Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Christian Schindler — Fri, 04 Nov 2005 20:23:29 GMT

Wow! Good stuff! That is why I like this blog!

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Lee — Fri, 04 Nov 2005 20:27:38 GMT

Does this mean that as long as at least one of the highest ranking GC's will respond, it/they will always get the requests and none will be sent to Exdomain. Could this create a load issue if there weren't enough GC's in the highest ranking?

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Fri, 04 Nov 2005 21:31:09 GMT

Lee, yes if there is only one GC that meets the requirements (whether Pre-SP2 or SP2) then that GC will receive all the referral requests.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Deji — Fri, 04 Nov 2005 23:57:21 GMT

Not to shoot the messenger or something like that :)

With regard to the DL mofidication issue, why would it not be possible to put some intelligence into DSProxy and have it directly detect the domain of the DL and have it refer the client to the appropriate DC (in whatever site) for the intended modification? If it's able to detect the client's domain right now, then it should be able to detect (from the change requested by the client) that the DL is NOT in the same domain as the client and the change can not be executed on the client's DC. It should then say something to the effect "this change can only happen on DC-xyz, go there".

Considering that the DL mod piece that is not addressed here is arguably the most sought-after feature (well....maybe "second-most-sought-after" - after delegation), I'd think that, given the huge efforts you guys put into making SP2, you'd at least put something (even if not elegant) in there to ameliorate the pains people are experiencing right now in a multi-domain environment.

Or did you, and I'm just over-simplifying the solution?

All in all, nice write-up. And good work on the enhancements.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Brian Magee — Sat, 05 Nov 2005 00:01:03 GMT

If I'm understanding this right, does that mean there is no way to force a user to use a GC in their own site? For example:

Lets say we centralized Exchange and consolidated to a couple of Exchange servers in Site A (Chicago). The users are in Site A of course, Site B (NY), Site C (Miami), Site D (L.A.), and site E (Denver). All sites have a GC, and all the users and servers are in the same domain (although not a single domain organization due to an empty root domain, for all intents and purposes it acts as a single domain. )

Obviously we would like a user in Miami to normally hit the GC in Miami, but it sounds like they will instead always hit Chicago. I understand that since the user has no IP address it would be hard to determine their site... :) but is there no way around this?

In any case thanks for the article, this blog really is great for learning stuff I'd probably never know otherwise...

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Wolfgang Sauer — Sat, 05 Nov 2005 15:51:47 GMT

Thanks for this excellent work.

Additional question. If Outlook is connected to a GC which is not in the users domain and the user adds a universal distribution group to a public folder ACL. This group should convert to a universal security group, does this happen in this case?

Regards

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Marcel Steijn — Mon, 07 Nov 2005 16:39:56 GMT

Thanks for this clear explanation.

I was just wondering what will will happen with GC requests that do get proxied, either because the client is pre Outlook 2000 or because the registry key that's enabling proxying all request is set. Does this new algorithm also goes for these kind of requests?

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Mon, 07 Nov 2005 21:23:58 GMT

Wolfgang,

The store handles the conversion of the UDG to a USG.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Mon, 07 Nov 2005 21:26:00 GMT

Brian,

To force Outlook to use a GC within its own site rather than the Exchange GC referral, you need to implement one of two registry keys that are discussed in

http://support.microsoft.com/default.aspx?scid=kb;en-us;319206.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Mon, 07 Nov 2005 21:41:38 GMT

Deji,

No you are not oversimplifying the issue. We addressed the delegate issue and didn't address the distribution group membership issue (if the DG is not in the same domain as the referral GC).

As to why we didnt't include this functionality, well it all comes down to customer pain issues (delegates was at the top), development time constraints, and testing time constraints.

If you feel strongly about this scenario, then I would suggest you contact your TAM (you do have one don't you <grin>) so that they can escalate as appropriate.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Mon, 07 Nov 2005 22:32:29 GMT

Marcel,

We did not change the behavior in SP2 for how proxy requests are performed. We only changed the behavior for referrals.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Bob Christian — Wed, 09 Nov 2005 06:58:29 GMT

Ross -

Thanks to the team for this wonderful update! Without going into too much detail, I have seen this issue twice.

Bob

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Christian Schindler — Fri, 11 Nov 2005 01:17:24 GMT

Thanks for all the updates - this is invaluable...

Just one more question:
You mentioned KB319206 to force Outlook to use a GC within its own site. Does this mean that Outlook is "site-aware"? Meaning: Outlook sends a query(SRV) to DNS to find the closest GC?

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Fri, 11 Nov 2005 19:50:29 GMT

Hi Christian,

The implementation for the 'Closest GC' option within Outlook 2002 and later utilizes the DSGetDCName API and not SRV records (DNS).

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Christian Schindler — Sat, 12 Nov 2005 00:17:52 GMT

Hi Ross,

thanks for the update!

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Marc Chenard — Mon, 14 Nov 2005 22:22:50 GMT

We actually prefer the old algorithm, when we migrated to Exchange 2003 we planned ahead and put all the DLs in the same site of our Exchange servers (they are all in the same domain), users are scattered across 5 other domain. This way the DL update issue is negated, as for the delegate problem we had no way to design around it. Now we are swapping problems. Any chance that we can at least control the algorithm? BTW: Why don’t you guys get together with the Office team and fix the problem for real, this is a know problem since 1999, there is no reason other than motivation for this problem to exist?

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Sun, 20 Nov 2005 22:04:27 GMT

Marc,

Stay tuned...I will be posting an update in the Dec/Jan timeframe that answers your issue.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Pete Heilig — Thu, 01 Dec 2005 02:54:55 GMT

I would like to clarify one specific detail, regarding the following:

> Considering the above design, there is
> basically a 66% chance that DSProxy will
> refer the Outlook client to a non-home-domain
> global catalog server. <snip> In this
> scenario, the Outlook clients can use that
> global catalog server successfully for all
> directory requests except:
>
> · Updating membership of distribution groups that reside in UserDomain.

My questions:

1.) Is this issue specific to *DISTRIBUTION* groups?

2.) Are *SECURITY* groups also similarly affected by this issue? (i.e. mail-enabled security groups)

thanks,
-Pete Heilig
Senior Systems Engineer
Gartner, Inc.

re: Exchange Server 2003 Service Pack 2 DSProxy Referral Process Changes

Ross Smith IV — Fri, 02 Dec 2005 21:50:28 GMT

Any mail enabled group that is not in the same domain as the GC that the client is utilizing will prevent the client from updating the membership due to its read-only nature in the GC.

Exchange 2003 post SP2 DSProxy Referral Update

You Had Me At EHLO... — Fri, 17 Mar 2006 19:12:57 GMT

In November 2005 I posted an article on the DSProxy referral changes that are included in Exchange Server...