Tag Archives: Exchange2010

Federation Information could not be received ..

Posted on by
1

When setting up federation between Exchange organization using the Hybrid Configuration Wizard, to connect your on-premise Exchange environment with Office 365, you may encounter an error message in the 2nd step of the Hybrid Configuration Wizard, Update-HybridConfiguration:

image

When inspecting the Update-HybridConfiguration results, it reads:

Updating hybrid configuration failed with error ‘Subtask Configure execution failed: Creating Organization Relationships.
Execution of the Get-FederationInformation cmdlet had thrown an exception. This may indicate invalid parameters in your Hybrid Configuration settings.
Federation information could not be received from the external organization.
..

The problem lies in the sentence “Federation Information could not be received from external organization”. To see where it goes wrong, you could run Set-HybridConfiguration and Update-HybridConfiguration manually, using additional parameters as shown in the result screen, providing proper credentials and additionally addint the Verbose parameter to increase output logged.

Most of the time this problem comes down to one of the following issues, which can be verified by running the following cmdlet, where example.com is to be replaced by the federated domain:

Get-FederationInformation example.com –Verbose

You’ll probably see the cmdlet going trough the discovery motions using autodiscover, ending up in the same “Federation information could not be received from the external organization” message. When analyzing this output, you’ll see it contains two hints on the potential issues:

Get-FederationInformation : The discovery process returned the following results:
Type=Failure;Url=https://autodiscover.example.com/autodiscover/autodiscover.svc;Exception=Discovery for domain example.com failed.; …

1. Autodiscover
The first issue often overlooked is internal autodiscover not working via DNS or not being set up properly, i.e. split DNS configurations. Some customers don’t configure internal DNS autodiscover records or don’t allow (internal) autodiscover to go through the proxy from inside.

Normally, when using regular clients like Outlook, this isn’t an issue because domain joined clients will be using SCP records from AD. However, federation will use DNS records so you need allow it or set it up in DNS; a CNAME for autodiscover.example.com as well as autodiscover.service.example.com pointing to your hybrid server will suffice.

Also make sure you enable WSSecurity authentication for autodiscover on your hybrid server using:

Set-AutodiscoverVirtualDirectory -Identity ‘autodiscover (Default Web Site)’ –WSSecurityAuthentication $true

2. Proxy rules
In the error message you’ll notice a autodiscover-related request going to /autodiscover/autodiscover.svc. These requests are normally caught by the autodiscover rule (path /autodiscover/*) in ISA or TMG. Issue is, these service requests require unauthenticated traffic. When you turn on logging in TMG, you’ll notice the requests for /autodiscover/autodiscover.svc will be denied.

To solve this issue, and to get federation working, you need to set up an additional ISA/TMG rule pointing to the hybrid server, using the proper public names (don’t forget autodiscover), bound to the OWA listener. You need to allow All Users (as opposed to Authenticated Users), set authentication to “No Authentication, but users can authenticate directly” and configure the following paths:

  • /EWS/Exchange.asmx/wssecurity
  • /Autodiscover/Autodiscover.svc
  • /Autodiscover/Autodiscover.svc/wssecurity

After configuring the rule, you need to put it above all the other Exchange rules, making it the first matching rule when federation traffic hits ISA/TMG.

After applying the rule changes, Get-FederationInfo example.com should work and you can continue with the Hybrid Configuration.

For more information on setting up co-existence, consult the steps provided by the Exchange Deployment Assistent.

The case of the missing Free/Busy public folder pt.2

Posted on by
Reply

In an earlier blog, I described the situation where a customer had improperly decommissioned Exchange 2003 Administrative Groups and ended up with invalid, orphaned legacyExchangeDN values causing all sorts of issues, most Public Folder / Free Busy related. Read more on this story here.

In the blog, I had two options on how to proceed:

  1. Edit the legacyExchangeDN attribute of the users affected;
  2. Recreate the Free/Busy public folder.

In the first blog, I described how to fix the situation using the 2nd option. Recently, I got an e-mail on how solve this if you have no Exchange 2003 server leftand want to go with the other option.

