Posts Tagged work
Converting Exchange 2003 conference rooms to Exchange 2010
Posted by evan in Uncategorized on September 1, 2010
I’m wrapping up moving mailboxes to Exchange 2010. The last ones to be moved (except for BlackBerry users… thanks BES) are the conference rooms. So the first step was to move them using the Local Move tool, which was pretty simple. But I don’t want them in 2010 as user mailboxes if they can be designated as “rooms,” which they can. So here’s how I’m doing it:
Identify the mailboxes to be moved
Once you figure out the syntax for the “-Filter” flag to get-mailbox, this is easy
[PS] C:\Windows\system32>get-mailbox -filter { (RecipientTypeDetails -eq "UserMailbox") -and ( DisplayName -like "*conference*") }
Name Alias ServerName ProhibitSendQuota
---- ----- ---------- -----------------
Conference Room2 ConferenceRoom2 exch2010be1 unlimited
Production Conference ... productionconf exch2010be1 unlimited
Conference Room 1 conference1 exch2010be1 unlimited
L&D Conference Room ldconference exch2010be1 unlimited
Tech Conference Room techconference exch2010be1 unlimited
Client Services Confer... csconference exch2010be1 unlimited
Suite 202 Conference Room 202conf exch2010be1 unlimited
Convert them to rooms
As Microsoft says in this story about converting mailboxes to rooms, this can only be done via Exchange Management Shell (not EMC), so just pipe the output from the previous command to Set-Mailbox -Type Room:
[PS] C:\Windows\system32>get-mailbox -filter { (RecipientTypeDetails -eq "UserMailbox") -and ( DisplayName -like "*confe
rence*") } | set-mailbox -type room
[PS] C:\Windows\system32>
Done! Now when you create an appointment in Outlook 2007, in Scheduling Assistant, you can click the “Add Room” button to add a room. Hooray.
ldapsearch on Active Directory
Posted by evan in Uncategorized on August 26, 2010
Just putting this here for safekeeping since I couldn’t remember the exact syntax.
[evan@ehoffman 10:35:50 ~]$ ldapsearch -x -LLL -D "ldapuser@example.com" -w password -b "OU=Users,DC=example,DC=com" -s sub -H ldaps://activedirectory.example.com "(sn=hoffman)" cn mail displayName samaccountname dn: CN=Evan Hoffman,OU=Tech,OU=Users,DC=example,DC=com cn: Evan Hoffman displayName: Evan D. Hoffman sAMAccountName: ehoffman mail: Evan.Hoffman@example.com
Oh, Compellent… again with the disk prices.
Posted by evan in Uncategorized on August 25, 2010
Time to expand the SAN again.
Read the rest of this entry »
Changing Active Directory Password in Browser through OWA 2010
Posted by evan in Uncategorized on August 5, 2010
A few months ago I was on a quest to figure out how to change my Active Directory password via a browser (for Linux/Mac users). I finally figured it out, but since I’ve been working on this Exchange 2010 migration I noticed one of the features of OWA (Outlook Web App) in Exchange 2010 is that you can change the AD password right in the browser from within the app:
The new OWA has a zillion other awesome features, my favorite being that Firefox and Chrome are no longer second-class-citizens and can use the “full version” now, even on Linux. So anyway, I guess all my work was for nothing. Not the first time (or the last).
Amazon EC2 – ext3 mkfs takes 30+ minutes?
Posted by evan in Uncategorized on August 2, 2010
I’ve been playing around with Amazon EC2 for a new project I’m working on and so far I’m really impressed. One thing I’ve noticed, however, is that it takes forever to create an ext3 filesystem on a new volume. For example, the below command took over 30 minutes to create the filesystem on a 300 GB volume:
# mke2fs -j -m0 /dev/sdf1
mke2fs 1.40.4 (31-Dec-2007)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
39321600 inodes, 78642183 blocks
0 blocks (0.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=4294967296
2400 block groups
32768 blocks per group, 32768 fragments per group
16384 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: doneThis filesystem will be automatically checked every 38 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
It took about 30 seconds do do everything up to the writing of the superblocks. Not sure why this takes so long, but it’s happened for every EBS volume I’ve formatted ext3. Annoying. Initially I thought it was hanging, and ended up terminating an instance that wouldn’t shutdown or let me cancel the operation. The terminated instance is still being displayed in the UI with a status of “terminated” and I can’t find any way to remove it from the list.
