    Make sure you open the below ports on the firewall

    Inbound traffic:
    SMTP – TCP port 25 (from Internet)
    SMTP – TCP port 25 (from Edge server to Hub server on internal network)
    Outbound traffic:
    SMTP – TCP/UDP port 25 (from Edge to Internet)
    SMTP – TCP/UDP port 25 (from Hub to Edge server)

    Very IMP : Do not open the below mentioned ports on perimeter firewall. These ports should be open only on intranet firewall.

    LDAP for Edge Sync – TCP port 50389 (from Mailbox to Edge server) Secure LDAP for Edge Sync – TCP port 50636 (from Mailbox to Edge server).

    Thanks
    Sathish Veerapandian

    MVP – Exchange Server