[Today's post comes to us courtesy of Shawn Sullivan from Commercial Technical Support]
If you have ever been in the situation where you had to recover an Active Directory object that was accidentally deleted within a multiple Domain Controller environment, then you are probably somewhat familiar with the term “authoritative restore” and what it does. This link gives a pretty in-depth look at the procedure, however, some important points I want to call out on this post are:
Scenarios where you would mark the entire copy of Active Directory as authoritative are rare and the situation is most likely catostrophic. If you believe you might be in a situation like this, you should probably contact Microsoft Product Support Services for troubleshooting assistance.
Performing an authoritative restore of objects in Active Directory can become a very complicated proposition, depending on what it is that you intend to recover. There are just too many variables and different situations you could find yourself in to cover in one comprehensive article. However, to give you a good idea of the whole process, we will go through the common scenario where you wish to restore a single user account to its complete original state.
Note: There are tools, such as ADRestore, that can pull a deleted object out of its tombstone and place it in its previous location. However, certain attributes that are stripped from the object when it was deleted cannot be restored by such tools; for instance passwords and group memberships for user accounts. A tool like ADRestore is meant to be used if you do not have system state backup, not as a replacement for a system state backup.
You can see from the output that the attribute’s version number was incremented by 100000, which essentially make it more up-to-date as compared with what the remaining Domain Controllers have for this object. You can also see that 4 records were updated, this is the security group membership held by the account that I had deleted. In a simple recovery of a single user account, we do not have to take any further action at this point other than rebooting the server into normal mode.
New for SBS 2011 Standard
Windows 2008 R2 introduces a new feature called the AD Recycle Bin, which allows you to restore a deleted object in its entirety without having to go through the process I just talked about. This can save you quite a bit of time, but there are some caveats:
You can find a step-by-step walkthrough at the following link, this covers everything from raising the functional level to performing a restore: http://technet.microsoft.com/en-us/library/dd392261(WS.10).aspx
[Today’s post comes to us courtesy of Michael Leworthy from Windows Server Marketing]
Today, the Small Business Server (SBS) engineering team signed off the release version of SBS 2011 Essentials—an exciting milestone for the product, and for the entire SBS family. This now starts a process to make the product available for purchase and evaluation.
Ideal as a first server for small businesses with up to 25 users, Windows Small Business Server 2011 Essentials provides a cost-effective and easy-to-use solution to help protect data, organize and access business information from virtually anywhere, support the applications needed to run a business, and quickly connect to online services for e-mail, collaboration and line-of-business applications.
To help with questions we hear during this time of the product release cycle, I have provided further guidance below. If you have a specific question, please feel free to post in comments, on our SBS forums, or on our SBS Facebook site.
I would also like to thank all our MVPs, partners and customers that have helped us get to this point. I look forward to sharing more information with you in early April.
[Today's post comes to us courtesy of John Bay from Commercial Technical Support]
On SBS 2008/2011 when you reboot the server, you may notice that some of the Exchange services that are set to automatic start are not started.
Some of the services that may not be started are:
If you attempt to manually start the services, the services should start correctly.
The problem occurs in some environments when Exchange is installed on a Global Catalog. The Exchange Team has released a KB article that addresses the issue. The article has four methods to try to resolve the issue. In SBS environments, Method 1 is usually impractical. Methods 2 and 3 tend to work the best on an SBS server. Method 2 is the easiest to implement because you can use Microsoft Fix It to adjust the service dependencies for you. If your server experiences the problem the Exchange services not starting automatically, we suggest you use the Fix It under Method 2 in the article to resolve the problem.
[Today's post comes to us courtesy of Justin Crosby from Commercial Technical Support]
Today we are going to discuss the first thing you should always check if you get an HTTP 500 error attempting to access OWA on an SBS 2011 server, after you have provided your credentials to the login form.
In Exchange 2010 a new service has been introduced to handle forms based authentication (FBA). The service name is Microsoft Exchange Forms-Based Authentication service, MSExchangeFBA for short. If this service is stopped and you have FBA enabled, the default on SBS, you will get an error 500 attempting to access OWA. So if you receive this error please verify that the MSExchangeFBA service is started as your first step.
[Today's post comes to us courtesy of Shawn Sullivan and Justin Crosby from Commercial Technical Support]
Some of you who have worked with SBS 2011 so far may have noticed a change in how archived email for security groups is handled; for details see our previous post. SharePoint document libraries are no longer used for email storage; this job has now been given to Public Folders. As a result, the configuration necessary to allow the routing of email from Exchange to SharePoint is no longer done automatically for you during SBSSetup. However, it is possible to have this functionality on SBS 2011 as well; you just need to perform the configuration manually. This post will show you how and covers the following areas:
Note: The SBS 2011 Add Security Group wizard is hardcoded to give you the option to archive to a Public Folder only. It will remain this way even after following these steps. There is no way to change the wizard’s options.
Incoming email is not enabled in SharePoint 2010 running on SBS 2011 by default. You will need to enable it, choose the “Companyweb” SMTP namespace, and enter the path of the drop directory that the SharePoint Timer service will poll for incoming email:
You’ll need a place inside your Companyweb site to store the archived email that will have an email address for you to send to. To do this:
Now we are ready to create the pieces that will physically connect Exchange and SharePoint as far as SMTP is concerned. Basically, Exchange will use the foreign connector to determine that email destined for the @Companyweb domain should be sent to the drop folder (c:\inetpub\mailroot\drop). SharePoint, on the other side, will pick the email up from this folder, read the recipient, and place the email into the document library that has the matching email address.
