Connect to Exchange Powershell website remotely (Office 365) and Exchange Server 2010, 2013

Start Powershell as a administrator

Run Windows PowerShell and check your Execution policy settings:

Get-ExecutionPolicy

If the execution policy is set to Restricted please change it to RemoteSigned or Unrestricted:

Set-ExecutionPolicy RemoteSigned

Provide the target server administrator credentials:

$LiveCred = Get-Credential

Configure the connection:
In the case of connecting to Exchange Server 2010, 2013:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://<target-server-address>/powershell/ -Credential $LiveCred

In the case of connecting to Exchange Online (Office 365):

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection

Start the connection:

Import-PSSession $Session

To disconnect type in:

Remove-PSSession $Session

The Exchange toolkit

Here's a great blog post from Chad Solarz over at the Technet blog.

Even tho the post itself is last updated may 2013 it is the biggest collection of tools I've seen so far .
View the post here.

Short summary of the tools listed:

VSSTester Script – Exchange 2010
MFCMAPI – Any version
Experfwiz – Exchange 2007 & higher (soon to be 2013 as well)
PAL – Any version
EWS Editor - Exchange 2007 and up
OffCat (now ver 1.2)– outlook 2003 and higher
Network Message Analyzer – Any version
Microsoft Script Center Repository – Any version
Exchange Remote Connectivity Analyzer – All versions
Autodiscover Self Test – Exchange 2007 and up
Exchange Client Network Bandwidth Calculator – Any version
CalCheck tool – Outlook and Exchange 2003 and higer
Datacenter Switchover Troubleshooter – Exchange 2010
Log Parser Studio 2.0 – Any version
Exchange Legacy API Scanner – Exchange 2010
Exchange Pre-Deployment Analyzer
Exchange Deployment Assistant (EXDeploy)
Exchange Mailbox Server Calculator – 2010 / 2013
Exchange Processor Query Tool
Microsoft Connectivity Analyzer Tool – Any version
Exchange Server User Monitor (ExMon) – Exchange 2000 and higher
Exchange Server Profile Analyzer – Exchange 2007
Exchange get file log usage script - Exchange 2007 +
Public Folder Replication Troubleshooter – Exchange 2003
PST Capture tool – Exchange 2010 & 2013
LoadGen – Exchange 2010
JetStress – Exchange 2010 (soon to be 2013 as well)
TCPView – All versions
PortQry UI – All versions
EAS Troubleshooter script - all versions
Report CAL information script - Exchange 2010
Exchange Log Growth Collector Script -  Exchange 2007 & 2010
Process Tracking Log (PTL) tool - Exchange 2007 & 2010
ActiveSync Guided walk-through - non-version specific
Outlook connectivity guided walkthrough - Exchange on-premises
Exchange 2003 Migration Toolkit - Exchange 2003
Office365 Mailbox Migration perf analysis - Hybrid / migration to the cloud
ActiveSync log analysis - All versions of Exchange
Exchange DB growth script - Exchange 2010 & 2013
Office 365 Mailbox / Folder sharing scenarios - Office 365 AND Exchange on-prem
Exchange Online migration guided walkthrough - Any on-prem to Office 365
Exchange Client Performance Analyzer
IMAP Migration walkthrough troubleshooter

Outlook switches

Never knew this:

How to use Outlook's Command line switches

When you're having problems with Outlook you may be told to start Outlook using a specific command line switch.

To do this:

Close Outlook.

At the Start menu, Run command (or open the Run command by pressing Windows Key 

() + R type:

Outlook /switch

Then click OK to start Outlook. (There is a space between outlook and /.)

This screenshot shows how you enter it, using the /cleanreminders switch as an example.

Occasionally you'll need to use the full path to Outlook, then the command line looks like this:

"C:\Program Files\Microsoft Office\Office11\Outlook.exe" /switch

 Notes:

Before using a command line switch, you need to close Outlook and verify it's closed in Task Manager's Processes tab.

Paths that include spaces between words must be enclosed in quotation marks (") and are case sensitive.

If you use Vista or Windows 7, you can type the command line in the Start Search field on the Start menu.

You'll need the full path if you  want to create desktop shortcuts using a switch, such as to open Outlook to a specific folder:

"C:\Program Files\Microsoft Office\Office11\Outlook.exe" /select outlook:calendar

All Switches

/a

Creates an item with the specified file as an attachment.

