I was trying to get Forefront Identity Management to provision a new user and enable Lync for this user through provisioning code.
Turns out this is a not supported feature, and can only be done through codeless provisioning.
A way to to do this is by running a script on the lync server (frontend).
This script searches for all users in a specific OU and checks if the value "enabled" is set to true.
If not (blank) then according to the email address the users gets enabled for lync and set to the correct pool.
The script:
import-module 'C:\Program Files\Common Files\Microsoft Lync Server 2010\Modules\Lync\Lync.psd1'
get-csaduser -filter {Enabled -ne $True} -OU "ou=Employees,dc=domain,dc=lan" | Enable-CsUser -RegistrarPool lyncpool.domain.lan -SipAddressType EmailAddress
Source
30 October 2013
Forefront Protection Server Management Console 2010 403 forbidden
Trouble accessing your newly installed Forefront protection for exchange 2010 management console from a remote machine by browser?
After a new install, forefront doesn't out of the box let you access the Frontpage of the management console.
If you try, you get a 403 Forbidden.
After adding your user account to the local admin group, you are able to access the Frontpage.
After a new install, forefront doesn't out of the box let you access the Frontpage of the management console.
If you try, you get a 403 Forbidden.
After adding your user account to the local admin group, you are able to access the Frontpage.
08 October 2013
How to Install Updates on Exchange Server 2010 Database Availability Groups
This one is a must read for every Exchange admin, thanks to Paul Cunningham who posted this excellent topic on how to and why you should use the DAG maintenance scripts provided by Microsoft.
How to Install Updates on Exchange Server 2010 Database Availability Groups
November 16, 2011 by
An Exchange Server 2010 Database Availability Group (DAG) provides several benefits to an organization, primarily that of continuous availability of mailbox databases.
To update the DAG members with new patches, update rollups or service packs, the update process should be managed to prevent all of the DAG members from being offline at the same time.
To do this you can move the active mailbox databases off a particular server so that it can be patched, and if necessary rebooted, without causing any downtime for mailbox users on that database.
This tutorial demonstrates how to update the servers in an Exchange Server 2010 Database Availability Group without causing downtime. Because this process differs depending on the version of Exchange Server 2010 you’re running I’ve covered each method here.
To see a list of mailbox databases and their current active server use the Get-MailboxDatabase cmdlet.
In this example I want to apply updates to server EX1, and I can see that it currently hosts the active copy of Mailbox Database 02.
If your environment has a lot of DAG members and mailbox databases you can refine this query to only show active mailbox databases for a specific server.
Move the mailbox databases using the Move-ActiveMailboxDatabase cmdlet.
All of the mailbox databases are now active on server EX2.
As another example, if there were multiple databases active on a server you can move all of them with a single command.
Note the use of -Confirm:$false to avoid having to confirm each move. Use this option with caution.
After moving all active mailbox databases off the server that you are planning to update, the final preparation step is to block activation on the server to prevent it from automatically reactiving a database copy while you are performing maintenance.
First check the current activation policy on the server using Get-MailboxServer.
Next run the StartDagServerMaintenance.ps1 PowerShell script.
The script will automatically do the following tasks for you:
For example to disable Forefront use the FSUtility command.
Another example is Data Protection Manager 2010, which may be configured to perform Copy backups from passive database copies at frequent intervals through the day. Make sure these jobs are paused to prevent errors or conflicts from occuring.
This will prevent alarms from being raised as well as prevent any automatic remediation actions from being run by the monitoring agent that may cause the server updates to fail.
Update rollups come in the form of a .MSP file (Windows Installer Patch) that is applied to the server. Simply double-click the file or launch it from a command line window.
Service packs are a complete reissue of the Exchange Server setup files and are installed by running setup in upgrade mode, which can be run in either graphical or command line mode.
Both update rollups and service packs can take some time to install, so plan a large window of time for these updates.
Event Logs – look for error or warning events that have started since the update was applied.
Setup Logs – service packs write a complete setup log file to C:\ExchangeSetupLogs
Services – check the Exchange services are running (or at least those that you expect to be running, some such as IMAP and POP will be stopped if you have not explicitly enabled them)
Re-enable services such as Forefront Protection for Exchange.
Re-enable monitoring agents and alarms for the server.
Set the server’s activation policy back to its original setting.
At this stage you might move all of the active mailbox databases to the server that was just updated so that you can update the other servers in the DAG. After all of the DAG members have been updated it is likely that mailbox databases will be active on servers that are not their first activation preference.
For Exchange Server 2010 RTM you can view the activation preferences for each database, and manually move active mailbox databases to their preferred server.
Next run the StopDagServerMaintenance.ps1 PowerShell script.
The script will automatically reverse each of the actions made by StartDagServerMaintenance.ps1 except that it will not move active mailbox databases back to the server.
To move the active mailbox databases you can continue to go to each mailbox server in the DAG and run StartDagServerMaintenance.ps1 and perform your updates. When all of the servers have been updated you can rebalance the DAG automatically using a script from Microsoft which is demonstrated here.