To fix this situation by changing the legacyExchangeDN values, you need to perform the following steps:

  1. Identify all mailboxes containing improper legacyExchangeDN values;
  2. For all those mailboxes, add the current legacyExchangeDN value as an x500 address;
  3. Fix the current legacyExchangeDN.

Note that by adding the invalid legacyExchangeDN value as an X500 address, we make sure (responding to) old e-mail messages or nickname entries can resolve properly.

You could use tools like ADModify to bulk edit those values. However, you also achieve the same result using a little PowerShell (surprise!), as shown in the following script:

Note: Use the script at your own risk. I cannot accept any responsibility for consequences when using this in your production environment. Before using it, prepare it in a lab environment first: test, test, test! Also, this script fixes invalid legacyExchangeDN values; it does not fix any related invalid settings, like delegates; that might be something for a next version when there’s demand for it.

$oldDN="/o=ADATUM/ou=First Administrative Group"
$newDN="/o=CONTOSO/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients"
$mbx= get-mailbox -Filter "LegacyExchangeDN -like '$($oldDN)/*'"
$mbx | ForEach {
    $x5= "x500:"+ $_.legacyExchangeDN
    Set-Mailbox $_.Identity -EmailAddresses @{Add=$x5}
    $User = [ADSI]("LDAP://"+$_.distinguishedName)
    $newDN= $newDN+ “/cn=”+ $_.Name
    $User.Put("legacyExchangeDN", $newDN)
    $User.SetInfo()
}

To use the script, replace the $oldDN value with your old, invalid legacyExchangeDN value (as reported in the Event Log entries with Event ID 14031). Set $newDN to your new legacyExchangeDN value; the default value of would be in the format “/o=<Organisation Name>/ou=<Administrative Group, i.e. Exchange Administrative Group (FYDIBOHF23SPDLT)>/cn=Recipients/cn=<Name>”.

If you have any questions, drop them in the comments below.

For all the PowerShell purists: Sometimes I prefer readability over trying to fit everything one 1 line. After all, this isn’t an Obfuscated Code Contest :)

Fix for Dutch “Global Addresslist” issue w/Exchange 2010 SP2

Posted on by
Reply

Today Microsoft released a fix (kb2677598) for a small cosmetic imperfection which shows up when using Outlook Web Access in Dutch, after installing Service Pack 2 on Exchange 2010.

Instead of showing up “Mail”, OWA displayed “Globale Adreslijst” (Global Addresslist) which might be confusing to end users.

To implement the hotfix, you need to apply the , dated 20 Feb, 2012, on your Exchange 2010 SP2 Client Access Servers.

You can download the Microsoft Exchange Server 2010 SP2 Language Pack Bundle (219 MB) here.

(Thanks to Jetze for the heads-up).

Exchange 2010 SP2 Rollup 1

Posted on by
3

Today the Exchange Team released Rollup 1 for Exchange Server 2010 Service Pack 2 (KB2645995). This update raises Exchange 2010 version number to 14.2.283.3.

Here’s the huge list of changes included in this rollup:

  • 2465015  You cannot view or download an image on a Windows Mobile-based device that is synchronized with an Exchange Server 2010 mailbox
  • 2492066  An automatic reply message is still sent after you clear the “Allow automatic replies” check box for a remote domain on an Exchange Server 2010 server
  • 2492082  An Outlook 2003 user cannot view the free/busy information of a resource mailbox in a mixed Exchange Server 2010 and Exchange Server 2007 environment
  • 2543850  A GAL related client-only message rule does not take effect in Outlook in an Exchange Server 2010 environment
  • 2545231  Users in a source forest cannot view the free/busy information of mailboxes in a target forest in an Exchange Server 2010 environment
  • 2549255  A meeting item displays incorrectly as multiple all-day events when you synchronize a mobile device on an Exchange Server 2010 mailbox
  • 2549286  Inline contents disposition is removed when you send a “Content-Disposition: inline” email message in an Exchange Server 2010 environment
  • 2556113  It takes a long time for a user to download an OAB in an Exchange Server 2010 organization
  • 2557323  Problems when viewing an Exchange Server 2003 user’s free/busy information in a mixed Exchange Server 2003 and Exchange Server 2010 environment
  • 2563245  A user who has a linked mailbox cannot use a new profile to access another linked mailbox in an Exchange Server 2010 environment
  • 2579051  You cannot move certain mailboxes from an Exchange Server 2003 server to an Exchange Server 2010 server
  • 2579982  You cannot view the message delivery report of a signed email message by using Outlook or OWA in an Exchange Server 2010 environment
  • 2585649  The StartDagServerMaintenance.ps1 script fails in an Exchange Server 2010 environment
  • 2588121  You cannot manage a mail-enabled public folder in a mixed Exchange Server 2003 and Exchange Server 2010 environment
  • 2589982  The cmdlet extension agent cannot process multiple objects in a pipeline in an Exchange Server 2010 environment
  • 2591572  “Junk e-mail validation error” error message when you manage the junk email rule for a user’s mailbox in an Exchange Server 2010 environment
  • 2593011  Warning 2074 and Error 2153 are logged on DAG member servers in an Exchange Server 2010 environment
  • 2598985  You cannot move a mailbox from a remote legacy Exchange forest to an Exchange Server 2010 forest
  • 2599434  A Public Folder Calendar folder is missing in the Public Folder Favorites list of an Exchange Server 2010 mailbox
  • 2599663  The Exchange RPC Client Access service crashes when you send an email message in an Exchange Server 2010 environment
  • 2600034  A user can still open an IRM-protected email message after you remove the user from the associated AD RMS rights policy template in an Exchange Server 2010 environment
  • 2600289  A user in an exclusive scope cannot manage his mailbox in an Exchange Server 2010 environment
  • 2600943  EMC takes a long time to return results when you manage full access permissions in an Exchange Server 2010 organization that has many users
  • 2601483  “Can’t open this item” error message when you use Outlook 2003 in online mode in an Exchange Server 2010 environment
  • 2604039  The MSExchangeMailboxAssistants.exe process crashes frequently after you move mailboxes that contain IRM-protect email messages to an Exchange Server 2010 SP1 mailbox server
  • 2604713  ECP crashes when a RBAC role assignee tries to manage another user’s mailbox by using ECP in an Exchange Server 2010 environment
  • 2614698  A display name that contains DBCS characters is corrupted in the “Sent Items” folder in an Exchange Server 2010 environment
  • 2616124  Empty message body when replying to a saved message file in an Exchange Server 2010 SP1 environment
  • 2616230  IMAP4 clients cannot log on to Exchange Server 2003 servers when the Exchange Server 2010 Client Access server is used to handle proxy requests
  • 2616361  Multi-Mailbox Search fails if the MemberOfGroup property is used for the management scope in an Exchange Server 2010 environment
  • 2616365  Event ID 4999 when the Store.exe process crashes on an Exchange Server 2010 mailbox server
  • 2619237  Event ID 4999 when the Exchange Mailbox Assistants service crashes in Exchange 2010
  • 2620361  An encrypted or digitally-signed message cannot be printed when S/MIME control is installed in OWA in an Exchange Server 2010 SP1 environment
  • 2620441  Stop-DatabaseAvailabilityGroup or Start-DatabaseAvailabilityGroup cmdlet fails when run together with the DomainController parameter in an Exchange Server 2010 environment
  • 2621266  An Exchange Server 2010 database store grows unexpectedly large
  • 2621403  “None” recipient status in Outlook when a recipient responds to a meeting request in a short period of time in an Exchange Server 2010 environment
  • 2628154  “The action couldn’t be completed. Please try again.” error message when you use OWA to perform an AQS search that contains “Sent” or “Received” in an Exchange Server 2010 SP1 environment
  • 2628622  The Microsoft Exchange Information Store service crashes in an Exchange Server 2010 environment
  • 2628693  Multi-Mailbox Search fails if you specify multiple users in the “Message To or From Specific E-Mail Addresses” option in an Exchange Server 2010 environment
  • 2629713  Incorrect number of items for each keyword when you search for multiple keywords in mailboxes in an Exchange Server 2010 environment
  • 2629777  The Microsoft Exchange Replication service crashes on Exchange Server 2010 DAG members
  • 2630708  A UM auto attendant times out and generates an invalid extension number error message in an Exchange Server 2010 environment
  • 2630967  A journal report is not sent to a journaling mailbox when you use journaling rules on distribution groups in an Exchange Server 2010 environment
  • 2632206  Message items rescanned in the background in an Exchange Server 2010 environment
  • 2633044  The Number of Items in Retry Table counter displays an incorrect value that causes SCOM alerts in an Exchange Server 2010 SP1 organization
  • 2639150  The MSExchangeSyncAppPool application pool crashes in a mixed Exchange Server 2003 and Exchange Server 2010 environment
  • 2640218  The hierarchy of a new public folder database does not replicate on an Exchange Server 2010 SP1 server
  • 2641077  The hierarchy of a new public folder database does not replicate on an Exchange Server 2010 SP1 server
  • 2642189  The RPC Client Access service may crash when you import a .pst file by using the New-MailboxImportRequest cmdlet in an Exchange Server 2010 environment
  • 2643950  A seed operation might not succeed when the source mailbox database has many log files in a Microsoft Exchange Server 2010 DAG
  • 2644047  Active Directory schema attributes are cleared after you disable a user’s mailbox in an Exchange Server 2010 environment
  • 2644264  Disabling or removing a mailbox fails in an Exchange Server 2010 environment that has Office Communications Server 2007, Office Communications Server 2007 R2 or Lync Server 2010 deployed
  • 2648682  An email message body is garbled when you save or send the email message in an Exchange Server 2010 environment
  • 2649727  Client Access servers cannot serve other Mailbox servers when a Mailbox server encounters a problem in an Exchange Server 2010 environment
  • 2649734  Mailbox replication latency may occur when users perform a Multi-Mailbox Search function against a DAG in an Exchange Server 2010 environment
  • 2649735  Warning of undefined recipient type of a user after the linked mailbox is moved from an Exchange Server 2007 forest to an Exchange Server 2010 forest
  • 2652849  The MailboxCountQuota policy is not enforced correctly in an Exchange Server 2010 hosting mode
  • 2665115  Event ID 4999 is logged on an Exchange Server 2010 Client Access server (CAS)