Usage:

Outlook /a "C:\My Documents\labels.doc"

 If no item type is specified, IPM.Note form is assumed. This switch cannot be used with message classes that aren't based on Outlook.

/altvba otmfilename

Opens the VBA program specified in otmfilename, rather than %appdata%\Microsoft\Outlook\VbaProject.OTM. Use this switch when you need to run macros not in your VBAProject file.

/autorun macroname

Opens Outlook and immediately runs the macro specified in macroname.

/c messageclass

Creates a new item of the specified message class, works for any valid MAPI form.

Examples:

• /c ipm.activity creates a Journal entry
• /c ipm.appointment creates an appointment
• /c ipm.contact creates a contact
• /c ipm.note creates an e-mail message
• /c ipm.stickynote creates a note
• /c ipm.task creates a task

/checkclient

Prompts for the default manager of e-mail, news, and contacts.

/cleanclientrules

Starts Outlook and deletes client-based rules. Used by non-Exchange account users.

/cleandmrecords

Deletes the logging records saved when a manager or a delegate declines a meeting. Used by Exchange Server accounts.

/cleanfinders

Removes Search Folders from the Microsoft Exchange server store.

/cleanfreebusy

Clears and regenerates free/busy information. This switch can only be used when you are able to connect to your Microsoft Exchange server.

/cleanprofile

Removes invalid profile keys and recreates default registry keys where applicable.

/cleanpst

Launches Outlook with a clean Personal Folders file (.pst)

/cleanreminders

Clears and regenerates reminders.

/cleanrules

Starts Outlook and deletes client- and server-based rules.

/cleanschedplus

Deletes all Schedule+ data (free/busy, permissions, and .cal file) from the server and enables the free/busy information from the Outlook Calendar to be used and viewed by all Schedule+ 1.0 users.

/cleanserverrules

Starts Outlook and deletes server-based rules. Used only with Exchange server accounts.

/cleansniff

Overrides the programmatic lockout that determines which of your computers (when running Outlook simultaneously) processes meeting items. The lockout process helps prevent duplicate reminder messages. This switch clears the lockout on the computer it is used, enabling Outlook to process meeting items.

/cleansubscriptions

Deletes the subscription messages and properties for subscription features. Used with SharePoint alerts.

/cleanviews

Restores default views. Use with care as all custom views you created are lost.

/designer

Starts Outlook without figuring out if Outlook should be the default client in the first run.

/embedding

Opens the specified message file (.msg) as an OLE embedding. Also used without command-line parameters for standard OLE co-create.

/explorer

Opens the new window in "explorer" mode (link bar on).

/f msgfilename

Opens the specified message file (.msg) or Microsoft Office saved search (.oss).

/firstrun

Starts Outlook as if it were run for the first time.

/folder

Opens a new window in "folder" mode (Navigation Pane off).

/hol holfilename

Opens the specified .hol file.

/ical icsfilename

Opens the specified .ics file.

/importprf prffilename

Launches Outlook and opens/imports the defined MAPI profile (*.prf). If Outlook is already open, queues the profile to be imported on the next clean launch.

/l olkfilename

Opens the specified .olk file.

/launchtraininghelp assetid

Opens a Help window with the Help topic specified in assetid.

/m emailname

Provides a way for the user to add an e-mail name to the item. Use either the full address or let alias resolve. Only works in conjunction with the /c command-line parameter.

Usage:

Outlook.exe /c ipm.note /m test@poremsky.com

Outlook.exe /c ipm.note /m dianep

/nocustomize

Starts Outlook without loading outcmd.dat (customized toolbars). With older versions of Outlook the *.fav file doesn't load.

/noextensions

Starts Outlook with extensions turned off, but listed in the Add-In Manager.

/nopollmail

Starts Outlook without checking mail at startup.

/nopreview

Starts Outlook with the Reading Pane off and removes the option from the View menu.

/p msgfilename

Prints the specified message (.msg). Does not work with HTML.

/profile profilename

Loads the specified profile. If your profile name contains a space, enclose the profile name in quotation marks.

/profiles

Opens the Choose Profile dialog box regardless of the Options setting on the Tools menu.

