Exchange 2010 - Deleted Mailbox Not Appearing in EMC Disconnected Mailbox

I was working on one issue that my customer had, the disconnected mailbox does not appear immediately in the EMC when he accidentally disconnect one of the user's mailbox.

 The reason behind is the online maintenance wasn't complete and below is the powershell command that will show the disconnected mailbox on  the EMC.

Get-Mailboxdatabase | Clean-Mailboxdatabase

By running the command it will clean all the databases in the entire organization,  the disconnected mailbox should display in the EMC now.

Modifying Exchange SCP due to SAN limitation

One of my customer's Exchange server private SSL is expiring soon and they plan to go for SSL certificate from public certification authority.Due to budget issue, they only plan to purchase 1 certificate with 2 SAN which is webmail.contoso.com and autodiscover.contoso.com.

Since the internal domain name(contoso.internal) is different with public domain(contoso.com), they asked me is it possible to consolidate both into one(contoso.com) without causing any service interruption to users, for example certificate warning when they open Outlook client.

To achieve the goal, all we need to do is to modify Exchange SCP(service connection point), to point the internal autodiscover URL to autodiscover.contoso.com.

Set-ClientAccessServer -Idendity CAS_Server_Name -AutodiscoverServiceInternalUri "https://autodiscover.contoso.com/autodiscover/autodiscover.xml"

Set-WebServicesVirtualDirectory -Idendity "CAS_Server_Name\EWS (Default Web Site)" -InternalUrl "https://webmail.contoso.com/EWS/exchange.asmx"

Set-OABVirtualDirectory -Idendity "CAS_Server_Name\OAB (Default Web Site)" -InternalUrl "https://webmail.contoso.com/oab"

By modifying the SCP and virtual directories internal URL pointing to the public domain name instead of internal domain name, we can achieve the goals of spending minimum amount of money on public SSL.

Exchange 2010 Unable to Relay Email : Error 451 4.4.0 DNS Query Failed

I'm working on a support request today, my customer found that they cannot send email to certain domain.

Upon opening the queue viewer in EMC, I found that there are Error 451 4.4.0 DNS Query Failed appear on the domain that my user tried to send to.

I've try using telnet command to send email to that domain but without success, the moment when I hit enter on the RCPT TO: someone@domain.com, Error 451 4.4.0 DNS Query Failed appears.

When I performed a nslookup and MX lookup on the target domain, it can be resolved successfully via local  AD DNS server.

Looking into the error and since my customer's messaging infrastructure design is to send emails directly to internet without routing to any smart host, I decided to use the well known Google DNS 8.8.8.8 on Exchange server to route email instead of the AD DNS. When I hit "retry" on the mail queue, the email was transferred immediately.

Below is the steps on how to configure it.

1. Open Exchange Management Console (EMS)
2. On Server Configuration -> Your HUB server -> right-click Properties
3. Click the "External DNS Lookups" tab.
3. Tick "Use These DNS Servers" , click "Add" and insert 8.8.8.8 (Google DNS)
4. Click "OK"
5. Go to Organization Configuration -> Send Connector -> right-click Properties
6. Click the "Network" tab.
7. Tick "Use the External DNS Lookup settings on the transport server"
8. Open "Queue Viewer" on "Tools"
9. Find the targer domain queue, right-click retry

The email is being transferred by now after applying the settings.

Exchange 2010 The Certificate Status could not be determined because the revocation check failed

I helped my customer to renew SSL certificate for Exchange yesterday but I ran into some issue.

My customer’s environment is having a proxy server to handle internet connection for all users. In the Exchange server I already specified Exchange server name in the bypass list but when I import the certificate into CAS, an error The Certificate Status could not be determined because the revocation check failed will display in EMC.

I downloaded the Digicert Certificate Utility for Windows here to test the proxy settings, certificate revocation status and it passes all the test, but unfortunately whenever I re-import the certificate it will display the previous error.

Finally I decided to import the certificate using Powershell.

First I import the certificate without assigning services with below command:

Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path c:\certificate.pfx -Encoding byte -ReadCount 0)) -Password:(Get-Credential).password

Then I assign services (POP, IMAP, IIS ,SMTP) to the certificate with below command:

Enable-ExchangeCertificate -Thumbprint certificate_thumb_print  -Services POP,IMAP,SMTP,IIS

The command executed successfully, and when I browse to the OWA page it is showing that it has the valid certificate now, however in the EMC it is still showing the revocation check failed error.

I’m suspect there are something needed to configure on the proxy server, however this is a workaround for myself to get Exchange services published with the valid SSL certificate.

Redirect Outlook From Direct Server Connection To CAS Array

Microsoft has been always advice customer to configure CAS Array although there is only one server needed, unfortunately not many people is following this best practice.

My customer is going to deploy HA for their environment, which originally consist of 1 CAS/HUB server and 1 Mailbox server. Now they planning to have 1 more CAS/HUB server and mailbox server for HA purpose.