When running ForeFront Protection for Exchange, make sure you disable ForeFront before installing the rollup and re-enable it afterwards, otherwise the Information Store and Transport services may not start. You can disable ForeFront using fscutility /disable and enable it using the fscutility /enable command.

You can download Exchange 2010 SP2 Rollup 1 here.

Exchange PST Capture Tool released

Posted on by
Reply

It took a while, but today the Exchange Team released the long awaited Microsoft Exchange PST Capture Tool (initial version 14.3.16.4). The tool can be used to discover and inject PST files in an Exchange 2010 Exchange Online mailbox or archive.

The tool was originally from Red Gate and known as PST Importer. It’s architecture consists of three components: the central service, (optional) agents for PST discovery, registration and collecting PST files and an administrative console (image by Red Gate):

The online documentation can be found here.

Note that although it’s only supported for Exchange 2010 and Exchange Online, you can use it with Exchange 2007; it’s only untested (and probably unsupported) with that product.

You can read the official announcement here; you can download the tool and the agents here.

Thoughts on “Automatic E-mail Server Notifications in Exchange 2010″

Posted on by
3

In an article on MsExchange.org, Markus Klein elaborates on the reasons behind the changed message delivery notification (MDN) behavior in Exchange 2010. Examples of MDNs are read or delivery receipts or out of office messages. Issues may arise with MDNs because Exchange 2010 (and Exchange 2007) will use a blank sender address and not all e-mail systems can cope with that, making Exchange compliant with the related RFC. The article ends with workarounds to mitigate the issue. Here are my thoughts on that article.

