Forefront Protection for Exchange Rollup 4

Posted on December 6, 2011 by Michel de Rooij

Microsoft released Hotfix Rollup 4 for Forefront Protection for Exchange Server (KB2619883).

Here’s the list of fixes included in this rollup:

Email is sent to the Forefront Protection for Exchange UNDELIVERABLE folder instead of being delivered
UNC and proxy credentials are stored in clear text in the Forefront Protection for Exchange file system
The Forefront Protection for Exchange FSEMachinePrep.exe fails with a fatal error
The external sender does not receive the expected Forefront Protection for Exchange generated notification
Forefront Protection for Exchange generates a notification with a blank subject line
Forefront Protection for Exchange virus engine updates fail between the passive node and active node in CCR clusters
Forefront Protection for Exchange only accepts 7-digit License Agreement numbers
Forefront Protection for Exchange generates a 2098 event ID every time the MSExchangeTransport service is restarted
Email queues at startup on an Exchange server running Forefront Protection for Exchange

For more details on the fixes consult the knowledge base article. You can request the hotfix rollup directly from the support center here.

Forefront Threat Management Gateway SP2

Posted on October 10, 2011 by Michel de Rooij

Microsoft released Service Pack 2 for Forefront Threat Management Gateway 2010, updating TMG to version 7.0.9193.500.

Here’s several highlights included in this service pack:

Kerberos Authentication
• You can now use Kerberos authentication when you deploy an array using network load balancing (NLB).

SSL
• Changes to SSL memory pool to increase Outlook performance when using Exchange online.

New Reports
• The new Site Activity report displays a report showing the data transfer between users and specific websites for any user.

Error Pages
• A new look and feel has been created for error pages.
• Error pages can be more easily customized and can include embedded objects.

You can download Forefront TMG 2010 SP2 here. Full release notes will be made available here.

Forefront Protection for Exchange Rollup 3

Posted on April 20, 2011 by Michel de Rooij

Microsoft released Hotfix Rollup 3 for Forefront Protection for Exchange Server (KB2538719).

Here’s the list of fixes included in this rollup:

Mail queues and sluggish Exchange/Outlook performance
Increased “Available Disk Space” Health Point threshold to 250MB
Error: The DNS Blocklist lookup domain blocklist.messaging.microsoft.com could not be contacted
The Exchange Information store crashes with Forefront Protection for Exchange installed
An attempted upgrade of Forefront Protection for Exchange fails with a “Registration Service Failed” error
You receive Forefront Protection Health Notifications indicating a status of “Green to Green”
Forefront generates a MaxDisabledWait error within 15 minutes after starting
A MaxDisabledWait error occurs and Forefront Protection does not recover
Forefront Protection doesn’t apply keyword filtering within hyperlink strings
Forefront Protection for Exchange crashes while scanning a TAR file
An engine update fails in Forefront Protection for Exchange
Emails that are 90 MB or larger are being sent to the Forefront archive folder
The Microsoft Forefront Server Protection Eventing Service will not start following an upgrade from a beta version of Forefront Protection for Exchange
Forefront Protection for Exchange detects files as “Engine Error” when no engines have been enabled for scanning
Messages quarantined due to engine error can now be delivered as complete email
High CPU conditions in EdgeTransort.exe process result in crash
You receive Forefront generated email notification that the Cloudmark engine or Worm list could not update
Exchange email queues at startup following an abnormal shutdown

For more details on the fixes consult the related knowledge base article. You can request the hotfix rollup through the support center here.

Comparing Active Directory Permissions

Posted on January 26, 2011 by Michel de Rooij

Every now and then you might be required to compare Active Directory account permissions. When it concerns one or few accounts, you could do the manual side-by-side comparison using Active Directory and Computers. However, when you need to check multiple accounts this task becomes tedious.

Now you could follow the practice laid out by Exchange fellow Andy Grogan here, generating permissions output using Quest Active Roles and comparing the textual output with a comparison utility like WinMerge or WinDiff. But you can also perform this comparison using PowerShell’s Compare-Object cmdlet, which I’ll show you here.

For this task we’re going to use the Quest AD extensions (Active Roles), which you can download here. Install these extensions on a domain-joined system where PowerShell is already installed. After installation, start the ActiveRoles Management Shell and enter the following, where IdA and IdB are the Identities of the objects you want to compare:

$a= Get-QadPermission <IdA> -Inherited -SchemaDefault
$b= Get-QadPermission <IdB> -Inherited –SchemaDefault

Now $a and $b contain the permission sets of both objects. Next, we’re going to utilize compare-object to compare these two sets. When we use Compare-Object $a $b you get the following output:

Not quite helpful this output but it isn’t unexpected. Since we’re comparing two object sets compare-object generates a result with objects. We can make this more readable by specifying the PassThru parameter so we can post-process these objects, like displaying certain fields using the Format-Table cmdlet, e.g.

Compare-Object $a $b -PassThru | ft SideIndicator,AccountName,Rights,Source,ApplyTo

Presto! The SideIndicator is included to see in which set the attribute is contained, e.g. “<=” means the element is contained in the 1st specified (reference) object and “=>” means its is contained in the 2nd (difference) object.

If you want to include equal objects in the output as well, add the IncludeEqual parameter to the Compare-Object cmdlet.

SSL client compatibility

Posted on January 4, 2011 by Michel de Rooij

Exchange fellow Jetze Mellema blogged (in Dutch) about a useful online check, which will allow you to check your current client – computer or smartphone – against a set of certificates from different vendors. The short – and more memorable and mobile friendly – URL for this test is as follows: http://m.ssltest.net.

The creator, SSL reseller FairSSL, also keep a total overview, which is located at http://www.ssltest.net/compare/sar.php. Note that the table’s titles are hard to read, but when hovering above the cells the corresponding product will be displayed.