iOS 9 Outlook App & Lync 2013 App Issues

iphone6After Apple released iOS 9 to the public yesterday. From an Exchange or Office 365 perspective, iOS 9 supports the enhanced calendar features of Office 365 and Exchange 2016 when that is released. Unfortunately, incidents have been reported with the Outlook app and the Lync 2013 App.

Regarding the Outlook App, iOS9 users might not be able to start the Outlook App or the Outlook app will just crash. The far from ideal workaround offered by the Outlook team, is to reinstall the Outlook app.


Of course, this also requires users to reconfigure accounts and Outlook App settings, so organizations can expect some calls to the service desk by users who upgraded. Organizations can report on the currently registered iOS8 devices that syned in the last 30 days, using:

Get-MobileDevice | Where-Object {$_.DeviceOS -like 'iOS 8*' -and $_.whenChanged -gt (Get-Date).AddDays(-30)} | Select UserDisplayName, FriendlyName, DeviceModel, DeviceOS, whenChanged

This will product a list of users, the name of their device, the device model and OS and when it last synced with Exchange. This information can be useful when you want to proactively approach users with iOS8 devices.

For Lync 2013 users, there are sign-in issues when they have configured different region and language settings on their iOS device. Those users will be presented the following:


The issue has officially been confirmed through publication of KB3096704, which states:

“This problem is fixed in the Microsoft Skype for Business for iOS app that will replace Lync for iPhone and Lync for iPad when it’s released. No fix for this issue is scheduled for the current releases of Lync for iPhone and Lync for iPad”.

Since the Skype for Business app is not available yet, this is not good news. Mitigation is possible by matching the region with the language setting (or the other way around), after which you need to reinstall the Lync 2013 app from the store.

With all this in mind, should organizations wish to first test the new iOS against their Exchange environment for potential other issues, you can block iOS 9 from accessing your Exchange 2013 environment, or Office 365 tenant if you must, using the Access/Block/Quarantine feature. First you need to retrieve the reported DeviceOS string for iOS 9 for a device:

Get-MobileDevice | Where-Object {$_.DeviceOS -like “iOS 9*”} | Select DeviceModel, DeviceOSLanguage, DeviceOS

The reported DeviceOS strings then is used to create an ActiveSync device rule. For example, my iPhone 6 reports DeviceOS as “iOS 9.0 13A344”. To block these devices with iOS 9.0 and put them in quarantine, run the following:

New-ActiveSyncDeviceAccessRule -QueryString "iOS 9.0 13A344" -Characteristic DeviceOS -AccessLevel Quarantine

If you would like to know more about the Access/Block/Quarantine option, check out this article.

The UC Architects Podcast Ep55

iTunes-Podcast-logo[1]Episode 55 of The UC Architects podcast is now available. This episode, which was recorded live at the Modern Workplace Summit and Skype Days in Oslo, is hosted by Steve Goodman, who is joined by Ståle Hansen and Tom Arbuthnot. Special Guests are Johan Delimon, Thomas Poet, and Fabriazo Volpe. Editing was done by Andrew Price.

Some of the topics discussed in this episode are:

  • Introducing the Microsoft Office 365 Hybrid Configuration Wizard
  • Set up Skype for Business Online for Skype Meeting Broadcast
  • Overview of Modern Workplace Summit
  • Exchange 2016 new features
  • Lync 2013 multi-tenant upgrade path
  • How do I convince the firewall team to open ports 50-59k?
  • Extensive reporting statistics on room bookings and internal message stats
  • Move Public Folders to room mailboxes
  • What are the technical challenges and business challenges and opportunities for Cloud PBX
  • Skype – in place upgrade with Windows Server 2008 R2
  • Lync Room System (LRS) upgrade route
  • UCDAY UK meeting

You can download the podcast here or you can subscribe to the podcasts using iTunes, Zune or use the RSS feed.

The UC Architects is a community podcast by people with a passion for Unified Communications; our main focus is on Exchange, Skype for Business or related subjects.

