SSL certificates are issued for periods of spanning a number of years (typically in multiples for example one, two or more years, however eventually they do expire and need to be renewed).

The renewal process involves generating a fresh CSR (Certificate Signing Request) on one of your Exchange Client Access servers. This is then sent to a root certification authority (e.g. VeriSign) for processing into a valid SSL certificate (essentially they sign the request).

Creating a Certificate

In order to generate a CSR file on the Client Access Server and Windows Server 2008 open the Exchange Management Shell and type the following command:

New-ExchangeCertificate -GenerateRequest -Path c:\myReq.csr -KeySize 1024 -SubjectName “c=GB, s=Middx, i=MyCompany, ou=IT, cn=mail.mydomain.com” -PrivateKeyExportable $True

The string that you provide after the -SubjectName switch is very important and it is made up of the following values:

• c – This is the country of origin.
• s – This is the state we are in.
• i – This is the company that you work for, or indeed the SSL certificate will be assigned to. You should note that if you have purchased SSL certificates before it is worth ensuring that the company naming convention is consistent throughout all certificates that you have purchased.
• ou – This is the organisation unit that the section of the company which will take charge of the certificate.
• cn – This should be set to the DNS FQDN of the Client Access Server which will be using the certificate.

This will produce a file in the root of C drive on the CAS server called myReq.csr. This should be sent to our root certification authority.

When the CSR has been generated you will be provided with a CRF (Certificate Response File) which looks like the following (this will be returned to you via email):

-----BEGIN CERTIFICATE-----JJkbbssCCAuucgAwIBAgIQcyE6jZgwnFgAq0d7onjMFzANBgkqhkiG9w0BAQUFADCBzj

EEWNNNEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du

MR0wGwYDVQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv

biBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFByZW1pdW0gU2VydmVyIENB

MSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNlcnZlckB0aGF3dGUuY29tMB4XDTA4MDcxMTE2M

DU0OFoXDTEwMDcyNjE1NTcxN1owgYYxCzAJBgNVBAYTADDDDDDjujjjjjw87666cvNxMJkeDE

PMA0GA1UEBxMGTG9uZG9uMSswKQYDVQQKEyJMb25kb24gQm9yb3VnaCBvZiBIb3Vuc2xvdyBD

b3VuY2lsMQswCQYDVQQLEwJJVDEcMBoGA1UEAxMTb3dhLmhvdW5zbG93Lmdvdi51azCBnzANB

gkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAolvn0lT1W+cdRFjqOn56tPwHNULjq7LDA/G4ZAIVf9

cl7y4jLKR/6/3x2O/1st8OEcFDFKElmn8dzoA3pG14JL8ZmBTh0RLxtGRw9fHB2ARuYplagoD

LqgA5mzEPo3a3wCKboTaEwKwoeQ9dAp2bGcvs4lMPptI48eoSDhFs/u0CAwEAAaOBpjCBozAd

BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwQAYDVR0fBDkwNzA1oDOgMYYvaHR0cDovL

2NybC50aGF3dGUuY29tL1RoYXd0ZVByZW1pdW1TZXJ2ZXJDQS5jcmwwMgYIKwYBBQUHAQEE

JjAkMCIGCCsGAQUFBzABhhZodHRwOi8vpgthennn/ss88877a222129tMAwGA1UdEwE

B/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEAuYSyeOUx53TkjCfol2psVY3E9uzMb6P6nrgs2U

uG8BBQlshPkv+te8G2JpaaaaCmcrCV8J0WQN8mRm5443vbdasafJTBxB2PAZfl3GSWEgDIH

q/lg3IOxG43YK4qDWYTu3j/Ngymq8g/d+0VrqkF/AmXWnGMGIQmE3GUnUDXeZKOR8SM=

-----END CERTIFICATE-----

You should copy the CRF (including the Begin Certificate and End Certificate) into a text file called owa.txt and then rename the file owa.cer. You should then copy this file up to a drive on the CAS server where you are working.

Installing a Certificate (CAS)

Firstly you need to remove the existing (expired) SSL certificate from your Client Access Server. In order to accomplish this you need to open the Exchange Management Shell and then type in the following command:

Get-ExchangeCertificate | fl | out-file –filePath c:\certs.txt

This will create a text file in the root of C drive called certs.txt which contains the details of every certificate install on the server. The output should look like the following:

The key property that will identify the certificate that you wish to replace is the Not After field. As this is essentially the expiry date and should have already expired or indeed be very close to expiring. Make a note of the thumbprint (the long number at the bottom after the Thumbprint field) and then type in the following command:

Remove-ExchangeCertificate –thumbprint <thumbprint that you noted down>

As a tip here is to copy the thumbprint from the text file above and then paste it into the PowerShell Window. When you have typed the command and pressed enter you will be presented with the confirmation message:

Are you sure you want to perform this action?

Remove certificate with thumbprint 138B6EC5AAE868F495ECCBDA05C1F011B08A7CD3?

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help(default is “Y”):

Confirm the action by entering A and then press ENTER. You are now ready to import the new certificate onto the Client Access Server. In order to do this type in the following command within the PowerShell window (ensure that the path you specify to the certificate file matches the location where you placed the new certificate in the earlier steps):

Import-ExchangeCertificate -path e:\certificates\owa.cer –FriendlyName “owa.mydomain.com”

You should then be presented with the following output (again here you will need to make a note of the thumbprint):

Thumbprint Services Subject

———- ——– ——-

B52842F7408772B7151FF74FDAE914EA7B59B53A ….. CN=owa.mydomain.com,…

Now that the certificate has been imported into the certificates repository you need to enable it for OWA. In order to do this run the following command in the PowerShell window:

Enable-ExchangeCertificate -Thumbprint B52842F7408772B7151FF74FDAE914EA7B59B53A -Services IIS

The new certificate should now be installed you can confirm this by running the following command:

Get-ExchangeCertificate

The output of which should be:

Thumbprint Services Subject

———- ——– ——-

B52842F7408772B7151FF74FDAE914EA7B59B53A …W. CN=owa.mydomain.com,…

The key thing here to note is the W under services (this signifies that the cert has been enabled for OWA) and that the thumbprint matched what you have typed in previously.

