Haven’t registered yet? Please do so now. www.thirdtier.net/registration Your registration fee includes a full day of training, lunch and an evening with Third Tier at the local pub. Space is limited so register today.

Since SBS 2003, the SBS family of products has included a feature that, quite frankly, has made some of the other product lines jealous – the Remote Web Workplace (now called Remote Web Access in the 2011 series of products). Starting with the 2008 product series, Microsoft made some significant changes to the way this remote connectivity tool works behind the scenes, and in some cases that has led to some frustration on the part of the user and IT support community. In this session, we will show you how remote connectivity works under the hood so you can learn how to gain remote access to servers and workstations while bypassing the RWA interface, as well as finally being able to allow Macintosh and other devices to remotely control PCs using this same mechanism. Plus, we’ll show you how to build your own remote access infrastructure using the same tools that MS uses to make the remote connectivity of RWA work.

Remember, register to reserve your space. Last year we sold out. www.thirdtier.net/registration

—–
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

In days gone by, I used to instead choose tick or tock, the USA Navy atomic clocks, as my servers of choice but they changed their support policy and were actively discouraging individual companies from using their time servers. Instead they are intended to provide sync services to other time servers. My search for a reliable time source found pool.ntp.org. As the name implies ntp.org is the home of the Network Time Protocol open source project. Members  work together to provide a public pool of time servers for use by individuals and businesses. Because the servers operate in a large network of pooled resources the time servers are highly redundant and reliable.

There are several pools of NTP servers for you to choose from based on what part of the world your server is located. You are not required to use the NTP servers pooled in your region, you could in fact choose the whole world by using pool.ntp,org as your specified time server. But ntp.org would appreciate it if you selected your region from the list in the link. http://support.ntp.org/bin/view/Servers/NTPPoolServers  Clicking through you’ll see that in North America, there’s us.pool.ntp.org, ca.pool.ntp.org, mx.pool.ntp.org and so on with 609 active servers in the pool. In Europe there’s a pool for every Country as well with 1386 servers total.

Here’s how to change your time server from what ever it is now to another NTP server. I’m going to use us.pool.ntp.org in my example.

To check the status of your current time server settings

In an elevated command prompt type: w32tm /query /status

The result will look something like this. Notice that in this example, no NTP server has been specified for this server so it is using it’s CMOS clock as a time source. This explains why many servers experience drifting time. As we know the CMOS batteries don’t last forever.

To set an NTP server

In an elevated command prompt type: w32tm /config /manualpeerlist:us.pool.ntp.org

Of course you will enter the name of the pool that you will be using after the : in the command above. Be sure not to leave a space after the :

After entering this command you will get confirmation as shown.

You now need to restart the windows time service for your change to take effect.

Once that is done you can check your work by executing the /status command again.

That’s the basics of how to change your time server from one source to another. The windows time service has much more to offer and tweak. TechNet has an excellent article on all of the settings available. http://technet.microsoft.com/en-us/library/cc773263(WS.10).aspx

—–

So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

WordPress Tags: server,Windows,domain,controller,servers,clocks,Network,Time,Protocol,region,NTPPoolServers,North,America,Europe,Country,CMOS,clock,batteries,TechNet

So you have a migration planned, and you want to change MX records and cut over, but it looks like it’s going to take 5 days to migrate those 59gb of email down from the hosted provider! What do you do?

First, you think differently. No, I’m not talking about provisioning mac.com accounts, I’m asking us to stop thinking about the mail as a big chunk of data to be moved in one unit. Don’t even think of a single mailbox in that way. Start thinking about what part of the user’s mailbox they couldn’t live without for a day or two. The last two weeks of mail? The last two months? Once you’ve identified that interval that we’ll call “staple data”, make your plan: first cut over the MX record and immediately migrate that staple data. The reduced footprint of that data will turn your multi-day mailbox move effort into a several-hour effort. As soon as the staple data is in place on the new server, then begin the import of the rest of the data. I usually call that data the “historical backfill.”

