Marcus Hass' [MS] Blog : Exchange

Microsoft Online and SBS 2003

mhass — Wed, 03 Jun 2009 05:16:00 GMT

I have been working with the Microsoft BPOS aka Microsoft Online guys in Enterprise accounts for a while to help big companies migrate to BPOS dedicated. Don’t know what that is? Check out www.microsoftonline.com. To sum it up, it is hosted Exchange, SharePoint, OCS, LiveMeeting, and a few other offerings. For bigger businesses, Microsoft sets up dedicated hosting servers, for small it is multitenant.

I help out a small company from time to time because they have 15 employees and a Small Business Server 2003 environment. They are constantly running out of space on their 5 year old server because mail boxes keep growing because of attachment sizes. These guys are the perfect scenario to migrate to Microsoft Online!

So, I setup a free trial and started loading some of the coexistence tools like email sync and dirsync onto the Small Business server. Well, that was the plan. Turns out, dirsync can’t be run on a domain controller and will only run on Windows Server 2003. I think the BPOS guys missed the Small Businesses aren’t going to have an extra server lying around. How can you miss this scenario when building your tools, especially a segment of the market so perfect for BPOS?

So, they will have to forgo the coexistence and migrate mailboxes in one fell swoop over a weekend, which won’t be pretty over the small network connection they have.

I am sure there are technical reasons, and that's what will be used as an excuse. It just disappoints me when we have really smart guys that miss such a big opportunity to help small businesses.

My iPhone 3G Review

mhass — Thu, 31 Jul 2008 18:57:00 GMT

Call me a traitor. Call me weak minded to the Apple Jedi mind trick. Yes I have a 3g iPhone, the cheapest one of course.

My Treo 750, which I really liked, was starting to have some battery fade. In addition, I was using the IE browser on my Treo more frequently, with more and more contempt for IE on the phone. I had loaded an experimental browser on it a while back called Deepfish, and it was great (very similar to the abilities of Safari on the iPhone). But, Deepfish was canceled as a standalone project and will probably be incorporated in a future version of Windows Mobile.

So, I was stuck using the "diet" version of IE on my phone, which made me want to pitch it for distance at times.

I was indoctrinated to the iPhone during a charity event for the Leukemia and Lymphoma society where I took many pictures using people's iPhones as proof they made it to a checkpoint along a race. I had to fumble into menus on the iPhone, and was instantly hooked by its interface and most of all its Safari browser, even though it was the Edge version at the time.

The stars aligned and I ordered one. Below are a few observations (please note that I don't care about iPod functionality because my Zune is way, way better).

Pros:

Now with Exchange Active Sync (EAS), see cons section for some quirks with EAS
EAS means security policy pushed from Exchange server, ability to remote wipe if lost
Safari browser rocks!
Overall Interface is excellent
GPS and Google maps integration
Camera is pretty good, interface for pictures is excellent
Good Facebook application add-in
Haven't had issues with it unlocking keys randomly in my pocket like I did with a "key locked" Treo
Better interface to read emails than on the Treo, especially expanding the reply list.

Cons:

Battery life, can't make it an entire day even with Wifi turned off
I miss Voice Command!!! I got used to not taking my phone out of my pocket/holster and using voice to call someone and it telling me who was calling. This might be coming in the near future from the application store.
Can't sync individual folders with EAS, it is "last 200 of items". I have a folder with all my travel plans and it usually isn't in the "last 200 items"
Calendar sync is screwy. Even though I accept an appointment in Outlook, the phone insists on me accepting it again.
Can't query other's calendars
Attachments aren't automatically downloaded, only when you click on them
Some applications from the application store are deemed "too big" so you have to use iTunes to download them. I have an all-you-can-eat data plan, why can't I use my 3g connection?
Smudges, grease spots, makeup (not mine of course). All inherent with a touch screen, reminds me of the old TMo XDA
One handed navigation was a Treo trademark, and still is. Apple can't match its one-handidness
Can't flip things like email on its side for reading. Only browser and camera seem to flip on their side.
GPS isn't real GPS. I believe it must use cell towers or something because it isn't nearly as accurate as my Garmin. Probably a fix in the future...

