Hi All,

We are using exchange server 2013, and barracuda spam filtering solution,all the inbound/outbound emails passes through barracuda on port 25, our CAS server is public facing for active sync, owa, ecp and mapi connections, i wanted to know what are ports that needs to be opened on CAS server, 

i know there are lot of articles for port requirement for internet facing CAS server but that is the case when there is no third party email filtering solution, in my case i have a third party email filtering solution, .

so what ports needs to be kept open i as i need to close all the other ports as security best practice.

Regards

ITGeek

TechGUy,System Administrator.

hi all,

is it posible to add a missing cmd-let Parameters ActiveSyncBlockedDeviceIDsto Exchange default roles?

example:

Get-ManagementRoleEntry “*\Set-CasMail*”

Name                           Role                      Parameters
Set-CASMailbox                 Exchange Virtual Direc... ResetAutoBlockedDevices
Set-CASMailbox                User Options              ActiveSyncDebugLogging, ActiveSyncSuppressReadReceipt, Con...
Set-CASMailbox                 Organization Client Ac...ActiveSyncAllowedDeviceIDs, ActiveSyncBlockedDeviceIDs, Co...

If we create a new Role with parent "Organization Client Access" we have to many unknown "Cmd-Lets". Most of this, we don't know what the are doing!

IF we create a new Role with parent Template "User Options" we can add a ParameterSet-CasMailbox because alreday exists.

If we remove Set-CasMailbox and add it: Second (Screenshot) Error Parent doesn't contain Parameter!

does anybody know a simple way for this problem

Greetings

I have just set up an Exchange hybrid environment running Exchange Server 2013 CU11 and Office 365.

I'm running into a problem where mailboxes in the cloud cannot see free/busy information for user mailboxes on the on prem Exchange server.

Testing shows that:

Bi-directional mailflow works.

Users on prem can see free/busy for on prem and cloud mailboxes

Cloud mailboxes can see free/busy for cloud mailboxes but not on prem mailboxes

The free busy test at https://www.testconnectivity.microsoft.com is successful for a prem mailbox user. 

Running that test as a cloud user fails at this step

Attempting to send an Autodiscover POST request to potential Autodiscover URLs. - error code 500, the e-mail address can't be found

Autodiscover is pointed at the on prem exchange server.

Any assistance for how to resolve this issue would be appreciated.

Hello,

Hoping someone could help with this error im getting. When i do a mailbox move from 2010 to 2013 using the 2013 Gui. I get an error saying ......

Cannot open mailbox /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXCHANGE/cn=Microsoft System Attendant.

Environment details are: 

DC 2008r2

Exchange 2010 on 2008 r2

Exchange 2013 on 2008 r2

Has any come across this before?

Thanks

Hi, 

Have some issues here. 

I have an Hybrid Exchange 2013 which is working and all is good, except for this one.

Starting Exchange shell is no problem. It connects and all seems good. Running any commands gives this :

Could not find any available Global Catalog in forest *DOMAIN*

I have researched this is somehow related to GC and have verified it is running in the two DC's and there seems to be no other issue. 

Is there anyone having any suggestions on what to try ?

Restarting the serveres (DAG) give a day or so without this error. Meaning ALL EXCHANGESHELL commands are working. 

What the **** is going on here ?

Hi,

I notice the event ID 74 and 12014 on both the mailbox servers but there is no impact on the services so far.

How can i fix it.

Thanks in Advances

Best Regards,

Mohammed

Hi Team,

I am trying to export a mailbox to pst file in certain range, the commands runs successfully but only extracts the folder structure  without any mails, i am running the below command, am i doing anything wrong in the below script?

 Regards

ITGeek

TechGUy,System Administrator.

hi all , 

i have one question , we have exchange server 2013 running on windows server 2012 node and we had another node that run windows server 2012R and we need to make a DAG and when run the cluster healthy check before proceed it is giving and error regarding windows level .

my question can we do the upgrade for windows 2012 on the current exchange server to make it Windows 2012 R2 without any issue or there is any concern ? i.e. the in place upgrade for the window .

appreciate your support and experience 

<The content in this article was originally published as below Exchange blogs in Japanese and has been reproduced here in order to benefit the global customers. :)  >

https://blogs.technet.microsoft.com/exchangeteamjp/2014/03/03/autodiscover-1/
https://blogs.technet.microsoft.com/exchangeteamjp/2014/03/18/autodiscover-2/
https://blogs.technet.microsoft.com/exchangeteamjp/2014/11/10/autodiscover/
https://blogs.technet.microsoft.com/outlooksupportjp/2017/02/28/testing_autodiscover-email_autoconfiguration1/
https://blogs.technet.microsoft.com/exchangeteamjp/2016/05/18/troubleshooting-through-autodiscover/

Enjoy!
-----------------------------------------------------------------------------------------------------------------------------------------------

If you are an Exchange administrator, you may have already known “autodiscover”. If you don’t know what autodiscover is, I guess you’ve heard this word at least once from IT administrator or Microsoft support engineer. Autodisover was introduced when Exchange 2007 was shipped and it is more than a decade technology, However all versions of Exchange (from Exchange 2007) heavily rely on Autodiscover and it is crucial for all Exchange administrators to understand what it is, how it helps users and most importantly how to troubleshoot when it is not working. Surprisingly, there aren’t so many Microsoft’s published documents about this technology, so I decided to write must-know about Autodiscover. If you know all content covered in this blog, I expect you can configure autodiscover right and quickly solve autodicover related issues.