Outlook 2007 & Exchange 2010 Autodiscover SSL certificate error annoyance
Posted by evan in Uncategorized on July 27, 2010
One of the more annoying side effects of migrating my mailbox to Exchange 2010 has been the nagging of Outlook 2007′s Autodiscovery feature. Now, every time I start Outlook I get hit with a certificate error for autodiscover.domain.com. Now, autodiscover.domain.com is a CNAME to mail.domain.com, which is the OWA URL for the CAS. The SSL certificate is valid – but it’s valid for mail.domain.com. I could buy a SSL certificate from GoDaddy for $12.99 (an insanely great price, btw) for “autodiscover” but that would also require using another IP address on the CAS (since you can can only bind one SSL certificate to an IP:port pair), and that seems like a waste of an IP address.
I found a possible solution in KB 940726. Basically you use this cmdlet to change the Autodiscover URI for internal clients:
Set-ClientAccessServer –AutodiscoverServiceInternalUri https://mail.contoso.com/autodiscover/autodiscover.xml
You’d replace mail.contoso.com with the external URL of your OWA server (in my case, mail.domain.com). I’ve made the changes but I think I need to wait for AD propagation. Hopefully this will resolve it, because I don’t want to move everyone’s mailboxes over until this thing is “perfect,” whatever that means.
Edit: I also needed to add a SRV record so Outlook would know what host to check for autodiscovery when outside the domain.
Edit 2:: Also need to install a hotfix or be running Outlook 2007 SP1 or later for the SRV functionality.
Edit 3: It occurs to me that a simpler fix for this issue may be simply to delete the DNS record for autodiscover entirely. That way, when Outlook attempts to open the SSL connection to autodiscover.domain.com, it gets a NXDOMAIN error (should) silently skip it. Unfortunately we have wildcard DNS active for our domain.
Other useful resources:
- MS Exchange Team blog post comparing the various autodiscover schemes.
- Set-ClientAccessServer.
- Test Exchange Connectivity
- Setting Autodiscover URL via DNS SRV record
- Autodiscover whitepaper.
- Example Autodiscover BIND record – _autodiscover._tcp.domain.com. SRV 0 0 443 webmail.domain.com.
- Debug Autodiscover by right-clicking the Outlook icon in the system tray while holding down Ctrl
- Verifying SRV records exist with nslookup
- What version of Outlook am I running? You need SP1 or later for the SRV hack.
- Hotfix for Outlook 2007 (pre-SP1) to use SRV records for autodiscovery
The Joy of Migrating from Exchange 2003 to 2010
Posted by evan in Uncategorized on July 20, 2010
I’ve been working on migrating from Exchange 2003 to Exchange 2010 for several weeks. Actually, at this point it feels like several months. Now that I think about it, I guess that’s because it’s actually been several months.
Back in January or February, I got fed up with the Exchange setup I inherited: our Exchange 2003 server was running on a server in the basement of our office, on non-UPS power, with a power company that likes to pull shenanigans (like 3-4 hour outages every few months). In addition, the physical machine itself has some weird bug where it would hang at the POST screen complaining about some USB device, even though there are no USB devices plugged in, and USB is disabled in the BIOS. Meanwhile, in the datacenter, I had recently finished migrating most of our ancient physical servers to virtual machines on beautiful new hardware. It didn’t take long to see the solution that seemed to be obvious: move Exchange to the datacenter, in a VM.
