Exchange 2003 ActiveSync

Creating a blog that acts as a reference to previous work is clearly not my forte.

We had an Exchange failure over the weekend. It wasn't actually an Exchange failure but a VMware ESXi 4.0 datastore that got out of control. The lesson learned was don't take snapshots unless you really have to and make sure you delete them as soon as possible. I already knew this but somebody, three years ago, took a snapshot called "test" and there it remained, undetected, consuming more and more of the disk until it was impossible to delete. It is impossible to delete because it needs to consolidate disks which are now too unwieldy to be merged on the remaining datastore. It is particularly difficult if you are using local storage and there's nowhere to go or grow.

So after a restore from tape everything was working again. Except ActiveSync.

So the environment consists of one front-end server and two back-end servers. In this scenario I am under the impression that as long as port 443 is open on your firewall the FE will catch all requests and pass them on to the BE servers. The default website config that the Exchange 2003 installation puts in place should just work. That is all the virtual directories (ExAdmin, Exchange, ExchWeb, Exchange-Server-ActiveSync, OMA and Public) will be set up with the correct security and functionality. The certificate should reside on the FE server which should also stipulate SSL.

In a scenario with no FE server AND SSL or forms-based authentication is enabled then you need to create a duplicate of the Exchange VD, assign it name (Microsoft seems to like "Exchange-OMA" but "Whatever-the-fuck-you-want" is ok too) and then point to it in a registry entry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MasSync\Parameters\ExchangeVDir

This should be case-sensitive and contain a string such as "/exchange-oma" or "/Whatever-the-fuck-you-want".

But you don't need this registry entry if you have a FE server. Of course in the upside-down environment I was working in all servers have this entry, even the FE server. So in order to get AS working I did the same on the restored server and it started working again. God knows why, but no doubt I will be returning to this at some point.

 A side note to this is about resetting the VDs should they stop working. Here are the steps:

1. In IIS delete all the VDs - the ones named above. You can take a backup of the website first but I'm not sure how useful this is.
2. Go to c:\inetpub\adminscripts in a cmd and type "adsutil delete ds2mb".
3. Restart the System Attendant and see the VDs recreated.

Add a route to a Cisco Switch

I tried this on two switches (one being a 3750 and the other being an old 10/100) and it only worked on the 3750.

So type en and enter and then the password.

Then

conf t

then

ip route 172.16.19.80 255.255.255.248 10.10.1.253

where the first address is the destination and the second the route.

You can see all the routes by typing show ip route.

LB 2003 to 2010 Exchange Migration p4

I went in to remove the Exchange 2003 server from the LB office and have the following observations.

The public folders went fairly smoothly, in that the "MoveAllReplicas" script seemed to do its job and clear the old server of all its replicas.

A new internet connector needed to be created for internet-bound email because ownership can't be given to the new server (due to it being in a different routing group).

The RUS service needs to be handed to the new server, which I didn't mention in past posts.

So after removing one system e-mail account (something to do with Free / Busy, but not sure what since this functionality should be derived from public folders...) the 2003 uninstall was ready to proceed. And so it did, but it also failed quite spectacularly and so, outlined below, is a guide on how to manually remove an orphaned Exchange 2003 server from AD:

1. Go into ADSIedit and delete the server object.

You should be able to run the BPA with no errors, and if you do have errors then they can probably be fixed by copying and pasting the DN from one field, in AD, to another. Not graceful, but there you go.

Cisco + NetApp + VMware p1

I have a free NetApp FAS2050, a very old Cisco 2950 100mb switch and a HP DL380 server. Can I make them work together?

My objective is to run ESXi 5.1 on the HP server with two guests (an Exchange 2010 server and a domain controller). The server only has 2 NICs unfortunately: one of them will be used for iSCSI and the other management. The NetApp must be configured in one big RAID 10 volume. They must communicate through the 2950.


