微软产品支持分析电子月刊 : Best Practice

在Exchange Server 2007中配置Internet邮件的收发

Support News Editor — Tue, 26 Jun 2007 05:55:00 GMT

利用Exchange Server 2007，用户可以根据自己企业环境里的需求来方便灵活得部署和控制Internet邮件的收发。三种常见的邮件路由部署场景是：

使用Edge Transport服务器来收发Internet邮件。Exchange环境中已经定制了Edge Transport服务器，运行在内部的Hub Transport服务器通过EdgeSync服务把收件人和配置信息同步到Edge Transport服务器上ADAM数据库中
使用Exchange Hosted Services或是第三方的SMTP网关服务器来收发Internet邮件
使用Hub Transport服务器来直接收发Internet邮件。

每种场景都需要特定的设置。请根据您企业里的需求来阅读微软TechNet的文章http://technet.microsoft.com/en-us/library/aa998212.aspx中的相关内容。

如何将Exchange 2007迁移到一台新的服务器并且保留原有服务器名

Support News Editor — Tue, 26 Jun 2007 05:46:00 GMT

我们收到一些用户的请求，想要知道如何将Exchange 2007迁移到一台新的服务器并且保留原有服务器名。下面，我将提供详细步骤。

1．拷贝mailbox database.edb、public database.edb以及mail.que文件到安全的地方以做备份。

当拷贝完成:

2．关闭老的Exchange 2007服务器。

3．打开"活动目录用户和计算机"，重置服务器的帐户并等待域控制器同步完成。

4．更改新服务期的名字和老服务器相同并且将它加入域。

5．调整IP设置是它和老服务器相同。

6．运行Exchange 2007安装程序并且使用/recoverserver和/donotrestart参数。范例如下：

Setup /m:recoverserver /donotrestart

当安装完毕:

a. 拷贝mail.que到c:\program files\Microsoft\Exchange Server\TransportRoles\data\queue

b. 拷贝mailbox database.edb到c:\Program Files\Microsoft\Exchange Server\Mailbox\First Storage Group

c. 拷贝public database.edt到c:\Program Files\Microsoft\Exchange Server\Mailbox\Second Storage Group

d. 打开"Exchange管理控制台"，打开存储的属性页，选择"这个数据库可以被恢复覆盖"

e. 启动所有Exchange 2007的服务

7．确认发送连接器设置正确

8．确认接受连接器设置正确

9．如果您想接受外部SMTP域的信件，请确保这个外部SMTP域在您的接受域列表里

10．可选：安装"Anti-Spam Agents"到"Hub Transport role"。详细步骤如下：

a. 运行Exchange管理命令行，转到脚本目录c:\program files\Microsoft\Exchange Server\Scripts。运行如下命令：.\install-AntispamAgents.ps1

b. 当安装完成，重起"Exchange Transport Service"服务

c. 打开"Exchange管理控制台"，确认"Anti-Spam Agents"已经出现在Anti-Spam页。(Organization Configuration – Hub Transport – Anti-Spam)

现在，我们可以测试内部和外部信件收发是否正常。若是，我们就完成了服务器的迁移。

Exchange Server 2007中Back Pressure新功能简介

Support News Editor — Tue, 26 Jun 2007 05:43:00 GMT

Exchange Server 2007中加入了Back Pressure这个新功能来防止邮件传输服务器上的系统资源被耗尽和滥用。

Back Pressure是运行在Exchange Server 2007中的Edge Transport服务器角色或是Hub Transport服务器角色上的一种系统资源监控机制。

当某种被监控的系统资源（例如磁盘空间利用率或是内存利用率）超出了特定的阀值时，Exchange传输服务器会采取例如停止接收新连接或是新邮件，专注于发送列表里的现有邮件等措施，来防止系统资源被消耗殆尽。当资源利用率恢复正常后，Exchange可自动重新开始接收新的连接和邮件。

对于每种被监控的资源，Exchange设定了正常，中等和高3种不同的等级的阀值。

例如，邮件列表数据库默认是存放在<磁盘号>:\Program Files\Microsoft\ExchangeServer\TransportRoles\data\Queue目录中。默认情况下，磁盘利用率的高位阀值被定义为100*(磁盘容量 - 4 GB) / 磁盘容量。随着剩余空间的减少，磁盘利用率开始增大。因此，我们在含有邮件列表数据的磁盘上需要至少4GB的剩余空间。否则，磁盘利用率将会超出高位阀值，Exchange相应的会就停止接收新的连接和邮件。

不了解Back Pressure这个新特性的人们，就可能会对Exchange服务器忽然停止邮件传输而产生疑惑。

想要了解关于Back Pressure特性的更多内容，请阅读微软TechNet文章http://technet.microsoft.com/en-us/library/bb201658.aspx