The article refers to RFC2298, dated March 1998. However, MDNs are defined by RFC3798 of May 2004, which obsoletes RFC2298. Nevertheless, like Klein indicated, both RFCs dictate the following:

The envelope sender address (i.e., SMTP MAIL FROM) of the MDN MUST be null (<>), specifying that no Delivery Status Notification messages or other messages indicating successful or unsuccessful delivery are to be sent in response to an MDN.

The idea behind using a blank sender address is that e-mail systems will not return DSN messages, e.g. mailbox unavailable or disk quota exceeded, as a reply to an MDN, preventing potential message loops. However, there are some side-effects as not all e-mail systems or messaging hygiene products are RFC compliant. For example, the default setting of ForeFront Protection 2010 for Exchange is to block messages with an empty sender address. These products may simply block those messages, since blank senders could potentially be an indicator for spoofed messages. When you suspect such product to be causing the issue, check and reconfigure when appropriate.

The author continues the article by describing how to configure and troubleshoot routing of MDNs to the internet. The author shows how to enable and inspect the receive connector logs. Instead, I suggest monitoring the send connector logs when troubleshooting MDN delivery. Inspecting the send connector log files, you can get a clue on why MDN delivery fails and will see if Exchange is trying to deliver the MDN at all, and if so, the reason why. To enable send connector logging use the following cmdlet:

Set-SendConnector <ConnectorID> -ProtocolLoggingLevel verbose

The log files are generated in the “V14\TransportRoles\Logs\ProtocolLog\SmtpSend” folder below the location where you installed Exchange.

Finally, the author suggests the following workarounds:

  1. Use Outlook “out of office”
  2. Switch Relay Provider
  3. Implement Exchange Server Edge Roles

The first workaround is a less preferable option, as it’s configured per-user as a rule and rules, stored in the user’s mailbox, can’t easily be managed. When using the OOF option, administrators can, using the Get-MailboxAutoReplyConfiguration and Set-MailboxAutoReplyConfiguration cmdlets. Also, it makes the end user responsible for working around the issue. Meanwhile, despite this instruction, you can still expect lots of users to keep using the OOF function.

The second and third suggestions are non-options, since they don’t eliminate the issue and will only add a product and an extra hop to the e-mail route. Yes, you can switch to using a different SMTP relay or implement an Exchange Edge server which will accept MDN messages with an empty sender address. However, that may not be the final destination of the e-mail message, so the (unpredictable) MDN delivery issue remains. Nobody can guarantee that the e-mail system or message hygiene appliance at the recipient blocks blocks your OOF message with an empty sender address. You can read that between the lines of the PSS statement the author quotes as well:

The Exchange edge server will not reject the OOF message as the edge server will be incorporated into the Exchange organization. The HUB server will transfer the OOF messages in the address of OOF mailbox to the edge server and the edge server will then send the messages with empty return path e.g. blank sender, MAIL FROM: <> “null” to Internet.

Now, when the issue lies outside of your Exchange organization, e.g. the hosted message hygiene service or destination mail system, you might be left with no other option than to violate RFC3798 by adding a sender address. In Exchange this isn’t possible, but other e-mail gateways could help you with that. Note that when using a hosted message hygiene service or appliance for outbound messages, using a non-blank sender might be less of an issue since you’re offloading the delivery, compared to trying to deliver the message to the destination mail system yourself.

However, when opting to resort to these measures, I’d strongly suggest reconsidering sending out of office messages (or MDNs in general) outside of your Exchange organization, regardless of the sender. Spammers love confirmed e-mail addresses, so treasure your business e-mail addresses like you probably treat your own personal address.

Note that this blog isn’t to condemn the author of the discussed article, but to clarify things up since many people moving from Exchange 2003 to Exchange 2007 or Exchange 2010 may run into these behavioral differences. You’re invited to comment or share your opinions in the comments below.

Exchange 2010 SP1 Update Rollup 6

Posted on by
2

Today the Exchange Team released RU6 for Exchange Server 2010 Service Pack 1 (KB2608646). This update raises Exchange 2010 version number to 14.1.355.2.