Verdict:

The browser alone is worth it, I can live with all the quirks
Apple needs to actually pick up a Windows Mobile phone and use it like millions of WinMo customers have been for years. Take some notes, and refine the experience more on the iPhone.
Where can I get an extended battery? Oh wait....

Note: If you have solutions to any of the issue or quirks, please post a comment.

Update: Added Con about querying calendars and con about attachments.

Exchange 2007 – Snags during my upgrade

mhass — Fri, 26 Jan 2007 20:34:00 GMT

This week I had some time to spend in my lab at home, so I thought I would catch up on some overdue projects, My biggest project was to get my lab up to Exchange 2007 from 2003. The complication here is that although I have a rack of “real” servers, I don’t have any spare capacity.

Virtual PC to the rescue! I grabbed a spare laptop from our inventory at the office, and snagged a copy of my sysprep’d Windows Server 2003 R2 image and installed Exchange 2007.

I decided to write about my experience so that the search engines catch it, and hopefully get you on your way quicker.

Mailbox Migration

After updating my AD schema and making reasonably sure that the 2007 box could talk to the 2003 box, I moved my mailbox. I checked, and I could still access my mailbox through OWA, RPC/HTTP, Local MAPI, and EAS (still accessed through the EX2003 box via publishing rules on my ISA 2006 box). Since all of this worked, I migrated over the 20 or so mailboxes that I host for friends.

Since I didn’t have any spare boxes, I would have to pave my old EX2003 box, install Exchange 2007, and move the mailboxes back off the VPC Exchange server. I decided to take an outage and didn’t change the ISA publishing rules to the new EX2007 box, so I don’t know if Exchange out of the box worked for me (something that in retrospect might have helped me). Uninstalling EX2003 was uneventful. I had to turn off NNTP and SMTP to allow EX2007 to install on the box, as well as apply a .NET hotfix that the installer guided me to install.

The “real hardware” EX2007 box was up and running, and was part of the Org. I moved the mailboxes back, and did a quick check with a local Outlook client to ensure I could still get to mailboxes.

Decommissioning the EX2007 VPC

This is where I hit my first real snag. I took care to move mailboxes and Public Folders over to the “Real EX2007” server. I wanted to ensure that everything was moved over by deleting the Mailbox and Public Folder database before I did the uninstall. When I tried to delete the Public Folders database using the GUI I kept getting this error:

--------------------------------------------------------
Microsoft Exchange Error
--------------------------------------------------------
The public folder database 'Public Folder Database' cannot be deleted.
Public Folder Database Failed
Error:
The public folder database specified contains folder replicas. Before deleting the public folder database, remove the folders or move the replicas to another public folder database.

--------------------------------------------------------
OK
--------------------------------------------------------

With the help of some really smart Exchange product team guys, they pointed me to a couple TechNet articles:

How to Remove a Public Folder Database

How to Remove the Last Public Folder Database in the Organization

For those with link impairment, and for the sake of search engines, I ran the following commands to resolve this issue:

Get-PublicFolder -Server <server with public folder database> "\" -Recurse -ResultSize:Unlimited | Remove-PublicFolder -Server <server with public folder database> -Recurse -ErrorAction:SilentlyContinue

Get-PublicFolder -Server <server with public folder database> "\Non_Ipm_Subtree" -Recurse -ResultSize:Unlimited | Remove-PublicFolder -Server <server with public folder database> -Recurse -ErrorAction:SilentlyContinue

Remove-PublicFolderDatabase -Identity "<server>\<storage group>\<public folder database>"

NOTE: This is where I had my first Eureka! moment. The GUI sucks, you can’t do much more than very basic management from the new Exchange System Management console. The Shell is where it’s at, the more you use it, the more you like it.

So all is good in the world: no more mailboxes or public folders on the EX2007 VPC. When I try and remove Exchange 2007, I started getting the error:

“this computer is configured as a bridgehead server for 1 routing group connector(s) in the organization. These must be moved or deleted before setup can continue”

Again, product team guys easily direct me to the good Exchange 2007 documentation regarding the cmdlets in the shell.