There was a major wrinkle in this plan, however: there were no quota limits enforced in Exchange, and the average mailbox was 6-7 gigabytes, with 4 users over 10 gigs. At the time, we only had a 5 mbit upload connection to the datacenter, and the total size of the mailboxes was around 400 gigs. I didn’t want to spend weeks and weeks moving tons of mail over a slow pipe – and with mailboxes being so big, I wasn’t sure I could even complete some of them overnight.
At this point I brought up the idea of migrating the company to Google Apps. I’m a big fan of Gmail and moving off of Exchange would have certainly simplified some aspects of my job, and nobody would need Outlook (especially not me). I knew it would be a tough sell internally, but the pricing certainly didn’t help; it came out to $83/user/year for Google Apps + document retention. The price came out to about the same as upgrading to Exchange 2010. If it had been half or a third the cost I may have pushed harder, but to make the story (a little) shorter, we ended up sticking with Exchange, and instituting quotas.
We phased in the quotas over the course of a month to give users time to archive and clean up their mailboxes. Once that was done, I setup a new Exchange 2003 frontend server (in a VM) in the datacenter and pointed our webmail (OWA & ActiveSync) there. So we had the frontend in the datacenter and the backend “mailbox” server still in the office. I then setup another VM running Exchange 2003 in the datacenter. This enabled me to move mailboxes over one at a time with almost no interruption in service, except for the user whose mail was in transit. Since we instituted quotas, the mailboxes were all under 2 GB, and I was able to do 6-10 mailboxes each night.
I can’t tell you how happy I was when we lost power yet everyone retained full connectivity to email via their phones (except BlackBerry users, since BES was still in the basement — note to RIM: ActiveSync!).
So phase 1 & 2 (instituting quotas and moving email out of the basement) were complete. Phase 3 was the bigger unknown – moving to Exchange 2010. After lots of reading and planning, installing, configuring and testing, about two weeks ago I setup a Client Access Server to serve as the new webmail “frontend.” Microsoft has some pretty great instructions for setting up 2003 and 2010 in coexistence, but basically you point your “real” webmail URL to the 2010 CAS and move your “old” Exchange 2003 webmail to another url (they suggest legacy.company.com). Then people log in to the 2010 interface, and if their mailbox is housed on the 2003 server, it seamlessly redirects them to https://legacy.company.com/, and they don’t have to log in again. Pretty slick, and I didn’t believe it would work until I saw it for myself (which, btw, it does). So ActiveSync and Outlook Anywhere were working through the 2010 CAS even for the users housed on the 2003 server (which was all of them).
This week I started moving users over to Exchange 2010. So far it’s been mostly positive. We have several Mac users, so the ability for them to have native mail & calendaring is pretty epic. The Outlook Web App in Exchange 2010 is phenomenal. I mean, it almost brings a tear to my eye, it’s so beautiful – especially when compared with 2003. And being able to do server-side searching in OWA & on my iPhone is fabulous.
All is not perfect, though. I keep getting stupid certificate errors for Autodiscover when I open Outlook 2007. I guess I’ll need to buy another SSL certificate and dedicate another IP to this service… ugh. And now that I moved my mailbox to Exchange 2010, Outlook Anywhere appears not to work. Oh well, almost there…
When single-sign-on isn’t.
Posted by evan in Uncategorized on July 16, 2010
I’m looking into training courses for Exchange 2010, and to add a course to “My Learning,” which I guess is the equivalent of a shopping cart, I had to sign in with my Live.com ID. I have a Live.com ID because you need one to see your MS licenses and download ISOs, etc. It’s not as seamless as Google’s ID but it seems to work ok most of the time. But here’s an instance where it sucks:
I’m already logged in, why do I need to input all my info again? Including my email address, which was required to login?
