22 February 2018

Clean IIS .LOG files, .BLG and .ETL files while we're at it

This is a script I found at "The Gallery" over at Technet.
Edward van Biljon created this for his own environment and I saw a great script to be used for my environment as well. In his version it also goes through the IIS folders, but I think there are better scripts available to do this so I don't use that function and commented it out in the script.

What it does is find log files, blg files and etl files.
If older than X days they get deleted.

Why would you want this? Well, disk space disk space disk space.
All the logging that Exchange 2013 and 2016 does out of the box will fill up your disks like crazy.

Running this as a scheduled task will prevent the most cases of system freezes and lockups because of full OS disks.

Certain files are in constant use by Exchange or IIS so this script won't be able to delete those files.
After a reboot you can delete those files by running this script.
The original script by Edward was missing some folders, so I added those:

$days=2            
#$IISLogPath="C:\inetpub\logs\LogFiles\"            
$ExchangeLoggingPath="C:\Program Files\Microsoft\Exchange Server\V15\Logging\"            
$ETLLoggingPath="C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces\"            
$ETLLoggingPath2="C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs"            
$ETLLoggingPath3="C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Data\ProgramLogArchive\"            
$ETLLoggingPath4="C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\Connectivity"            
$HTTPERRLoggingPath="C:\Windows\System32\LogFiles\HTTPERR"            
Function CleanLogfiles($TargetFolder)            
{            
  write-host -debug -ForegroundColor Yellow -BackgroundColor Cyan $TargetFolder            
            
    if (Test-Path $TargetFolder) {            
        $Now = Get-Date            
        $LastWrite = $Now.AddDays(-$days)            
        $Files = Get-ChildItem "C:\Program Files\Microsoft\Exchange Server\V15\Logging\"  -Recurse | 
Where-Object {$_.Name -like "*.log" -or $_.Name -like "*.blg" -or $_.Name -like "*.etl"}  | 
where {$_.lastWriteTime -le "$lastwrite"} | Select-Object FullName              
        foreach ($File in $Files)            
            {            
               $FullFileName = $File.FullName              
               Write-Host "Deleting file $FullFileName" -ForegroundColor "yellow";             
                Remove-Item $FullFileName -ErrorAction SilentlyContinue | out-null            
            }            
       }            
Else {            
    Write-Host "The folder $TargetFolder doesn't exist! Check the folder path!" -ForegroundColor "red"            
    }            
}            
#CleanLogfiles($IISLogPath)            
CleanLogfiles($ExchangeLoggingPath)            
CleanLogfiles($ETLLoggingPath)            
CleanLogfiles($ETLLoggingPath2)            
CleanLogfiles($ETLLoggingPath3)            
CleanLogfiles($ETLLoggingPath4)            
CleanLogfiles($HTTPERRLoggingPath)

Source

15 February 2018

Schannel errors and the alert codes - What does the alert code mean

SSL / TLS  Alert Protocol and the Alert Codes.

When a schannel error is logged in the system eventlog there will be an alert code as well.
The table below shows what the alert code means.
Now this isn't going to help you fix your issue but it will point you in the direction you need to investigate.



Alert Code
Alert
Message
Description
0
close_notify
Notifies the recipient that the sender will not send any more messages on this connection.
10
unexpected_message
Received an inappropriate message This alert should never be observed in communication between proper implementations. This message is always fatal.
20
bad_record_mac
Received a record with an incorrect MAC. This message is always fatal.
21
decryption_failed
Decryption of a TLSCiphertext record is decrypted in an invalid way: either it was not an even multiple of the block length or its padding values, when checked, were not correct. This message is always fatal.
22
record_overflow
Received a TLSCiphertext record which had a length more than 2^14+2048 bytes, or a record decrypted to a TLSCompressed record with more than 2^14+1024 bytes. This message is always fatal.
30
decompression_failure
Received improper input, such as data that would expand to excessive length, from the decompression function. This message is always fatal.
40
handshake_failure
Indicates that the sender was unable to negotiate an acceptable set of security parameters given the options available. This is a fatal error.
42
bad_certificate
There is a problem with the certificate, for example, a certificate is corrupt, or a certificate contains signatures that cannot be verified.
43
unsupported_certificate
Received an unsupported certificate type.
44
certificate_revoked
Received a certificate that was revoked by its signer.
45
certificate_expired
Received a certificate has expired or is not currently valid.
46
certificate_unknown
An unspecified issue took place while processing the certificate that made it unacceptable.
47
illegal_parameter
Violated security parameters, such as a field in the handshake was out of range or inconsistent with other fields. This is always fatal.
48
unknown_ca
Received a valid certificate chain or partial chain, but the certificate was not accepted because the CA certificate could not be located or could not be matched with a known, trusted CA. This message is always fatal.
49
access_denied
Received a valid certificate, but when access control was applied, the sender did not proceed with negotiation. This message is always fatal.
50
decode_error
A message could not be decoded because some field was out of the specified range or the length of the message was incorrect. This message is always fatal.
51
decrypt_error
Failed handshake cryptographic operation, including being unable to correctly verify a signature, decrypt a key exchange, or validate a finished message.
60
export_restriction
Detected a negotiation that was not in compliance with export restrictions; for example, attempting to transfer a 1024 bit ephemeral RSA key for the RSA_EXPORT handshake method. This message is always fatal.
70
protocol_version
The protocol version the client attempted to negotiate is recognized, but not supported. For example, old protocol versions might be avoided for security reasons. This message is always fatal.
71
insufficient_security
Failed negotiation specifically because the server requires ciphers more secure than those supported by the client. Returned instead of handshake_failure. This message is always fatal.
80
internal_error
An internal error unrelated to the peer or the correctness of the protocol makes it impossible to continue, such as a memory allocation failure. The error is not related to protocol. This message is always fatal.
90
user_cancelled
Cancelled handshake for a reason that is unrelated to a protocol failure. If the user cancels an operation after the handshake is complete, just closing the connection by sending a close_notify is more appropriate. This alert should be followed by a close_notify. This message is generally a warning.
100
no_renegotiation
Sent by the client in response to a hello request or sent by the server in response to a client hello after initial handshaking. Either of these would normally lead to renegotiation; when that is not appropriate, the recipient should respond with this alert; at that point, the original requester can decide whether to proceed with the connection. One case where this would be appropriate would be where a server has spawned a process to satisfy a request; the process might receive security parameters (key length, authentication, and so on) at start-up and it might be difficult to communicate changes to these parameters after that point. This message is always a warning.
255
unsupported_extension