/recycle

Starts Outlook using an existing Outlook window, if one exists. Can be used in combination with /explorer or /folder. The Outlook shortcut in the Quick Launch bar uses the /recycle switch.

/resetfoldernames

Resets default folder names (such as Inbox or Sent Items) to default names in the current Office user interface language. For example, if you first connect to your mailbox Outlook using a Russian user interface, the Russian default folder names cannot be renamed. To change the default folder names to another language such as Japanese or English, you can use this switch to reset the default folder names after changing the user interface language or installing a different language version of Outlook.

/resetfolders

Restores missing folders for the default delivery location.

/resetnavpane

Clears and regenerates the Navigation Pane for the current profile. Removes all Shortcuts and FavoriteFolders. Has the same effect as deleting profilename.xml in your user directory.

/rpcdiag

Opens Outlook and displays the remote procedure call (RPC) connection status dialog.

/s filename

Loads the specified shortcuts file (.fav). Use to load *.fav files created in older versions of Outlook.

/safeStarts Outlook without extensions, Reading Pane, or toolbar customization.

/safe:1

Starts Outlook with the Reading Pane off. New to Outlook 2003.

/safe:2

Starts Outlook without checking mail at startup. New to Outlook 2003.

/safe:3

Starts Outlook with extensions turned off, but listed in the Add-In Manager. Outlook 2003 only.

/safe:4

Starts Outlook without loading Outcmd.dat (customized toolbars) and *.fav file. Outlook 2003 only.

/select foldername

Starts Outlook and opens the specified folder in a new window.

Usage:

"C:\Program Files\Microsoft Office\Office11\Outlook.exe" /select outlook:calendar

outlook /select "outlook:Inbox\Old Messages"

/sniff

Starts Outlook and forces a detection of new meeting requests in the Inbox, and then adds them to the calendar.

/t oftfilename

Opens the specified .oft file.

/v vcffilename

Opens the specified .vcf file.

/vcal vcsfilename

Opens the specified .vcs file.

/x xnkfilename

Opens the specified .xnk file.

Source

Get eventviewer events from multiple servers and email combined errors and warnings per server report

****UPDATED****

Check http://vanbrenk.blogspot.nl/2015/10/get-winevent-from-multiple-servers.html

for the new and improved version.

It's a bit of a mouth full, the title that is, but the script does even more.

Specify which servers you want to monitor the error and warnings events from, then write a HTML file to a specified (shared) location per server and per type of log (system log or Application log).
You can even specify how far back in time you want to see the errors and warnings, 1 day, 2 or even 7 days.

Combine those files in to a single HTML file and send that one by email.

That way you get one email that has all info you want to see every morning.

The script:

#SMTP options for sending the report email            
$smtpServer = "smtp.domain.lan"            
$smtpFrom = "Eventlogs@domain.com"            
$smtpTo = "username@domain.com"            
$messageSubject = "Latest Eventlog events"            
            
$logPath = "C:\Temp\Eventlogs\"            
$logsys = "system"            
$logapp = "application"            
            
#Specify the servers you want to report on            
$servers = "sr-xxxxx","sr-yyyyy","sr-zzzzz"            
            
$style = ""            
            
# End HTML Output file style            
            
$date = get-date -format dd-MM-yyyy            
$now = get-date            
#Specify the number of days you want to be reported on            
$subtractDays = New-Object System.TimeSpan 1,0,0,0,0            
$then = $Now.Subtract($subtractDays)            
            
# Get the servers from the list and perform the following            
Foreach ($server in $servers)            
                {            
    $systemErrors = Get-EventLog -Computername $server -LogName $logsys -After $then -Before $now -EntryType "Error","Warning" | select EventID,MachineName,Message,Source,TimeGenerated,Entrytype            
                    
    $systemErrors | ConvertTo-HTML -head $style -body "<H2>System log Report From Server $server</H2>" | Out-File "$logPath\$server-$logsys-$date.html"            
            
    $applicationErrors = Get-EventLog -Computername $server -LogName $logapp -After $then -Before $now -EntryType "Error","Warning" | select EventID,MachineName,Message,Source,TimeGenerated,Entrytype            
                