This is a case study of a customer who wanted to perform a migration from Exchange Server 2000 / 2003 to Exchange Server 2007 whilst consolidating a number of remote sites to a centralised hub site. The main premise of this engagement was to ascertain Microsoft’s best practice methodologies for migrating very large mailboxes and moving large amounts of data with the least amount of risk of data loss, and the consolidation of globally dispersed messaging environments.

I’d like to send from here a HUGE THANKS to my peer, Ray Khan for putting all of this information together, as he was the one involved on the project and who kindly present to us this awesome case study which hopefully will encourage some other customers!

Problem Statement

This customer had a need to migrate all of their regional site data into a centralised site in UK with the least amount of downtime. They had users with very large mailboxes in China and Japan of up to 40 GB per mailbox, however there were only 30 to 40 users at each of these sites. There was a total of around 600 GB of mailbox data that would be required to be migrated from the regional sites to UK.

The objective was to archive most of the data from these mailboxes onto a new Enterprise Vault platform, so once on Exchange Server 2007 they would only have around two gigabytes of "online" mail.

They had reviewed several migration approaches but wanted our advice on these approaches and any others that have been proven in other environments.

As part of their upgrade project they were also investigating all other messaging platforms including Microsoft’s BPOS solution as well as partner’s and other third party solutions and also considering carrying on running On Premise. This aspect was out scope for this engagement.

Infrastructure before Upgrade

The company has just under a couple of thousand employees. Over 75% of their staff are located in UK and Switzerland the other 25% are located around the major financial centres around the world including China, Japan, and US.

Their Exchange server organization exists inside a single Active Directory Forest running Exchange Server 2003 SP2 in native mode. However there were several Exchange 2000 SP3 mailbox servers situated at some of their key branch offices such as China, Japan, UAE, Canada and Uruguay.

Exchange Estate Summary

• 31 servers globally, 11 routing groups and 6 administrative groups;
• they employ a single ended Exchange topology and do not use any front-end servers;
• 4,128 mailboxes (including resource mailboxes but some are dormant or on disabled accounts);
• 5.1 TB personal mailbox data and approximately 650 GB of Public Folder data (PF's mostly in UK and Switzerland);
• The global organisation sends around 850,000 messages a week and receives around 1,000,000 messages a week;

Exchange 2003 Integrations

• 17 Enterprise Vault 6.x and 7.x archiving servers hosting around 7.5TB of archive data (but not all regions have archiving);
• 10 Blackberry Enterprise Servers servicing around 800 Blackberry handsets globally;
• OCS 2007 R1 transitioning to R2;

Many of their users have very large mailboxes, averaging 2 to 4 GB, but in some regions where no archiving exists we have users with up to 40GB mailboxes

Our client estate is based on Windows XP SP3 and Outlook 2003 with SP3 (new workstations with 2GB RAM).

Networks (Global MPLS WAN)

• 100 Mbps (between UK and Switzerland);
• 45 Mbps (between UK, China, Japan and US);
• 2 Mbps (high latency links between UK, UAE, Uruguay, Canada, Singapore, etc.);

Target Architecture

They planned to transition their entire organization to Exchange Server 2007 SP2 into a consolidated and centralised architecture hosted in our new Global Data Centre in UK. This network will be facilitated by Cisco WAN Accelerators, situated at all of their branch offices.

They were also planning to consolidate and centralise their archiving and BES estate into the UK Global Data Centre.

They were in the planning/design phase of this programme and were scheduled to commence deployment in beginning of 2010 for completion by end of summer of 2010.

Proposed Solution

This customer designed a number of solutions to address the problem statements listed above. They decided to go for the following approach to migrate the Exchange Server 2000 / 2003 users with very large mailboxes and archive their data to the centralised site using SCR data replication technologies... Please refer to the steps below for more detail.

Migration Steps

1. Install and configure the entire centralised Exchange Server 2007 SP2 infrastructure, EV and BES infrastructure into the Global Data Centre (GDC). Install WAN Accelerators;
2. Install an Exchange Server 2007 staging mailbox server in the GDC (to receive gross branch office mailboxes);
3. Install an Exchange Server 2007 MBX/HT as swing server at the remote site (on the same LAN);
4. Configure staging server in the GDC as an SCR target of the swing box Exchange Server 2007;
5. Run Move-Mailbox command from Exchange Server 2000 (at the branch office) to Exchange Server 2007 swing box server (move entire existing mailbox over – swing box becomes the production MBX/HT for the branch office users);
6. Allow SCR to seed the staging server over a period of up to 2 to 3 weeks (however long it is expected to take – after testing) – using SMB 2.0 as both servers will be Windows Server 2008 SP2;
7. Once all data is migrated across – perform VSS backup of the SCR target – run ESEUtil /G to check database - invoke SCR disaster recovery process and switch the active mailbox node to the staging server in the GDC;
8. Move BES account to GDC BES server;
9. Enable EV archiving policy and groom the mailboxes (that are in the staging server) to 1 GB in size – all inside the GDC site (SAN to SAN);
10. Once complete run Move-Mailbox to migrate the 1 GB mailboxes to the production CCR cluster (SAN to SAN);
11. Once all data is validated delete the staging server databases used to eliminate white space;
12. Move Exchange Server 2007 swing box server to the next branch office;
13. Remove and re-install Exchange MBX/HT in the next branch office site (also rename the swing server);

Summary

This customer decided to migrate to Exchange Server 2007 and to continue managing their infrastructure to On Premise using the above approach. They have managed to migrate their remote site data using the strategy outlined above. They are continuing with us from a support perspective and will be booking further proactive engagements looking forward to migrating to Exchange Server 2010.

Overview

Exchange Server 2010 help organizations guard their messaging with built-in protective technologies; offers anywhere access to email, voice mail, calendars, and contacts; and enables new levels of operational efficiency. Help develop your expertise in this advanced messaging system with state-of-the-art training from Exchange Server 2010 product specialists. Choose a certification path that is relevant to your current job role or one that prepares you for your next career step.

Microsoft Certified Technology Specialist certification

Whether you are new to Microsoft Certification or a Microsoft Certified Professional (MCP) certified on Microsoft Exchange Server 2003, consider earning the Microsoft Certified Technology Specialist (MCTS): Microsoft Exchange Server 2010 – Configuration certification. This certification highlight your area of expertise and help validate the knowledge and skills that are required to deploy and administer an enterprise messaging environment by using Exchange Server.