06 February 2018

Enable Out of Office thru Powershell - Formatted in HTML

Enable Out of Office thru Powershell

Set-MailboxAutoReplyConfiguration -identity “user@domain.com” –AutoReplyState Scheduled 
–StartTime “mm/dd/yyyy” –EndTime “mm/dd/yyyy” –ExternalMessage “The mesage you want to 
be displayed in the reply” -InternalMessage “The mesage you want to be displayed in the reply”

If User needs external OOO as well: 


-ExternalAudience:All parameter should be used.


Removing Out of office by Exchange Shell:

Set-MailboxAutoReplyConfiguration “username@domain.com” –AutoReplyState Disabled –ExternalMessage $null –InternalMessage $null

Check the OOO that has been configured:

Get-MailoxAutoReplyConfiguration -Identity “username@domain.com”

Example formatted in HTML:
Set-MailboxAutoReplyConfiguration -identity "john.doe@domain.com" –AutoReplyState Scheduled –StartTime “02/06/2018” –EndTime “12/31/2018” 
–ExternalMessage "<html><head></head><body><p>First line of the reply text.</br>Second line of the reply text</br>Job Title</br>First and 
last name</br>Email: youremail@domain.com</br>Phone: 01 23 45 67 89</br></br>" -InternalMessage "<html><head></head><body><p>First line 
of the reply text.</br>Second line of the reply text</br>Job Title</br>First and last name</br>Email: youremail@domain.com</br>Phone: 01 23 
45 67 89</br></br>" -externalaudience:All

Exchange 2013 installing a CU, Schema update required or not?

Update 21-06-2018 - CU21 added & Visual C++ Redistributable Packages for Visual Studio 2013
Update 27-03-2018 - CU20 added
Update 06-02-2018 - CU19 added & .NET 4.7.1. requirement for up coming CU21
Update 03-10-2017 - Technet article quote added

From Technet:
Active Directory schema changes in Exchange 2013 cumulative updates CU8 and later

No changes have been made to the Active Directory schema in Exchange 2013 from CU8 onwards. The last cumulative update to include schema changes is currently Exchange 2013 CU7.https://technet.microsoft.com/en-us/library/bb738144(v=exchg.150).aspx

This is some of those things you need to check before updating an Exchange environment every time a new CU gets put out.

Do i need to do a Schema update or not?

I came across this post from Rhoderick Milne,

Table Of Exchange 2013 Schema Versions

Exchange Version
msExchProductId
rangeUpper
MESO objectVersion
Organisation objectVersion
Exchange 2013 RTM
15.00.0516.032
15137
13236
15449
Exchange 2013 CU1
15.00.0620.029
15254
13236
15614
Exchange 2013 CU2
15.00.0712.024
15281
13236
15688
Exchange 2013 CU3
15.00.0775.038
15283
13236
15763
Exchange 2013 SP1
15.00.0847.032
15292
13236
15844
Exchange 2013 CU5
15.00.0913.022
15300
13236
15870
Exchange 2013 CU6
15.00.0995.029
15303
13236
15965
Exchange 2013 CU7
15.00.1044.025
15312
13236
15965
Exchange 2013 CU8
15.00.1076.009
15312
13236
15965
Exchange 2013 CU9
15.00.1104.005
15312
13236
15965
Exchange 2013 CU10
15.00.1130.007
15312
13236
16130
Exchange 2013 CU11
15.00.1156.006
15312
13236
16130
Exchange 2013 CU12
15.00.1178.004
15312
13236
16130
Exchange 2013 CU13
15.00.1210.003
15312
13236
16130
Exchange 2013 CU14
15.00.1236.003
15312
13236
16130
Exchange 2013 CU15
15.00.1263.005
15312
13236
16130
Exchange 2013 CU16+.NET4.6.2
15.00.1293.002
15312
13236
16130
Exchange 2013 CU17
15.00.1320.004
15312
13236
16130
Exchange 2013 CU18
15.00.1347.002
15312
13236
16130
Exchange
2013 CU19
15.00.1365.001
15312
13236
16130
Exchange
2013 CU20
15.00.1367.003153121323616130
Exchange
2013 CU21 
+ .NET 4.7.1 + VC++2013
15.00.1395.004 



TechNet documents the expected values for the various Exchange 2013 objects in AD.

Check back here when a new CU is released.

Another top tip from Rhoderick is to install .net 4.6.1 after installing the CU and having the machine rebooted.
At this moment .NET 4.7 is being skipped altogether.

From CU21 .NET 4.7.1 and VC++2013 are required 

After installing CU19 .NET 4.7.1. is supported not required.

How to prepareAD from a member server:
https://technet.microsoft.com/en-us/library/bb125224(v=exchg.150).aspx#Anchor_2