    $applicationErrors | ConvertTo-HTML -head $style -body "<H2>Application log Report From Server $server</H2>" | Out-File "$logPath\$server-$logapp-$date.html"            
    }            
#Combine all the html files in to one file               
Remove-Item C:\Temp\Eventlogs\combined.html            
Get-Content -path c:\temp\eventlogs\*.html | Add-Content -Path C:\temp\Eventlogs\combined.html            
            
#Construct email message            
send-mailmessage -to $smtpto -from $smtpfrom -smtpserver $smtpserver -subject $messagesubject -body (Get-Content $logpath\combined.html | Out-String) -bodyashtml            
# Remove all html files to prevent filling the disk            
Remove-Item $logpath\*.html

Mail tips cannot be displayed

When typing a mail message to a colleague i received the following error:

Before you start looking at your Exchange configuration and mess up everything that's working, run this: Outlook.exe /cleanmailtipcache

You don't see anything happening, but underwater your mail tips cache is being cleared.

After starting Outlook again and composing a new mail message you could get your mail tips back.

If it still doesn't work for you, check out the following:

1. Are your autodiscover url's correctly configured and working

Here is a quick way to test the autodiscover configuration:

Go to your computer start bar, right side where Date and time is showing, you will find the Outlook icon, hold Ctrl + right click on the outlook icon and click “Test Email Auto Configuration…”

After this choose the settings as shown below:

Run the test.

The output of a working Autodiscover is displayed below, compare with your results.

1. The type of mail tip that'not working for you.
2. Check the organisation config in Exchange
3.  Check the group metrics based mail tips

Source 1

Source 2

Renew Exchange 2010 certificate with internal CA and SSL offloading

Every half year this returns, and almost every time i do this something happens that i forgot from the previous one. So note to myself:

In the Exchange management console go to server configuration and select the server you wish to renew the certificate for:

These are just the basic steps, below i will continue with the strange part.

After importing the certificate and assigning the appropriate services to it something funny happens.

I think it's some kind of intelligence from Exchange it self, but after importing and assigning the services the settings in IIS are changed on the default website. The SSL setting "Require SSL" is turned on, even when it was off before.(This only applies when you have SSL offloading on your loadbalancer configured)

In my experience it's a good idea to make an excel with all off your current IIS settings.

In case something fails you will know how things where configured.

PowerShell 5.0 and the OneGet commandlets

Great new feature coming up in WMF 5.0: OneGet.
Most people are familiar with the package managers within the different Linux tastes.

Well OneGet is just like that but then for Windows.
Command line based software installation and un-installation.
It works with the Chocolatey as the software repository which currently holds up 2561 applications.

There are 2 more repository's, PSGallery and MSPSGallery but they hold none to little applications.

First let's see what we can do with OneGet:

Get-Command -Module OneGet | Select Name

Name
----
Find-Package
Get-Package
Get-PackageProvider
Get-PackageSource
Install-Package
Register-PackageSource
Save-Package
Set-PackageSource
Uninstall-Package
Unregister-PackageSource

If you want to start using OneGet, you first have to install "nuget":

Find-Package

The provider 'nuget v2.8.3.6' is not installed.
'nuget' may be manually downloaded from
'https://oneget.org/nuget-anycpu-2.8.3.6.exe' and copied to 'C:\Program
Files\OneGet\ProviderAssemblies'.
Would you like OneGet to automatically download and install 'nuget' now?
[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"):

To view the installed repositories:

Get-PackageSource

To view the total number of packages in the repository:

Find-Package | Measure-Object

To show all the packages in the repository:

Find-Package | Sort-Object –Property Name | Out-GridView

Install a package:

install-package -Name imgburn

To uninstall a package:

uninstall-package -Name imgburn

Set the repository as trusted:

set-packagesource -name chocolatey -trusted

To unregister the Chocolatey repository:

Unregister-PackageSource –name Chocolatey

Source

Schedule a PowerShell script with task scheduler

For all your status emails that you want to run every day the task scheduler is your friend, well sort of.
Sometimes i just can't understand why it throws errors at me.
I found a nice article about this over at Dmitry's blog.

1. Get your script ready
Surprising as it might sound, your script might actually not be ready to run in a scheduled task as is. This happens if it uses cmdlets from a particular PowerShell module or snapin, and it worked for you interactively because you used a specialized shell (e.g. Exchange Management Shell) or a tool like PowerGUI Script Editor which loads the modules for you.
If you indeed are using using any non-default cmdlets, simply add Add-PSSnapin or Import-Module to the beginning of the script. For example:

Add-PSSnapin Quest.ActiveRoles.ADManagement

2. Schedule the task

To schedule a task simply start Windows Task Scheduler and schedulepowershell.exe executable passing the script execution command as a parameter. The -File parameter is the default one so simply specifying the script path as the argument would work in a lot of cases:

You can find powershell.exe in your system32\WindowsPowerShell\v1.0 folder.

4. Report task success or failure

If you want your script to report success or failure (or some sort of other numerical result) simply use the exit keyword in the script to pass the value, e.g.:

exit 4

Then your Windows Task Scheduler will show the value in the Last Run Result (you might need to hit F5 to refresh the column in the task scheduler):

3. Passing parameters

If you need to pass parameters things get a little trickier. Say, you have a script which adds two numbers:

param($a=2, $b=2)
"Advanced calculations ahead"
exit $a + $b

To pass the numbers as parameters, you would want to use powershell.exe -Command instead of powershell.exe -File. This -Command argument will then have the script invocation operator &, path to the script, and the parameters. E.g.:

Program:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add argument (optional): -Command "& c:\scripts\hello.ps1 -a 2 -b 3"

If you want to also get your exit code from the script, you would need to re-transmit that by adding exit $LASTEXITCODE to the command (I learnt this tip from MoW). E.g.

Program:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add argument (optional): -Command "& c:\scripts\hello.ps1 -a 2 -b 3; exit $LASTEXITCODE"

5. Run x86 PowerShell on x64 Windows

On 64-bit versions of Windows you actually have both 64-bit and 32-bit versions of PowerShell. In most cases you don’t care but in some cases (e.g. specific COM objects being used) you might need specifically a 32-bit version. To get that to run, simply pick the proper executable when you schedule the task:

Regular PowerShell (64-bit version on 64-bit Windows):%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe

32-bit PowerShell (x86):%SystemRoot%\syswow64\WindowsPowerShell\v1.0\powershell.exe

6. Other options

To learn about all parameters PowerShell executable has simply run it with /? option (from either cmd.exe or a PowerShell session).

I normally use -noprofile to make sure that nothing in the PowerShell profile interferes with the task.

Also, if your Execution Policy does not allow running scripts the -ExecutionPolicy parameter comes handy allowing you to make an exception just for this task. E.g.:

c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -File c:\scripts\hello.ps1 -ExecutionPolicy RemoteSigned

Here are some other parameters provided by PowerShell:

-PSConsoleFile
    Loads the specified Windows PowerShell console file. To create a console
    file, use Export-Console in Windows PowerShell.

I guess you could use that is you want the exact environment you have in the predefined shell from Exchange, AD, or SQL. E.g.: PowerShell -PSConsoleFile SqlSnapIn.Psc1

-Version
    Starts the specified version of Windows PowerShell.

I don’t think this one actually works.

-NoLogo
Hides the copyright banner at startup.

Not really relevant for scheduled tasks, imho…

-NoExit
    Does not exit after running startup commands.

Might be useful for troubleshooting.

-Sta
    Start the shell using a single-threaded apartment.

If your script needs STA mode (if you don’t know what this is – most likely you don’t need this. ;))

-NonInteractive
    Does not present an interactive prompt to the user.

Not really relevant for scheduled tasks, imho…

-InputFormat
    Describes the format of data sent to Windows PowerShell. Valid values are
    "Text" (text strings) or "XML" (serialized CLIXML format).

-OutputFormat
    Determines how output from Windows PowerShell is formatted. Valid values
    are "Text" (text strings) or "XML" (serialized CLIXML format).

Not sure how I would use those… Here’s one example of how -InputFormat none can help fix issues with PowerShell becoming unresponsive when waiting for input.

-WindowStyle
    Sets the window style to Normal, Minimized, Maximized or Hidden.

Unfortunately, I could not make this work. I tried to use -WindowStyle Hiddento avoid the PowerShell console window popping up during task execution but with no luck.

-EncodedCommand
    Accepts a base-64-encoded string version of a command. Use this parameter
    to submit commands to Windows PowerShell that require complex quotation
    marks or curly braces.

