MS Ignite 2016

As I'm sure you are all aware MS Ignite this year was held in Atlanta in September for those of us not lucky enough to be there in person Microsoft have kindly put the session online via YouTube so we can view them.  With over 1000 sessions it can be a daunting task trying to figure out which ones to watch and which ones not to.  I've put together a list of six sessions I really enjoyed watching and think would be of benefit to you guys as well.

Session Name	Overview
BRK4010: Learn about Windows 10 Secure Kernel	Another informative session from Sami Laiho.
BRK2215: Debate the top 10 reasons not to move your Exchange on-premises mailboxes to Exchange Online	An informal dicussion with Messaging experts on the age old question, on-premises or cloud for Exchange.
BRK3218: Discover what's new and what's coming for Microsoft Outlook	A good look at what they are doing with end user feedback to develop Outlook into a more efficient product.
BRK2186: Introduce Windows Server 2016 into your environment	This is a good look at the new technologies that Windows Server 2016 has and how it can be used within your environment.
THR2141: Disrupt cyber-threats with revolutionary security in Windows 10	This is a quick overview of the security that is now built within Windows 10 to help mitigate against malware and hacking threats.
BRK4028: Case of the unexplained: Windows Troubleshooting with Mark Russinovich	Mark has had similar sessions at TechEd and Ignite in previous years and they are always very informative. He gives an insight into how the SysInternals tools can help to troubleshoot issues with malware, error messages, blue screens of death, and much more.

There is a nice PowerShell script available that can help you download the videos and slide decks to watch offline and store for future use over at the Technet Gallery:  https://gallery.technet.microsoft.com/Ignite-2016-Slidedeck-and-296df316

.NET Framework 4.6.1 and Exchange Compatibility Issue

The Exchange team at Microsoft have issued a warning to customers saying NOT to install .NET Framework 4.6.1 on Exchange servers.

We wanted to post a quick note to call out that since yesterday, the .NET Framework 4.6.1 has been made a recommended update on WU (Windows Update).
As we have already stated in the Exchange Supportability Matrix, at this time, this version of .NET framework is not supported by Exchange. In fact, we know of some issues if it is installed.

We are working with the .NET team to ensure that Exchange customers have a smooth transition to .NET Framework 4.6.1, but in the meantime, delay this particular .NET update on your Exchange servers (information on how this can be accomplished can be found in the KB article 3133990, How to temporarily block the installation of the .NET Framework 4.6.1).

Be careful when approving any updates within your WSUS server or deployment system ensurig you do not inadvertently approve the update for your Exchange servers.

Retention Policy Powershell Commands

I've recently been working on applying retention policies to mailboxes and we've been doing a granular roll-out to the users.  I've been using some Powershell commands to track who has the policy applied and who hasn't.

The following command will list all users who have a retention policy applied to their mailbox:

Get-Mailbox -filter 'RetentionPolicy -like "*"' | Select-Object Name, RetentionPolicy

You can export that to a CSV if need be by using:

 Get-Mailbox -filter 'RetentionPolicy -like "*"' | Select-Object Name, RetentionPolicy | Export-CSV C:\directory\file.csv

To identify which users don't have a retention policy applied to their mailbox the following command will assist:

Get-Mailbox -filter 'RetentionPolicy -eq $null' | Select-Object Name, RetentionPolicy

Again to export that to CSV you would use:

Get-Mailbox -filter 'RetentionPolicy -eq $null' | Select-Object Name, RetentionPolicy | Export-CSV C:\Directory\file.csv 

Clearing out move requests

When you perform a successful mailbox migration, either from another version of Exchange or from another mailbox database the move request is "left" behind as such and should be cleared out as part of good housekeeping.

My favourite command for doing this is:

Get-MoveRequest -MoveStatus Completed | Remove-MoveRequest

Exchange 2013 Active Directory property ‎homeMDB‎ is not writeable on recipient

When trying to migrate users from Exchange 2007 to Exchange 2013 you may see the following error below:

 Error:MigrationPermanentException: Active Directory property ‎'homeMDB‎' is not writeable on recipient ‎'domain.local/users/employee.smith‎'. --> Active Directory property ‎'homeMDB‎' is not writeable on recipient ‎'domain.local/users/employee.smith‎'.

With many Exchange issues the solution is to set the correct permissions to allow Exchange to migrate the mailbox.

