About Michel de Rooij

Michel de Rooij, with over 25 years of mixed consulting and automation experience with Exchange and related technologies, is a consultant for Rapid Circle. He assists organizations in their journey to and using Microsoft 365, primarily focusing on Exchange and associated technologies and automating processes using PowerShell or Graph. Michel's authorship of several Exchange books and role in the Office 365 for IT Pros author team are a testament to his knowledge. Besides writing for Practical365.com, he maintains a blog on eightwone.com with supporting scripts on GitHub. Michel has been a Microsoft MVP since 2013.

Load balancing Exchange 2010 using a KEMP Virtual LoadMaster

Posted on June 28, 2012 by Michel de Rooij

In an earlier blog, I mentioned the requirement for an external load balancer when co-locating Exchange server roles, because Failover-Clustering and Network Load Balancing (NLB) are mutually exclusive. However, there are also situations when a load balancer is a better solution over Windows built-in NLB, mainly because there are some things NLB can’t do or doesn’t do well, like:

Service awareness: NLB distributes clients over member nodes, even over nodes of which required services, like IIS or RPC Client Access Service, are not responding;
Experience: Clients need to reconnect after adding or removing nodes;
Scalability : it’s not recommended to scale NLB beyond 8 nodes;
Affinity (also known as persistence or sticky sessions): NLB can only do Source IP affinity, i.e. distribute clients based on their IP address, while load balancers can utilize cookies or SSL session IDs.

Note: Why affinity is important and why Source IP can be bad sometimes, you can read in one of my earlier blogs on load balancing Exchange ActiveSync here.

To show you setting up a load balancer doesn’t have to be rocket science, I’ll demonstrate how to implement a load balancer for Exchange 2010 using a KEMP Virtual Loadmaster (VLM); setting up other load balancers should be similar, hardware appliances included, but keep in mind implementations by vendors vary, so check the product documentation as well. However, the basics are same, you only need to understand what you’re trying to achieve.

Note: The KEMP’s VLM used for this article runs on Hyper-V, but there are virtual load balancers for different hypervisors as well.

The setup we’re going to work with is roughly as follows:

In the sample environment, I’ve installed two Exchange 2010 servers, L12EX1 and L12EX2; both hold the Client Access, Hub Transport and Mailbox server roles. The domain name used is litware.com, and we have no site nor subnet definitions, so everything is located in the default Active Directory site, Default-First-Site-Name. Clients will access Exchange services (HTTPS, MAPI) using a single FQDN, outlook.litware.com.

The Exchange servers are located in a dedicated subnet, so we’ll use a so called two-armed setup (2 NICs); one NIC will connect the VLM to the subnet where the Exchange servers are located; the other one will be used for client access. In order to have the VLM work transparently, we configure the VLM as default gateway on the CAS servers. The result is that the CAS servers will see the original client IP addresses instead of the VLM’s address, which is not only helpful in log files, but is also needed for throttling or when limiting SMTP connections to Receive Connectors based on IP addresses for example.

Note: This article doesn’t describe implementing SSL offloading; for more information on SSL offloading and how to configure it, check this Technet article. Also, this article doesn’t go into any built-in ability of load balancers to mirror or create standby copies, meant to prevent the load balancer from becoming a Single Point Of Failure (SPOF) or improve Availability level.

We’ll start off by downloading the KEMP Virtual Loadmaster here. After downloading, extract the contents and import the VM in Hyper-V. After firing it up, it will use DHCP or 192.168.0.1 if DHCP is unavailable. You can check the console to see what IP address is used:

Now, before we can configure the VLM, we need to perform the initial setup:

Use the console to log in using the administrator account or connect with a browser to the VLM’s IP address;
If you haven’t got an activation key, you can apply for a trial key;
Complete licensing of the VLM;
Configure VLM network interfaces;
Import Configure certificate

Note: Make sure you set the MAC addresses of your NICs to static. When going through the licensing process, the access code is based on MAC address. If you don’t, the license will be invalidated if you migrate to a different host.

Note: We’re going to load balance services over port 443 and the administrative web interface uses that port as well, so configure the GUI on a different IP address or port.