Exam 70-662 – TS: Exchange Server 2010, Configuring

Microsoft Certified IT Professional certification

The Microsoft Certified IT Professional (MCITP): Enterprise Messaging Administrator certification is also appropriate for MCPs who are certified on Microsoft Exchange Server 2003 as well as IT professionals who are new to Microsoft Certification. This certification helps demonstrate your professional expertise in using Microsoft Exchange Server 2010 to excel in a specific job role, such as the lead engineer for messaging solutions within an enterprise organization.

Exam 70-662 – TS: Microsoft Exchange Server 2010, Configuring

Exam 70-663 – Pro: Designing and Deploying Messaging Solutions with Microsoft Exchange Server 2010

Microsoft Certified Master program

Differentiate yourself as the technical expert. The Microsoft Certified Master (MCM) program helps the best professionals in the IT industry become even better. Whether you want to enhance and help validate your advanced skills or take your career to the next level, achieving a Microsoft Certified Master certification will help differentiate you from others in the competitive ranks of senior IT professionals.

This unique program consists of three weeks of mandatory, hands-on training led by experts, and extensive written and lab-based testing. Candidates' practical product knowledge, technical acumen, knowledge of best practices, personal and professional stamina, and communication skills are constantly challenged as they work toward attaining this premier Microsoft technical certification.

MCM Certification

Microsoft Certified Architect certification

Validate your capability to translate business problems into technology solutions. When you earn the Microsoft Certified Architect (MCA) certification, you can be recognized by Microsoft and the IT industry worldwide as an expert who holds the highest level of professional certification from Microsoft.

MCA Certification

Data Protection Manager

As this blog main technologies are Exchange and Data Protection Manager I could miss the Data Protection Manager exams information:

Exam 70-658 – TS: System Center Data Protection Manager 2010, Configuring

If you are concerned on knowing exactly what you need to do in order to migrate your current Exchange environment to Exchange Server 2010, whatever reason it is (multiple firewall rules, multiple certificates, multiple external URLs/ports for clients) don’t be as there is good news. We completely understand that this complexity means there is opportunity for making mistakes, which causes deployments to stall-not to mention a lot of frustration.

The solution is Exchange Server 2010 Deployment Assistant!!!

It will allows you to create Exchange Server 2010 On-Premises deployment instructions that are customized to your environment and all of your specific situations. It starts by collecting some information from you, and based on a your answers, it provides a finite set of instructions that are designed to get you up and running on Exchange Server 2010.

Main idea is to avoid the infinite information you can find in Internet specially in Exchange Server 2010 library and go straight to what you need to do.

Here is a screenshot from the tool, after the initial set of questions were answered and instructions generated.

Happy Exchange Server 2010 Migration!!!

There has been one too many conversations about Data Protection Manager and The Cloud… Some of them correct and others eventually a little bit less correct, so I decide to write this post in order to clear things a bit and hopefully help someone with it.

So apart from being able to protect to disk, tape and disk to disk to tape we can actually protect our information online, now how can we do that?

We have basically two great partners who have been with us on this, and they are Iron Mountain who provide us CloudRecovery solution and I365 who provide us a brilliant solution called EVault (DPM):

CloudRecovery

The new release of Iron Mountain, CloudRecovery, will provide support for DPM 2010 in addition to continued support for DPM 2007 with Service Pack 1. To support rapid corporate data growth, the solution also provides increased scalability – protecting multi-terabyte servers.

“We need to have systems that are always on, and always available.  This is especially true when it comes to the backup and recovery needs of our Microsoft applications – including Exchange, SQL, and SharePoint,” said Alan Bourassa, CIO, Empire CLS. “The seamless integration between Microsoft DPM and Iron Mountain CloudRecovery is ideal for addressing these requirements and we are looking forward to taking advantage of the new features that will be available with the new release.”

EVault (DPM)

EVault (DPM) is an all-in-one backup and recovery appliance for Microsoft centric, mixed computing environments. And besides that believe-it or not even to non Microsoft Platforms… all in the same box!!!

It integrates with your Microsoft business applications and offers the most up-to-date protection for your Microsoft systems. You also gain broad non-Microsoft system protection; optimized cloud connectivity for fast, secure, affordable offsite disaster recovery; and the simple deployment and maintenance of an all-in-one appliance.

Jason Buffington, recently blogged about the DPM 2010 release and the i365 partnership.

So basically these are the solutions we have with these two brilliant partners, and that should be what is considered to be recommended, any further information until today’s date may not be absolutely true…

And finally it is out… The “kind of” expected element to allow Exchange Server 2010 (including BPOS) to coexist with Lotus Notes… The Quest Solution!

As you probably are aware already there is no support from Microsoft to make both environments to coexist, and as far as I am aware, there won’t be, obviously on a native Exchange Server 2010 organization, as so Quest will provide that service… If you want to do it using Microsoft products only you will need to have an Exchange Server 2007 as a bridge to the Lotus Connector… however Exchange Server 2007 needs to be there before the Exchange Server 2010 boxes… :)

“Quest Software is one of Dimension Data’s premier partners for our Microsoft Solutions line of business. We are pleased to partner with Quest to combine our specialist services with their best-of-breed Lotus Notes to Microsoft Exchange migration tools and coexistence solutions. Together, we have helped our clients enable high performance workplaces by improving competitiveness, increasing return on IT assets and providing better regulatory compliance. ”

Phil Aldrich, Practice Director of Microsoft Solutions, Dimension Data

“A Lotus Notes transition to Microsoft Exchange Server can be a complex project with considerable risk.  To ensure business continuity and minimal user impact, organizations need a tool that keeps end users collaborating together throughout the coexistence period. With the new functionality of Quest Coexistence Manager for Notes, we enable organizations to establish interoperability between Notes e-mail and applications and Exchange/Outlook by ensuring the accuracy of mail and calendar data.”

Bill Evans, Vice President and General Manager, SharePoint and Notes Transition, Quest Software

As we heard on the 19th of April we finally released DPM 2010 RTM, however customer wise it will only be available in June…

For our customers which have already in place previous versions of DPM the main question will be how can they migrate their system.