终端服务许可证错误信息的排错方法

Support News Editor — Tue, 29 May 2007 09:41:00 GMT

终端用户可能由于许可证错误而不能登录到终端服务. 这篇文章列举了客户端可能收到的错误信息.虽然错误信息出现在客户端,但是问题通常是终端服务器或者许可证服务器的配置或者网络连接问题引起的. 以下链接提供了错误信息相应的排错方法.

http://technet2.microsoft.com/WindowsServer/en/Library/159e6ff8-4edb-43fd-8767-3d9858897e2c1033.mspx

在Windows Vista环境下如何使用BitLocker 的“恢复密码“

Support News Editor — Tue, 29 May 2007 09:39:00 GMT

用户在Windows Vista启用 BitLocker时, 会弹出一个友好的界面要求用户创建“恢复密码“。用户可能此时会有疑问“这个恢复密码是什么，并且我改如何处理这个密码呢？”。

首先，让我们了解一下BitLocker系统。BitLocker有两个主要的功能：1)硬盘加锁：可以有效的保护笔记本丢失或者被盗时数据窥取；2)使用“启动过程检查”确保系统启动时的完整性。该检查用于检测在操作系统加载前是否有外界的攻击威胁存在。

如果在启动过程中的检查和启用BitLocker的检查一致的话，系统将正常启动。如果检查发生变化， BitLocker将进入“恢复模式”。几种情形可以导致这种情况的发生，一些情形时无害的，比如将BitLocker保护的磁盘移到一台新机器上；而有时却是有害的，比如RootKit袭击。有关更完整的恢复情形，请参考BitLocker技术概要。

在“恢复模式”，除非您提供“恢复密码”，加密数据不会解锁，或者插入一个包含“恢复密码“的U盘，或者人工键入密码。此时，启动PINs和密钥在”恢复模式“里面并不工作。这会引出两个关键点:

Ø 如果“恢复密码“而且系统进入”恢复模式“，数据无法挽回。

Ø 如果他人获取您的“恢复密码“，他能很容易对您的系统作任何改变并绕开BitLocker (这种情形相当于Windows XP的管理员密码被窃)。

于是您会注意到一个很有趣的问题：期望保护“恢复密码“，但是又要确保不能让它易于被攻击。把密码直接保存在电脑上显然不是个好的安全措施,那么我们有没有其他的选择途径呢? 下面提供几个选项供大家参考:

Ø 将“恢复密码“保存在U盘上,并把U盘放在一个安全的地方

Ø 将“恢复密码“打印出来,藏在某个文件柜里

Ø 将“恢复密码“烧在一张CD上(或者一个存放在一张软盘上),把碟片放在某个安全之处

Ø BitLocker也支持对”活动目录”服务器的自动备份

以上就是在一个商业环境里面备份“恢复密码“的推荐方案.

任何时候在使用“恢复密码“时,您都需要记住两点:备份和存放在安全之处。

微软IT部门如何对抗垃圾邮件和病毒

Support News Editor — Tue, 29 May 2007 09:34:00 GMT

如何有效的对抗垃圾邮件和病毒长久以来一直是一个热门的话题。并且是邮件系统管理员们的重要任务之一。当今来自Internet的邮件里有75％属于垃圾邮件。所以一套完整，现实，集中化的反垃圾邮件和病毒的解决方案是众多使用邮件系统的客户们所关心和必需的。在这里，我们将会看到微软的IT部门是如何应用Exchange Server 2007（包括Edge Transport前端服务器）和Forefront Security for Exchange Server中的增强技术和功能来保护微软的邮件系统的。

在一个像微软之类的大公司环境中，每天的巨大邮件处理量也带来了潜在的受到垃圾邮件和病毒侵入的威胁。微软13万员工每天总共大约要处理将近1400万封电子邮件。由于采取了有效的反垃圾邮件和病毒的措施，95％的垃圾邮件和病毒邮件被过虑掉了。微软IT部门是如何做到这一点的呢？详情请参阅下面的TechNet文档：

A Comprehensive Anti-Spam and Antivirus Solution: Microsoft IT's Rollout

http://technet.microsoft.com/en-us/library/bb430746.aspx

如何在集群系统中配置杀毒软件

Support News Editor — Tue, 29 May 2007 09:33:00 GMT

很多公司在实际的生产力环境中把杀毒软件作为必须要配置的软件之一。微软公司并不生产杀毒软件，但是微软公司对于如何在集群系统中配置杀毒软件有如下的建议：

防病毒软件可能导致群集服务问题

选择在正在运行 SQLServer 计算机上运行防病毒软件的指南

如何升级自定义SharePoint站点

Support News Editor — Tue, 29 May 2007 09:31:00 GMT

如果您曾对 SharePoint 网站进行过大量自定义（例如使用 Microsoft Office FrontPage），则在升级时必须决定如何处理这些自定义网站。根据自定义程度、网站复杂度以及升级目标的不同，处理方案也各有差异。在您升级之前,我们建议您阅读以下文章帮助您更好地做出决策：