In this case, the GUI didn’t show any routing group connectors (please see my note above about how much the GUI is a waste of time). So, I had to use a command to first find out the names of the routing group connector and then delete it. I ran the following commands:

Get-RoutingGroupConnector [-Identity <RoutingGroupConnectorIdParameter>] [-DomainController <Fqdn>]

Remove-RoutingGroupConnector -Identity <RoutingGroupConnectorIdParameter> [-DomainController <Fqdn>]

Phew, after deleting the server-to-server routing connector I was able to uninstall EX2007 from the VPC.

Can’t send or receive email

After numerous attempts to send and receive email from internal and external clients, I wasn’t able to send or receive internal or external email. I tried using the queue viewer tool in the GUI, and it didn’t give me any clues. I figured I was missing an external send connector, and a quick glance at the GUI verified my assumption (reminder to self: must stop using the GUI). To polish my mad Shell skillz further, I decided to create an external connector for all external domains (*) using the following command:

New-SendConnector -Name <String> -AddressSpaces <MultiValuedProperty> [-AuthenticationCredential <PSCredential>] [-Comment <String>] [-ConnectionInactivityTimeOut <EnhancedTimeSpan>] [-DNSRoutingEnabled <$true | $false>] [-DomainController <Fqdn>] [-DomainSecureEnabled <$true | $false>] [-Enabled <$true | $false>] [-Force <SwitchParameter>] [-ForceHELO <$true | $false>] [-Fqdn <Fqdn>] [-IgnoreSTARTTLS <$true | $false>] [-MaxMessageSize <Unlimited>] [-Port <Int32>] [-ProtocolLoggingLevel <None | Verbose>] [-RequireTLS <$true | $false>] [-SmartHostAuthMechanism <None | BasicAuth | BasicAuthRequireTLS | ExchangeServer | ExternalAuthoritative>] [-SmartHosts <MultiValuedProperty>] [-SourceIPAddress <IPAddress>] [-SourceTransportServers <MultiValuedProperty>] [-TemplateInstance <PSObject>] [-Usage <Custom | Internal | Internet | Partner>] [-UseExternalDNSServersEnabled <$true | $false>]

After creating the send connector, I thought my troubles were over. Wrong! Nothing was working. I did a quick telnet to my server on port 25 and got the error:

“452 4.3.1. Insufficient system resources

Connection to host lost.

Press any key to continue…”

Well, it just so happens that this machine had two partitions, one for OS and one for the stores. By default the SMTP queue is located on the C drive, which only had about 1GB left. Exchange 2007 has a “Back Pressure” feature that disables the SMTP queue when there is low disk space. Unfortunately, there is no handy-dandy shell command to move the queue location. There is a pretty good article up on Technet that tells you how to Change the location of the Queue Database, It involves moving some files, granting “Full Control” to the network service on the new directory, and editing an XML file that contains the location of the queue. I also spotted a way to disable the Back Pressure feature. Just sucks that this isn’t in the Shell….

Immediately after this adjustment I got a shotgun of test emails, and the queue monitor lit up light a Christmas tree.

Certificates, OWA, and ISA

Because I want my buddies to be able to use OWA, EAS and RPC/HTTP securely, I have a public SSL certificate (really cheap from GoDaddy.com). Exchange actually generates its own certificates which is great, but doesn’t really work for my purposes. I also wanted to have ISA do the forms authentication, so I had to have the SSL cert on both the ISA server and Exchange box. It was pretty routine to export the cert with public key and install it on ISA using certificate manager.

I used the ISA publishing wizard for Exchange 2007 for OWA and it made it pretty brainless. I also published IMAP and POP3 for those friends I have that aren’t quite on the RPC/HTTP bandwagon. Additionally, I had already published the SMTP server and created a rule to allow outgoing SMTP from the Exchange server.

