Exchange Ideas - Daniel Kenyon-Smith

I’m a Messaging consultant working for Microsoft Consultancy Services in the UK. Find out about all the latest technology, news, tips and tricks in the world of messaging and much more!

August, 2011

  • Office 365 - Non-Federated Identity, Password never expires

    The Microsoft Online Services Module allows you manage your tenant directly and in some cases change settings you can’t change in GUI (note this can only be achieved if you’re managing accounts that have been created in the tenant e.g. not created using Dirsync/ADFS).  To access Remote PowerShell to the Service Portal you will need to install the following prerequisites:-

    • Operating system: Use Windows 7 or Windows Server 2008 R2.
    • Microsoft .NET Framework: You must turn on the Microsoft .NET Framework 3.51 feature in Windows 7 or Windows Server 2008 R2.
    • Windows PowerShell 2.0 and AD FS 2.0: In order to run the cmdlets to set up single sign-on, you must turn on the Windows PowerShell 2.0 feature, and you must have administrator privileges on the AD FS 2.0 server. We recommend that you use remote access to the AD FS 2.0 server when you run the cmdlets; to do this you must use Windows PowerShell remoting.
    • All Office 365 software updates: From the Office 365 downloads page, install the required updates. To access the Office 365 downloads page, sign in to the Office 365 portal, and, under Resources, click Downloads. These updates are required because the features in Office 365 will not work properly without the appropriate versions of operating systems, browsers, and software.
    • Sign-In Assistant

    Download the Microsoft Online Services Module

    The Microsoft Online Services Module for Windows PowerShell is a download that comes with Office 365. This tool installs a set of cmdlets to Windows PowerShell (you run those cmdlets to set up single sign-on for Office 365).

    In this case i want stop user(s) from being prompted to change their password. In order to do this you can run the Microsoft Online Services Module from the shortcut menu and connect to your Office 365 Tenant by running the following commands:-

    • Connect-MSOLService –Credential $MSOLCred –Verbose

    You will need to enter your tenant credentials, once you have done this you can check what the current settings are by running

    • get-MsolUser –UserPrincipalName <UPNName> | fl

    Note that PasswordNeverExpires is set to false, you can then change the setting for either that individual user or all users

    • All users - Get-MsolUser | Set-MsolUser –PasswordNeverExpires $True
    • Individual user - Set-msoluser –UserPrincipalName <UPNName> -PasswordNeverExpires $True

    Run the this command again to ensure that the settings have taken effect and that PasswordNeverExpires is set to True

    • get-MsolUser –UserPrincipalName <UPNName> | fl

    Also if you don’t want the user t be prompted when they login you can run the following command

    • Set-MsolUserPassword –userPrincipalName <UPNName> -NewPassword "P@ssword" -ForceChangePassword $false

    If you want to know a list of commands run

    • get-command –module msonline

    This is the output (so as you can see its a pretty powerful tool, for example you can automate the provisioning of licenses for example):-

    Add-MsolGroupMember

    Add-MsolRoleMember

    Confirm-MsolDomain

    Connect-MsolService

    Convert-MsolDomainToFederated

    Convert-MsolDomainToStandard

    Convert-MsolFederatedUser

    Get-MsolAccountSku

    Get-MsolCompanyInformation

    Get-MsolContact

    Get-MsolDomain

    Get-MsolDomainFederationSett.

    Get-MsolDomainVerificationDns

    Get-MsolFederationProperty

    Get-MsolGroup

    Get-MsolGroupMember

    Get-MsolPartnerContract

    Get-MsolPartnerInformation

    Get-MsolRole

    Get-MsolRoleMember

    Get-MsolSubscription

    Get-MsolUser

    Get-MsolUserRole

    New-MsolDomain

    New-MsolFederatedDomain

    New-MsolGroup

    New-MsolLicenseOptions

    New-MsolUser

    Remove-MsolContact

    Remove-MsolDomain

    Remove-MsolFederatedDomain

    Remove-MsolGroup

    Remove-MsolGroupMember

    Remove-MsolRoleMember

    Remove-MsolUser

    Set-MsolADFSContext

    Set-MsolCompanyContactInform.