To update the DAG members with new patches, update rollups or service packs, the update process should be managed to prevent all of the DAG members from being offline at the same time.
To do this you can move the active mailbox databases off a particular server so that it can be patched, and if necessary rebooted, without causing any downtime for mailbox users on that database.
This tutorial demonstrates how to update the servers in an Exchange Server 2010 Database Availability Group without causing downtime. Because this process differs depending on the version of Exchange Server 2010 you’re running I’ve covered each method here.
- Preparing an Exchange Server 2010 RTM DAG member for updates, or
- Preparing an Exchange Server 2010 SP1 DAG member for updates
- Stopping Conflicting Services
- Disabling Server Monitoring
- Updating the Server
- Verifying the Update
- Returning an Exchange Server 2010 RTM DAG member to production, or
- Returning an Exchange Server 2010 SP1 DAG member to production
Preparing an Exchange Server 2010 RTM DAG Member for Updates
The first step is to move active mailbox databases to another DAG member so that the server can be updated.To see a list of mailbox databases and their current active server use the Get-MailboxDatabase cmdlet.
[PS] C:\>Get-MailboxDatabase Name Server Recovery ReplicationType ---- ------ -------- --------------- Mailbox Database 02 EX1 False Remote Mailbox Database 01 EX2 False Remote
In this example I want to apply updates to server EX1, and I can see that it currently hosts the active copy of Mailbox Database 02.
If your environment has a lot of DAG members and mailbox databases you can refine this query to only show active mailbox databases for a specific server.
[PS] C:\>Get-MailboxDatabase | where {$_.Server -eq "EX1"}
Name Server Recovery ReplicationType
---- ------ -------- ---------------
Mailbox Database 02 EX1 False Remote
Move the mailbox databases using the Move-ActiveMailboxDatabase cmdlet.
[PS] C:\>Move-ActiveMailboxDatabase "Mailbox Database 02" -ActivateOnServer EX2
Confirm
Are you sure you want to perform this action?
Moving mailbox database "Mailbox Database 02" from server "ex1.exchangeserverpro.local" to server
"EX2.exchangeserverpro.local".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y
Identity ActiveServerAtS ActiveServerAtE Status NumberOfLogsLost RecoveryPoint MountStatus MountStatus
tart nd Objective AtMoveStart AtMoveEnd
-------- --------------- --------------- ------ ---------------- ------------- ----------- -----------
Mailbox Data... ex1 ex2 Succeeded 0 14/09/2010... Mounted Mounted
All of the mailbox databases are now active on server EX2.
[PS] C:\>Get-MailboxDatabase Name Server Recovery ReplicationType ---- ------ -------- --------------- Mailbox Database 02 EX2 False Remote Mailbox Database 01 EX2 False Remote
As another example, if there were multiple databases active on a server you can move all of them with a single command.
[PS] C:\>Get-MailboxDatabase | where {$_.Server -eq "EX1"} | Move-ActiveMailboxDatabase -ActivateOnServer EX2 -Confirm:$false
Identity ActiveServerAtS ActiveServerAtE Status NumberOfLogsLost RecoveryPoint MountStatus MountStatus
tart nd Objective AtMoveStart AtMoveEnd
-------- --------------- --------------- ------ ---------------- ------------- ----------- -----------
Mailbox Data... ex1 ex2 Succeeded 0 14/09/2010... Mounted Mounted
Mailbox Data... ex1 ex2 Succeeded 0 14/09/2010... Mounted Mountede
Note the use of -Confirm:$false to avoid having to confirm each move. Use this option with caution.
After moving all active mailbox databases off the server that you are planning to update, the final preparation step is to block activation on the server to prevent it from automatically reactiving a database copy while you are performing maintenance.
First check the current activation policy on the server using Get-MailboxServer.
[PS] C:\>Get-MailboxServer EX1 | fl Name,DatabaseCopyAutoActivationPolicy Name : EX1 DatabaseCopyAutoActivationPolicy : UnrestrictedNext, use Set-MailboxServer to block activation.
[PS] C:\>Set-MailboxServer EX1 -DatabaseCopyAutoActivationPolicy Blocked
Preparing an Exchange Server 2010 SP1 DAG Member for Updates
For Exchange 2010 with Service Pack 1 the process is a little easier thanks to some scripts provided by Microsoft. Open the Exchange Management Shell and navigate to the scripts folder on the Exchange server.cd $exscripts
Next run the StartDagServerMaintenance.ps1 PowerShell script.
.\StartDagServerMaintenance.ps1 -serverName ho-ex2010-mb1
The script will automatically do the following tasks for you:
- Calls Suspend-MailboxDatabaseCopy on the database copies.
- Pauses the node in Failover Clustering so that it can not become the Primary Active Manager.
- Suspends database activation on each mailbox database.
- Sets the DatabaseCopyAutoActivationPolicy to Blocked on the server.
- Moves databases and cluster group off of the designated server.
Stopping Conflicting Services
If the mailbox server is running any Exchange-integrated services, such as antivirus software, these should be disabled prior to the update.For example to disable Forefront use the FSUtility command.