Exchange 2013 and .NET Framework 4.6

Ex2013 LogoA quick heads-up that when you are running Exchange Server 2013, you should not install or update to .NET Framework 4.6. This version of the .NET framework is not only not supported, it may also cause your Exchange 2013 server to stop functioning correctly.

When you have updated from a previous version, a suggested workaround is to uninstall .NET Framework 4.6. However, with all the dependencies on the .NET Framework by Exchange Server, it maybe preferred, when you did install version .NET Framework 4.6, to migrate contents, i.e. mailboxes etc., to a new Exchange 2013 server, and decommission the one you installed .NET 4.6.

More information can be found in KB3095369.

Exchange 2013 CU10 & Exchange 2010 SP3 RU11

Ex2013 LogoThe Exchange Team released Cumulative Update 10 for Exchange Server 2013 (KB3078678) as well as Rollup 11 for Exchange Server 2010 Service Pack 3 (KB3078674). These version levels will be required for co-existence with Exchange Server 2016, which is to be released at a later date. The updates raise the version numbers to 15.0.1130.7 and, respectively.

Cumulative Update 10 contains the following fixes for Exchange Server 2013:

  • KB 3087126 MS15-103: Description of the security update for Exchange Server: September 8, 2015
  • KB 3094068 Permissions for a linked mailbox are added to an account in the wrong forest in an Exchange Server 2013 environment
  • KB 3093884 The link in a quarantined email shows an empty list for ActiveSync-enabled devices in Exchange Server 2013
  • KB 3093866 The number of search results can’t be more than 250 when you search email messages in Exchange Server 2013
  • KB 3088911 Inline attachments are sent as traditional when you smart forward an HTML email in an iOS device in Exchange Server 2013
  • KB 3087571 Can’t edit or resend a delayed delivery message when you open the message from the Outbox folder in Exchange Server 2013
  • KB 3087293 “550 5.6.0” NDR and duplicated attachments when an encrypted email is sent in Outlook in Exchange Server 2013
  • KB 3080511 HTML forms aren’t available when the DisableFilter parameter is enabled in Outlook Web App in Exchange Server 2013
  • KB 3080221 LegacyExchangeDN attribute is displayed when you use Outlook Web App to view an appointment in Exchange Server 2013
  • KB 3079217 Outlook Web App replies to the wrong email address when an email has more than 12 recipients in Exchange Server 2013
  • KB 3078966 Outlook 2011 for Mac client displays emails as they come from the same senders in Exchange Server 2013
  • KB 3078443 Incorrect results are displayed when you search for an email that has a certain attachment name in Exchange Server 2013
  • KB 3078438 Performance issues occur in an Exchange Server 2013 environment that’s running BlackBerry Enterprise Server 5
  • KB 3078404 Can’t access a shared mailbox after you migrate from Exchange Server 2010 to Exchange Server 2013
  • KB 3076257 EWS returns a Success response code even if a batch deletion request isn’t completed in Exchange Server 2013
  • KB 3074823 No Send As audit events are logged when you use Send As permission in Exchange Server 2013
  • KB 3071776 “A problem occurred” error when you access shared folders in Exchang Server 2013 mailbox by using Outlook Web App
  • KB 3069516 Mailbox size and quota information are reported incorrectly in Outlook and Outlook Web App in Exchange Server 2013
  • KB 3061487 “FailedToGetRootFolders” error when you run an eDiscovery estimate search for archive mailboxes in Exchange Server 2013
  • KB 3058609 Wrong recipient is specified in an inbox rule that has the ForwardTo or RedirectTo option in Exchange Server 2013
  • KB 3009631 Advanced Find against the Sent Items folder in Outlook returns no result in Exchange Server 2013
  • KB 2999011 Documents are partially indexed by Exchange search when they embed other documents in Exchange Server 2013
  • KB 2983161 Organization unite picker is missing when you create a Remote Mailbox in Exchange Admin Console in Exchange Server 2013
  • KB 3091308 Can’t install cumulative updates or service packs when MachinePolicy or UserPolicy is defined in Exchange Server 2013

For Exchange Server 2010 SP3, Rollup 11 contains the following fix:

  • KB 3092576 Exchange 2010 Information Store crashes randomly


    • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to stay current.
    • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
    • This Cumulative Update does include Active Directory changes when compared to the previous Cumulative Update. If you have deployed a version earlier than CU10, make sure you run setup /PrepareAD.
    • If you got an Exchange 2010 DAG, and want to properly update the DAG members, check the instructions here.