升级自定义网站时的注意事项

http://office.microsoft.com/zh-cn/sharepointdesigner/HA101741392052.aspx

如果您的网站基于自定义的网站定义，则建议您在升级前创建新的网站定义，然后创建一个映射文件，从而确保升级过程能将旧的网站定义元素映射到新的网站定义。有关如何实现这一过程,请参考以下文章：

Develop new custom site definitions and create upgrade definition files (Office SharePoint Server)

http://technet2.microsoft.com/Office/en-us/library/e9ce38b0-e047-4519-a12c-3ded2231e87d1033.mspx?mfr=true

Deploy upgrade definition files and new site definitions [Office SharePoint Server]

http://technet2.microsoft.com/Office/en-us/library/c32cbc26-b1cd-4c3a-8285-6223d458e86d1033.mspx?mfr=true

访问Exchange服务器与Self-Signed证书

Support News Editor — Tue, 29 May 2007 09:23:00 GMT

- 如何在Vista上面安装Self-Signed证书使之成为根信任证书

如果你的Exchange服务器使用的是Self-Signed证书，无论你用Outlook或者是OWA来收发电子邮件，你都必须安装这个证书使之成为根证书，这样RPC over Http才能工作。这篇文章解释了如何在Vista上面安装Self-Signed证书从而可以正常访问Exchange服务器。

1. 使用以下URL访问OWA https://host.domainname.com/exchange

由于你的Self-Signed证书不被信任，你会看到一个类似于上面的一个画面。

2. 选择”Continue to this website”

这是你会看到OWA登陆界面。

3. 在地址栏上点击“Certificate Error”选择”View certificates”

如果你看不到”Install Certificate”选项，关闭IE7,使用Administrator权限启动IE7在做一遍。

4. 选择 "Install Certificate".

5. 启动Certificate Import Wizard. 确保选择选项 “Place all certificates in the following store”,选择”Browse…”

6. 选择”Trusted Root Certification Authorities”

7. 点击Finish关掉Certificate Import Wizard.

8. 选择”Yes”, 安装certificate

9. 如果你想确认证书是否被安装，你可以打开certificates snap in，你会看到证书保存在Certificates – Current User – Trusted Root Certification Authorities – Certificates.

提示:

(1) 你也可以拷贝证书到Local computers certificate store,这样这个机器的所有用户都可以使用这个证书。

(2) 你也可以创建一个组策略，导入证书到"Computer Settings\Windows Settings\Security Settings\Public Key Policies\Trusted Root Certification Authorities". 使用组策略可以将证书引用到域里面的机器。

如何在您的机构内配置垃圾邮箱地址列表

Support News Editor — Wed, 23 May 2007 05:49:00 GMT

As we know, we can set Outlook's "Safe Senders list", "Block Senders list" and "Safe Recipients list" to help people protect Spam. However, allowing all users to modify their lists is time-consuming and inconvenient. Now, we can use the following steps to deploy such lists throughout your organization (we will use "Safe Sender list" as example).

1. Create a share folder on server, say Junk E-mail, and give everyone read permission. Create a text file name SafeSender.txt. Input email addresses into file (one address one line).

2. Install "Microsoft Office 2003 Resource Kit" on the Domain Controller.

3. Start Active Directory Users and Computers (ADUC), Right Click on the OU in which users account is present, Go To "Properties", Click on "Group Policy" tab.

4. Select the Policy in effect, click on "Edit". It will open "Group Policy Object Editor". Right click on "Administrative Templates" under "User Configuration" -> All Tasks -> "Add/Remove Templates" -> Click on "Add" -> Select "Outlk11.ADM" and click "Open" -> Click "Close".

5. Expand "Microsoft Office Outlook 2003" under "Administrative Templates" -> Expand "Tools | Options" -> Expand "Preferences" -> Click on "Junk E-mail".

6. In the right pane double click on "Specify path to Safe Senders list".

7. Click on "Enabled" and under "Specify full path and filename to Safe Senders list" type UNC path of SafeSender.txt file (e.g.\\Server\JunkE-mail\SafeSenders.txt).