Here’s the list of changes included in this rollup:

  • 2431609  An update is available that updates the message of a retention policy in OWA for Exchange Server 2010
  • 2449266  EWS drops the TCP connection to the EWS client application without any error message in a Microsoft Exchange Server 2010 environment
  • 2480474  A Users do not receive quota warning messages after applying SP1 for Exchange 2010
  • 2514820  An incoming fax message is not delivered to the recipient in an Exchange Server 2010 SP1 environment
  • 2521927  Disabling the Exchange ActiveSync Integration feature for OWA does not take effect in OWA Premium clients in an Exchange Server 2010 environment
  • 2528854  The Microsoft Exchange Mailbox Replication service crashes on a computer that has Exchange Server 2010 SP1 installed
  • 2535289  The Microsoft Exchange Information Store service crashes occasionally when you run an antivirus application on an Exchange Server 2010 Mailbox server
  • 2536313  Slow message delivery and mailbox access for journaling mailboxes on an Exchange Server 2010 server
  • 2544246  You receive a NRN of a meeting request 120 days later after the recipient accepted the request in an Exchange Server 2010 SP1 environment
  • 2548246  The Microsoft Exchange Information Store service crashes occasionally when a folder view is corrupted on an Exchange Server 2010 mailbox server
  • 2549183  “There are no objects to select” message when you try to use the EMC to specify a server to connect to in an Exchange Server 2010 SP1 environment
  • 2549289  A RBAC role assignee can unexpectedly run the Add-MailboxPermission command or the Remove-MailboxPermission command on an Exchange Server 2010 server that is outside the role assignment scope
  • 2555851  A mailbox does not appear in certain address lists after you run commands on the mailbox in an Exchange Server 2010 SP1 environment
  • 2559814  A user cannot add or remove delegates from a mailbox by using Outlook in an Exchange Server 2010 environment
  • 2561514  Exchange Server 2003 user cannot view the free/busy information of a user in a different federated organization
  • 2563860  You cannot create a new mailbox database if you already have 1000 mailbox databases in an Exchange Server 2010 environment
  • 2567409  Certain free/busy messages are not replicated from an Exchange Server 2010 server to an Exchange Server 2003 server
  • 2571791  Retention policies are applied to Contact items unexpectedly in an Exchange Server 2010 environment
  • 2572052  Certain properties of a recurring meeting request from external email accounts are missing in an Exchange Server 2010 SP1 environment
  • 2575005  You cannot start the EMC or the EMS in an Exchange Server 2010 Service Pack 1 environment
  • 2578631  Certain users cannot send email messages to a mail-enabled public folder in an Exchange Server 2010 environment
  • 2579172  Items that are deleted or moved still appear in the original folder when you use Office Outlook in online mode to access an Exchange Server 2010 mailbox
  • 2579671  No results returned when you use the ExpandGroup method in EWS to retrieve a list of members of a Dynamic Distribution Group in an Exchange Server 2010 environment
  • 2582095  The SmtpMaxMessagesPerConnection property of a send connector is not replicated to the subscribed Edge Transport server in an Exchange Server 2010 environment
  • 2600835  The RPC Client Access service crashes when you delete an attachment of an item by using Outlook in online mode in an Exchange Server 2010 SP1 environment
  • 2601701  The memory usage of the MSExchangeRepl.exe process keeps increasing when you perform a VSS backup on Exchange Server 2010 databases
  • 2616127  “0×80041606″ error code when you use Outlook in online mode to search for a keyword against a mailbox in an Exchange Server 2010 environment
  • 2617126  The Store.exe process crashes when you send an email message that has attachments in an Exchange Server 2010 SP1 environment
  • 2627769  Some time zones in OWA are not synchronized with Windows in an Exchange Server 2010 environment

Note that update rollups are cumulative, i.e. they contain fixes released in earlier update rollups for the same product level (RTM, SPx). This means you don’t need to install previous update rollups during a fresh installation but can start with the latest rollup available right away.