All the client is currently connected directly to the CAS and when  the new CAS is in place, I need to redirect them to connect to CAS Array.

There is around 700 users in the organization and I’m planning to perform the migration in a big bang strategy and minimize user’s downtime, so, I achieve the goal by using below steps:

  

1. Delete the old CAS DNS A record.

2. Create DNS A record for CAS Array.

3. Dismount all databases and re-mount them.

4. Outlook will perform a new autodiscover search and connect to CAS Array.

I hope this could help you to perform the migration with minimal user impact if you have a similar situation like this.

Error:The operation couldn't be performed because object 'Server\Autodiscover(Default Web Site)' couldn't be found

February seems to be full of troubleshooting month. Today I got another call regrading their OOF reply not working.

Upon Checking, I found that the autodiscover internal URL was empty when i run the command get-AutodiscoverVirtualDirectory

When I try to reset with command Set-AutodiscoverVirtualDirectory -Identity <server_name> -InternalURL "https://test.doman.com/Autodiscover/Autodiscover.xml, there is an error : 
  
  The operation couldn't be performed because object

  '<Exchange_Server>\Autodiscover' couldn't be found on 'ad.example.com'.

Although I set the preferred AD to another server, the same error still appear.

After quite some time I finally found a way to reset the Autodiscover virtual directory by running:

Get-ActiveSyncVirtualDirectory -Server <server_name> | Set-AutodiscoverVirtualDirectory -InternalURL https://test.doman.com/Autodiscover/Autodiscover.xml

Not sure what really happened but using this method seems able to reset the virtual directory.

OWA Redirect Did Not Work After Replacing New Certificate

Yesterday one of my customer ran into some issue after replacing a new certificate for Exchange.

My customer's  public certificate is going to expired soon, they had requested us to replace it with a private certificate instead. Everything works fine after replacing the certificate, and I’ve verified with the them before I leave.

After few hours somehow I was told that OWA redirect is not working anymore and user cannot login into OWA. Please read the similar symptom here:

This error actually only happen if the Exchange server has redirect from HTTP to HTTPS features implemented. The redirect will eventually create infinite loop although you run “iisreset” and all the authentication method(owa,active_sync,outlook_anywhere,ecp and etc) will not work unless you manually configure them.

Troubleshooting Steps:

1. check the Exchange virtual directory using EMS, type Get- WebServicesVirtualDirectory and to make sure the URL is correct

2. goto IIS manager -> default website ->HTTP redirect -> make sure the box is check “redirect request to this destination” and insert the the url ending with /owa.

3. check the box “Only redirect requests to this content in  this directory” (not subsidiaries), with status code (found 302)

4. On the default website, click SSL settings and uncheck "Require SSL" .

5. Remove the enforced redirect for following directories:

• aspnet_client
• Autodiscover
• ecp
• EWS
• Microsoft-Server-ActiveSync
• OAB
• PowerShell
• Rpc

5. run iisreset in CMD

Everything working back to normal after steps above is done.

Lotus Notes to Microsoft Exchange Migration Project

Recently I was assigned with Migration from Notes to Exchange 2010 project. Well I’ve been waiting for this project so long because I think I could gain some very valuable experience in my career.

Unfortunately this project turns out to be no migration at all because the customer did not want to buy the migration tools from Quest software. In a nutshell, this is a simple new Exchange implementation project.Since high availability (HA) isn’t my customer’s requirement, I deploy all 3 server roles (CAS,HUB,Mailbox) in a single VM running on top of ESXi5.

We set a cut-off date that all mails will be routed to Exchange server instead of Lotus Domino, and all users starts using outlook on the same time.

Everything was running quite smooth since there is not much of real migration involve.

  

EMC 2010 Initialization Failed

There is a time when my customer opens EMC 2010, an initialization failed eror appeared: The following error occurred while attempting to connect to the specified Exchange server.

After some research, I was hinted that this problem might related to proxy issue. You can read more here.

In order to verify the proxy settings, you can enter the command in CMD:

netsh winhttp show proxy

Once the result shows that there is a proxy server on the server, you can remove it by using command:

netsh winhttp reset proxy

And the problem resolved.

How To : Update Offline Address Book(OAB), and distribute to all users immediately

Due to some reason, my customer wants to update the OAB and distribute to all users immediately today. Here is it can be done:

Normally Exchange will run into maintenance mode at daily 5am(by default),during this time, Exchange will distribute the latest version of OAB to all users. User’s outlook client will automatically download the OAB generated by Exchange during next logon.

Today I’ll show you how to make a force update and distribution of OAB to user manually without waiting for Exchange to enter maintenance mode.

First,open EMC in Exchange server, under Organization pane, click the Offline Address Book tab, right-click on the Default Offline Address book and select Update.

Once it is done, open Services on CAS server. Look for a service name Microsoft Exchange File Distribution and restart the service. 

Once the service is restarted, Exchange will automatically distribute the updated OAB to all users, where users can see the changes\updated OAB without waiting till Exchange enter maintenance mode.