8. Double Click "Overwrite/Append Junk Email Import List" to configure if you want to keep user's own list.

9. Click on OK. Close "Group Policy Object Editor". Click OK again. Close Active Directory Users and Computers.

10. Log on to client machine and edit the following registry entry:

HKey_Current_User\Software\Microsoft\Office\11.0\Outlook\Options\Mail

DWORD = JunkMailImportLists

Value = 1

Note: This registry key should be deployed to the client machines for successfully deploying the Safe Senders List. We can use Group policy again to deploy this key. The value of this registry key will turn back to zero after Outlook applies the safe sender list from group policy. So if you need to modify the list, please change the value to 1 again.

11. Log off from the client machine and log on again.

12. Launch Outlook. Now you can see the email addresses in the Safe Sender list.

NOTE: The same procedure described above can be used to specify "Safe Recipients" and "Blocked Senders" list.

We also can use the Custom Installation Wizard or the Custom Maintenance Wizard to deploy such lists. Please refer to the following article for more information.

How to use the Custom Installation Wizard or the Custom Maintenance Wizard to customize user profiles to load default junk e-mail filter lists in Outlook 2003

http://support.microsoft.com/?id=927470

This article also applies to Outlook 2007. We can replace Outlk11.ADM with Outlk12.ADM file from "Microsoft Office 2007 Resource Kit".

改进virtual server性能

Support News Editor — Wed, 23 May 2007 05:47:00 GMT

More and more customers are consolidating their server by virtualization. Some customer may raise some performance issue regarding the virtual server. This article will cover following topics.

Improving virtual hard disk performance

You can improve throughput for virtual hard disks by using the following techniques:

•	Use a hard disk solution that allows fast access, such as a SCSI hard disk, a redundant array of independent disks (RAID), or storage area network (SAN).
•	Put each virtual hard disk on a dedicated volume, SCSI hard disk, RAID, or SAN. It is easiest to put virtual hard disks together with their associated virtual machine configuration files on a RAID or SAN because this keeps everything in one place.
•	Put virtual hard disks on a different physical disk than the host operating system. In particular, you want to put virtual hard disks on a different physical disk than the host page file.
•	Compact virtual hard disks to free more physical disk space.

For more information about improving virtual hard disk performance, see Optimizing virtual hard disks .

Improving network performance

You can improve network performance by using the following techniques:

•	Distribute the networking load. If you are running multiple instances of Virtual Server, you can distribute the networking load between them in the same manner as you would with physical servers. To do this, run a mix of network-intensive and non-network-intensive applications on a single instance of Virtual Server.
•	Add physical network adapters. For best performance, dedicate at least one physical network adapter to each virtual machine.

Improving processor performance

You can improve processor performance by using the following techniques:

•

Adjust the CPU allocation for virtual machines according to their CPU requirements. You can use monitoring software, such as Microsoft Operations Manager (MOM), to ascertain CPU utilization for each virtual machine. For more information about adjusting CPU allocation, see Configuring CPU resources for virtual machines .

Improving Virtual Server performance

You can improve the performance of Virtual Server by making the following configuration changes on the host operating system:

•	Increase the acceleration of your graphics hardware to full, as follows. On the Display control panel, click the Settings tab, and then click Advanced. Click the Troubleshoot tab, and then move the Hardware acceleration slider to Full.
•	Disable all unnecessary pointer options, such as pointer trails and shadow cursors, as follows. On the Mouse control panel, click the Pointer Options tab, and clear the check boxes of any options that you do not need.
•	Optimize system settings for performance, as follows. On the System control panel, click the Advanced tab. Under Performance, click Settings, and then click Adjust for best performance. Click the Advanced tab, select Background services, and then click OK twice.

You can improve the speed with which the Administration Website Master Status page displays and refreshes by hiding the virtual machine thumbnails that appear under Remote View. You can do this by clearing the Remote View check box on the Administration Website Properties page.

For more information of virtual server operation guide ,please visit Virtual Server 2005 Technical Library

使用Exchange Management Shell作大批量收件人管理

Support News Editor — Wed, 23 May 2007 05:46:00 GMT

There has been a big change in recipient management from Exchange 2003 to Exchange Server 2007. Exchange Recipient Management is the second biggest administration component of Exchange 2007, which ranks as top Exchange key component with respectable incident volume and an amount of supporting labor.

In Exchange Server 2007, you can do most of your recipient management tasks in both the Exchange Management Shell and the Exchange Management Console. For tasks that involve single recipients, it is usually simpler to use the Exchange Management Console (unless you are immune to typos). However, when you are trying to configure multiple recipients, there simply is no alternative to the power and ease of using the Exchange Management Shell. A new article was recently released that aims to help customers deal with bulk exchange recipient management more efficiently. Please click the link below to view this article at TechNet for details:

Using the Exchange Management Shell for Bulk Recipient Management

http://technet.microsoft.com/en-us/library/bb310752.aspx