A great utility we came up with was the DPM 2010 Upgrade Advisor. It is an Excel spreadsheet where you can fill in what version that you are coming from and what version that you want to go to as well as what you are using for Disaster Recovery, Tape Library Sharing, etc. And it outputs a checklist to walk you through the upgrade process.

Imagine the following scenario where you have your Exchange Organization split in three major sites, where each site has their own domain, for instance EMEA, APAC and AMERICAS.

In each site we have CCR clusters, Hub Transport and CAS servers, all in Service Pack 1. Service Pack 2 meanwhile is released and we end up with a major doubt regarding how should we act in terms of such upgrade.

The doubt generally resides between:

• Upgrade each site, every single role, to Service Pack 2 and only then upgrade the other sites, one by one;
• Upgrade all the CAS servers followed by the Hub Transport servers in every single site to Service Pack 2 and only then upgrade the CCR clusters;

The answer for this is quite simple, long maybe as we need to reassure some stuff around it, but definitely it is not hard as it may initially seem.

It doesn’t matter which choice we take, as long as we upgrade first the CAS servers, especially if we are using CAS-CAS proxy. We can have servers with Service Pack 1 and others with Service Pack 2, as long as the CAS is greater (or equal) to the mailbox. In terms of delays, as in timeframe for the patching operation between the first and last patches, that doesn’t really matter, as far as the versions are supported and in this case Service Pack 1  is still supported!

Another thing to take as a recommendation is that two CAS servers can have different versions as far as we do not have them in NLB or even in a CAS Array as in that case the RPC Client Access attribute in the databases will just be a virtual name, as so everything within that virtual name (NLB or CAS Array) need to be consistent in terms of versions… This exclude the time that takes the update of all servers in the NLB or CAS Array obviously.

This apply to all builds, or at least to all the Release Updates and Service Packs supported at the moment. Obviously the CAS servers on the internet facing site must always be the first servers to upgrade, otherwise you definitely break the OWA.

Finally if you upgrade a whole site first, if it is the internet-facing site, there is no issue in having the others sites with lower versions.

Best Practices Analyzer (BPA) is a server management tool that is available in Windows Server 2008 R2. BPA reports best practice violations to the administrator after BPA scans the roles that are installed on Windows Server 2008 R2. Administrators can filter out unnecessary information or exclude results from BPA reports. Administrators can also perform BPA tasks with either the Server Manager GUI, or Windows PowerShell cmdlets. For more information about Best Practices Analyzer and scans, see the Best Practices Analyzer Help.

When you select the entry for Hyper-V under the Roles node you should see a new section called Best Practice Analyzer:

Here you can select to scan the Hyper-V role and see how you are going against common best practices. One other neat feature of the Best Practice Analyzer is the ability to exclude results.  This way you can remove best practices that you do not believe apply to your environment – so you will not have to deal with a large number of unnecessary errors / warnings.

Imagine the scenario where you want to to set an execution policy for a specific user on a machine. The per-user setting is nothing more than a key in the registry, something like:

[HKEY_USERS\S-1-5-21-REST-OF-SID\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell]

"ExecutionPolicy"="RemoteSigned"

So all you have to do is grab your users’ SIDs (easy enough with AD cmdlets or ADSI I suppose) and modify the registry directly (as long as you have admin rights).

The proper way of doing this, of course, would be using Group Policy, see Set-ExecutionPolicy for details on that.

You can alter who is affected by the statement by using the –scope option.  The setting will be persistent though. You shouldn’t need to run it each time PS is started up.

None of the transport rule predicates support matching on only BCC, so I don’t believe a basic transport rule will block outgoing BCC emails.  I think you’d have to do a transport agent (routing agent) to do what you’re looking for. Something like this might get you started:

This is just some sample code which was quickly modified. It wasn’t even put in Visual Studio, so it’s NOT TESTED AT ALL!  Sample code courtesy of Matt Stehle.

using System;

using System.Collections.Generic;

using System.Diagnostics;

using System.Text;

using System.IO;

using Microsoft.Exchange.Data.Transport;

using Microsoft.Exchange.Data.Transport.Email;

using Microsoft.Exchange.Data.Transport.Routing;

namespace CustomNDR

{

    public sealed class CustomNDRAgentFactory : RoutingAgentFactory

    {

        public override RoutingAgent CreateAgent(SmtpServer server)

        {

            return new CustomNDR();

        }

    }

    public class CustomNDR : RoutingAgent

    {

        public const string NdrSubject = "Rejected Message - Original Attached";

        public const string NdrFromDisplayName = "System Administrator";

        public const string NdrFromAddress = "administrator@contoso.com";

        public const string OutputPath =

            @"C:\Users\Administrator\Desktop\CustomNDR\output\";

        public const string PickupPath =

            @"C:\Program Files\Microsoft\Exchange Server\TransportRoles\Pickup\";

        public CustomNDR()

        {

            LogMessage("CustomNDR{}", "Enter");

            this.OnSubmittedMessage += new SubmittedMessageEventHandler(CustomNDR_OnSubmittedMessage);

            LogMessage("CustomNDR()", "Leave");

        }

        void CustomNDR_OnSubmittedMessage(SubmittedMessageEventSource source, QueuedMessageEventArgs e)

        {

            LogMessage("OnSubmittedMessage", "Enter");

            try

            {

                // Check for BCC recipients...

                if (e.MailItem.Message.Bcc.Count > 0)

                {

                    EmailMessage origMsg = e.MailItem.Message;

                    LogMessage("OnSubmittedMessage", String.Concat("Message: ", origMsg.Subject));

                    if (Directory.Exists(OutputPath))

                    {

                        // Save a copy of the original message for debug

                        //SaveMessage(origMsg, String.Concat(OutputPath, "Original.eml"));

                        EmailMessage newMsg = EmailMessage.Create();

                        newMsg.To.Add(new EmailRecipient(origMsg.Sender.DisplayName, origMsg.Sender.SmtpAddress));

                        newMsg.From = new EmailRecipient(NdrFromDisplayName, NdrFromAddress);

                        newMsg.Subject = NdrSubject;

                        // Setting the contentType to 'message/rfc822' is the key to avoid an InvalidOperationException

                        // with a message 'Cannot set the property, the attachment is not an embedded message.'