    Set-MsolCompanySettings

    Set-MsolDirSyncEnabled

    Set-MsolDomain

    Set-MsolDomainAuthentication

    Set-MsolDomainFederationSett.

    Set-MsolGroup

    Set-MsolPartnerInformation

    Set-MsolUser

    Set-MsolUserLicense

    Set-MsolUserPassword

    Set-MsolUserPrincipalName

    Update-MsolFederatedDomain

     

    Written by Daniel Kenyon-Smith

  • Enabling Retention Policies - Office 365

    Steps

    Action

    The first step is understand the different types of retention policies you can apply and plan appropriately

    See http://help.outlook.com/en-us/beta/gg271153.aspx for more details on retention policies.

    First create Retention Tags

    Create retention tags under the online tenant (for mailboxes that have been migrated to O365), under ‘Organisation configuration’ and ‘Mailbox’, the select the ‘Retention Policy Tags’ tab and create a new retention tag based on the setting you planned for in the previous step e.g.

    image

    This tag will apply to all folders and is therefore an default policy tag

    In this example I also created a personal tag

    This tag applies to personal folders or individual items that the user can select e.g. emails

    image

    Create a retention policy and assign the retention tags to the policy

    In the online EMC click ‘Retention Policies’ tab and create a new retention policy and assign the retention tags to the policy

    image

    Assign a mailbox to the policy

    image

    Process the retention policy immediately if required

    Run the following command

    Start-ManagedFolderAssistant -Identity "Mailbox added the previous step" (using remote PowerShell)

    Check the retention policy is applying to the user

    Run the following command

    Get-mailbox "Mailbox added the previous step" | fl ret* (using remote PowerShell)

    Login to the users mailbox to see if the retention polices have applied and are available (this will depend on the retention policy types you have created)

    Login to a user’s mailbox that has the retention policies assigned and notice the available policies in the ‘Home’ ribbon in Outlook 2010. The ‘Use Folder Policy’ is the default policy tag we created called ‘Move To Archive’ and is applied to all folders. The 14 days/2weeks policy is the ‘Custom – Move To Archive’ retention tag we created earlier, this is applies to ‘Personal folders’ and is therefore a personal tag, which users can apply to custom folders and individual items e.g. emails

    image

    Apply the personal tag to an individual item

    image

    Written by Daniel Kenyon-Smith

  • Performing a Multi Mailbox Search

    Steps

    Action

    Login to the portal

    Sign into https://portal.microsoftonline.com as the tenant administrator

    Add the user to the Discovery Management Role

    Select ‘Manage’ Under Exchange Online

    Select ‘Roles and Auditing’ and select the ‘Discovery management Role’ and details to add a user to the Discovery Management role group

    image

    Add the relevant user

    NOTE: This user will have access to search information within a user’s mailbox

    image

    Note the new membership

    image

    Perform a new search and estimate the search results first

    When I login to the portal with the assigned user we specified above I see the ‘Discovery’ tab under ‘Mail Control’.

    image

     

    When I click on new search I need to specify what the search criteria is, such as keywords, mailbox to search and you can also estimate the search results before you run an actual search

     

    image

    image

    image

    image

    Note: If no results are returned you can go back into details and redefine your search

    Perform a search and select ‘copy search results’

    Select details again

    image

    You can now save the search results to a destination mailbox (Discovery Search Mailbox)

    image

    Note the number of items found, click open to see the search results

    image

    Select ‘Open’ to open the discovery mailbox and view the search results

     

    View the search results

    image

    image

    Written by Daniel Kenyon-Smith

  • Enable a hosted (Personal) Archive for Office 365

    Steps

    Action

    Configure the ‘Office 365 Tenant’ Organization Relationship

    Get-OrganizationRelationship "Office 365 Tenant" | fl

    image

    Run - Set-OrganizationRelationship "Office 365 Tenant" -ArchiveAccessEnabled $true