Next, we need to create a Client Access Server Array. Note that creating a CAS Array before creating or moving mailboxes is best practice, as it prevents having to reconfigure Outlook MAPI profiles when clients have already connected (unless you want to perform mailbox move tricks to force MAPI reconfiguration). Basically, the steps to perform are:

Create a DNS record with FQDN which is going to be used for clients to connect. In our example, the FQDN used is outlook.litware.com using IP number 172.16.10.100;
Create a CAS Array object using New-ClientAccessArray, i.e.New-ClientAccessArray -Name outlook-default -Fqdn outlook.litware.com -Site Default-First-Site-Name

As per best practice, we’re fixing the RPC (59531) and Addressbook (59532) ports by setting the following registry keys on each CAS server and restarting the related MSExchangeRpc and MSExchangeAB services:

HKLM\System\CurrentControlSet\Services\MSExchangeRPC\ParametersSystem\TCP/IP Port = 0xe88b (59531) REG_DWORD

HKLM\System\CurrentControlSet\Services\MSExchangeAB\Parameters\RpcTcpPort = ”59532” (REG_SZ)

You can verify Exchange is listening on these ports using netstat –an | find “5953”.

Finally, we need to configure the mailbox databases with the new RPC endpoint using Set-MailboxDatabase in conjunction with the RpcClientAccessServer parameter:Get-MailboxDatabase | Set-MailboxDatabase -RpcClientAccessServer outlook.litware.com

Note: More information on creating CAS Arrays, check here.

After creating the CAS array, fixing the ports on Exchange and reconfiguring the RPC endpoint configuration on mailbox databases, configure the Exchange URLs to match the new client endpoint FQDN, outlook.litware.com. To so so, use cmdlets like Set-OWAVirtualDirectory –InternalURL https://outlook.litware.com/owa or Set-WebServicesVirtualDirectory –InternalURL https://outlook.litware.com/EWS/Exchange.asmx. In addition to InternalURL, set the ExternalURL as well depending on your setup, i.e. HTTPS services may be load balanced at the reverse proxy.

Now we’re ready to configure the VLM. We start off by creating Virtual Services, which are a combination of IP address and ports. Each Virtual Service has it’s own characteristics, like persistence, scheduling (distribution), can have its own certificate, distribution mechanism and appointed set of real (backend) servers and related service monitors.

We decided to use a single IP address for the various Exchange services, so we only need to configure a single Virtual Service for each port, via Virtual Services > Add New:

In the next screen you need to configure the Virtual Service settings like persistence and scheduling, as well as configure the real servers, i.e. the backend servers actually providing the service. You can also configure how the service health on the real server is monitored, i.e. is the service up or down. If a service on a real server is considered down, the load balancer won’t send clients to that server for that particular Virtual Service.

Note: The overview below is taken from a non-SSL offloading (SSL acceleration) configuration; when enabled, it will show additional options on the certificate to use.

Note: When using “Least Connection” persistence as recommended in the KEMP documentation, be advised a client traffic storm can occur after the Real Server comes online. Reason is it starts without connections, so all new clients will be directed to this server. Other products have mechanisms in place to prevent this by throttling traffic, gradually increasing the connections; F5 calls this feature Slow Ramp Timeout in their F5 BIG-IP Local Traffic Manager products.

When configuring the Virtual Service, click Add New to add a Real Server to the Virtual Service.

A suggestion on how to configure the Virtual Services:

Virtual Address	Port	Service Name	Persistence	Scheduling
172.16.10.101	443	Exchange-HTTPS	Super HTTP	Round Robin
172.16.10.101	59531	Exchange-RPC	Source IP	Round Robin
172.16.10.101	59532	Exchange-AB	Source IP	Round Robin
172.16.10.101	135	Exchange-EPM	Source IP	Round Robin

Note: When required, you can also load balance inbound SMTP traffic using ports 25/587, IMAP4 (ports 143/993) and POP (110/995) using no persistence.

Note: Using Source IP can result in an unbalanced distribution of client load, when SNAT devices come into play. For an example scenario, see my earlier article on Load balancing, ActiveSync and Affinity.

And that’s basically it. When you want to channel specific HTTP services (Outlook WebApp, Exchange ActiveSync, Autodiscover etc.) you can appoint different FQDNs for each service and configure different FQDN/IP addresses per service in DNS, after which you can configure separate Virtual Services with more specific options. For example, you can not only configure specific persistence or scheduling settings for per Virtual Service, but also Real Servers checks (depending on the protocol). Instead of checking if a Real Server responds on port 443, you can check if the server responds on a different URL, e.g. https://<server>/owa.