To begin testing this, you should be able to send an email to the document library by directly addressing it in OWA. Any mistakes made with the above steps will result in errors that are documented fairly well in the SharePoint Products Event Viewer log: Application and Services Logs > Microsoft > SharePoint Products > Shared > Operational.
In order to route e-mail sent to a security group, you will have to create a contact for the SharePoint document library and add it as a member of the group. You can actually use either a distribution group or a security group here.
In this example, we will create a contact for mylist@companyweb and add it to the new test distribution group. This group’s SMTP address will be derived from the e-mail address policy, which will allow it to receive e-mail from the internet. Unless you specify otherwise, no sender restrictions are placed on the group.
If you wish to add the contact to an existing group, test2 for example:
A group who does not have any restrictions will display the following output: [PS] C:\Windows\System32>Get-DistributionGroup test2 | fl *accept*,*reject* AcceptMessagesOnlyFrom : {} AcceptMessagesOnlyFromDLMembers : {} AcceptMessagesOnlyFromSendersOrMembers : {} RejectMessagesFrom : {} RejectMessagesFromDLMembers : {} RejectMessagesFromSendersOrMembers : {}
If you do see entries for these parameters that are not intentional, go to the Exchange Management Console > Recipient Configuration > Distribution Group > properties of the group in question > Mail Flow Settings > Message Delivery Options. Adjust the settings from there (it’s much easier than typing a potentially very lengthy command). One common mistake people make is unintentionally allowing the “Require that all senders are authenticated” option to be checked, which kills the ability of external senders to submit to this group. An example of a group that is not applying restrictions looks like this:
If attachments are missing from e-mail messages that are sent to a SharePoint Foundation 2010 document library, it might be because you associated the document library with an e-mail address. When you do this, Directory Management Service may not add the following two attributes:
You must use Active Directory Service Interfaces (ADSI) to manually add these two missing attributes.
To add attributes by using ADSI Edit:
Click Start, and then click Run.
In the Run dialog box, type Adsiedit.msc, and then click OK.
In the ADSI Edit window, expand ADSI Edit, expand Domain [DomainName], expand DC=DomainName, DC=com, CN=MyBusiness, CN=Users, and then CN=SBSUsers.
Right-click the user name to which you want to add the missing attributes, and then click Properties.
In the Properties dialog box, double-click internet Encoding on the Attribute Editor tab.
In the Integer Attribute Editor dialog box, type 1310720 in the Value box, and then click OK.
In the Properties dialog box, double-click mAPIRecipient on the Attribute Editor tab.
In the Boolean Attribute Editor dialog box, click False, and then click OK two times.
Today, we are proud to announce that Windows Small Business Server (SBS) 2011 Standard and Premium Add-On are now fully available through all channels - from Volume Licensing to our largest OEM partners.
Microsoft has always been committed to supporting you and your business success. Our goal is to help you maximize the value of IT, even when your IT resources are stretched very thin—as is the case in organizations that have few IT professionals managing IT needs.
In keeping with this commitment, we’re introducing Windows SBS 2011 Standard, which is one of the latest editions of our SBS family of products. This all-in-one solution is designed to address key customer pain points: SBS takes the benefits of enterprise-class technology and makes them accessible, affordable and less complex for small and medium businesses (SMBs).
With this latest edition we have completely refreshed SBS Standard’s technologies and components. As a result, SBS 2011 Standard offers new, exciting features and technology solutions that will help SMBs reduce costs and increase productivity.
Features like mobile device security that makes sure Security policies are enforced by default in SBS 2011; like the easier migration to the new platform with enhanced migration tools, extensive pre-migration checks, and prescriptive guidance, or like the streamlined Outlook Web Access interface included in Exchange Server 2010, are just few examples that explain how, over the long term, Windows SBS 2011 Standard will help you grow your business.
Early adopters have seen the ease-of-use and value of SBS 2011 Standard. Take Scott Starr, Marketing Director of Firetrace International, for example. He says, “With Windows Small Business Server 2011, it’s a lot easier for me as a non-technical person to understand how the server is doing and take care of daily administrative tasks without involving our Microsoft partner or chasing down my coworker. I’d say that it’s given me back about two hours a week that I can use to do more important things than manage servers.”
To learn more about this product and how it can help your business, please visit the SBS 2011 Standard website. If you are interested in a trial version of the software, sign up here and discover why many customers and analysts are so passionate about it.
Microsoft’s partners are also excited about SBS 2011. This week HP announced full availability of SBS 2011 Standard on the HP server platform. You can hear more about how SBS 2011 Standard and HP can be an important asset in increasing your business's productivity. Just tune in to one of our recent launch webcasts.
Dell is another partner supporting SBS 2011. Make sure you don’t miss out on the live webcast next week, where you can learn how SBS 2011 and Dell can help you maximize return on your IT investment, improve employee productivity and ensure your data is protected. Register now!
Act now and get SBS 2011 Standard to give your business all the advantages that come with it.
Curtis Lee, Director, Server and Cloud Platform Marketing.