Now how do you accomplish this date-delimited dissection of the mailbox? Pretty easily. All the basic tools we use or have used have all had date-specific parameters we can use during exports and imports. Exmerge had them, the PowerShell Export\Import-Mailbox commandlets have them. What are the other tools we can use? There’s one main other one that people aren’t usually familiar with. It’s called the Exchange Transporter Suite. It was built primarily to assist people in migrating from non-Microsoft mail platforms. In addition to tools to assist with Lotus migrations, it also has a very nice IMAP and POP migration tool. The IMAP tool is especially helpful for bringing client mail off of Google Apps and onto an Exchange server without having to do it from the Outlook client. Wouldn’t it be nice to do it in one place, all the mailboxes at once? Yep. It is. I’ll introduce you more formally to that tool in a future post.

How Come ExMerge Won’t Run?

One thing I’ve realized is that many SMB consultants aren’t sure how to move mail around in a world in which ExMerge isn’t easily accessible. That’s right, you can’t run ExMerge on an SBS 2008 or Exchange 2007 server to export\import mail. Ah, you might say, I’ve heard that you have to use PowerShell instead. Partly true, but you still can’t run the PowerShell import\export scripts on the server. You have to set up a separate management workstation to run them from. In fact, you can actually run ExMerge from a separate management workstation. The same change in functionality that will not let you run the PowerShell cmdlets on the server also “broke” ExMerge on the server.

The need for a separate management workstation to handle mail import\export procedures gets complicated for those who are trying to host their SBS 2008 box at a colo. In those situations, we’ve temporarily installed VMWare on the server and installed an XP Pro VM to use as a management workstation. Trying to handle the migration via a workstation connected to the colo via VPN is NOT a good idea.

So what’s involved in setting up a management workstation to run ExMerge or use the Import\Export scripts? I would suggest that you focus on running the PowerShell scripts rather than using ExMerge, but I’ll give you the details for both:

Installing ExMerge on a 32-bit Management Workstation

For ExMerge, you are going to follow the normal rules for running Exmerge on a workstation.

1. If on XP, install the IIS Snap-In component from the Add Components Add/Remove applet.
2. If on XP, install the Windows Server AdminPack tools.
3. Install the Exchange 2003 (yes, 2003) management tools on the workstation from the Exchange 2003 media. Ignore the schema error.
4. Download and install ExMerge on the workstation.
5. Pick or create a user who is not a member of the Domain Admins group to use for the import process.
6. Create an “ExMerge” group to assign Exchange permissions to and add the target user to the group.
7. Use the Exchange Management Console to delegate “Exchange View Only Administrator” control to the ExMerge group.

8. Give the ExMerge group Send-As and Receive-As rights. The easiest way to do this is in Exchange Powershell, like this:

Get-MailboxDatabase -identity “SERVER\First Storage Group\Mailbox Database” | Add-ADPermission         -user “DOMAIN\ExMergeGroup” -ExtendedRights Receive-As, Send-As

(You’d swap SERVER and DOMAIN\ExMergeGroup with the appropriate server name and domain and group names in your environment.)

You should now be able to log on to that workstation as a member of the ExMerge group and run ExMerge to pull data out of Exchange 2007 or migrate data into Exchange 2007. I will show you how to do date-delimited extraction later in this article.

If you are interested in knowing whether ExMerge will work in the same way with Exchange 2010, the answer is no, but you can read more about that in this helpful article by Alexander Zammit.

Getting Ready to use Import-Mailbox on a 32-bit Management Workstation

If you are going to use PowerShell to pull the mail into the new Exchange 2007 server (which I recommend), then you are going to need to get a workstation ready to run the import process on. This is mainly written with an XP system in mind.