The Cisco 2950

Log in as a super user:

en ↵
[password] ↵

The "show" command followed by "?" will display all the informational commands. To start off, good informational commands:

show running-config ↵
show interface status ↵ 

The switch that I picked up has most of its ports set to VLan 100, but I want VLan 302 because that is what the NetApp is set to. To create a VLan:

conf t ↵
vlan 302 ↵
name iSCSi ↵
Ctrl Z

Now to assign a port (or two) to the previously created VLan:

conf t ↵
int fa0/1 ↵
switchport mode access ↵
switchport access vlan 302 ↵
Ctrl Z

If you wanted to make that port a trunk you would have entered:

switchport mode trunk ↵

A trunk can accept multiple VLan traffic:

switchport trunk allowed vlan 100,302,303
 
I cheated a bit in the end. I had the config from the switch the NetApp used to be plugged into. From that I determined how the ports should be configured. This is the port configuration that I copied:

interface GigabitEthernet0/7
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,302,303
switchport mode trunk
spanning-tree portfast

After this the NetApp could be pinged and I could connect to it via putty.

WMIC

Invoke simply with "wmic" and see usage with "/?".

If you want to see the shares on another computer, you can type:

/node:[comp name] shares

or if you want to see the default gateway:

/node:[comp name] nicconfig get defaultIPgateway

The nicconfig command displays screeds of stuff so the "get defaultIPgateway" narrows it down.

LB 2003 to 2010 Exchange Migration p3

I was told today that they wouldn't mind a new name for their external OWA address and so the co-existence stuff isn't necessary anymore. Can't say I'm mortified by this news...

On Friday we managed to get through to the installation of SP2 and so I didn't have a great deal to do. The ESM presented me with a long terrifying error but was ok after a reboot. I put on RU5v2 and begun public folder replication:

.\AddReplicaToPFRecursive.ps1 -server "Exchange 2010 Server" -TopPublicFolder "\" -ServerToAdd "Exchange 2010 Server"

I will return to this company to remove the old public folders. I will probably run (to hurry it up):

Update-PublicFolderHierarchy -Server "Exchange 2010 Server"

To get rid of the replicas on the old server:

.\MoveAllReplicas.ps1 -Server "Exchange 2003 Server" -NewServer "Exchange 2010 Server"

To check on the progress:

Get-PublicFolder -recurse |fl name,replicas
Get-PublicFolder -recurse \non_ipm_subtree |fl name, replicas
Get-PublicFolderStatistics

The Exchange server's certificate was replaced by a wildcard certificates, which seem to simplify everything a lot over SAN certificates. There must be a catch.

The setting of the "legacy" URL was now uneccessary.

Set-OwaVirtualDirectory -Identity "esp-ho-ex2010a\owa (Default Web Site)" 

-Exchange2003Url https://legacy.crapulent.net/exchange

And there was no need to enable forms based authenication on the 2003 server, or for installing the Activesync hotfix to enable kerberos between the two servers.

The first Activesync test failed because of the domain admin protected group issue.

Other than that, job done for now. 

LB 2003 to 2010 Exchange Migration p2

Yesterday I copied and pasted a screed of unformated text which formed my attack plan for the migration. Today I have been at the company and gotten underway with the whole thing. So, inevitably with IT, my list wasn't comprehensive and certain problems have slowed the progress of the installation.

When Exchange 5.5 was around it used a thing called the "Active Directory Connector" which was for syncing with AD. 2003 did away with it and began using the recipient update service and the ADC was rendered redundant. Exchange 2007 / 2010 will not proceed with installation if there are any traces of the ADC left. Additionally, the Exchange orgnisation was in "mixed mode" and should have been in "native mode". So how do you remove these traces of ADC and change the mode of the organisation?

Firstly, uninstall the ADC service. In the case of this company it was installed on a DC. Uninstall failed citing "additional connectors". From here the ADC connectors need to be manually deleted from ADSIEdit. So go to Config > Services > Exchange > AD Connectors and delete the connectors not related to the ADC service. Once this is done the uninstall will proceed.

Some pesky ADC were still lingering, however. These we simply deleted. This can be achieved from ADSIEdit, as mentioned above, or AD Sites and Services (remember to show the hidden service options from the toolbar).

Now we thought we would be able to change to native mode, but still it was greyed out. The next thing to be done is to stop and disable the "Site replication service" on Exchange 2003. Still native mode was greyed out.

Finally we deleted the "Site replication service" in Exchange system manager under Tools. At last we could change to native mode and begin to prepare Legacy permissions (setup /pl), the schema (setup /ps) and the domain (setup /prepareAD).