Exchange 2010 and Set-ActiveSyncVirtualDirectory Identity
Posted by evan in Uncategorized on July 12, 2010
I don’t really know why I put this blog up, but generally I write stuff here after I muddle through some ridiculous problem that may have ended up being easily resolved, but whose solution was hard to find. That’s definitely the case with this post. Currently I’m in the middle of moving my company’s email from Exchange 2003 to Exchange 2010. Microsoft has provided some pretty good documentation on how to do this, but they do assume a certain level of familiarity with the product. For example, I probably spent 30 minutes trying to run Exchange cmdlets in Powershell before I realized there’s a special shell just for Exchange, the Exchange Management Shell.
Anyway, I’m trying to setup a Client Access Server to replace our Exchange 2003 Outlook Web Access (webmail) system. Again, Microsoft’s walkthrough is pretty good, and everything seemed to be working until I got to section 4c of their instructions:
Exchange ActiveSync: Set-ActiveSyncVirtualDirectory -Identity
\Microsoft-Server-ActiveSync -ExternalURL https://mail.contoso.com
For the other examples they provided, I had been replacing
[PS] C:\Windows\system32>Set-ActiveSyncVirtualDirectory -Identity EXCH2010FE1\Microsoft-Server-ActiveSync -ExternalURL https://webmail.example.com
The operation couldn’t be performed because object
‘EXCH2010FE1\Microsoft-Server-ActiveSync’ couldn’t be found on ‘activedir.example.com’.
+ CategoryInfo : NotSpecified: (0:Int32) [Set-ActiveSyncVirtualDirectory], ManagementObjectNotFoundException
+ FullyQualifiedErrorId : B33731BE,Microsoft.Exchange.Management.SystemConfigurationTasks. SetMobileSyncVirtualDirectory[PS] C:\Windows\system32>
I racked my brain on this for a while. I discovered the Get-ActiveSyncVirtualDirectory command, hoping it would magically solve the problem (telling me what the “Identity” was), but it didn’t – at least not at first:
[PS] C:\Windows\system32>Get-ActiveSyncVirtualDirectory -server exch2010fe1
Name Server InternalUrl
—- —— ———–
Microsoft-Server-ActiveSync (Default… EXCH2010FE1 https://exch2010fe1.example.com/Microsoft-Se…[PS] C:\Windows\system32>
It was showing me the server, but not the Identity, which is what I wanted. Having never used Powershell before, I figured there had to be a way to get that property out of the command, but I had no idea what it was. Some more Googling finally helped me resolve it:
[PS] C:\Windows\system32>Get-ActiveSyncVirtualDirectory -server exch2010fe1 | Select-Object Identity
Identity
——–
EXCH2010FE1\Microsoft-Server-ActiveSync (Default Web Site)[PS] C:\Windows\system32>
Once I supplied “EXCH2010FE1\Microsoft-Server-ActiveSync (Default Web Site)” for the Identity parameter the command completed correctly. I also tried piping the Get-ActiveSyncVirtualDirectory command directly to Set-ActiveSyncVirtualDirectory, like this:
[PS] C:\Windows\system32>Get-ActiveSyncVirtualDirectory -Server exch2010fe1 | Set-ActiveSyncVirtualDirectory -ExternalURL https://webmail.example.com
This appeared to execute successfully, but I don’t know if it actually did what I intended, so I stuck with specifying the identity manually.
The Exchange 2010 CAS is properly redirecting users to legacy.example.com, but ActiveSync isn’t working (I’m testing with my iPhone), so I guess the problem I was having above wasn’t the source of all my ills, sadly. The battle continues…
vCenter: Error parsing the server “(server IP)” “clients.xml” file
Posted by evan in Uncategorized on June 23, 2010
I got the above error today after running Windows Update on my XP VM a few days ago. A quick search showed that the error is caused by a Microsoft update to the .NET framework. To resolve it, remove update KB980773 (Add/Remove programs, make sure “Show Updates” is checked; KB980773 is under “Microsoft .NET Framework 2.0 Service Pack 2″). I removed it and was able to log in without problems.
References:

