Exchange Control Panel - not only Control Panel after all

When the user goes to Options/Change password in OWA (Exchange 2010), user gets redirected to https://yourmailserver.yourdomain.com/ecp...  Therefore 'ecp' is not for working as 'control panel' only.  (You have to make sure ecp is available from outside access if you configure OWA access through TMG or another reverse proxy device)

How to get list of mailboxes for enabled users only

Task: Provide the list of mailboxes for only accounts that are enabled (excluding the mailboxes for disabled accounts).  This is frequently required for any type of Exchange mailbox migration projects, when disabled mailboxes will not be migrated.

1. Get the all mailboxes list - including disabled (distinguishedname only): in Exchange Management Console run following command:"Get-Mailbox -resultsize unlimited | select-object distinguishedname | export-csv c:\admin\dn_mailboxes_all.csv -notype"
2. Get the list of distinguishednames of disabled accounts: using Quest ActiveRoles Management Shell: "Search-ADAccount -AccountDisabled | select-object distinguishedname | export-csv c:\admin\disabled-objects.csv -notype"
3. So - now we have 2 spreadsheets, first has all mailboxes, second all disabled objects - use your favorite way to select only items that exist in person first spreadsheet, but not in second.  I use Excel Pivot table: I combine both spreadsheets in one (simple copy/paste will work) and then I insert Pivot Table with 'count' option for that column...  The lines that have count '2' exist in both files, therefore disabled, so I need only lines that have count '1'.
4. Copy the ones that have count "1" (therefore either enabled objects or disabled non-user objects) to txt file (c:\admin\enabledobjects.txt in our case).
5. In Exchange Management Console run following command: "get-content c:\admin\enabledobjects.txt | Get-Mailbox -resultsize unlimited | select-object displayname, Organizationalunit, UserPrincipalname, PrimarySMTPAddress, ServerName | export-csv c:\admin\mailboxes_enabled_users.csv -notype" (note that when you run the script, non-user objects will produce error, that is normal: non-user objects do not have a mailbox, therefore the resulting file will have correct information with only enabled user mailboxes).

I am sure there maybe more elegant ways to do this...

Remove old IIS files with batch file (running on Task Scheduler)

Script below allows you to remove IIS Logs older than MaxDays days.

You can put it in vbs file and create bat file that will call vbs file:

cscript \.vbs

Then, you can schedule execution of that file using Task Scheduler.

Mostly the script is taken from http://gallery.technet.microsoft.com/scriptcenter/ba67b84a-286e-4256-8a6c-d6579dce2045 (replace interactive pieces of the script with providing the local computer as a target for the script).

MaxDays = 10

Set objNetwork = CreateObject("Wscript.Network")

strComputer = objNetwork.ComputerName

wmiQuery = "Select * from Win32_OperatingSystem" 

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") 

Set colItems = objWMIService.ExecQuery(wmiQuery) 

    For Each objItem In colItems 

        sWindowsPath = objItem.WindowsDirectory 

    Next 

Set objW3SVC = GetObject( "IIS://" & strComputer & "/W3SVC") 

    For Each objSite In objW3SVC 

        If objSite.Class = "IIsWebServer" Then 

            strLogDir = UCase(objSite.LogFileDirectory) 

                strLogDir = Replace(strLogDir,"%WINDIR%",sWindowsPath,1,1,1) 

                strLogDir = cscript C:\Scripts\VG\deleteoldiisfiles.vbsReplace(strLogDir,"%SYSTEMROOT%",sWindowsPath,1,1,1) 

                strLogDir = Replace(strLogDir,":","$",1,1,1) 

            objLogFolder = "\\" & strComputer & "\" & strLogDir 

            Set oFSO = CreateObject("Scripting.FileSystemObject") 

            Set oFolder = oFSO.GetFolder(objLogFolder) 

            Set colSubFolders = oFolder.Subfolders 

            For Each oSubFolder In colSubFolders 

                If InStr(UCase(oSubFolder),"W3SVC") Then 

                    For Each oFile In oSubFolder.files 

                        If InStr(LCase(oFile.Name),".log") Then 

                             If (Date - oFile.DateCreated > CInt(MaxDays)) Then 

                                oFSO.DeleteFile(oSubFolder & "\" & oFile.Name) 

                            End If 

                        End If 

                    Next 

                End If 

            Next 

        End If 

    Next 

Starting/stopping maintenance mode in large Exchange 2010 deployment

We noticed that StartDAGServerMaintenance.ps1 -serverName SERVER is not working well for large deployments - causes indexes corruption. 