Another bonus of using a load balancer, depending on functionality of the product used of course, is that you can (temporarily) disable a real server from the VLM. After doing this, clients won’t be directed to the corresponding Exchange server, which is very useful when you want to perform maintenance.

In this article we quickly went through setting up a KEMP VLM to load balance Exchange 2010 services. However, the article is based on certain decisions regarding the configuration, which can differ from organizational to organization. For more information on deploying KEMP VLM and its possibilities, check out the KEMP Virtual LoadMaster Deployment Guide here.

Most vendors, like KEMP, provide template functionality, which enables you to quickly set up the load balancer using preconfigured settings; make sure you inspect those settings afterwards (i.e. know what you’re doing). You can download KEMP templates here. Unfortunately, these files are in binary format so you can’t edit them nor can you export Virtual Services, otherwise I could have provided you with the template for the above settings.

Be advised that I am in no way connected to KEMP and this article hasn’t been sponsored or commissioned by KEMP technologies, apart from providing an NFR license for writing and testing purposes.

Storing Replies with Received Items

Posted on June 20, 2012 by Michel de Rooij

Not directly Exchange related but mail-related, I’d like to mention a function in Outlook which could make organizing e-mail a lot easier, depending on if and how you organize them of course.

Normally, when replying to an e-mail in Outlook, it will store a copy of that message in the Sent Items folder of that account. That is, assuming you have 1 Exchange account set up or multiple in conjunction with the DelegateSentItemsStyle setting as described here.

Now after a while, your Sent Items folder will be full of messages sent over the past period. For received messages you may have created folders and perhaps rules to automatically organize incoming e-mail in projects or customers folders. Wouldn’t it be nice if you can keep those messages with their replies automatically, instead of having to organize your Sent Items by manually distributing its contents over the projects and customers folders?

Well, you can actually, and it’s a setting in Outlook. Open up the File > Options and select the Mail settings. In the right pane, check the When replying to a message that is not in the Inbox, save the reply in the same folder setting:

Note that this setting in pre-Outlook 2010 versions is called In Folders Other Than The Inbox, Save Replies With Original Message.

Now when you reply to a message, it will save the reply in the same folder unless the message was in the Inbox.

Note that this setting will apply to all accounts and personal folders.

Exchange 2010 Mailbox Role Calculator 19.9

Posted on June 19, 2012 by Michel de Rooij

It’s been almost 3 months since the last update, but today the Exchange Team released version 19.9 of the Exchange 2010 Mailbox Role Calculator.

Enhancements since version 18.9:

Revised name of Offline Address Book in MailboxDatabases.csv file
Integrated revised CreateMBDatabases.ps1 script that better handles database creation with large numbers of databases
Integrated revised CreateMBDatabaseCopies.ps1 script that performs faster
Added validation check to ensure message profile has a mailbox size limit
Added 4TB disks as a disk selection option
Included prompt for 2nd site GC for on DB Export Primary DB List dialog
Included prompt for 1st and 2nd site GC on Export Copy DB List dialog
Revised default for GC on Export Primary DB List dialog to use FQDN
Revised default for Public Folder DB on Export Primary DB List dialog to clarify it is a DB name
Added problem explanation text to Distribution tab status line to show why the Calculator considers a configuration invalid
Updated CreateMBDatabaseCopies.ps1 to use GC1 and GC2 from export file
Added status information to Diskpart.ps1 to show the state of disks before and after script execution

Bug Fixes since version 18.9:

Fixed issue with “Number of Active Databases / PDC (After Second PDC Server Failure)” formula to ensure that the PDC cannot have more active databases than possible
Removed rounding on calculating number of active databases / server
Fixed “DB and Log LUN Design / Server” to accurately calculate /DAG totals when 2 LUNs / Backup Set architecture is chosen
Fixed conditional formatting issue with Number of Mailbox Servers when the design utilizes standalone Mailbox servers
Fixed bug preventing running multiple StorageCalc instances from running concurrently
Fixed bug when saving a workbook under a new name after making changes to the original workbook
Fixed “Number of Mailbox Cores Required to Support Activated Databases in Secondary Datacenter” to accurately take into account the correct number of remaining servers
Fixed diskpart.ps1 script to ensure it can be re-executed
Fixed diskpart.ps1 script to cater for embedded spaces in mountpoints
Fixed CreateMBDatabaseCopies.ps1 to read input for Primary site and Secondary site DC’s
Fixed Export Primary Databases List to use PF Database instead of PF Server

You can download the calculator here. For more information please consult the changeblog or usage instructions.