1. Install these prerequisites: .Net Framework 2.0 and its update, MMC 3.0 (if on XP), and Powershell 1.0. Ah yes, and Outlook 2007 or 2010.
2. Download, extract and install the Exchange 2007 32-bit Management Tools. Make sure you download the version that matches the service pack level of your Exchange 2007 installation, otherwise you will have problems.
3. Pick or create an account that is NOT a member of the Domain Admins or any other privileged group in the domain. Add that user to the local Administrators group on the Exchange 2007 server.
4. In the Exchange 2007 Management Console on the server (click on Organization), use the Add Exchange Administrator action to grant that user account the Exchange Server Administrator role.
5. To import and export mail, you need to grant import user account Receive-As and Send-As permission on any mailbox databases on the Exchange 2007 server. To do that, run this command at an “escalated” Exchange PowerShell prompt:

Get-MailboxDatabase | Add-ADPermission –User Importer –ExtendedRights Receive-As,Send-As
(replace Importer with the name of the user that you created\picked.)

To import all the .pst files in a specific directory into appropriate mailboxes, just make sure that each .pst file is named to match the user’s mailbox alias (jsmith’s .pst would be called jsmith.pst), and then execute something like this:

Dir D:\PSTDump\*.pst | Import-Mailbox

This will look at each .pst, match it to it’s mailbox on the server and import the contents of the .pst.

To import a single .pst file that doesn’t match the mailbox name, you can do this:

import-mailbox jsmith@domain.com -pstfolderpath d:\PSTDump\johnnyboy.pst

You can also do date-delimited imports, but that’s primarily something you’d want to do as an export process in ExMerge. I’ll go over that now.

Date-Delimited Mail Exports using ExMerge

Using date-delimited exports is commonly used when mailboxes are very large and need to be exported in chunks in order to avoid the 2gb limit on ANSI .pst files. It is also useful when there are many mailboxes to be moved in a short time and it is not practical to move all the data at once.

Let’s create a scenario: It’s March 13th, 2010 and tonight we need to migrate 115 users from an Exchange 2003 server in one domain to an Exchange 2007 server in another domain. We’ve already migrated the user accounts to the new domain using LDIFDE, but now it’s time to migrate the mail. We changed the firewall’s configuration an hour ago so that new email is being delivered to the mailboxes on the new server. We’ve set up our export\import account and are ready to use ExMerge.

Because the total amount of mail on the server is equal to 79gb (yes, this is an urgent project!) and a dozen of the mailboxes are larger than 3gb, it would take quite a bit of time to export all the mail out this evening. What we will do is export the “staple data” first: all the mail from January 1st 2010 up till today. Because that is only 73 days of mail, the .pst file for each mailbox will will be relatively small, and the entire export process will probably take 35 minutes or so. Since ExMerge will automatically name the .pst file after the user alias, the exported files are ready to be imported into Exchange 2007 immediately.

Once the initial run of .pst files has been exported and then imported successfully, it’s time to start working on historical backfill. We will go back to ExMerge and begin running another date-delimited export covering all of 2009, choosing a separate directory as the destination. When that export finishes, we will use import-mailbox again (pointing it at the new directory) to bring that mail into the mailboxes on the new server. We can go backwards, year by year, until all the mail has been brought in. Since the most critical data has already been imported, the migration should seem smooth to the users even if data is continuing to be imported over the next 24 hours. It is the rare user that refers to 36-month old emails on a daily basis.

What if you have just set up Exchange 2010? Can the management workstation you set up for importing into Exchange 2007 still be used? Nope, while the strategies I’ve outlined here are still valid, you can only use a system set up with Exchange 2007 management tools to import data into an Exchange 2007 mailbox server. If you have SP1 loaded on Exchange 2010, you can run the new-mailboximportrequest and new-mailboxexportrequest commands to export or import to\from .pst files. See this article for more details: http://msexchangeteam.com/archive/2010/04/26/454733.aspx

Using strategies like these can reduce the stress of having to migrate a lot of mailbox data in a short time-frame, and make large-mailboxes less formidable seeming. I hope you find this helpful. Of course, if you’re in the middle of it and short on patience, go ahead and open a ticket, and I’ll help you out!