                        Attachment attach = newMsg.Attachments.Add("RejectedMessage", "message/rfc822");

                        attach.EmbeddedMessage = origMsg;

                        // Save a copy of the NDR message for debug

                        //SaveMessage(newMsg, String.Concat(OutputPath, "newMsg.eml"));

                        // Save message to the pickup directory to send it

                        SaveMessage(newMsg, String.Concat(PickupPath, "newMsg.eml"));

                        // Cancel the original message

                        source.Delete();

                    }

                    else

                    {

                        LogMessage("OnSubmittedMessage", "OutputPath does not exist.");

                    }

                }

            }

            catch (Exception ex)

            {

                LogMessage("OnSubmittedMessage",

                    String.Format("EXCEPTION: Type={0}, Message='{1}'", ex.GetType().FullName, ex.Message));

            }

            LogMessage("OnSubmittedMessage", "Leave");

        }

        public static void SaveMessage(EmailMessage msg, string filePath)

        {

            try

            {

                FileStream file = new FileStream(filePath, System.IO.FileMode.Create);

                msg.MimeDocument.WriteTo(file);

                file.Close();

            }

            catch

            {

                LogMessage("SaveMessage",

                    String.Format("Failed to save message, {0}, to {1}.",

                        msg.Subject, filePath));

                throw;

            }

        }

        public static void LogMessage(string methodName, string message)

        {

            try

            {

                StringBuilder traceMessage = new StringBuilder();

                traceMessage.Append(System.DateTime.Now.ToString("s"));

                traceMessage.Append("|");

                traceMessage.Append(methodName);

                traceMessage.Append("|");

                traceMessage.Append(message);

                traceMessage.Append("\r\n");

                System.Diagnostics.Debug.WriteLine(traceMessage.ToString());

                File.AppendAllText(

                    String.Concat(OutputPath, "log.txt"),

                    traceMessage.ToString());

            }

            catch (Exception ex)

            {

                Debug.WriteLine(String.Format("Failed to log message, {0}, to 'log.txt' in {1}.", message, OutputPath));

                System.Diagnostics.Debug.WriteLine(String.Format("Exception: {0}", ex.Message));

            }

        }

    }

}

This code will block ALL messages with ANY BCC recipients, including internal to internal, so additional modification would be required to process only messages leaving the organization if that’s the desired goal. Unless obviously you have this on the Edge Transport role…

While searching on Internet about this piece of information couldn’t really find a place where we had it all together as so I have decided to blog it… mostly because a team mate asked me… :)

DPM2007 Server Services

Protected Server Services

Imagine a scenario where we would have an Exchange Server 2007 CCR on Windows Server 2008. In this setup we only have two network cards.

Initially our thoughts would go to that it’s a best practice to configure the private/heartbeat NIC as the primary one to be used for log shipping and seeding and thus to move that traffic away from the public/MAPI NIC, as per Tim McMichael’s blog.

So the main question here would be if we could use such configuration. Unfortunately there's no support statement on this, just best practices. But we can't configure log traffic on a network that doesn't support client traffic, so a purely private network would be restricted from log shipping anyway.

As per the above blog instructions the heartbeat NIC needs to be set to mixed as well which bring us to our initial question again:

Exchange 2007 SP1 CCR (Cluster Continuous Replication) – Two Network Ports

When using a cluster continuous replication cluster with two network ports, your options are limited.  Consider the following design:

• First port set to “allow the cluster to use this network” and “allow clients to connect through this network”.

• Second port set to “allow the cluster to use this network” and “allow clients to connect through this network”.

You’ll noticed that in this configuration both networks are set to “allow clients to connect through this network”.  This is necessary in order to establish the private network for use with log shipping functions.

To establish this network for log shipping functions, refer to the enable-continuousreplicationhostnames cmdlet:

• http://technet.microsoft.com/en-us/library/bb690985.aspx
• http://technet.microsoft.com/en-us/library/bb629629.aspx

If used the replication service will first prefer to perform log shipping functions over the “private” network.  Should the private network be unavailable the replication service will resume log shipping functions over the public network.

However in the above case, if we didn't enable both cluster and client connectivity for both networks, we'd have at least one single point of failure again. That's something to avoid in a two-port configuration. I believe Tim McMichael’s blog generally recommends a minimum of three ports for CCR systems, with two networks set for public and private and one for private only.

Last but definitely not least, for Windows Server 2008 clusters there really is no such thing as a dedicated private network anymore. As soon as you enable the network for client use, you have to enable it for cluster use, you can’t enable it for client use until you have set it for cluster use. Additionally there is no way to control the priority of the networks for cluster use, the failover cluster adapter determines the routing paths for that. Also, apparently “the allow clients to connect through this network” option is only used for automating and/or controlling the wizards for configuring services and applications, this setting tells the wizards which networks to create the service IPs on. So it actually no longer matters if you don’t have a dedicated heartbeat network, even ExBPA has been updated to not fire the “Dedicated heartbeat network not found” warning for Windows 2008 Failover Clusters. The key thing is that the networks must be on different subnets, and therefore client traffic would never go over the cluster/log shipping network.

The main reason we wanted dedicated private networks in Windows Server 2003 was because we were not very tolerant of missed heartbeats, in Windows Server 2008 we are certainly far more tolerant of missed heartbeats with the new network heartbeat improvements, especially when using a Majority Node Set with File Share Witness (no bus resets to rely on, with buggy disk drivers and firmware). But if you are wanting to be extra, extra safe then go with three networks.

Hopefully you have already heard about this and have change your deployment plans, otherwise here it goes. Recently it was compared the performance of the Exchange 2010 Client Access role supporting Outlook Anywhere users on both Windows 2008 SP2 and Windows 2008 R2, and found that the improvements the Windows Team has made in R2 more than doubles the number of concurrent users a given server can support, assuming CPU is the limiting resource.

For more information refer to the Microsoft Messaging Team Blog…

These results will be included in an upcoming TechNet whitepaper on Exchange 2010 CAS Guidance.

First of all a HUGE THANKS to Yuval Sinay for putting this information together.

The following article will provide a summary on common issues in Exchange 2010 deployment in the Enterprise. The information in this article consists of my own experience and official Microsoft knowledgebase articles. Due to the fact that your Exchange environment may vary, please read the information carefully and test the suggestions from this article - in a lab that can demonstrate the current Exchange infrastructure.