To resolve this issue follow these steps:

1. Launch Active Directory
2. Click on View and select Advanced Features
   
   
   
   
   
3. Now location the users mailbox you are having the issue with and select properties
4. Now click on the security tab
5. Next select Advanced
   
   
        
6. Now place a tick in the "Include inheritable permissions from this objects parents" box and click OK
7. It may take a few minutes for this change to take effect but once it has you should be able to migrate the users mailbox without any problems. 

Unable to sync phone to Exchange

If you've been following my blog for the last few weeks you'll have heard me talk about the Exchange 2013 migration project I've been working on.  Well we hit another snag in the migration the other day around the users mobile phones not syncing to the new mailbox server after moving to Exchange 2013.

At first we thought it was just one or two users but it transpired that over 80 users were affected!! After investigating whether or not ActiveSync was working as expected (it was) we turned our attention to looking at an issue within the users accounts.

It turned out that the 80 users were all a member of a protected group within Active Directory and weren't getting the correct permissions to sync their phones as per Microsoft's best practices.

In order to get to that stage I used some PowerShell queries which I thought were quite interesting so I'm sharing.

I used the following command to query Active Directory for all users that had the "AdminCount" attribute set to something greater than 0.  If set to 1 it indicates the user is either a member of a protected group or has been:

Import-Module ac* 

Get-ADuser -filter {admincount -gt 0} -Properties admincount -ResultSetSize $null | export-csv c:\\onyx\document.csv

To find out which groups within the Active Directory environment I was working in were considered a Protected Group I ran the following query:

Import-Module ac*

Get-ADgroup -LDAPFilter "(admincount=1)" | select name 

From there I was able to check the groups individually to see which ones contained, if any, the users that were having issues with their phones.  All the affected users were a member of the "Print Operators" group. Mystery solved!

A review of the Unified Communications Day conference

Yesterday I attended the first Unified Communications Day at the National Motorcycle Museum in Birmingham, and I must say it was a very worthwhile event to attend.

The event was the brain child of Andrew Price and several of colleagues and it's goal was to bring together like minded people in the hope of networking and sharing knowledge on Unified Communications (Exchange/Office 365/Skype for Business) systems.

The UC Day team had managed to gather some very recognisable and well known names to attend and speak at the event as well as attracting the support of many big name companies to sponsor the event.

Attended the event for me meant a trip down south to Birmingham, but as the event venue (the National Motorcycle Museum) was only a 10 minutes taxi ride from the airport it was very accessible.

On arrival we collected our lanyards and badges and gathered for some pastries and coffee to start the day off, it was a nice way to ease into the day by catching up with old colleagues and friends also attending the event. The keynote speech by Andrew Price and Ian Woolner from the Microsoft Skype team. There was a nice buzz to the opening session of the day, you could tell that everyone was excited about what lay ahead.

Once the keynote was finished we all broke away to our sessions. There were three conference rooms dedicated to sessions throughout the day, one for Skype for Business, one of Office 365 and lastly one for Exchange. I chose to head to Steve Goodman's "Exchange 2016 Hybrid – Getting it right first time" session. Having followed Steve on Twitter and read many of his blog/tutorial posts over the years it was a nice chance to get to meet the man in the flesh and hear what he had to say. His session was very informative and gave a very good overview of what to do and what not to do in regards to a hybrid setup.

My second session of the day was Gary Steere's "Troubleshooting AutoDiscover and Availability in Exchange and Office 365" session. One of the best sessions of the day for me, Gary took the Autodiscover right back the basics and gave us some useful insights and tips on how to troubleshoot and set up Autodiscover within Exchange.

After a well deserved lunch break I chose to attend Justin Harris's "So You Think Your Directory is Ready for Office 365?" session. I came out of the session a little disappointed as I don't think the session went deep enough into the topic for the audience that attended. It was billed as an Intermediate session but I was still left a little wanting from it.

My next session was with Dave Stork on "Tooling Your Exchange", unfortunately the Demo Gods were against Dave during his session but none the less he pointed out some really good tips on troubleshooting Exchange and listed some great resources to use.

The penultimate session of the day for me was Michael Van Horenbeeck's "Exchange Hybrid Inside and Out" session. Michael is an energetic speaker and had the audience really engaged. He was struggling to cram all his content into the 45 minutes he had but he crammed alot into that session. Definately another session for me that was worth travelling for.

Nick Parlow's "Be Smart, Play Dumb; Exchange Design and Operations for Shared Services" session was the last of the day. Again Nick is an engaging speaker and had the audience intrigued with his knowledge and witty banter.