When I tried OWA, I kept getting the following Error:

500 Internal Server Error – The target principal name is incorrect”

Turns out that ISA’s interface in 2006 has changed a bit, and was misleading for me. I had created an HTTPS listener with the SSL cert, and everything looked good. ISA allows you to “bridge” the names by allowing you to have an “outside” name and route it to an “internal” name. Turns out, that on the “To” tab of the OWA publishing rule, I had mistakenly specified the “outside” DNS name of instead of my internal server. To set this up correctly, it needs to be:

This rule applies to this published site:

Mail.mydomain.com (external certificate name)

Computer name or IP address (required if the internal site name is different or not resolvable):

10.1.1.1

Summary

When I setup numerous Exchange 2003 servers for customers, I have a set way of doing it. And between having done it a bunch of times, and most of the tweaking in the GUI, 2003 seems easier. That said, I think that if you set the expectation that the Shell is your new config tool, it isn’t much harder. I really like the flexibility of the Shell, and I assume we took the Shell approach because the GUI would be impossibly complex to design for effective management especially with the Unified Communication components.

On your side, Microsoft has provided great documentation this time and it is already published on Technet and other resources.

Is it worth the hassle? Heck ya. Can you run setup.exe and be ready to go in 20 minutes? Nope. This is a complex, powerful product with lots of options. But, most admins familiar with Exchange should not have many issues getting it up and going.

Seriously scary Blackberry

mhass — Mon, 21 Aug 2006 17:20:00 GMT

For years, competitors to Blackberry have been pointing out the inherent security flaws with RIM’s services such as, um, all your corporate data flows through their network (along with all your competitor’s data). Microsoft's play around this is the fact that Exchange Active Sync doesn’t flow over someone else’s network, it simply uses HTTPS over your carrier’s network to sync with your Windows Mobile device. And BES can add significant load to your Exchange Back End because of the way it monitors messages.

What is more disturbing lately is an article presented at Defcon 14 this year about using a RIM device and their proxy to expose a customer’s internal network. The BES services work a lot differently than Exchange Front End Server or a direct connection to the Exchange Back End, so I can’t see how Exchange could be used in the same fashion using Exchange Active Sync. But, I am sure that our security folks have run through this and are double checking it to ensure that we have a “leg up” on RIM.

Exchange 12 Stuff that I liked

mhass — Tue, 08 Aug 2006 23:38:00 GMT

I got a sneak preview of the Exchange 12 at TechReady and got excited about a few things. Since most of the features are included in beta’s I can share them with you.

1) New server roles. Gone is the idea of a “Front End Server”, instead there will be several roles that a server can have. This eliminates the need to install Exchange completely on each FE then disable services that aren’t used. It is much more streamlined and only bits needed are loaded on the server.

2) Lots of great new features on the backend as far as storage groups and mailstore options. I won’t elaborate a whole lot more, but you can read all about it soon. There is an up to 75 percent reduction in I/O per second, which is remarkable.

3) Voice, voice, voice. I did a project 3 years ago with a startup company, and we called it HUC (Hosted Unified Communications). It was all about PBX integration and Call Control. When a call comes into your PBX, it tries to ring your phone and then runs a set of rules that we had on a proprietary server that determined whether to call your cell phone, etc. Eventually, the call ends up in Voice Mail, and the PBX system used SMTP/IMAP to push and pull Email messages. This is a lot like what Vonage or ATT Callvantage do today for consumers, but this was for business.

The hardest part was the blinking (I use this as an expletive as well as a visual indicator) red new message light on your phone. The problem was always that if you picked up your Vmail via email, how would the phone know that it is okay to turn off the blinking red message light?

The idea is to have a common message repository for Vmail and Email. This was a HUGE pain 3 years ago, but oh what a difference 3 years makes! I saw this in action, so it isn’t complete vaporware, and we actually had it do things to our mailboxes and mobile phones (unrehearsed).

Basically, Exchange becomes the store for everything. Voice mail can be picked up via Outlook, where it becomes more than an attached WAV file. Outlook has a built in player, and you can check in either via the fat Outlook client or OWA. But wait, it gets better! Say you are at an airport Kiosk which doesn’t have speakers or you don’t want people around you to hear your personal message. You can have the Exchange server call your cell phone and play it for you.