    Start a remote PowerShell session

    Run

    $LiveCred = Get-Credential

    $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection

    Import-PSSession $Session –AllowClobber

    Configure the ‘On Prem’ Organization Relationship

    Run - Get-OrganizationRelationship "On Prem" | fl

    Then enable ArchivedAccessEnabled attribute by running - Run - Set-OrganizationRelationship "On Prem" -ArchiveAccessEnabled $true

    image

    Enable user archive

    In EMC select the mailbox you want to enable, right click and select ‘Enabled Hosted Archive’

    image

    Select Yes to enable hosted archive message ‘The archive will created in the online tenant specified. An archive will be created for ‘MAILBOXNAME’. Would you like to proceed?’

    Note the icon changes for the mailbox when the archive is enabled

    Login to the user mailbox

    Ensure the archive appears in the users profile (either Outlook 2010 or OWA)

    image

    Written by Daniel Kenyon-Smith

  • Enable Mailtips - Office 365

    Steps

    Action

    Enable on-premise Mailtips

    Set-OrganizationRelationship -id "Office 365 Tenant" -MailTipsAccessEnabled $True -MailTipsAccessLevel all

    Enable Office 365 Mailtips

    Set-OrganizationRelationship -id "On-Prem" -MailTipsAccessEnabled $True -MailTipsAccessLevel all

     

    Written by Daniel Kenyon-Smith

  • Enable Mailbox Moves–Office 365

    Steps

    Actions

    Enable move mailboxes for the organization relationship

    Run Set-OrganizationRelationship -id "Office 365 Tenant" -MailboxMoveEnabled $True

     

    Note:

    The MailboxMoveEnabled parameter specifies that the organization relationship is used to provide the credentials for moving mailboxes to Office 365.  If you don’t set this parameter you are required to provide admin credentials for the remote move.

    Access the Mailbox Replication Service Proxy (MRSProxy) service config file

    By default MRSProxy is disabled and must be enabled to help facilitate cross forest moves. On the Client Access Server browse to

    C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\exchweb\ews\web.config

    Enable the MRSProxy setting on all CAS’

    Locate ‘Mailbox Replication Proxy Service configuration’ in the web.config file and enable ‘ISEnabled’ by setting to true

    image

    Written by Daniel Kenyon-Smith

  • Enabling Calendar Sharing - Office 365

    Steps

    Action

    Enable free/busy calendar sharing on-premise

    Run the following command

    Set-SharingPolicy ‘Default Sharing Policy’ –domains ‘*: CalendarSharingFreeBusySImple’, ‘Company.com:CalendarSharingFreeBusyReviewer, ContactsSharing’, ‘Company.onmicrosoft.com:CalendarSharingFreeBusyReviewer, ContactsSharing’, ‘Office365.Company.com:CalendarSharingFreeBusyReviewer, ContactsSharing’

    image

    Confirm the settings have been applied in the EMC, under Organisational configuration, Mailbox, Sharing Policies

    image

    Enable free/busy calendar sharing for Office 365

    Open a remote PowerShell session by running the following commands and set the sharing policy

    $liveCred = Get-Credential

    $Session = New-PSSession –ConfigurationName Microsoft.Exchange –ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred –Authentication Basic -AllowRedirection

    Set-SharingPolicy ‘Default Sharing Policy’ –Domains ‘*: CalendarSharingFreeBusySimple’, ‘Company.com:CalendarSharingFreeBusyReviewer, ContactsSharing’, ‘Company.onmicrosoft.com:CalendarSharingFreeBusyReviewer, ContactsSharing’

     

    Written by Daniel Kenyon-Smith

  • Adding and Exchange forest to the EMC

    Steps

    Actions

    Add the online tenant to the on-premise EMC

    In the on-premises EMC right click ‘Microsoft Exchange’ and select add forest

    image_thumb

     

    In the drop down list specify ‘Exchange Online’ as the external exchange forest and specify your Office 365 administrator credentials if prompted

    image_thumb[1][1]

    Verify Exchange Online is added to the you on-premise EMC

    image_thumb[2][1]

    Written by Daniel Kenyon-Smith