—–

So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Honestly, it’s a remarkable document. Great work contributors.

http://social.technet.microsoft.com/wiki/contents/articles/small-business-server-2008-build-document.aspx

Check it out and contribute!

Wayne Small, SBS, Hyper-V, Trend, Storagecraft and all-around SBS-FAQ guy says…

Hyper-V is the best solution for SMB clients wanting to have their servers virtualised.  However there are a lot of myths about how to configure it and how not to configure it.  Come to this session to learn about not only the basics of good Hyper-V configuration, but how to get the best performance out of your Hyper-V solutions for your clients.  We’ll bust myths such as “Is RAID 10 really better than RAID 5?” and “What’s the best way to configure my CPUs in Hyper-V”. 

If you attended Wayne’s Third Tier webinar on Hyper-V you’ll have a leg up because his content here will build and expand upon that webinar.

Join Third Tier in Las Vegas for an all day training on the day prior to SMBNation. See other content details elsewhere in our blog. Thanks to our sponsors, Hewlett Packard, Symform and Storagecraft we are able to keep the cost down to only $50. So head on over to the store and reserve your space for this all-day training session! Seats are limited for this event and we expect to sell out. So register early. http://www.thirdtier.net/store Training takes place October 21st.

Unable to load Library C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\{43F8CF32-15B7-44DD-A01D-A3372DD2856E}\zlib1.dll.

If you run across this, Trend has a great KB that will walk you through doing a manual removal. If you keep the GUID in your Worry Free Remote Management Console, then you can do a copy and paste into the new install of the agent and you'll be set.

If you don't feel like clicking through to the KB, here's a copy of it as of 9/8/2010:

Manually uninstalling the Worry-Free Remote Manager (WFRM) 1.0 / 2.0 Agent 
 
Solution ID: EN-1035023
Product: Client Server Messaging Security for SMB - 3.5, 3.6; Client Server Security for SMB - 3.5, 3.6; Worry-Free Remote Manager - 1.0
Operating System: Windows Server 2003 Standard Edition - SP1; Windows 2000 Server - SP4
Published: 4/3/2009 1:00 AM 
 
 
Solution: Public

--------------------------------------------------------------------------------

Please do the following:
 
     
1. Stop the Trend Micro Worry-Free Remote Manager Agent service.

   a. Click Start > Run.
        
   b. Type "cmd" on the command line and then press the Enter key.
        
      Run this command:   
      net stop Trend Micro Worry-Free Remote Manager Agent
 
     
2. Remove the Trend Micro Worry-Free Remote Manager Agent service.
        
   a. On the command line, use the change directory (cd) command to go to the WFRM Agent directory.
        
   b. Run this command:
        
      TMICAgent -u
     
3. Remove the program files.
     
   Delete [agent install directory] – WFRMAgentForCSM
     
4. Open the Registry Editor (regedit.exe) and then remove these registry keys:
     
   Important:Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues. Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.
     
   •  HKEY_OCAL_MACHINE\SOFTWARE\TrendMicro\TMIC4CSM\Agent\...
        
   •  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\ 23FC8F347B51DD440AD13A73D13A73D22D58E6
        
   •  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\23FC8F347B51DD440AD13A73D13A73D22D58E6
        
   •  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{43F8CF32-15B7-44DD-A01D-A3372DD2856E}
        
   •  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information\{43F8CF32-15B7-44DD-A01D-A3372DD2856E}
        
   •  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_\{43F8CF32-15B7-44DD-A01D-A3372DD2856E}
     
5. Remove the WFRM Agent shortcut from the Start menu.
        
   a. On the desktop, click My Computer.
   b. Change the current directory to ..\Documents and Settings\All Users\Start Menu\Programs.
   c. Delete the Worry-Free Remote Manager Agent folder.

