Cliff Galiher SBS, DNS and Exchange guru says…

The mobile landscape has changed. What was in the office, is now in the hands of your clients. They expect it to work and they expect you to make it secure. Mobile devices communicate with Exchange in their own unique way. We’ll take a deep look at how devices communicate with Exchange and get technical about the protocols. This will cover activesync AND autodiscover at a protocol level. Then we’ll walk through the process of setting up different devices and visually tie the steps back to the theory. So now the mobile device works and you understand why it works, how are you going to secure it? Cliff will cover controls IT can have on activesync devices such as remote encryption and remote wipe, how to use and how to configure it.

Join Third Tier in Las Vegas for an all day training on the day prior to SMBNation. See other content details elsewhere in our blog. Thanks to our sponsors, Hewlett Packard, Symform and Storagecraft we are able to keep the cost down to only $50. So head on over to the store and reserve your space for this all-day training session! Seats are limited for this event and we expect to sell out. So register early. http://www.thirdtier.net/store Training takes place October 21st.

Exchange Powershell Essentials and Certificate Handling

If you’ve been working a bit with Exchange 2007, you’ve probably used just enough PowerShell to get by. In this session I’d like to take you further by showing you a few key PowerShell procedures that will make Exchange 2007 and Exchange 2010 administration and troubleshooting easier. We’re not going to go deep into PowerShell programming, what this session will do is give you some valuable but simple tools to increase your value when working with Exchange. Some of what we’ll cover includes:

- Working with single and multi-name certificates (including a cool new downloadable tool!)

- Refreshing Exchange virtual directories quickly to resolve CAS issues

- Easy quota administration

- Displaying mailbox size information in a user-friendly format

- Quick bulk-creation of users and mailboxes from a simple CSV file

Participants will be emailed a document with copy\pasteable scripts from this session to ensure that you can immediately put this content to use.

Check out the rest of our blog for more content details and don’t forget to register.

Speakers are our own fabulous staff: Dave Shackelford, Cliff Galiher, Eriq Neale and Wayne Small

Our content has been selected by the guys to reflect the growing concern over compliance, business continuity, manageability and issues surrounding these that our customers are contacting us for help with. Case studies and examples will abound and they guys will show you how to configure the products they will be working with which including Exchange, Sharepoint, Terminal Services and Hyper-V. Expect the sessions to be intense with advanced material. Your brain will be exploding by the end of the day.

I’ll be posting more and more specifics about the content as the event gets closer. Let’s have a look at what Eriq is going to cover first:

Configuring and Using Remote Desktop Services Remote Apps – A Love Story

Many people have heard of Remote Desktop Services Remote Apps (formerly Terminal Server Remote Apps) but either haven’t had an opportunity to implement the solution or just are not sure how to. In this session, Eriq Neale will show how to configure RDS Remote Apps on a Remote Desktop Server and then go over several real-world deployment scenarios. We will also go over how to set up RDS Remote Apps to work with Remote Web Workplace on an SBS Server. Eriq will include case studies on when and why this technology is used.

Configuring RDS Remote Apps

Publishing an Application through RDS Remote Apps

Publishing an Application with multiple configuration options through RDS Remote Apps

Publishing an RDS Remote App through Remote Web Workplace

Please make your flights accordingly and plan to join us for a full day of intense training on October 21st.

Shout Out to Hewlett Packard, Symform and Storagecraft. Without awesome vendors that get the small business space and are willing to invest in partner education, this event would not be possible.

—
Connect with us now…
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Cannot expand the folder. The attempt to log on to Microsoft Exchange has failed

It’s likely that they recently installed KB980376. As of today, the only known fix is to uninstall that security update from the client machine so that they can get into public folders.

1. From the Home screen (or whichever screen you’ve moved the icon to), click the Settings icon.
   
2. In the Settings screen, click Mail, Contacts, Calendars
   
3. Click Add Account
   
4. Click Microsoft Exchange
   
5. Enter the information in the account screen:
   
   • Enter your e-mail address *exactly* as the default account is set (for example, if your outbound e-mail address is Jonathan.Dough@smallbizco.net, enter it exactly that way – do not enter jonathan.dough@smallbizco.net).
   • Enter your internal domain name (if needed)
   • Enter your account name (this is the name used to log into your computer, it may or may not match your e-mail address)
   • Enter your account password
   • Enter a description for the account (Exchange will be the name if you do not put anything into the description field
6. Once you have verified that the information entered is correct, click Next.
   
7. You may see a warning that your server identity cannot be identified. This is expected if the server is Exchange 2003 or if the Autodiscover record for the server has not been set up properly. If you see this message, click Continue.
   
8. If you did get the previous message that the phone could not verify the identity of the server, you will need to enter the name of the server. This will be the same address you enter to get to Outlook Web Access (i.e., if you use https://remote.smallbizco.net/owa as the address for your Outlook Web Access server, then enter remote.smallbizco.net in the Server field).
   
9. You may receive a second warning that the server identity cannot be verified. This will be the case if your Exchange server has an invalid or untrusted SSL certificate. The iPhone can continue to communicate with the server using this certificate, and that communication is still secured. If this is the first, or second, time you get this warning, click Continue.
10. If you receive a message that the Exchange account cannot be verified, click OK and make sure you have entered the account information correctly. This error will most often appear if a password has not been entered correctly or if the Domain information is incorrect.
    
11. Once the account has been validated, select which Exchange features you wish to synchronize with your phone, then click Save.
    
12. After creating the account, you can go back into the account settings to change the items you wish to synchronize, or to modify other synchronization options.
    

At this point, your iPhone will start to synchronize information with your Exchange account. Depending on the data connection speed of the iPhone and your server, along with how much data you have in your mailbox to synchronize, this process may take some time.

Using this powershell command, you can give one user the permission to open and view another user’s entire mailbox. They won’t be able to send mail from that mailbox though, unless you add the SendAs permission:

Add-MailboxPermission user1 -User user2 -AccessRights fullaccess

So if you wanted to give Paul Stanley access to Gene Simmons’ mailbox, you would do this:

Add-MailboxPermission gsimmons -user pstanley -AccessRights fullaccess

To add sending functionality, you would do this:

Add-MailboxPermission gsimmons -User pstanley -AccessRights sendas

Make sure you run the Exchange Management Shell as Admin (escalated) or you may not get the results you were expecting.

If you want to verify the permissions you’ve given Paul, you can run this command:

Get-MailboxPermission gsimmons -User pstanley | fl

After you tell Bill that you’ve taken care of it, he asks you what Paul is supposed to do to view the mailbox. You send him the following instructions:

In Outlook, go into Tools -> Account Settingss and open up the properties on your Exchange email account. Choose More Settings, and when you get to the tabbed window, choose the Advanced tab.

On the Advanced tab, you will see the option to open additional mailboxes. Click Add and type the name of the user whose mailbox you want to open. In this case, Paul could type “Gene Simmons” or “gsimmons”. OK all the way out, and you should see another root mailbox for Gene Simmons added to Paul’s Outlook.

And yes, this can be done in the Exchange Management Console, but PowerShell is quicker!

Chances are this user recently had a password change, or maybe the users account was deleted and then recreated again. But you’ve checked everything: the password, the OWA feature turned on for that user, the ability to log on with other user accounts, the temporary internet files cache, IISRESET. But nothing works–no matter which workstation you use to access OWA, you can’t log on as that user.

If you really press on and actually reboot the server, you find that the problem is resolved, but you are left uneasy. What actually happened, and why did it take a server reboot to fix it? Very unsatisfactory.

The problem is actually related to how IIS caches credentials when it uses Forms Based Authentication. If you change a user password or delete and recreate a user account, sometimes IIS has a different SID/password cached for that user and any attempts to authenticate will fail until that cache is emptied. An IISRESET will not resolve the problem, but a reboot will.

But there’s another way to resolve this without a reboot.