    # To use the -EncodedCommand parameter:
    $command = 'dir "c:\program files" '
    $bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
    $encodedCommand = [Convert]::ToBase64String($bytes)
    powershell.exe -encodedCommand $encodedCommand

Can be useful when having to pass advanced expressions and getting issues with parser.

Check WAN IP address at icanhazip.com and mail the results

Since my ISP had planned maintenance last week, i couldn't access my boxes at home from the internet. My WAN IP address had changed. This happens once a year maybe but it's annoying enough to make something for it.

I found a great script from Leon van Efferen, but it didn't do exactly what i needed so i modified it a bit.

First off the check against whatismyip.com didn't work anymore, so i modified that to check against icanhazip.com.

Which by the way you can also do from Powershell directly:

(Invoke-WebRequest icanhazip.com).Content.Trim()

Then i wanted to receive an email everyday just to know it's still working and to be able to check my IP address always, not only if it changes.

This is what i came up with:

###########################################################################
#
# NAME:  CheckWANIP 
#
# COMMENT: Check the WAN IP Address based on ifconfig.me Automation page
#   and e-mail a message .
#
###########################################################################

#Set Target Domain
$TargetDomain = "domain.com" #Enter your FQDN that is linked to your WAN ip address

Function SendMail {
$EmailFrom = "IPCheck@domain.com" #Enter the e-mail address it should send the message from.
$EmailTo = "user@domain.com" #Enter the e-mail address it should send the message to.
$Subject = "External IP Address at icanhazip.com is $current_WAN_IP" #Enter your subject the e-mail message should contain.
$Body = "Compare the IP addresses from domain.com $DNS_WAN_IP and DNS records from ifconfig.me $Current_WAN_IP"  #Enter the message that the e-mail should contain.
$SMTPServer = "smtp.gmail.com" #Enter the FQDN of your SMTP server eg. smtp.gmail.com
$SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 25) #Enter your SMTP Port eg. 587
$SMTPClient.EnableSsl = $false # Change to $false if you don't want to use SSL
$SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)
}

# Do not change anything below this line.
$DNS_WAN_IP = [System.Net.Dns]::GetHostAddresses("$TargetDomain") | select-object IPAddressToString -expandproperty  IPAddressToString
Write-host "Resolved IP Address of $TargetDomain = $DNS_WAN_IP" 
$Current_WAN_IP = (Invoke-WebRequest icanhazip.com).Content.Trim()
Write-host "Current WAN IP Address = $Current_WAN_IP"
SendMail
Write-host "Sending email"
exit

Then you can schedule it as a daily task:
Powershell.exe "& 'C:\path to script\CheckWANIP.ps1'"

How to Publish New Certificate Revocation List (CRL) from Offline Root CA to Inetpub

Its highly recommended when building your Microsoft PKI (Public Key Infrastructure) to have your Root CA offline after issuing the Enterprise Sub CA certificates. Its recommended to minimize the access to the Offline Root CA as possible. The Root CA is not a domain joined machine and can be turned off without any problem.

One of the Key issue is the CRL generated from the Root CA, you need to set the CRL interval for a large value so that we don’t need to copy the CRL to an online location frequently and do not implement delta CRLs, because the publication of each delta CRL would require access to the offline root CA in order to copy the delta CRL to an online publication location. In order to change the CRL interval you need to:

1. Turn on the Offline Root CA and login with Admin account
2. Open the Certification Authority Console
3. Right Click on the "Revoked Certificates" and click Properties.
4. Set “CRL Publish interval” to a large value (Default is 26 Weeks) and  uncheck “Publish Delta CRL” check-box.

In order to Publish a new CRL from the offline Root CA to the Enterprise Sub CA you need to do the following:

1. Publish a new CRL on the Root CA, this can be done by Right Click the "Revoked Certificates" - All Tasks - Publish                                                                                                                                                                                                                                                          
   
                                                                                                                                                                    
2. Copy the CRL file from the Root CA located under %systemroot%\system32\certsrv\certenroll to the Sub CA Server
3. Turn off the Root CA
4. Copy the above file to the InetPub folder (HTTP Path) in the Sub CA server which is by default located under the C:\inetpub\wwwroot\Certdata
5. 
   

This process of renewing the CRL and publishing a new one is manually done since the Root CA is offline and thats why its better to make the CRL publish interval more than the default value so you won't do it frequently. You may also want to set an automated reminder before the next renewal date.

Source