The article is divided to the following chapters:

1. General issues in Exchange 2010 deployment.

2. Best practices in Exchange 2010 deployment.

3. Common issues in Exchange 2007 migration to Exchange 2010.

4. Common issues in Exchange 2003 migration to Exchange 2010.

Common issues in Exchange 2003 migration to Exchange 2010.

• During mailbox movement, the following error may appear: “Active Directory operation failed on DC. This error is not retriable. Additional information: Insufficient access rights to perform the operation. Active directory response: 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0"
  • Use Remove-MoveRequest command to cancel the mailbox movement.
  • Verify that the account that is used has permissions to access the mailboxes in the Exchange 2003 server.
• During access to user mailboxes that reside on Exchange 2003 from Exchange 2010 management tool, the following error may appear: "Property Expression “User name” isn’t valid. Valid values are : Strings that includes ‘@’, where ‘@’ cannot be the last character."
  • Use ADSIEdit and fixed the following users attributes that may contain a space in the beginning: “User Alias” and “Username”.
  • Error message occurs when you move a mailbox from an Exchange Server 2003 server to an Exchange Server 2007 or Exchange Server 2010 server
• The following error may appear during Exchange 2003 migration: “Event ID 1036 is logged on an Exchange 2007 server that is running the CAS role when mobile devices connect to the Exchange 2007 server to access mailboxes on an Exchange 2003 back-end server.”
  • Event ID 1036 is logged on an Exchange 2007 server that is running the CAS role when mobile devices connect to the Exchange 2007 server to access mailboxes on an Exchange 2003 back-end server
  • Install Update for Exchange 2003 (KB 922817) on each Exchange 2003 server.
  • Review the instructions in http://support.microsoft.com/kb/937031.
  • Move the user mailboxes to the Exchange 2010 server.

First of all a HUGE THANKS to Yuval Sinay for putting this information together.

The following article will provide a summary on common issues in Exchange 2010 deployment in the Enterprise. The information in this article consists of my own experience and official Microsoft knowledgebase articles. Due to the fact that your Exchange environment may vary, please read the information carefully and test the suggestions from this article - in a lab that can demonstrate the current Exchange infrastructure.

The article is divided to the following chapters:

1. General issues in Exchange 2010 deployment.

2. Best practices in Exchange 2010 deployment.

3. Common issues in Exchange 2007 migration to Exchange 2010.

4. Common issues in Exchange 2003 migration to Exchange 2010.

Common issues in Exchange 2007 migration to Exchange 2010

• Strange errors may appear during OWA/Outlook Anywhere, Offline Address book management (e.g. Event ID 9519 "Error 0x80004005" in Application event log, etc.).
  • Event ID 9519 "Error 0x80004005" is logged in the Application log when you try to mount a database in Exchange Server 2010 or in Exchange Server 2007
  • In rare situations, you may need to apply the solution from the link above, to “Exchange Enterprise Servers” group (e.g. Give the group the user right to”Manage auditing and security log” in the domain controllers GPO) – I saw this issue when the Exchange 2007 server was installed in the past on domain controller.
• After creating a new Exchange 2010 database, the new database wouldn’t mount and the following error may appear: “Active Directory operation failed on <<DOMAIN CONTROLLER NAME>>. This error is not retrievable. Additional information: The name reference is invalid. This may be caused by replication latency between Active Directory domain controllers. Active directory response: 000020B5: AtrErr: DSID-03152392, #1: 0: 000020B5: DSID-03152392, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 200f4 (homeMDB)”
  • You cannot create a new Exchange Server 2010 Mailbox database in a multiple domain environment
  • Due the fact that the issue appear in customer with a single domain, I recommended to review the steps bellow.
    • Use the following method to create a new Exchange 2010 database:
      • Create a new Exchange 2010 database without mount it.
      • Use the power shell command to force the Exchange 2010 to use a preferred domain controller: "Set-ADServerSettings –PreferredServer mydomaincontrollername.domainname.local"
      • Mount the database by using the following power shell command: "Mount-Database -Identity "Second Mailbox Store" -DomainController mydomaincontrollername.domainname.local"

First of all a HUGE THANKS to Yuval Sinay for putting this information together.

The following article will provide a summary on common issues in Exchange 2010 deployment in the Enterprise. The information in this article consists of my own experience and official Microsoft knowledgebase articles. Due to the fact that your Exchange environment may vary, please read the information carefully and test the suggestions from this article - in a lab that can demonstrate the current Exchange infrastructure.

The article is divided to the following chapters:

1. General issues in Exchange 2010 deployment.

2. Best practices in Exchange 2010 deployment.

3. Common issues in Exchange 2007 migration to Exchange 2010.

4. Common issues in Exchange 2003 migration to Exchange 2010.

General issues in Exchange 2010 deployment

• When you are using account with administrative privilege to export mailboxes, you may get error on permission issue. The same symptoms may occur if you are using Backup software from third party.
  • Give the account that use for export/backup purpose, the required permissions to access to the user mailbox: Get-MailboxDatabase | Add-ADPermission -user "domainname\backupaccountserviceaccountname" -AccessRights GenericAll
  • Administrative Accounts (e.g. Domain Admins have deny access permission to users mailboxes by default).
• When you are trying to relay from Exchange 2010 server, you may block by default.
  • Setup the required relay permissions: Allow Anonymous Relay on a Receive Connector
  • In high secure environment you can add security features like Authentications, SSL, etc.
• Microsoft posts a nice guide on known issue while trying to move mailboxes from old Exchange system to the Exchange 2010 system.
  • Troubleshooting Mailbox Moves
• Outlook 2003 customers may report on slow performance during send and receive.
  • Upgrade to Outlook 2007 or higher, otherwise: Outlook 2003 email messages take a long time to send and receive when you use an Exchange 2010 mailbox
• After installing Exchange 2010 on computer that own Global Server role, Exchange services may not started after reboot.
  • Services for Exchange Server 2007 or Exchange Server 2010 cannot start automatically after you install Exchange Server 2007 and Exchange Server 2010 on a global catalog server
• During Apple iPhone synchronization, the following error message may appear:"Exchange ActiveSync doesn’t have sufficient permissions to create the “CN=Yuval Sinay,OU=Users,OU=Lab Demo,OU=Pilot Exchange 2010,DC=shadowall,DC=local” container under Active Directory user “Active Directory operation failed on mail.shadowall.local. This error is not retriable. Additional information: Access is denied. Active directory response: 00000005: SecErr: DSID-03151E04, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0“.
  • If the account is a member of Protect Group you may need to verify that the user Mailbox permission set to apply inheritance has the following setting on: “Include inheritable permissions from this object’s parent".
  • The "Send As" right is removed from a user object after you configure the "Send As" right in the Active Directory Users and Computers snap-in in Exchange Server
• Users with mobile phones that using third party operating system may report on “Certificate Error” during the synchronization stage.
  • This issue isn’t related to Microsoft, and it’s a common issue that the mobile phone operating system didn’t setup with the correct “Root CA” certificate or the mobile phone operating system don’t support certificate with SAN extensions *”Unified Communications Certificate”).
  • Microsoft recommends using only specific certificate type in Exchange 2010 system. If you are like to obtain a public certificate, please note that Microsoft released a list of official supported vendors: Unified Communications Certificate Partners for Exchange Server and for Communications Server
• Outlook 2003 users may report on failure in connection to the Exchange 2010.
  • Upgrade to Outlook 2007 or higher, otherwise enable the option on the outlook 2003 (Manually or by using GPO): “Encrypt data between Microsoft Office Outlook and Microsoft Exchange Server".
  • Alternatively we can disable the requirement to use RPC with encryption support, by using the power shell command on the relevant Exchange 2010 server: “Set-RpcClientAccess -Server savdalex10 -EncryptionRequired $false". This one isn’t recommended, due the security risk it imposes.
• During use Exchange 2010 Best Practice Analyzer, the following error may appear: "Unrecognized Exchange signature Active Directory domain 'domainname' has an unrecognized Exchange signature. Current DomainPrep version: 12639."
  • As I know, this issue should be resolved in Exchange 2010 Service Pack 1. Exchange 2010 Best Practice Analyzer doesn’t support earlier Exchange versions.
• Using Symantec BackupExec 2010 to restore users emails accomplished successful. However, after checking the user mailbox you may found that no user data is restored.
  • Restore of individual emails/mailbox from a Granular Recovery Technology (GRT) backup set of Exchange database, completes successfully but no messages are restored
• During the Exchange 2010 organization upgrade, the following error may appear: "The execution of: "$error.Clear(); if ($RolePrepareAllDomains) { initialize-DomainPermissions -AllDomains:$true -CreateTenantRoot:$RoleIsDatacenter; } elseif ($RoleDomain -ne $null) { initialize-DomainPermissions -Domain $RoleDomain -CreateTenantRoot:$RoleIsDatacenter; } else { initialize-DomainPermissions -CreateTenantRoot:$RoleIsDatacenter; }", generated the following error: "Length of the access control list exceed the allowed maximum."
  • On a Windows Server 2008-based computer, Exchange Server 2010 installation cannot be successful at the organization preparation process
• During Exchange 2010 installation, “error code 3221685941” may appear.
  • You receive an error message that contains error code 3221685941 when you install Exchange Server 2010
• Users may report that they can’t open DOC, PDF, and XLS files by using Exchange 2010 OWA.
  • Install Exchange 2010 Rollup Pack 3 or higher: Description of Update Rollup 3 for Microsoft Exchange Server 2010 Release to Manufacturing
• Outlook 2003 users can’t publish their FB data on Exchange Server 2007 or 2010:
  • Users who use Outlook 2003 cannot publish their free/busy data in Exchange Server 2010 or in Exchange Server 2007
• Some users cannot connect Exchange Server 2010 using Outlook Anywhere.
  • You cannot connect to an Exchange Server 2010 server by using Outlook Anywhere
• Self signed certificates warnings.
  • Outlook displays the Security Alert dialog box when Exchange is using a self-signed certificate
• A few customers that are using Symantec Enterprise Vault 8.x reported on mailbox data restore issues. The following error may appear: “Error 3310: There was a problem accessing a network service or resource. The dispenser will re-queue the current item and sleep for 5 minute(s). Task: Mailbox Archiving Task for EXCHANGESERVERNAME (Retrieval). For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp.”
  • Upgrade to Symantec Enterprise Vault 9.x contact Symantec Support for further assistant.
• Exchange Server 2010 Management Tools start up issues.
  • Microsoft Exchange Team released a nice document that can help: Troubleshooting Exchange 2010 Management Tools start up issues
• Due miss configuration of third party backup software, the following error may appear: “Exact Error Message 0xe0000380 - Backup Exec attempted to back up an Exchange database according to the job settings. The database was not found in the Database Availability Group”
  • Please contact the third party support staff to resolve this issue. Symantec released a nice article how to resolve this issue: Exchange Information Store for Exchange 2010 is not visible in the Backup Selections or the Exchange 2010 backup fails with either the error "0xe0000380 - Backup Exec attempted to back up an Exchange database according to the job settings. The database was not found in the Database Availability Group
• In most scenarios, the backup server should use Windows 2008 x64 / Windows 2008 R2 operating system with the latest edition of the Exchange 2010 Management Tools.
• An issue with cluster upgrade was reported by a customer from Israel. Upgrading from Exchange Server 2003 cluster to Exchange Server 2007/2010 cluster may lead to communication issue, if we are hosting the routing group connector on that cluster.
• It’s recommended to move the routing group connector to an alternative Exchange Server, before starting the cluster upgrade.
• During Exchange Server 2010 installation, the following error may appear: “The execution of: “$error.Clear(); if ($RoleStartTransportService) { start-SetupService -ServiceName MSExchangeTransport }”, generated the following error: “Service ‘MSExchangeTransport’ failed to reach status ‘Running’ on this server.”
• Enable IPV 6 on the network adapter(s).
• When you try to install the Exchange Server 2010 mailbox role, the installation process fails

First of all a HUGE THANKS to Yuval Sinay for putting this information together.

The following article will provide a summary on common issues in Exchange 2010 deployment in the Enterprise. The information in this article consists of my own experience and official Microsoft knowledgebase articles. Due to the fact that your Exchange environment may vary, please read the information carefully and test the suggestions from this article - in a lab that can demonstrate the current Exchange infrastructure.