Along those same lines, the “voice” of Exchange becomes very, very powerful. You can have Exchange do simple things like read email back to you, but much more. You can schedule appointments, and dig deeper by having Exchange search free/busy schedules of attendees. You can also do amazing things with contacts such as searching them and have Exchange connect them to your mobile phone.

Given, we probably used the best partner we had for PBX integration, and there is a lot of plumbing work behind the scenes. To do all this stuff, still involves SIP gateways, and most importantly High Availibilty (afterall, how many times does your Vmail system go down?) But, the voice stuff absolutely blew me away.

4) I also liked the Exchange Management Shell, which basically lets you script ANYTHING that you can do in GUI. This is where the magic for consultants like me will happen.

5) SSL Integration and opportunistic TLS is finally there, and integrated nicely.

6) OWA ships with web parts, which allows much more flexibility for developers when they are developing portal with .NET 2.0 or SharePoint. You can basically move around anything on the screen for users.

7) Resource scheduling (conference rooms, etc) is finally better than GroupWise, which I still think has one of the best user experiences for finding available resources.

Anyway, I knew I was going to like MOSS 2007 (SharePoint) and I am using Office 2007 on my main laptop now, I just wasn’t prepared for the really cool stuff in Exchange 12. Looks like 2007 is going to be a great year to be an infrastructure consultant. For more info on what is new, check out the Exchange 2007 Preview Web Site

Bedlam DL3 (revisited)

mhass — Sat, 25 Feb 2006 01:30:00 GMT

So, I am on a few distribution lists that pertain directly to my every day job. I have a few others that are nice to look at because there is interesting stuff. One of the hobby DL’s that I like to read is our “Pocket PC Users and Enthusiasts”, which we share all kinds of gripes and praise about our Windows Mobile devices.

Justin Emch, our resident Program Manager for mobile devices decided that we had fractured into many different DL’s and people where asking the same questions on several different DL’s and a consolidation was in order. This is a great idea as the rules in my inbox were gathering email from like three different DL’s into one folder to make sure I got it all. Justin also sent out like 5 emails warning people that this was going to happen and to make sure you adjust your rules appropriately because your inbox could grow pretty quick if the rules don’t pick it up.

Wouldn’t you know it, that a day after it went into effect, you have all kinds of people asking to be unsubscribed from it. Of course this means that you are flooding 1000’s of mailboxes with your email to unsubscribe, this is Bedlam DL3 all over again!

First of all, there is no owner of a DL that will unsubscribe you from the DL at Microsoft because it would take too much time to manage DL’s like this. Second, we have a tool called AutoGroup (formerly known as AutoDL) that lets you manage all your subscriptions and create your own groups. So, to unsubscribe, you have to go do it yourself. Lastly, I can’t believe the number of smart people we have at Microsoft that sent Unsubscribe requests to the DL. I found out about AutoGroup within minutes of joining Microsoft almost 6 years ago since that is how we communicate internally. I am astounded at the number of people that don’t know about AutoGroup, especially some of the more senior people.

I think the problem is that we have so many interesting DL’s that people subscribe to, that they don’t get a chance to read the email that their Inbox rules filter. So, those people never saw the ample warning emails that Justin sent and were surprised by the barrage of email yesterday and today to the new DL. My advice: Prune the DL’s you are on to a manageable level and only subscribe to the ones that you can read each week.

Gripes and praise about Communicator Web Access

mhass — Thu, 26 Jan 2006 00:56:00 GMT

I am working on an LCS design for a customer and saw that LCS’ Communicator Web Access shipped in December. I read the docs and discovered that it works a lot like Outlook Web Access (OWA) because it uses forms based authentication. I was surprised at this because I assumed that we would have created a web client as an ActiveX control that behaved like Office Communicator.

Office Communicator accesses the corporate LCS environment through an Access Proxy server in the DMZ, which in turn connects to a Director in your Corporate network. I believe the Office Communicator uses SIP for signaling and talks to the Access Proxy using this protocol.