Note that Cumulative Updates can be installed directly, i.e. no need to install RTM prior to installing Cumulative Updates. Note that once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles. The order of upgrading Exchange 2013 servers is irrelevant, unlike with previous generations of Exchange. Exchange 2010 Rollups are cumulative per service pack level, i.e. they contain fixes released in earlier updates.

You can download Exchange 2013 Cumulative Update 10 here and Exchange 2010 SP3 Rollup 11 here. The Exchange 2013 CU10 Language Packs are available here.

IT/Dev Connections 2015

imspeakingatdevconnections[1]I am in Las Vegas at the moment for the IT/DEV Connections conference which will take place in Las Vegas this week. Looking at the schedule and list of speakers, the conference is bound to be a success. If you’re not in Las Vegas, you can follow the conference on Twitter. The designated hashtag is #ITDEVCON.

itdevconMany thanks to Penton Media for giving me the opportunity to co-host the “Managing Exchange On-Premises and Exchange Online with PowerShell” workshop in the Enterprise Collaboration with Jaap Wesselius, on September 14th in Bluethorn 4. I will be present at the conference the whole week, so if you have questions or just want to say hi, look me up or ping me on Twitter or e-mail.

Connecting to Office 365/Exchange

powershellAlmost 3 years ago, I wrote an article on how to enhance the PowerShell Integrated Scripting Environment, or ISE. That seemed adequate for the Exchange admin back then, who mostly connected their PowerShell session to their his on-premises environment, and perhaps occasionally a bit of Exchange Online.

Fast forward to 2015, most modern Exchange administrators not only require a connection – if any – to their Exchange on-premises environment, but likely to one or more of the Office 365 services as well. This includes Exchange On-Premises, Azure Active Directory, Exchange Online Protection and perhaps even Skype for Business Online, SharePoint Online, Azure Rights Management Services or Compliance Center.

All these service use a different PowerShell session, use a different endpoint FQDN, and sometimes even require a locally installed PowerShell module. Likely common denominator is the credential used to access each of these services. So, tired of re-entering my credentials every time when switching from Exchange Online to Exchange Online Protection, I created a script with a set of functions to allow me connect to each individual Office 365 service or Exchange Online:

  • Connect-AzureAD: Connects to Azure Active Directory
  • Connect-AzureRMS: Connects to Azure Rights Management
  • Connect-ExchangeOnline: Connects to Exchange Online
  • Connect-SkypeOnline: Connects to Skype for Business Online
  • Connect-EOP: Connects to Exchange Online Protection
  • Connect-ComplianceCenter: Connects to Compliance Center
  • Connect-SharePointOnline: Connects to SharePoint Online
  • Get-Office365Credentials: Gets Office 365 credentials
  • Connect-ExchangeOnPremises: Connects to Exchange On-Premises
  • Get-OnPremisesCredentials: Gets On-Premises credentials
  • Get-ExchangeOnPremisesFQDN: Gets FQDN for Exchange On-Premises
  • Get-Office365Tenant: Gets Office 365 tenant name (SharePoint)

Note that functions and credentials used in the script are global, and in principle only need to be entered once per shell or ISE session. If you need different credentials, call Get-Office365Credentials again. User interaction is a very basic Read-Host, but it does the job.