Overall, I feel the event was very worthwhile. I thoroughly enjoyed being able to learn from people who I regularly follow and use as mentors via Twitter and blog posts. It was also nice to get a chance to meet up with old colleagues and discuss issues and woes we have with clients, technology and life itself. The event was extremely well organised and laid out by Andrew and his team, here's hoping they will be able to organise the event again for next year and even more people make take the time to support it. We definitely need more events like this in the UK, there is an active and dedicated community willing to get involved and support events like this without a doubt. It's just a shame that there is a lack of woman within the IT community, would love to see some more females rolling up their sleeves and getting involved in the technical aspect of IT.

My Top Three Sessions

1. Michael Van Horenbeeck's "Exchange Hybrid Inside and Out" session
2. Gary Steere's "Troubleshooting AutoDiscover and Availability in Exchange and Office 365" session
3. Nick Parlow's "Be Smart, Play Dumb; Exchange Design and Operations for Shared Services" session

Unified Communications Day website - http://www.ucday.co.uk/

All ready for the event in my Windows 10 #UpgradeYourWorld t shirt

Share this post on StumbleUpon:

Setup cannot continue with the upgrade because the “beremote()” process has open files.

I was applying a Service Pack to an Exchange server last week and came across this error message when running the setup wizard:

Setup cannot continue with the upgrade because the “beremote()” process has open files:

The server was being backed up with Symantec Backup Exec, this was causing an issue. I stopped the Backup Exec services and was able to continue with the service pack installation.

How to resolve the error ‘550 5.7.1 Unable to Relay’?

I recently came across an issue at work where one of our servers wasn't able to send any email alerts out. On troubleshooting the issue we were receiving a '550 5.7.1 Unable to relay' error message.

Duly checked the receive connectors within the Exchange Management GUI and everything looked okay but still the server wasn't able to relay. On launching the Exchange Management Powershell console we ran the command:

Get-ReceiveConnector "Receive Connector" | Get-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON"

And noticed that instead of there being rights for "ms-Exch-SMTP-Accept-Any-Recipient", there were rights for "ms-Exch-SMTP-Accept-Any-Sender"

We issued the command:

Get-ReceiveConnector "Receive Connector" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Recipient"

And the server was able to relay messages once again. We haven't been able to determine, who or what changed the permissions on the connector but they'd been modified and the above command resolved our issue.

If you are trying to send notifications via your Exchange with an Anonymous connector ensure the following has extended rights:

NT AUTHORITY\Anonymous Logon {ms-Exch-SMTP-Submit}
NT AUTHORITY\Anonymous Logon {ms-Exch-Accept-Headers-Routing}
NT AUTHORITY\Anonymous Logon {ms-Exch-Bypass-Anti-Spam}
NT AUTHORITY\Anonymous Logon {ms-Exch-SMTP-Accept-Any-Recipient}

Powershell Tip: Search for users with an Active Sync device

The script below will search through a mailbox database and list the users that have Active Sync devices attached and list the type of device.

ForEach ($mb in (Get-Mailbox -database DATABASENAME)) { Get-ActiveSyncDeviceStatistics -Mailbox $mb | Select @{Label="Name";Expression={$mb.Name}},DeviceType,DeviceOS,LastSuccessSync}

Replace DATABASENAME with the name of the database you wish to query

This script has been test on Exchange 2010 SP1 and Exchange 2010 SP3.

Exchange 2010 EMC "Kerberos" authentication failed

Came across an issue today where when I launch the Exchange 2010 EMC I was presented with the error message:

"The attempt to connect to http://server.domain.com/PowerShell using "Kerberos" authentication failed: connecting to remote server failed with the following error message : The WinRM client cannot complete the operation within the time specified. Check if the machine name is valid and is reachable over the network and firewall exception for Windows Remote Management service is enabled. For more information, see the about_Remote_Troubleshooting Help topic."

Not an error I had seen before so after searching around the Internet for awhile I came across the correct fix for this issue.

1. First Close EMC

2. Navigate to C:\users\specific user\AppData\Roaming\Microsoft\MMC and delete the Exchange Management Console config file

3. Then within the registry HKCU\Software\Microsoft\Exchangeserver\v14\AdminTools\NodeStructureSettings delete the value NodeStructureSettings

4. Log off and back on

5. The EMC should now launch fine

How many users are stored in an Exchange Database?

In order to find out how many users are stored within an Exchange 2010 Database there is a very useful and simple Powershell Command you can run:

Get-Mailbox | Group-Object -Property:Database | Select-Object name,count