1. Open up the Exchange System Manager and drill down into the Server section and down into Protocols.
2. Open the HTTP folder and get properties on Exchange Virtual Server.
3. Go into the Settings tab and uncheck the  Enable Forms Based Authentication checkbox. Apply it.
4. Go to the command-line and do an IISRESET.
5. Now go and recheck the Enable Forms Based Authentication checkbox.

That’s it. You should be able to log into OWA with that user now.

Microsoft Most Valuable Professionals (MVPs) are exceptional technical community leaders from around the world who are awarded for voluntarily sharing their high quality, real world expertise in offline and online technical communities. Microsoft MVPs are a highly select group of experts that represents the technical community’s best and brightest, and they share a deep commitment to community and a willingness to help others. For more information on the MVP program, visit http://mvp.support.microsoft.com/.

Dave was awarded for the Exchange Server category. His MVP profile can be found at https://mvp.support.microsoft.com/profile=B058C0A5-2970-4645-BEA1-A7EAECEA9C2A

In the morning when I got up and checked my email I was shocked to see only 3 new emails instead of the usually 30+. I wiped the blur from my eyes and noticed that all three email were from my own internal network. I first checked the usual suspects. Is my Internet up? Did my IP address change? Is my MX record still there? Is my firewall working correctly? Yes, yes, yes and yes. Time to look at the event logs and the Exchange server. Exchange server says my stores are mounted and Outlook says so too.

The event log had a story to tell. Fortunately for me the event log on this server is very clean otherwise I could have easily overlooked the error message that led me to the solution because it only occurs one time.  It’s Event ID 15006 Source MSExchangeTransport.

The Microsoft Exchange Transport service is rejecting message submissions because the available disk space has dropped below the configured threshold.

Resource utilization of the following resources exceed the normal level:
Queue database logging disk space ("C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Queue\") = 97% [Medium] [Normal=95% Medium=97% High=99%]
Physical memory load = 92% [limit is 94% before message dehydration occurs.]

Back pressure caused the following components to be disabled:
Inbound mail submission from the Internet
Mail submission from the Pickup directory
Mail submission from the Replay directory

The following resources are in the normal state:
Queue database and disk space ("C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Queue\mail.que") = 96% [Normal] [Normal=95% Medium=97% High=99%]
Version buckets = 0 [Normal] [Normal=80 Medium=120 High=200]
Private bytes = 3% [Normal] [Normal=71% Medium=73% High=75%]

As you can see the message is pretty detailed and tell you exactly what the problem is, except be sure to read the whole thing. At the top is says that transport service has stopped and is rejecting message submissions because the available disk space has dropped below the configure threshold. While it’s true the disk space was an issue it wasn’t enough to create the stop. Physical memory load was the problem. And the solution was, as Eriq pointed out in a earlier blog post and screencast, to reduce the amount of memory that Sharepoint and Monitoring databases are allowed to use on the server.

Read Eriq’s blog post here: http://www.thirdtier.net/2009/08/setting-the-maximum-memory-usage-on-the-sharepoint-database/

And what his screencast demonstrating the procedure here: http://www.thirdtier.net/screencasts/limit-sharepoint-database-memory-usage/

Note that after applying the fix, I had to restart the Exchange Transport service to get my incoming to start flowing again.

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Scott lives in Redmond and has resided in Washington for over 12 years. He is looking to attend several of the Washington State user groups over the next year to answer any questions that may arise around servicing, tools, Microsoft Update, and other related areas so that he can ensure that the CXP team properly understands the customer scenarios that are out there.

If you are a user group leader in the northwest and would like to get connected with Scott for possible presentations, drop me a note with your email address and I'll make sure it gets over to Scott. Possible topics he'll consider for group meetings include:

1.       Servicing via Microsoft Update, WSUS, SMS/Systems Center, 3^rd Party

2.       Silent install versus UI based install

3.       Servicing Cluster Scenarios

4.       Servicing E14 DAG Scenarios

5.       E12 specific servicing pain points

6.       E14 Rollup 1 experience

7.       Servicing SBS

For those of you in the Bellevue area tonight, head on over to the Puget Sound Small Business Server User Group meeting in Lincoln Square. Check out http://www.pssbs.org/about/ for directions.