The article is divided to the following chapters:

1. General issues in Exchange 2010 deployment.

2. Best practices in Exchange 2010 deployment.

3. Common issues in Exchange 2007 migration to Exchange 2010.

4. Common issues in Exchange 2003 migration to Exchange 2010.

Best practices in Exchange 2010 deployment

• Before starting the implementation stage, verify that the third party products in your company (e.g. Antivirus, Backup, etc.) support Exchange 2010 and Windows 2008 R2.
• Although you can install Exchange 2010 on Windows 2008 x64, I recommend using Windows 2008 R2 that provide a higher performance.
• To use all Exchange 2010 features, you may need to upgrade the workstation to use Outlook 2010.
  • Outlook 2007 Features for Exchange Unified Messaging
  • Outlook 2010 Features in Unified Messaging
• Exchange 2010 use RAM for most of its tasks. I recommend adding RAM to the server by estimated the future overhead on the server.
• Microsoft is doing a great job to fix all the known issue in a short time. Please upgrade the environment to the latest service pack / hot-fix. Before starting moving mailboxes to the new Exchange 2010 system.
• Consider to use Windows 2008 R2 Enterprise edition, so you can implement Exchange 2010 DAG in the future. Exchange 2010 DAG provides excellent high availability solution, that can provide you company 24/7 service.
• Using Microsoft Best Practice analyzer can help you to find known issues in your environment.
• Microsoft has released the tool “Exchange Pre-Deployment Analyzer” that can help you to map the Exchange system before you make changes on it. You can download this tool from this link.
• Review Exchange 2010 System Requirements, before starting the Exchange deployment project.

To all the DPM 2010 fans out there, here are some notes/transcriptions of the sessions which were delivered at MMS 2010 in Las Vegas by Jason Buffington!

MMS 2010 – BB12 – Technical Introduction to DPM 2010

MMS 2010 – BB13 – Protecting Applications with DPM 2010

MMS 2010 – BB14 – Protecting Windows Clients with DPM 2010

MMS 2010 – BB15 – Virtualization and Data Protection, better together with DPM 2010

MMS 2010 – BB37 – Disaster Recovery and Advanced Scenarios with DPM 2010

MMS 2010 – Partner Announcements (DPM 2010)

A huge THANKS to Mike Resseler for taking these notes as Jason was presenting his slide decks…

Load balancing serves two primary purposes. It reduces the impact of a single Client Access server failure within one of your Active Directory sites. In addition, load balancing ensures that the load on your Client Access server and Hub Transport computers is evenly distributed.

A great document online has been published regarding Exchange Server 2010 Load Balancing which you can see in the link below, however it is never bad to not forget the requirements of load balancing when we play it in Exchange protocols… http://technet.microsoft.com/en-us/library/ff625248.aspx.

Understanding Load Balancing in Exchange 2010:
http://technet.microsoft.com/en-us/library/ff625247.aspx

It is a bit late to announce, however that is just due to my  blog’s maintenance!

Finally this day has arrived ob the 19th of April. It has been so long in the making, and yet it seems like time flew by.

Check out the official blog announcing the RTM launch: http://www.microsoft.com/systemcenter/en/us/data-protection-manager.aspx.

Here are a few of my favourite features in DPM 2010:

• The ability for roaming laptops to get centrally managed policies around desktop protection, so that your laptop data is protected, whether you are connected to the corporate network or remote
• Enhanced virtualization protection, including Hyper-V R2 LiveMigration scenarios and the ability to recover single-files from within host-based backups
• Additional protection and recovery capabilities for Windows application servers like SQL Server, Exchange or SharePoint
• Native site-to-site replication for disaster recovery to either another DPM server or an off-site cloud provider
• Significant enterprise-scalability increases for deploying DPM in large environments
• Centrally managed System State and Bare Metal Recovery

The RTM Evaluation Software for DPM 2010 is now available at: http://technet.microsoft.com/en-us/evalcenter/bb727240.aspx

Shadow redundancy minimizes message loss due to server outages. When a transport server comes back online after an outage, there are two scenarios:

• The server comes back online with a new transport database – In this scenario, the transport database is unrecoverable due to data corruption or hardware failure. In this case, because the transport server will have a new database ID, it will be recognized as a new route by the other transport servers in the organization. This also applies to the situation where a server couldn't be recovered, and a new server was provisioned as a replacement.
• The server comes back online with the same transport database – In this scenario, the particular transport server didn't fail, but was offline for an extended period of time. For example, a network card failure, or a long maintenance on the server would cause this scenario.

The following table summarizes how transport reacts to these two scenarios when shadow redundancy is enabled. For clarity, assume that the server that had an outage is named Hub01.

However regarding duplicate messages we should always refer this very interest link which actually applies since previous versions and which explains how Exchange can in some scenarios avoid message duplication:

http://msexchangeteam.com/archive/2004/07/14/183132.aspx

I was trying to pull some stuff together for a customer who’s contemplating going from Exchange 2003 to Exchange 2010 and looking for slides/charts comparing the two. This may be useful to some of you, as so here it is.

Awesome news as the so much waited SP1 on Exchange Server 2010 will be out, hopefully soon… And the good news continue as these should be some of the improvements:

• Archiving and Discovery Enhancements;
• All the Mobility all the time;
• New Management UI;
• Outlook Web App better than ever;

http://msexchangeteam.com/archive/2010/04/05/454533.aspx

The main reason this guidance was developed was due to customers requesting that CAS be placed in a perimeter network.  See http://msexchangeteam.com/archive/2009/10/21/452929.aspx for more information on why that is not supported.  This same guidance, as the article indicates, is true for the other server roles, with the exception of Edge Transport as it was designed from a usage scenario to only communicate from the perimeter network to the internal network via SMTP and to allow connections (LDAP and SMTP) from the internal network.

As for what customers can do - If their plan is to open up all the defined ports between the Exchange and AD servers in Site A and all Exchange and AD servers in Site B, then this would be supported since one could argue that there isn't really a "firewall" between the two sets of servers anymore.  They will be able to get support  after deploying like that. And if an issue comes and then, while helping them debug it, its found that there was network traffic blocking going on which breaks some aspect of Exchange communications with other server roles in the AD Sites, then they would be helped at least help them get into a supported state (without traffic limitations between the Exchange servers and DCs).

Yes this adds complexity.  Yes it could break things.  Yes customers have reasons to do it.