So, why wouldn’t Communicator Web Access use the same type of protocols to connect to LCS? I hate it when we make products that have 6 different ways to connect to it, it makes us infrastructure guy’s life hell. After all, we had to implement this weird, Access Proxy to Director to LCS Pool to LCS Backed infrastructure.

I can think of three main reasons:

1) There are much better packet filters for HTTP/HTTPS than there are for SIP

2) Most people that have LCS have OWA, so this fits that model

3) Allow people with other platforms to use LCS

I have also posted an example below of our High Availability Infrastructure, right click and save to your PC for a better picture. Since we haven’t implemented it yet, I can’t vouch for its entire accuracy, but you can get the idea.

Hosted Messaging and Collaboration 3.5 released today

mhass — Mon, 28 Nov 2005 18:56:00 GMT

This morning, Microsoft announced version 3.5 of the Solution for Hosted Messaging and Collaboration (the product formerly known as HVMC). The latest version of the solution incorporates new mobile synchronization capabilities, a variety of security enhancements, and new tools that lessen management time and extend customer acquisition opportunities for hosting partners. As always, the solution includes engineered tools and guidance on hosting Windows, Exchange, SharePoint, and LCS.

The official press release is here.

New Stuff:

§ Windows Server 2003 SP1 support

§ Automated password synchronization between hoster directories and end-customer accounts

§ New customer migration tools and updates to key technology components

§ Exchange SP2 support

§ Direct push technology (similar to Blackberry devices)

§ New mobile security features include the ability to wipe data from devices that have been lost or stolen and set up automated rules to help prevent access by unauthorized users

HVMC v3.5 training

mhass — Thu, 17 Nov 2005 02:23:00 GMT

I am up in Redmond this week for training on our new High Volume Messaging and Collaboration (HVMC) release, v3.5. I got "nominated" to go to the training because both Gloria Alexander and Todd Luttinen, our resident Hosted Exchange experts, deserted us and moved to product teams (Todd went to Exchange, Gloria to the Hosting Solutions group).

I haven't really done much Hosted Exchange work since 2003 when I helped Deutsche Telekom migrate off MCIS to Exchange 2000. Back when I did Hosted Exchange, it was difficult because we didn't have any tools, guides, provisioning systems, etc. We have come a long way, and I am really impressed by the cohesion we have with the latest solution, as well as the guidance on deployment.

We also have awesome partners like implement.com that have implemented Hosted Exchange infrastructures that support millions of users.

As soon as it is released, I will try and describe some of the cool new things we can do with v3.5

Small Business Server 2003 Upgrade from Hell

mhass — Thu, 03 Nov 2005 06:32:00 GMT

Last week, I decided to take a few vacation days and fly out to Ogden, Utah to help my wife’s old company upgrade from Small Business Server (SBS) 2000 to SBS 2003. They are a small, 10 person operation that manufactures high end ski and board apparel (www.descente.net or www.ridedna.com). The have a main office in downtown Ogden, a warehouse about 5 blocks away and a Canadian office in Vancouver.

The primary reason for the upgrade is that the president now resides in Canada, and his mailbox is back in Ogden. OWA is great, but it times out and the Exchange 2000 version was not the best and fastest interface. So, RPC/HTTP aka Outlook over the Internet is the perfect solution! BTW, his laptop runs Windows XP Japanese as well as Office 2000/Outlook 2003 Japanese but when I sit down it almost looks like I can read Japanese because I have almost everything memorized, I was often asked by other employees if I spoke Japanese.

Anyway, SBS has always meant in my mind “super tight integration of Microsoft Infrastructure products and a super easy GUI for non-computer type people to manage their business”. Of course another way of saying this is “I am going to hate using the SBS tools, please god give me normal MMC consoles”. I also thought, “what a simple upgrade this is going to be, should I fly out or can I do it over VPN if someone sites there on the phone with me”. Flying turned out to be a godsend.

First of all, support calls for Microsoft employees are not free. We either have to pay, or we get 3 Quick Assist calls that we can give to people. These are mainly meant to give to the guys that stop you and say, “Hey you work for Microsoft? I have Windows 98’ and I can’t print to this HP LaserJet II, can you help?” In this case, I needed all three Quick Assists and didn’t have any with me so I bummed a couple from coworkers.

Here are the highlights:

Support Call 1:

SBS upgrade halted, keeps insisting that “All domain controllers could not be contacted”. Some braniac when the system was first installed decided to implement a second DC on some old hardware. The hardware failed shortly after installation and AD was never cleaned up.

I made sure that all the roles were seized by their primary DC (they were). And I tried to delete the DC out of the domain, no luck. I used NTDSUTIL, ADSI Edit, DNS srv records, everything was gone, but it still insisted that “All domain controllers could not be contacted”.

Support ended up finding a way around this little check in the upgrade process and we were able to continue with the upgrade.

Support Call 2:

ISA 2004 is included in on the Technologies disk of SBS 2004 Premium Edition. They don’t’ advertise that, but I feel it is critical because the ISA 2004 GUI is worlds better than ISA 2000/Proxy Server 2.0.

During the install, ISA would bomb out with a .Net runtime error. It appeared that ISA completed installing itself and the MSDE for ISA, but it never installed the rules for SBS.

Turns out that the SBS wrapper around ISA 2004 forces it to utilize some of the SBS Admin tools that get installed. The Admin tools were never installed during the upgrade, and I never unselected them. To me, there must be a bug in the upgrade process or they purposely defaulted them not to be installed.

After installing SBS admin tools, I reran ISA setup and it went through fine.

Support Call 3:

After a long debate with SSL certs because for some reason their old SSL cert didn’t correctly move over to the Windows 2003 certificate store, I had to have the cert authority reissue it.

After reissue, I imported it into both IIS and used it for the web listener in ISA. It is a cert from www.xramp.com that has a public cert authority at very reasonable prices.

After OWA, OMA, and EAS were working, I decided to tackle RPC/HTTP for the president and their warehouse. By this time, I had flown back home and I built a Windows XP Virtual Server image and joined it to their domain to test RPC/HTTP. I VPN’d in from my Virtual Server image, joined the domain and got standard MAPI over TCP/IP working, cool! I disconnected the VPN, and setup the RPC/HTTP proxy settings on the client, and I new that the Outlook settings were correct and the certs were good, but it wouldn’t connect. It kept prompting me for login credentials.

Support traced the problem to the “Proxy Authentication Settings” being set to NTLM Authentication, for SBS apparently it must use Basic Authentication. The support tech also claimed that you can’t hit the “Check Name” button when you use RPC/HTTP, which I knew for a fact not to be an issue when you initially create the profile with TCP/IP. I tested this, and there isn’t an issue if you create a profile when you have the full MAPI TCP/IP connection, and later add RPC/HTTP.

Summary:

I am disappointed that this wasn’t as smooth as an update as I expected. Again, SBS is targeted at business of 100 or less people that probably don’t have a full time IT person, or have access to $295 per incident support from Microsoft.

In dealing with the SBS products, there seems to be a GUI that has simplified administrative tasks, but the underlying technology seems to still be hobbled together. Many of the products are wrapped or functionality is hidden/taken away, and don’t appear to be engineered from the beginning to work together on a single server. Overall, I highly recommend SBS 2003 especially since the premium edition includes ISA 2004. But, I think that we need to have the SBS teams sit in early on Windows, Exchange/Office, ISA, and SQL engineering design sessions and architect those products to operate better together on a single box to give SBS the reliability and ease of updates it deserves.

Microsoft Support from India

mhass — Fri, 28 Oct 2005 04:41:00 GMT

I admit it, I am not the all-knowing Microsoft consultant I should be. The real truth is, our support folks have the best tools to diagnose problems a lot faster than I can muddle through things.

I have had the occasion over the last few weeks to call Microsoft Support (PSS) several times with issues around SQL, AD, SharePoint and Small Business Server. Every single time, I was routed to someone in India. The support was phenomenal (as always), but what was more impressive was the language skills and how hip the support guys were on the other end of the phone, especially for being so far from the US. I think my expectation was that I would still receive good support, but a bit of a language barrier as well as some bias to culture.

Next time you call in, I bet you won’t be able where the person is located that is helping you fix your issue.

Turn off MAPI on Exchange, good news for hosters, but....

mhass — Thu, 28 Jul 2005 00:45:00 GMT

I just saw this post from the Exchange team. This is great news for hosters that want to offer a choice of packages, but does it really save anything? OWA is as big of a pig as a full MAPI user, just without the hassle of client configuration. Support teams win, but the infrastructure doesn’t gain anything.

The other issue is licensing. I believe the SPLA license doesn’t differentiate between a MAPI user and an OWA user. OWA users get most of the advantages of the MAPI user, so I can’t imagine there would be a break in the cost.

Just thought it was cool to see the Exchange team listen to Hosters, which is a relatively small percent of the target audience for Exchange.

RANT: Exchange Calendar and Contact email problems

mhass — Wed, 27 Jul 2005 21:33:00 GMT

I don't know exactly what or when this happened, but email has become a lot harder to use, especially around sending appointments or contacts. Most of my customers have Exchange 2003, Microsoft has Exchange 2003 and I have Exchange 2003 here at my lab at home (where I host several SMTP domains). Most of the time now, my customer's appointments come through as attachments to an email and not an actual appointment. Outlook won't let me drag the appointment to my calendar or save it to the desktop, so I have no way of saving it to my calendar. Sending these same messages to my home Exchange server results in the same issues.

I have heard that I need to have the sender change the encoding. But why? If they have Outlook 2003 and Exchange 2003 shouldn't it just work? And if myself or my customers have to do this on a contact by contact basis, that will be painful!

Grrrr, to add to it, when I send a contact as an attachment it comes across as a generic email, not a contact or Vcard.

Anyone?

Microsoft to Acquire FrontBridge Technologies, a Leading Provider of Secure Messaging Services

mhass — Thu, 21 Jul 2005 00:20:00 GMT

Cool news for Exchange! But, won't this be seen as competing with our partners that are ASP's? Hosted Exchange, bah, we will do it ourselves...

iSCSI, cheap disk for archiving?

mhass — Sat, 16 Jul 2005 21:33:00 GMT

Back in 2002, I was involved in migrating some of Microsoft’s biggest ISP customers from a product we called MCIS (Microsoft Commercial Internet Server) to Exchange 2000. I was the project manager for Deutsche Telekom (DT) were we had several hundred thousand email boxes and about 40,000 SMTP domains.

Hosted Exchange back then was a thing of legend and only wizards such as Colin Ricketts (www.implement.com), Steve Schwartz, Todd Luttinen, Aaron Brown, Gloria Alexander, and Vlad Mott were able to master the spell that conjured Hosted Exchange. We now have an entire solution team dedicated to High Volume Messaging and Collaboration and it has gotten relatively simple.

To add to the complexity, DT wanted to use some equipment they already had, namely a NetApp Filter 840 which is a NAS. Back then iSCSI was something you called yourself when you were ill. Actually, NetApp had SnapManager which installed a iSCSI driver on Windows that allowed it connect to the SAN thinking it was real disk. This even worked with a cluster.

We had to warn DT that this is not supported, but they insisted. We went ahead and did the migration, and our stores were on the NAS with decent performance. About 4 weeks after we completed the migrations, all hell broke loose as the system crashed, and naturally everyone blamed the NAS. In reality, we had to get Developers from Exchange to connect to our platform to determine the root cause, which turned out to be issues with no message size limits being set for POP3, STORE.EXE bugs as well as IMAP bugs. We were forced to move the majority of users to other backend that had arbitrated loop fibre storage to eliminate the wild card of iSCSI. But we NEVER had any issue with the users that say on the NAS, it was completely stable.

Why am I mentioning this? iSCSI is now in a working group, and I don’t think that enough people are utilizing this as low end storage. With products such as Symantec/Vertias Enterprise Vault for archiving you could buy really cheap NAS devices and archive the older messages to really cheap disk.