Cliff Galiher SBS, DNS and Exchange guru says…

The mobile landscape has changed. What was in the office, is now in the hands of your clients. They expect it to work and they expect you to make it secure. Mobile devices communicate with Exchange in their own unique way. We’ll take a deep look at how devices communicate with Exchange and get technical about the protocols. This will cover activesync AND autodiscover at a protocol level. Then we’ll walk through the process of setting up different devices and visually tie the steps back to the theory. So now the mobile device works and you understand why it works, how are you going to secure it? Cliff will cover controls IT can have on activesync devices such as remote encryption and remote wipe, how to use and how to configure it.

Join Third Tier in Las Vegas for an all day training on the day prior to SMBNation. See other content details elsewhere in our blog. Thanks to our sponsors, Hewlett Packard, Symform and Storagecraft we are able to keep the cost down to only $50. So head on over to the store and reserve your space for this all-day training session! Seats are limited for this event and we expect to sell out. So register early. http://www.thirdtier.net/store Training takes place October 21st.

After some fussing, rebuilding the RAID array, calling hardware support at Equus (who by the way was wonderful) we finally found something of a solution on the Internet. Apparently what we ran into is pretty common, though the solution that worked for us was not exactly as found by an Internet search.

The problem was that the server was attempting to install the OS onto the USB key (which we needed for the answer file). It was doing this even though, the USB key was not an option to select in the where do you want to install the OS screen in the installer.

The puzzling part for us is that we have done many migrations and never run into this problem before. We have used this exact same server hardware configuration. We have booted with a USB key already plugged in. We have used OEM media. This we think was our first OEM media with SP2 slipstream, but that hardly seems like something that would cause what really appears to be an installer issue. Was it the particular USB key we used? So while we’re stumped on the cause, at least we found a solution.

The Internet search solution was to go into the BIOS and move the USB key in the boot order to the last option. We did that, no dice. Same problem, this solution did not work for us but if you are having this problem it may be worth a try as others report that it does work. Our install absolutely insisted on not installing where we selected and attempting to install to a drive that was not even available as a selection in the installer!

We had to remove the USB key from the server during installation and plug it in at the appropriate time to read the answer file. The appropriate time we selected was immediately following the confirmation that the OS is installing. When your server reboots be sure to again remove the key and wait until the installation resumes before plugging it in. This will allow the installation to start and your migration to succeed.

—–

Need more help with this or some other sticky situation? Click to hire us.
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Cannot expand the folder. The attempt to log on to Microsoft Exchange has failed

It’s likely that they recently installed KB980376. As of today, the only known fix is to uninstall that security update from the client machine so that they can get into public folders.

Using this powershell command, you can give one user the permission to open and view another user’s entire mailbox. They won’t be able to send mail from that mailbox though, unless you add the SendAs permission:

Add-MailboxPermission user1 -User user2 -AccessRights fullaccess

So if you wanted to give Paul Stanley access to Gene Simmons’ mailbox, you would do this:

Add-MailboxPermission gsimmons -user pstanley -AccessRights fullaccess

To add sending functionality, you would do this:

Add-MailboxPermission gsimmons -User pstanley -AccessRights sendas

Make sure you run the Exchange Management Shell as Admin (escalated) or you may not get the results you were expecting.

If you want to verify the permissions you’ve given Paul, you can run this command:

Get-MailboxPermission gsimmons -User pstanley | fl

After you tell Bill that you’ve taken care of it, he asks you what Paul is supposed to do to view the mailbox. You send him the following instructions:

In Outlook, go into Tools -> Account Settingss and open up the properties on your Exchange email account. Choose More Settings, and when you get to the tabbed window, choose the Advanced tab.

On the Advanced tab, you will see the option to open additional mailboxes. Click Add and type the name of the user whose mailbox you want to open. In this case, Paul could type “Gene Simmons” or “gsimmons”. OK all the way out, and you should see another root mailbox for Gene Simmons added to Paul’s Outlook.

And yes, this can be done in the Exchange Management Console, but PowerShell is quicker!