During initialization, the script will detect the modules which are required for certain Office 365 services. When not installed, it will notify you, and provide a link where to obtain the PowerShell module. The related Connect function will not be made available. The Azure Active Directory module also requires the Microsoft Online Sign-In Assistant to be installed. Needless to say, PowerShell is required to run this script, which is tested against version 4 (but should work with 3)

The functions are contained in a script called Connect-Office365Services.ps1. You can call this script manually from your PowerShell session to make the functions available. However, more convenient may be to have them always available in every PowerShell or ISE session. To achieve this, you need to edit your $profile, which is a script which always starts when you start a PowerShell or ISE session. By default this file does not exist and you need to create it, including the path. Also note that the files for PowerShell and ISE are different, Microsoft.PowerShell_profile.ps1
and Microsoft.PowerShellISE_profile.ps1 respectively.

Now, of course you can copy and paste the functions from the script file to your own $profile. Better is to call the script from your $profile, as this allows you to overwrite the Connect-Office365Services.ps1 with updates. To achieve this, assume you copied the Connect-Office365Services.ps1 in the same location as your $profile, for example C:\Users\Michel\Documents\WindowsPowerShell. You can then make PowerShell and ISE call this script by adding the following line to the $profile scripts:

& “$PSScriptRoot\Connect-Office365Services.ps1”

Now when you start a PowerShell session, you might see the following:


This shows the Microsoft Online Sign-In Assistant and Azure Active Directory PowerShell module is available, and related connect functions should be available.

When you load the script from ISE, it will show something similar. However, it will also show ISE is detected and make all functions available through the Add-On menu:


Customize this script to your liking. For example, if you always want to connect to Azure Active Directory when connecting to Exchange Online, add Connect-AzureAD in the Connect-ExchangeOnline function, or when you always want to connect to a fixed FQDN for Exchange On-Premises, insert it in the script or – better – configure your $profile to predefine the FQDN, e.g. $global:ExchangeOnPremisesFQDN=’’.

Also, you may with to leverage prefixing the imported cmdlets so you can easily switch between Exchange On-Premises and Exchange Online. For example, you can then having something like Get-EXOMailbox and Get-EOPMailbox corresponding to Get-Mailbox in your Exchange Online or Exchange On-Premises within the same shell session. However, as with aliases, think of the ‘the next guy’ who may not have these prefixed cmdlets, and instructions or scripts may require adoption to work, etc. But if you insist, for more information on prefixing cmdlets when importing a PowerShell session, see here.

Windows 10
Be advised that when used with Windows 10 build 10525 or 10532, your PowerShell session might crash when connecting to certain services, e.g. Exchange Online Protection. Fellow Exchange MVP Tony Redmond wrote about this here, including a possible workaround. Windows 10 RTM does not have this issue.

Download / Revisions
You can download the script from the TechNet Gallery here. The TechNet Gallery page as well as the script contains revision information.

Feedback is welcomed through the comments. If you got scripting suggestions or questions, do not hesitate using the contact form.

IT/Dev Connections 2015 App

IMG_0608A quick note that if you are attending IT/Dev Connections this year, you can now build your schedule using a mobile app. The app allows you to browse and pick from 190 sessions, view speaker bios, etc.

The app is available for:

For other devices, you can use the generic mobile website here.

Note: You can still register for the event. New registrations can use SPKRSOC15 when registering for a $400 off!

The UC Architects Podcast Ep54

iTunes-Podcast-logo[1]Episode 54 of The UC Architects podcast is now available. This episode is hosted by Steve Goodman, who is joined by Michael van Horenbeeck and Michel de Rooij. Editing was done by Andrew Price.

Some of the topics discussed in this episode are:

You can download the podcast here or you can subscribe to the podcasts using iTunes, Zune or use the RSS feed.

The UC Architects is a community podcast by people with a passion for Unified Communications; our main focus is on Exchange, Skype for Business or related subjects.

KEMP LoadMaster & HA Virtual ID

imageA small heads-up on something which you need to configure when deploying a Highly Available setup of physical or virtual KEMP LoadMaster devices in environments with redundant network routing components, but this may apply to other components with similar functionality as well. While in typical environments the LoadMaster’s default setting will never be an issue, it can easily be overlooked or not immediately considered suspect when you do have issues, for example in hosted environments.

Note: If you are looking for more information on load balancing Exchange 2013 using KEMP LoadMaster devices, Exchange-fellow Jeff Guillet did an excellent multi-part write-up on this topic here.