I’d recommend to thoroughly test this rollup in a test and acceptance environment first, prior to implementing it in production.

Note that when running ForeFront Protection for Exchange, you need to stop all ForeFront services before installing the rollup. While not entirely perfect, this is a welcome improvement over earlier rollups, where you had to disable and re-enable ForeFront using fcsutility /disable and fcsutility /enable respectively.

For the correct procedure on how to update a DAG and its members, check here.

You can download Exchange 2010 SP1 Rollup 6 here.

Exchange 2010 RTM EOL’s on October 11th

Posted on by
Reply

After returning from holiday, between all the Build Windows (Windows 8 ) news, a quick heads-up for those with lagging upgrade schemes or any other valid reason to be still running Exchange 2010 RTM. On October 11th, 2011, support for Exchange 2010 RTM will end.

This should be of no surprise when you practice proper lifecycle management or track Microsoft’s KB bulletins as this information was published on the lifecycle page as well as knowledge base article KB2615653.

For those doing fresh installs and still wondering if this affects their process of installing SP1 versions starting by using the RTM files; since Exchange 2007, Service Packs for Exchange contain all binaries enabling you to perform a fresh installation as well as an upgrade using the same set of files.

You can download Exchange 2010 Service Pack 1 here.

Exchange ActiveSync and Inheritable Permissions issue

Posted on by
4

The issue and solution described here is by design, but not known by every customer so here’s my short write-up on this subject.

Recently, I was at a customer reporting issues with several users not being able to synchronize their mobile devices using ActiveSync. The customer was running Exchange 2010 SP1 and used various mobile devices, e.g. iPhones as well as Android phones and tablets. A quick look in the IIS logs revealed that devices were connecting properly, but they received HTTP return code 403 (forbidden):

2011-08-30 10:09:31 172.16.10.12 OPTIONS /Microsoft-Server-ActiveSync/default.eas User=XXXXX&DeviceId=d849cec9be024c828b9af73da93bb59b&DeviceType=htcbravo&Log=LdapC2_Error:UserPrincipalCouldNotBeFound_Dc:dc.domain.com_Budget:(D)Conn%3a1%2cHangingConn%3a0%2cAD%3a%24null%2f%24null%2f0%25%2cCAS%3a%24null%2f%24null%2f0%25%2cAB%3a%24null%2f%24null%2f0%25%2cRPC%3a%24null%2f%24null%2f0%25%2cFC%3a1000%2f0%2cPolicy%3aDefaultThrottlingPolicy%5Fe205201e-d418-409a-a15b-4b51baef9bf4%2cNorm%5bResources%3a(DC)dc.domain.com(Health%3a-1%25%2cHistLoad%3a0)%2c%5d_ 443 domain\XXXXX 62.140.137.149 Android-EAS/0.1 403 0 0 124

Another clue was provided by the eventlog, which revealed MSExchange ActiveSync was reporting error 1053:

ss

The remainder of the message reads: “Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type “msExchangeActiveSyncDevices” and doesn’t have any deny permissions blocking such operations”. What happens when setting up ActiveSync is that Exchange tries to create a container named ExchangeActiveSyncDevices below the user object in Active Directory and will store in that container an MsExchActiveSync object for each ActiveSync device. Apparently Exchange doesn’t have sufficient permissions to create these objects.

To fix this, open up Active Directory Users and Computers. Now, to be able to inspect the security settings, we first need to activate Advanced Features if not already set. To do this, from the View menu option, select Advanced Features.

Next, navigate to the user object experiencing the issue. Open up Properties, select the Security tab and click Advanced.

image

Notice the Include inheritable permissions from this object’s parent is not set, the reason for Exchange not having any permissions on the object.