Before putting server in the maintenance, databases should be moved manually or using your favorite Powershell script) out of the server.

After that SERVER can be put into the maintenance node with no problems.

Enterprise Vault - SQL Query to find number of items awaiting indexing

SELECT Count(*) FROM JournalArchive WHERE IndexCommited = '0'

 

Note: it should be ran on the Vault Database

Configuring POP3s/SMTPs access to Exchange 2010 (part 2 - POP3s)

POP3s:

• Setting up the X.509 certificate name: in EMC – Server Configuration/Client Access; highlight the server, click “POP3 and IMAP4” tab in the lower pane; highlight POP3/right click/Properties; on “Authentication” tab put popserver.yourdomain.com in the “X.509 certificate name” field

• Assigning the certificate to POP3:

Unlike the IIS, SMTP, the POP3 certificate assignment fails when you use the “normal” way (ie. Server Configuration/highlight the server/select the proper certificate in the lower pane/right click/”Assign Services to Certificate”), you have to run following command in the Powershell “Set-PopSettings –X509CertificateName popserver.yourdomain.com” (check PopSettings using the command “Get-Popsettings | fl”)

• Publish POP3 settings to outside:

Follow the article: http://exchangeserverpro.com/exchange-2010-publish-pop3-client-settings/ .   Basically, if you follow the article they have you do following:

•  Run command “Set-PopSettings –ExternalConnectionSettings {popserver.yourdomain.com:995:ssl}

• Check the setting by running “Get-Popsettings | fl”

• Do iisreset

Configuring POP3s/SMTPs access to Exchange 2010 (part 1 - SMTPs)

SMTPs:

• Create ‘Receive Connector’ for this (in EMC: Server Configuration/Hub Transport, highlight the server, ‘New Receive Connector’ from the right pane) – on the production servers naming convention like ‘Fancy Name Connector’

• Following are parameters of the new connector:    

       On General Tab: Specify the FQDN: smtphost.yourdomain.com 
       On Network Tab: Use these local IP addresses to receive mail: 'All Available IPv4'; Port: 465; Receive mail from remote servers that have these IP addresses: all 
       On Authentication: Following to be check marked: 'Transport Layer Security' (TLS), 'Basic Authentication', 'Offer Basic Authentication after starting TLS', 'Integrated Windows authentication
       On Permission Groups: 'Exchange users'

• Allow the group “Authenticated Users” proper permissions (ie. “Accept any Sender”) using ADSIEdit:

  Run ADSIEDIT

Connect to “Configuration”

Navigate to: “CN=Configuration,DC=yourdomain,DC=com/CN=Services/CN=Microsoft Exchange/CN=First Organization/CN=Administrative Groups/CN=Exchange Administrative Group (FYDIB…)/CN=Servers/CN=’ServerName’/CN=Protocols/CN=SMTP Receive Connectors”

             Right click the connector/Properties/Security Tab 
             Set “Accept Any Sender” for “Authenticated Users” 

• Follow the article: http://exchangeserverpro.com/exchange-2010-publish-pop3-client-settings/ .   Basically, if you follow the article they have you do following: Set the attribute “AdvertiseClientSettings” to true (default is “false”):

Run command “Get-ReceiveConnector "hubserver.yourdomain.com\ Fancy Name Connector " | fl” to note the “AdvertiseClientSettings” set to false

Run command: “Set-ReceiveConnector " hubserver.yourdomain.com \ Fancy Name Connector " –AdvertiseClientSettings $true”

Check the setting by running “Get-ReceiveConnector " hubserver.yourdomain.com \ Fancy Name Connector”