C:\> fsutility /disable
Another example is Data Protection Manager 2010, which may be configured to perform Copy backups from passive database copies at frequent intervals through the day. Make sure these jobs are paused to prevent errors or conflicts from occuring.
Disabling Server Monitoring
If the DAG members are monitored using SCOM or a similar system then this should also be disabled or placed into maintenance mode.This will prevent alarms from being raised as well as prevent any automatic remediation actions from being run by the monitoring agent that may cause the server updates to fail.
Updating the Server
Install the update following the deployment notes for that update type.Update rollups come in the form of a .MSP file (Windows Installer Patch) that is applied to the server. Simply double-click the file or launch it from a command line window.
Service packs are a complete reissue of the Exchange Server setup files and are installed by running setup in upgrade mode, which can be run in either graphical or command line mode.
C:\> setup /m:upgrade
Both update rollups and service packs can take some time to install, so plan a large window of time for these updates.
Verifying the Update
After the update has completed, and if necessary the server rebooted, you should check the server’s health before placing it back into production in the CAS array.Event Logs – look for error or warning events that have started since the update was applied.
Setup Logs – service packs write a complete setup log file to C:\ExchangeSetupLogs
Services – check the Exchange services are running (or at least those that you expect to be running, some such as IMAP and POP will be stopped if you have not explicitly enabled them)
[PS] C:\>Get-Service *exchange* Status Name DisplayName ------ ---- ----------- Running MSExchangeADTop... Microsoft Exchange Active Directory... Running MSExchangeIS Microsoft Exchange Information Store Running MSExchangeMailb... Microsoft Exchange Mailbox Assistants Running MSExchangeMailS... Microsoft Exchange Mail Submission Stopped MSExchangeMonit... Microsoft Exchange Monitoring Running MSExchangeRepl Microsoft Exchange Replication Running MSExchangeRPC Microsoft Exchange RPC Client Access Running MSExchangeSA Microsoft Exchange System Attendant Running MSExchangeSearch Microsoft Exchange Search Indexer Running MSExchangeServi... Microsoft Exchange Service Host Running MSExchangeThrot... Microsoft Exchange Throttling Running MSExchangeTrans... Microsoft Exchange Transport Log Se... Running msftesql-Exchange Microsoft Search (Exchange) Running vmickvpexchange Hyper-V Data Exchange Service Stopped wsbexchange Microsoft Exchange Server Extension...
Returning an Exchange Server 2010 RTM DAG Member to Production
If the update was successful and the server healthy then it can be placed back into production.Re-enable services such as Forefront Protection for Exchange.
C:\> fsutility /enable
Re-enable monitoring agents and alarms for the server.
Set the server’s activation policy back to its original setting.
[PS] C:\>Set-MailboxServer EX1 -DatabaseCopyAutoActivationPolicy Unrestricted
At this stage you might move all of the active mailbox databases to the server that was just updated so that you can update the other servers in the DAG. After all of the DAG members have been updated it is likely that mailbox databases will be active on servers that are not their first activation preference.
For Exchange Server 2010 RTM you can view the activation preferences for each database, and manually move active mailbox databases to their preferred server.
[PS] C:\>Get-MailboxDatabase | fl name,activationpreference
Name : Mailbox Database 02
ActivationPreference : {[EX2, 1], [EX1, 2]}
Name : Mailbox Database 01
ActivationPreference : {[EX1, 1], [EX2, 2]}
[PS] C:\>Move-ActiveMailboxDatabase "Mailbox Database 01" -ActivateOnServer EX1
Confirm
Are you sure you want to perform this action?
Moving mailbox database "Mailbox Database 01" from server "EX2.exchangeserverpro.local" to server
"ex1.exchangeserverpro.local".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y
Identity ActiveServerAtS ActiveServerAtE Status NumberOfLogsLost RecoveryPoint MountStatus MountStatus
tart nd Objective AtMoveStart AtMoveEnd
-------- --------------- --------------- ------ ---------------- ------------- ----------- -----------
Mailbox Data... ex2 ex1 Succeeded 0 14/09/2010... Mounted Mounted
Returning an Exchange Server 2010 SP1 DAG Member to Production
Once again Exchange 2010 with Service Pack 1 makes this task easier thanks to a script provided by Microsoft. Open the Exchange Management Shell and navigate to the scripts folder on the Exchange server.cd $exscripts
Next run the StopDagServerMaintenance.ps1 PowerShell script.
.\StopDagServerMaintenance.ps1 -serverName ho-ex2010-mb1
The script will automatically reverse each of the actions made by StartDagServerMaintenance.ps1 except that it will not move active mailbox databases back to the server.
To move the active mailbox databases you can continue to go to each mailbox server in the DAG and run StartDagServerMaintenance.ps1 and perform your updates. When all of the servers have been updated you can rebalance the DAG automatically using a script from Microsoft which is demonstrated here.
07 October 2013
Adding multiple Remote IP Addresses to existing Receive Connectors
I had to add a lot of ip addresses to our receive connector, but not overwrite the existing ip addresses in the receive connector.
For that I came across this excellent Powershell script that does just that:
Source
For that I came across this excellent Powershell script that does just that:
<#
.DESCRIPTION
Simple Powershell script that can bulk import remote IP ranges from a text file in a determined Exchange Receive Connector.
The Import of the Remote IP ranges maintains the original values which are already present on the Selected Connector.
.PARAMETERS
None - execute directly from the Exchange Management Shell
.Version
0.1
.Author
Andy Grogan
http://www.telnetport25.com
.Compatibility
Exchange 2007
Exchange 2010
Exchange 2013
.Release Date
Jan 2013
#>
function Select-FileDialog
{
param([string]$Title,[string]$Directory,[string]$Filter="Text Files (*.txt)|*.txt")
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null
$objForm = New-Object System.Windows.Forms.OpenFileDialog
$objForm.InitialDirectory = $Directory
$objForm.Filter = $Filter
$objForm.Title = $Title
$objForm.ShowHelp = $true
$Show = $objForm.ShowDialog()
if ($Show -eq "OK")
{
return $objForm.FileName
}
else
{
exit
}
}
function get_RecConnector{
$RecConns = Get-ReceiveConnector | Select -ExpandProperty Identity
$Count = 0;
Write-Host "Bulk Import of Remote IP Addresses for Exchange Receive Connectors" -ForegroundColor Green
Write-Host "Version 0.1" -ForegroundColor Green
Write-Host "www.telnetport25.com" -ForegroundColor Green
Write-Host ""
Write-Host "Detected Receive Connectors: " -ForegroundColor Cyan
Write-Host ""
foreach($Connector in $RecConns){
Write-Host $Count "." $Connector -ForegroundColor White
$Count ++
}
Write-Host ""
$Choice = Read-Host "Please select the Receive Connector that you wish to work with."
Write-Host ""
import_RemoteIPRanges $RecConns[$Choice]
}
function import_RemoteIPRanges{
param($ConnectorID)
$FileName = Select-FileDialog "Open IP Range Text File..."
$IPs = Get-Content $FileName
foreach($IP in $IPs){
Write-Host "Adding IP Address :" $IP " to "$ConnectorID -ForegroundColor Cyan
$Rcnn = Get-ReceiveConnector "$ConnectorID"
$Rcnn.RemoteIPRanges += $IP
Set-ReceiveConnector "$ConnectorID" -RemoteIPRanges $Rcnn.RemoteIPRanges
}
}
get_RecConnector
Write-Host ""
Write-Host "Script Completed." -ForegroundColor Yellow
Source
Export Receive connector RemoteIpRanges
Backing up your Receive connector RemoteIpRanges seem like a good idea, to me at least.
We currently have several hundred ip addresses added to our relay connector.
Losing all that work by some(ones) mistake would take a lot of work to recreate.
So here's how to do it:
First set your output higher, otherwise more than 16 ip addresses added to your connector will be truncated in the powershell output.
To unlimit the output for your current Powershell session:
Now we can list all the output to a file:
Source
We currently have several hundred ip addresses added to our relay connector.
Losing all that work by some(ones) mistake would take a lot of work to recreate.
So here's how to do it:
First set your output higher, otherwise more than 16 ip addresses added to your connector will be truncated in the powershell output.
[PS] C:\>Get-ReceiveConnector "Relay Connector" | fl remoteipranges
RemoteIPRanges : {10.0.0.14, 10.0.0.20, 10.0.0.19, 10.0.0.18, 10.0.0.17, 10.0.0
.16, 10.0.0.15, 10.0.0.10, 10.0.0.9, 10.0.0.8, 10.0.0.7, 10.0.
0.6, 10.0.0.5, 10.0.0.4, 10.0.0.13, 10.0.0.12...}
As you can see the ...} at the end of the output means there's more than Powershell shows.To unlimit the output for your current Powershell session:
$FormatEnumerationLimit =-1Now we can list all the output to a file:
[PS] C:\>Get-ReceiveConnector "sr-XXXXX\smtp relay" | fl remoteipranges | out-file "d:\temp\smtp relay sr-XXXX.txt"This file can be edited to your needs.
Source
30 September 2013
WSUS thorough cleanup
1. Open the Windows Update Services MMC |  | |
2. Select the All Updates ViewSet the display to show the Approval status of 'Any except Declined' with a Status of 'Any'. Click Refresh. |  | |
3. Display the Supercedence ColumnRight-click the column headers and select Supercedence. |  | |
4. Sort by SupercedenceLeft-click on the Supercedece Column. | ||
5. Select and Decline the Superceded UpdatesThe updates to be declined have one of two particular flowchart symbols for their updates pictured in the attached image. Select the correct updates and Decline them by either right-clicking the selected updates and clicking decline or by pressing the decline button in the action pane. |  | |
6. Run the Server Cleanup WizardMake sure you have all options selected in the wizard and let it run. It will delete the files from the declined updates. |  | |
7. OPTIONAL: Automatic Approval OptionsIn the automatic approval options, under the advanced tab, there is an option to automatically approve update revisions for previously approved updates and subsequentially decline the now expired updates. I suggest you select them. |  |
25 September 2013
Verifying the file share witness server / directory in use for Exchange 2010
After trying a script that i was building, i received an unexpected error.
WARNING: Database availability group 'CL-XXXX' witness is in a failed state. The database availability group requires
the witness server to maintain quorum. Please use the Set- DatabaseAvailabilityGroup cmdlet to re-create the witness
server and directory.
After some reading i came across this blogarticle.
In short:
To check the witness share(s):
Get-DatabaseAvailabilityGroup -Identity CL-XXXXX -Status | fl name,servers,witnessserver,witnessdirectory,alternatewitnessserver,
alternatewitnessdirectory,operationalservers,primaryactivemanager,
witnessshareinuse
Name : DAG-Clustername
Servers : {SR-XXXX1, SR-XXXX2, SR-XXXX3, SR-XXXX4}
WitnessServer : sr-CasHub1.domain.lan
WitnessDirectory : C:\DAGFileShareWitnesses\DAG-Clustername
AlternateWitnessServer : sr-CasHub2.domain.lan
AlternateWitnessDirectory : C:\DAGFileShareWitnesses\DAG-Clustername
OperationalServers : {SR-XXXX1, SR-XXXX2, SR-XXXX3, SR-XXXX4}
PrimaryActiveManager : SR-XXXX3
WitnessShareInUse : InvalidConfiguration
Check cluster resource using cluster commands
[PS] D:\Scripts>cluster cl-XXXXX.domain.lan res
Listing status for all available resources:
Resource Group Node Status
-------------------- -------------------- --------------- ------
Cluster IP Address Cluster Group SR-XXXX3 Online
Cluster Name Cluster Group SR-XXXX3 Online
File Share Witness (\\sr-XXXX1.domain.lan\CL-XXXXX.domain.lan) Cluster Group SR-XXXX3 Failed
Check cluster using cluster Powershell module
[PS] D:\Scripts>Import-Module FailoverClusters
[PS]:\Scripts>
[PS] D:\Scripts>Get-ClusterQuorum -Cluster cl-XXXXX.domain.lan | fl
Cluster : CL-XXXXX
QuorumResource : File Share Witness (\\sr-XXXX1.domain.lan\CL- XXXXX.domain.lan)
QuorumType : NodeAndFileShareMajority
[PS] D:\Scripts>Get-ClusterResource "File Share Witness (\\sr- XXXX1.domain.lan\CL-XXXXX.domain.lan)" -Cluster cl-XXXXX.domain.lan
| Get-ClusterParameter
Object Name Value Type
------ ---- ----- ----
File Share Witness (\\sr-X... SharePath \\sr- XXXX1.domain.lan\CL-1... String
File Share Witness (\\sr-X... ArbitrationDelay 6 UInt32
To correct the error:
Set-DatabaseAvailabilityGroup -Identity CL-XXXXX -WitnessServer sr- XXXX1 -WitnessDirectory C:\DAGFileShareWitnesses\CL-XXXXX.domain.lan
And for the alternate witness directory:
Set-DatabaseAvailabilityGroup -Identity CL-XXXXX -AlternateWitnessDirectory C:\DAGFileShareWitnesses\CL- XXXXX.domain.lan -AlternateWitnessServer SR-XXXX2
Source
WARNING: Database availability group 'CL-XXXX' witness is in a failed state. The database availability group requires
the witness server to maintain quorum. Please use the Set- DatabaseAvailabilityGroup cmdlet to re-create the witness
server and directory.
After some reading i came across this blogarticle.
In short:
To check the witness share(s):
Get-DatabaseAvailabilityGroup -Identity CL-XXXXX -Status | fl name,servers,witnessserver,witnessdirectory,alternatewitnessserver,
alternatewitnessdirectory,operationalservers,primaryactivemanager,
witnessshareinuse
Name : DAG-Clustername
Servers : {SR-XXXX1, SR-XXXX2, SR-XXXX3, SR-XXXX4}
WitnessServer : sr-CasHub1.domain.lan
WitnessDirectory : C:\DAGFileShareWitnesses\DAG-Clustername
AlternateWitnessServer : sr-CasHub2.domain.lan
AlternateWitnessDirectory : C:\DAGFileShareWitnesses\DAG-Clustername
OperationalServers : {SR-XXXX1, SR-XXXX2, SR-XXXX3, SR-XXXX4}
PrimaryActiveManager : SR-XXXX3
WitnessShareInUse : InvalidConfiguration
Check cluster resource using cluster commands
[PS] D:\Scripts>cluster cl-XXXXX.domain.lan res
Listing status for all available resources:
Resource Group Node Status
-------------------- -------------------- --------------- ------
Cluster IP Address Cluster Group SR-XXXX3 Online
Cluster Name Cluster Group SR-XXXX3 Online
File Share Witness (\\sr-XXXX1.domain.lan\CL-XXXXX.domain.lan) Cluster Group SR-XXXX3 Failed
Check cluster using cluster Powershell module
[PS] D:\Scripts>Import-Module FailoverClusters
[PS]:\Scripts>
[PS] D:\Scripts>Get-ClusterQuorum -Cluster cl-XXXXX.domain.lan | fl
Cluster : CL-XXXXX
QuorumResource : File Share Witness (\\sr-XXXX1.domain.lan\CL- XXXXX.domain.lan)
QuorumType : NodeAndFileShareMajority
[PS] D:\Scripts>Get-ClusterResource "File Share Witness (\\sr- XXXX1.domain.lan\CL-XXXXX.domain.lan)" -Cluster cl-XXXXX.domain.lan
| Get-ClusterParameter
Object Name Value Type
------ ---- ----- ----
File Share Witness (\\sr-X... SharePath \\sr- XXXX1.domain.lan\CL-1... String
File Share Witness (\\sr-X... ArbitrationDelay 6 UInt32
To correct the error:
Set-DatabaseAvailabilityGroup -Identity CL-XXXXX -WitnessServer sr- XXXX1 -WitnessDirectory C:\DAGFileShareWitnesses\CL-XXXXX.domain.lan
And for the alternate witness directory:
Set-DatabaseAvailabilityGroup -Identity CL-XXXXX -AlternateWitnessDirectory C:\DAGFileShareWitnesses\CL- XXXXX.domain.lan -AlternateWitnessServer SR-XXXX2
Source
19 September 2013
Lync and the address book sync errors
"Cannot synchronize with the corporate address book. This may be because the proxy server setting in your web browser does not allow access to the address book"
Look familiar?
A couple of things to check, first on the lync server in Powershell
Update-CsUserDatabase
update-csuseraddressbook
After 5 minutes the update has completed, check the event viewer for event id 21005.
The Lync client will not immediately update the address book, but you can force the update.
First, execute the following command from the Windows Command Prompt run as an administrator (or manually add the GalDownloadInitialDelay registry key). Setting this value to 0 will force Lync to immediately download the address book instead of randomly selecting a time to check the server.
Second, exit the Lync client and manually delete the GalContacts.db and GalContacts.db.idx files from the user’s profile directory. If the .db file still exists during startup of the client then Lync may still wait for that random interval between 0 and 60 minutes before checking for changes on the server’s address book files. By deleting the file the Lync client must download an entire new copy, forcing it to pick up any changes.
Another few things to check:
Use the “Automatically detect settings” instead of specifying settings for a proxy server in IE
For IE7 under Advanced / Security, uncheck the option “Check for server certificate revocation” and restart the browser (manually or via Group Policy)
Ascertain that the URL listed on the certificate points to the Certificate Revocation List (CRL) Distribution Point that is reachable on the inside and/or outside network
If OCS is deployed with digital certificates issued from an internal CA, add the .crl URL to the Trusted sites or Local Intranet zone on the Security tab in IE then exit and restart MOC e.g. http://*.cinline.se This enables the intranet URL for Address Book (AB) download to be recognized as safe and valid.
Deploy certificates from trusted public Certificate Authority (CA) permits both domain and guest (non-domain) accounts to connect to internal OCS pools
Possibly another solution even though it is for OCS 2007:
GAL Status;https://ocspool.work.domain.com/Abs/Int/Handler;Cannot synchronize with the corporate address book. This may be because the proxy server setting in your web browser does not allow access to the address book. If the problem persists, contact your system administrator.; So i try to open the url in IE to see that it is not related to a certificate and it is not because i can not even log in, and after 3 tries I’m off to the 401. So my next attempt is on the front end OCS 2007 R2 server and i try from there as a domain admin, does not work. Well ill just try with https://localhost/abs/int … and guess what that works, so it has to do with Kerberos or something.. Do the following: C:\Windows\System32\inetsrv>setspn -A HTTP/ocspool.work.domain.com RTCCOMPONENTSERVICE Registering ServicePrincipalNames for CN=RTCComponentService,CN=Users,DC=work,DC=domain,DC=com HTTP/ocspool.work.domain.com Updated object
C:\Windows\System32\inetsrv>iisreset
A last thing to check:
SYMPTOMS
Source 1
Source 2
Source 3
Source 4
Look familiar?
A couple of things to check, first on the lync server in Powershell
Update-CsUserDatabase
update-csuseraddressbook
After 5 minutes the update has completed, check the event viewer for event id 21005.
The Lync client will not immediately update the address book, but you can force the update.
reg add HKLM\Software\Policies\Microsoft\Communicator /v GalDownloadInitialDelay /t REG_DWORD /d 0 /f
On Windows XP workstations:Restart the Lync client and search for any of the recently changed information, for example the Telephone Number added to this AD user account now appears for the Lync contact.
%userprofile%\Local Settings\Application Data\Microsoft\Communicator\sip_<username@domain>\
On Windows Vista or Windows 7 workstations:
%userprofile%\AppData\Local\Microsoft\Communicator\sip_<username@domain>\
Another few things to check:
Possibly another solution even though it is for OCS 2007:
GAL Status;https://ocspool.work.domain.com/Abs/Int/Handler;Cannot synchronize with the corporate address book. This may be because the proxy server setting in your web browser does not allow access to the address book. If the problem persists, contact your system administrator.; So i try to open the url in IE to see that it is not related to a certificate and it is not because i can not even log in, and after 3 tries I’m off to the 401. So my next attempt is on the front end OCS 2007 R2 server and i try from there as a domain admin, does not work. Well ill just try with https://localhost/abs/int … and guess what that works, so it has to do with Kerberos or something.. Do the following: C:\Windows\System32\inetsrv>setspn -A HTTP/ocspool.work.domain.com RTCCOMPONENTSERVICE Registering ServicePrincipalNames for CN=RTCComponentService,CN=Users,DC=work,DC=domain,DC=com HTTP/ocspool.work.domain.com Updated object
C:\Windows\System32\inetsrv>iisreset
A last thing to check:
The Lync 2010 client or the Office Communicator client does not download the corporate address book and displays a notification: "Cannot Synchronize Address Book"
Article ID: 939530 - View products that this article applies to.
SYMPTOMS
Consider the following scenarios:
In these scenarios, the corporate address book does not download, and no results are displayed when you search contacts by name.
Also, you receive the following notification in the Lync 2010 client or in the Communicator client:
When you click the notification to display the details, you receive the following error message:
Communicator 2007
Lync 2010 or Communicator 2007 R2
If you run the Validation Wizard on the Communications Server 2007 R2 or Communications Server 2007 front-end server, you receive the following error message in the log:
In the Validation Wizard log, expand Diagnose WebComponents, expand Check Connectivity, and then expand Checking Address Book Serverconfiguration. The URL of the location to download the address book is displayed in the Check Http URL field together with the following error message:
Note: Lync Server 2010 does not have a validation wizard.
- You use the Microsoft Lync 2010 client to log on to the Microsoft Lync Server 2010.
- You use the Microsoft Office Communicator client to log on to the Communications server.
In these scenarios, the corporate address book does not download, and no results are displayed when you search contacts by name.
Also, you receive the following notification in the Lync 2010 client or in the Communicator client:
Cannot Synchronize Address Book
When you click the notification to display the details, you receive the following error message:
Communicator 2007
Cannot synchronize with the corporate address book because the file could not be found. Please contact your system administrator with this information.
Lync 2010 or Communicator 2007 R2
Cannot synchronize with the corporate address book. This may be because the proxy server setting in your web browser does not allow access to the address book. If the problem continues please contact your...
If you run the Validation Wizard on the Communications Server 2007 R2 or Communications Server 2007 front-end server, you receive the following error message in the log:
Failure [0xC3FC200D] One or more errors were detected
In the Validation Wizard log, expand Diagnose WebComponents, expand Check Connectivity, and then expand Checking Address Book Serverconfiguration. The URL of the location to download the address book is displayed in the Check Http URL field together with the following error message:
Internal Error: ConnectFailure
Note: Lync Server 2010 does not have a validation wizard.
This issue occurs if the website that hosts the address book does not have a valid Secure Sockets Layer (SSL) certificate installed.
RESOLUTION
To resolve this issue on a computer that is running Windows Server 2003, make sure that the website that is hosting the address book has a valid SSL certificate installed. To do this, follow these steps:
To resolve this issue on a computer that is running Windows Server 2008, make sure that the website that is hosting the address book has a valid SSL certificate installed. To do this, follow these steps:
- On the computer that is running Internet Information Services (IIS), click Start, click Run, type inetmgr.msc, and then click OK.
- Expand ComputerName (local computer), expand Web Sites, right-click the website that hosts the address book, and then click Properties.
- Click the Directory Security tab.
- In the Secure communications section, determine whether View Certificate is enabled.
Note If View Certificate is enabled, click View Certificate. Then, you can determine whether the certificate is valid.- If the certificate is invalid, follow these steps:
- Click Server Certificate in the WebSiteName Properties dialog box.
- Click Next, and then click Renew the current certificate. Or, click Replace the current certificate.
- Follow the steps to finish the IIS Certificate Wizard.
Note The IIS Certificate Wizard will help you renew your certificate or replace your certificate with a valid certificate.
For more information about how to request a certificate and install the certificate in IIS, click the following article number to view the article in the Microsoft Knowledge Base:
- If View Certificate is disabled, no certificate is installed on this computer. You have to install a certificate to this website. To do this, follow these steps:
- Click Server Certificate in the WebSiteName Properties dialog box.
- Click Next, and then click Create a new certificate.
- Follow the steps to finish the IIS Certificate Wizard.
Note The IIS Certificate Wizard will help you install a certificate to this website.
For more information about how to request a certificate and to install the certificate in IIS, click the following article number to view the article in the Microsoft Knowledge Base:
- If the certificate is invalid, follow these steps:
To resolve this issue on a computer that is running Windows Server 2008, make sure that the website that is hosting the address book has a valid SSL certificate installed. To do this, follow these steps:
- 1. On the computer that is running Internet Information Services (IIS 7.0), click Start, click Run, type inetmgr.msc, and then click OK.
- Expand ComputerName (local computer), expand Web Sites, click the website that hosts the address book, and then click Bindings in the Actions pane.
- Select the HTTPS site binding that includes the port that the Address book Service is listening on, and then click Edit.
- Click View to open the certificate dialog box, and then view the expiration date of the certificate on the General tab.
Note The IIS Server Certificate feature helps you renew your certificate or replace your certificate with a valid certificate.- If the certificate is invalid, follow these steps:
- In the Connections pane, select the name of the IIS 7.0 server that hosts the Address Book service, select the Features view, and then click Server Certificates.
- In the Actions pane, select Open Feature.
- In the Features view, select the certificate that you viewed in step 4, and then use the Actions pane to renew the certificate.
- If the needed certificate is not installed on this computer, use the certificate wizards in the Actions pane to do one of the following: Import, Create a Certificate Request, Complete a Certificate Request, or Create a Domain Certificate.
- For more information about how to renew, create, and complete certificate requests on IIS 7.0, visit the following Microsoft website: http://technet.microsoft.com/en-us/library/cc732230(WS.10).aspx
- If the certificate is invalid, follow these steps:
Source 1
Source 2
Source 3
Source 4
17 September 2013
Custom Role Group for "Send as" and "Full access permissions"
The Role Recipient Management is often given to Helpdesk and Support staff who need to be able to create, modify and disable recipients in Exchange 2010. One permission which this role does not grant and may be needed is the ability to modify the “Send as” attribute on recipients.
The Active Directory Permission Role allows this access and by default is part of the Role Group Organisation Management. This Role Group grants the member complete access to Exchange and it’s likely you don’t want to grant complete access to allow them to modify the “Send as” attribute.
There are 2 ways to create such a group.
Then add the "Active Directory Permission" group
Source
The Active Directory Permission Role allows this access and by default is part of the Role Group Organisation Management. This Role Group grants the member complete access to Exchange and it’s likely you don’t want to grant complete access to allow them to modify the “Send as” attribute.
There are 2 ways to create such a group.
- Through the ECP page in OWA
- In the EMC under "Tools"
Then add the "Active Directory Permission" group
Add the member to this newly created group.
After an hour or so you support staff will be able to grant "Send as" and "Full access" permissions to mailboxes.
12 September 2013
Enable PDF indexing on Exchange 2010 servers.
Download and install
the Adobe PDF iFilter 9 for 64 bit platforms located here:http://www.adobe.com/support/downloads/detail.jsp?ftpID=4025
After installing the Adobe PDF Filter Pack, paste the following text into the Exchange Management Shell window:
After installing the Adobe PDF Filter Pack, paste the following text into the Exchange Management Shell window:
# Adobe iFilter Directory Path
$iFilterDirName = "C:\Program Files\Adobe\Adobe PDF IFilter 9 for 64-bit
platforms\bin"
# Get the original path environment variable
$original = (Get-ItemProperty
"HKLM:SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
Path).Path
# Add the ifilter path
Set-ItemProperty "HKLM:SYSTEM\CurrentControlSet\Control\Session
Manager\Environment" Path -value ( $original + ";" + $iFilterDirName
)
$CLSIDKey =
"HKLM:\SOFTWARE\Microsoft\ExchangeServer\V14\MSSearch\CLSID"
$FiltersKey =
"HKLM:\SOFTWARE\Microsoft\ExchangeServer\v14\MSSearch\Filters"
# Filter DLL Locations
$pdfFilterLocation = “PDFFilter.dll"
# Filter GUIDs
$PDFGuid
="{E8978DA6-047F-4E3D-9C78-CDBE46041603}"
# Create CLSIDs
Write-Host "Creating CLSIDs..."
New-Item -Path $CLSIDKey -Name $PDFGuid -Value $pdfFilterLocation -Type
String
# Set Threading model
Write-Host "Setting threading model..."
New-ItemProperty -Path "$CLSIDKey\$PDFGuid" -Name "ThreadingModel" -Value
"Both" -Type String
# Set Flags
Write-Host "Setting Flags..."
New-ItemProperty -Path "$CLSIDKey\$PDFGuid" -Name "Flags" -Value "1"
-Type Dword
# Create Filter Entries
Write-Host "Creating Filter Entries..."
# These are the entries for commonly exchange
formats
New-Item -Path $FiltersKey -Name ".pdf" -Value $PDFGuid -Type
String
Write-Host -foregroundcolor Green "Registry subkeys created. If this
server holds the Hub Transport Role, the Network Service will need to have read
access to the following registry
keys:`n$CLSIDKey\$PDFGuid`n$FiltersKey\.pdf”
Reboot the Exchange
Server
Rebuild the search indexes using the
Management Shell commands:
Cd ‘C:\Program Files\Microsoft\Exchange
Server\V14\Scripts’
./ResetSearchIndex.ps1 –Force –All
Wait for the indexes to be rebuilt before initiating a search.
Assuming all mailbox databases are empty this should take little time to
complete.
Repeat this process on each Mailbox Server and Hub Transport in the
organization.
Note: The permissions on for NETWORK SERVICE are required on the Hub
Transport role (or multi-roled server that hosts the Hub role) so that transport
rules can do PDF attachment filtering.
Subscribe to:
Posts (Atom)