To fix the issue, simply check Include inheritable permissions from this object’s parent and click OK. You’ll return to the previous window where you’ll notice the Exchange Server account is now granted permissions on the object:

image

At this point, ActiveSync will work and Exchange will be able to create MsExchActiveSync objects in the ExchangeActiveSyncDevices container:

image

Note that Include inheritable permissions from this object’s parent by default is not enabled for members of the protected groups, e.g. Domain Admins. In fact, every hour the DACL on members of protected groups will be reset and inheritable permissions will be removed. This process is called AdminSDHolder which is to prevent inappropriate changes from being made to protected groups, accidently or otherwise.  Michael B. Smith did a nice write-up on this subject here. This is also the reason why bypassing the AdminSDHolder limitation by manually granting Exchange permissions would be inappropriate.

To prevent this issue, it is recommend to follow an old, yet far from rusty administrator best practice, which is to use one account for day-to-day operations, e.g. work and e-mail, and another account for administrative purposes.

Exchange 2010 SP1 Update Rollup 5

Posted on by
1

Today the Exchange Team released RU5 for Exchange Server 2010 Service Pack 1 (KB2582113). This update raises Exchange 2010 version number to 14.1.339.1.

I’d recommend to thoroughly test this rollup in a test and acceptance environment prior to implementing it in production. After the RU3 and RU4 debacles, I can’t emphasize this enough: test, test. test.

Here’s the list of changes included in this rollup:

  • 2275156  The inline contents disposition is removed when you send a “Content-Disposition: inline” email message by using EWS in an Exchange Server 2010 environment
  • 2499044  You cannot save attachments in an email message by using OWA if the subject line contains special characters in an Exchange Server 2010 environment
  • 2509306  Journal reports are expired or lost when the Microsoft Exchange Transport service is restarted in an Exchange Server 2010 environment
  • 2514766   A RBAC role assignee can unexpectedly run the Add-ADPermission command on an Exchange Server 2010 server that is outside the role assignment scope
  • 2529715  Slow network or replication issues after you change the number of virus scanning API threads in Microsoft Exchange Server 2010
  • 2536704  Mailbox users who are migrated by using ILM 2007 cannot use the Options menu in OWA in an Exchange Server 2010 environment
  • 2537094  French translation errors occur when you edit a response to a meeting request by using OWA in an Exchange Server 2010 SP1 environment
  • 2554604  A RBAC role assignee can unexpectedly manage certificates that are outside the role assignment scope in an Exchange Server 2010 environment
  • 2555800   You cannot use the GetItem operation in EWS to retrieve properties of an email message in an Exchange Server 2010 environment
  • 2555850   You cannot delete a mailbox folder that starts with a special character in its name by using Outlook in an Exchange Server 2010 environment
  • 2556096  The columns in the .csv logging file are not lined up correctly when you perform a discovery search on a mailbox in an Exchange Server 2010 environment
  • 2556107  The columns in the .csv logging file are not lined up correctly when you perform a discovery search on a mailbox in an Exchange Server 2010 environment
  • 2556133   A device that uses Exchange ActiveSync cannot access mailboxes in an Exchange Server 2010 environment
  • 2556156  Extra.exe crashes when it performs RPC activity checks against an Exchange Server 2010 server
  • 2556352  “ChangeKey is required for this operation” error message in Outlook for Mac 2011 in an Exchange Server 2010 environment
  • 2556407  Certain client-only message rules do not take effect on email messages that are saved as drafts in an Exchange Server 2010 environment
  • 2559926   ”There are no items to show in this view.” error message when you try to view a folder by using Outlook in an Exchange Server 2010 environment
  • 2572958  The “Test-OutlookConnectivity -Protocol HTTP” command fails with an HTTP 401 error in an Exchange Server 2010 environment

When running ForeFront Protection for Exchange, make sure you disable ForeFront before installing the rollup and re-enable it afterwards, otherwise the Information Store and Transport services may not start. You can disable ForeFront using fscutility /disable and enable it using the fscutility /enable command.

For the correct procedure on how to update a DAG and its members, check here.

Note that update rollups are cumulative, i.e. they contain fixes released in earlier update rollups for the same product level (RTM, SPx). This means you don’t need to install previous update rollups during a fresh installation but can start with the latest rollup available right away.

You can download Exchange 2010 SP1 Rollup 5 here.