Cmdlet Extension Agents Part 2: Postconfiguring Mailboxes

Posted on June 19, 2012 by Michel de Rooij

Cmdlet Extension Agents Part 1: Automatic archive creation

Almost a year ago, I posted an article in which I tried to show the power of Cmdlet Extension Agents in Exchange 2010, or more specifically, the Scripting Agent. Unfortunately, the Cmdlet Extension Agents are often overlooked or ignored, despite customers having requirements to customize things immediately after creating a mailbox. Therefor, I decided to write another article on this topic, hoping people take up using Scripting Agents.

Now while you can also put all sorts of post-configuration tasks in provisioning scripts, using the Scripting Agent when possible has a big bonus, because those additional actions not only run when you run the cmdlet directly from the Exchange Management Shell but also when you run them indirectly by using the Exchange Management Console.

So, as this follow up of the previous article, in which I explained what the CmdLet Extension Agents are and how to utilize the Scripting Agent to automate tasks, I’ll show you another example of a Scripting Agent and quickly walk you through it, so you can experiment with it (first in a lab of course) and tune it to your own requirements.

In this example, we’ll disable ActiveSync and configure SingleItemRecovery when creating a new user with a mailbox or mailbox-enabling an existing user. Therefor, the cmdlets we’re going to customize are New-Mailbox and Enable-Mailbox.

Open up Notepad and create a file \bin\CmdletExtensionAgents\ScriptingAgentConfig.xml located in Env:ExchangeInstallPath, e.g. C:\Program Files\Microsoft\Exchange Server\V14\Bin\CmdletExtensionAgents, using the following contents:

Note: If you’ve already got a ScriptingAgentConfig.xml file, you need to integrate the following content.

<?xml version="1.0" encoding="utf-8" ?>
 <Configuration version="1.0">
 <Feature Name="Mailboxes" Cmdlets="New-Mailbox,Enable-Mailbox">
 <ApiCall Name="OnComplete">
   if($succeeded) {
     $Name= $provisioningHandler.UserSpecifiedParameters["Name"]
     Set-Mailbox $Name -SingleItemRecoveryEnabled $true
     Set-CASMailbox $Name -ActiveSyncEnabled $false
   }
 </ApiCall>
 </Feature>
 </Configuration>

As you can see, you’re not limited to 1 action or related cmdlets (*-Mailbox). A small explanation:

The Cmdlets specified in this feature extension dictates which cmdlets will be extended, in this case New-Mailbox and Enable-Mailbox;
OnComplete dictates that our script will fire when the cmdlet has finished;
We check for OnComplete parameter $succeeded, only configuring the mailbox when the preceding events were successful;
$provisioningHandler.UserSpecifiedParameters contains user provided parameters passed to the cmdlet. So, $provisioningHandler.UserSpecifiedParameters[“Name”] will return the value of –Name;
We set SingleItemRecovery to $true for the mailbox specified by $Name;
We disable ActiveSync client access for this mailbox as well.

As mentioned in part 1, distribute this XML file to all your Exchange servers in the local CmdletExtensionAgents folder. When you haven’t already enabled the Scripting Agent, do so by running the following cmdlet:

Enable-CmdletExtensionAgent “Scripting Agent”

Now, when we create a new mailbox or mailbox-enable an existing user:

.. you’ll see the SingleItemRecovery has been enabled and ActiveSync has been disabled for this mailbox by the scripting agent:

I recommend you start checking out the Scripting Agent if you haven’t already done so. You can use these examples as a starting point and work from there. More information on the Scripting Agent, alternative APIs etc. can be found here.

The UC Architects Podcast S01E01

Posted on June 19, 2012 by Michel de Rooij

Today, the inaugural episode of the UC Architects went online, a bi-weekly podcast on the subjects of Exchange and Lync Server.

The UC Architects team consists of Pat Richard, Johan Veldhuis, Ståle Hansen, Tom Arbuthnot, Mahmoud Magdy, Paul Cunningham, Andrew Prics and yours truly, Michel de Rooij.

The first episode is hosted by Steve Goodman, who’s joined by John A Cook, Michael van Hoorenbeek, Dave Stork and Serkan Varoglu.

Topics discussed are Exchange 2010 SP2 Update Rollup 3, rumors around Exchange 15, TechEd and MEC and Exchange or Lync related news.

You can get the podcast through here.