When configuring multiple LoadMaster’s in a High Availability setup, one of the settings is the HA Virtual ID parameter, which is located System Configuration > Miscellaneous Options > HA Parameters. This setting configures the routing identifier used by the LoadMaster as part of the VRRP or Virtual Router Redundancy Protocol (see RFC5798).

The HA Virtual ID is used to construct a unique MAC address, so that all devices in the same VRRP group can communicate. The MAC address uses a format as defined by VRRP, and is 00:00:5E:00:01:<ID> for IPv4 and 00:00:5E:00:02:<ID> for IPv6.  One device, the Master being the Active LoadMaster, owns the VRRP group and manages its MAC address and shared IP address.

As you can imagine, using the same identifier for multiple non-related devices on the same segment may cause unexpected behavior, like LoadMasters being unable to communicate with eachother, both HA LoadMasters thinking they are the Active HA node, or other disruptive behavior. This is likely caused by a device other than LoadMasters managing the VRRP group.

Therefor, it is recommended to always change the default value of ‘1’, but always consult with the network or hosting people which value to use, as different vendors use their own default ID. For example, Cisco may use a different default value than FortiNet or CheckPoint for their redundant networking components. Of course, you also need to use different values when using multiple HA LoadMaster deployments on the same segment.

Exchange Server 2016 Preview is here!

Ex2013 LogoAnd so it begins. Few moments ago, the Exchange team published the public preview of Exchange 2016. The build number of the preview version is (yes, 15.1.*, not 16.*). Exchange 2016 Preview raises schema to version 15317.

The team’s post contains information on the changes and features introduced in Exchange 2016. Many of these were already announced at Ignite earlier this year. An earlier blog post on these announcements can be found here.

With this Exchange 2016 Preview, there are important deviations from announcements made at Ignite 2015:

  • Minimum required Forest Functional Level (FFL) and Domain Functional Level (DFL) is Windows Server 2008. At Ignite is was announced Windows Server 2008 R2 FFL/DFL would be required.
  • Supported Operating Systems will be Windows Server 2012 and Windows Server 2012 R2. At Ignite, it was announced Windows Server 2012 was not going to be supported. Note that Windows Server 10 (Windows Server 2016) is currently in preview, is not (yet) supported, but likely will be at or shortly after both reach RTM status.
  • Coexistence requires  Exchange Server 2013 Cumulative Update 8 or Exchange Server 2010 Service Pack 3 Rollup 9. This is lower than Exchange 2013 CU10+ or Exchange 2010 SP3 RU11+ as was mentioned at Ignite.
  • Exchange 2016 Preview works with Outlook 2013, Outlook 2010 with KB2965295, or Outlook 2016 (currently in Preview). This is a lower requirement than Outlook 2010 SP2 with KB2956191 and KB2965295 or Outlook 2013 SP1 with KB3020812 as announced at Ignite. Note that Mac users can utilize Outlook for Mac for Office 365 or Outlook for Mac 2011.
  • Not mentioned at Ignite, but something which recently was introduced in Exchange Online, is the introduction of auto-expanding In-Place Archives in Exchange 2016 Preview. After filling up the initial archive with 100 GB (default quota), Exchange will create auxiliary archives in chunks of 50 GB. To the end user using Outlook 2016 or Outlook for the web (the new Outlook WebApp branding), these archives will appear as a single archive. Downlevel Outlook clients will only display the initial 100 GB archive.

Meanwhile, the TechNet technical library has been updated with information on Exchange 2016. Be advised that this documentation may be incomplete and subject to change, and in fact may even be not on par with the preview product. However, as the product reaches RTM, the documentation should become more complete and final.

Some links to get you started:

  • The official announcement from the Exchange Team can be found here
  • Preliminary documentation for Exchange 2016 can be found on TechNet here
  • Documentation on Active Directory schema changes for Exchange 2016 can be found here

Needless to say, this is a preview. It’s great to play with in a lab, but don’t install it in your production environment unless you are part of the TAP program.

You can download the Exchange 2016 Preview here