How Autodiscover works

Autodiscover is a feature which enables automatic client profile configuration and provides end point of Exchange Web Service (EWS) such that clients can utilize EWS related feature like getting free busy information. The following TechNet explains more about Autodiscover.

Autodiscover service

https://technet.microsoft.com/en-us/library/bb124251(v=exchg.160).aspx

When Outlook client attempts to autodiscover, Outlook tries to connect the following URLs.

1) URL defined in SCP (Service Connection Point) in On-premises Active Directory.

2) https://<SMTP-address-domain>/autodiscover/autodiscover.xml

3) https://autodisocver.<SMTP-address-domain>/autodiscover/autodiscover.xml

4) <SMTP-address-domain> defined in Local XML

5) http://autodisocver.<SMTP-address-domain>/autodiscover/autodiscover.xml

6) _Autodiscover._tcp. <SMTP-address-domain> (SRV Record)

Let me explain some key words and detail behaviors.

What is SCP ?

SCP is abbreviation for Service Connection Point, which means connection end points for Exchange related service. SCP is created for each CAS (in Exchange 2007/2010) or Mailbox server. SCP can be found at Active Directory Configuration partition by using ADSI Editor as follows.

　[Configuration] – [CN=Configuration,DC=example,DC=local] – [CN=Services] – [CN=Microsoft Exchange] – [CN=<Organization Name>] – [CN=Administrative Groups] – [CN=Exchange Administrative Group (FYDIBOHF23SPDLT)] – [CN=Servers] – [CN=<CAS or Mailbox server name>] – [CN=Protocols] – [CN=Autodiscover] – [CN=<CAS or Mailbox server name>]

Outlook client gets the list of SCP from Active Directory (AD) and then finds URL to connect.

Which SCP does Outlook client access?

We should be aware of which AD site clients belong to.

Outlook looks at Keyword attribute in SCP from the SCP list. This Keyword attribute contains AD site name and Outlook checks if its AD site matches with the one defined in the Keyword attribute. If Outlook finds SCP whose Keyword attribute matches with its AD site, Outlook sends Autodiscover request to URL defined in ServiceBindingInformation attribute of that SCP.

If there aren’t any SCP which has client’s AD site, Outlook attempts to connect each SCP in the order of the SCP list obtained by LDAP query. There is no sort mechanism in SCP list so in general Outlook connects to SCP in random order. (As a rule of thumb, it is the order by the time SCP was created).

In other words, autodiscover access point is configurable by changing Keyword or ServiceBindingInformation attributes. Those attributes can be defined by Set-CleintAcessServer command and Keyword attribute corresponds to AutodiscoverSiteScope parameter and ServiceBindingInformation attribute to AutodiscoverServiceInternalUri parameter.

There is TechNet article which explains how to control target SCP by utilizing AutodiscoverSiteScope parameter.

Configure the Autodiscover Service to Use Site Affinity

https://technet.microsoft.com/en-us/library/aa998575(v=exchg.141).aspx

Non-domain joined Outlook client scenario

Non-domain joined or Workgroup clients cannot access SCP, so those clients start trying to connect from Step (2) explained above. It means we need DNS A record for autodiscover.<smtp-address-domain> or hosts file which has  autodiscover.<smtp-address-domain> entry.

Resource/Account forest scenario

If you are running Exchange in resource/account forest topology, you have user accounts and clients reside in account forest and utilize “Linked mailbox” to connect to mailboxes which are in resource forest. In order for clients to successfully make autodiscover connection, you should either have SCPs in account forest or create DNS records (since SCP lookup fails).

There is an Exchange PowerShell command called Export-AutoDiscoverCnnfig to create SCP in account forest. You ran this command from Exchange in resource forest as follows.

Export-AutoDiscoverConfig -TargetForestDomainController <DC in account forest> -TargetForestCredential:(get-credential).

For more detail on Export-AutoDiscoverConfig, check up the following TechNet below.

Export-AutoDiscoverConfig

https://technet.microsoft.com/en-us/library/aa998832(v=exchg.160).aspx

SCP created in account forest has ServiceBindingInformation attribute pointing to LDAP URL of resource forest (Example: LDAP://example.com).

Outlook client attempts to connect DC in resource forest based on this LDAP URL and get ServiceBindingInformation attribute of SCP in resource forest.

How does Outlook client attempt to connect SCP if there are multiple SCPs in resource forest?

The behavior is the same as I explained previously. Outlook relies on Keyword attribute (AutodiscoverSiteScope). In other words, if SCP of CAS or Mailbox server set AutodiscoverSiteScope as AD site called “AccountForest01”, all clients in “AccountForest01” always attempt to connect  AutodiscoverServiceInternalUri of the corresponding Exchange servers.

Hybrid Exchange scenario

If you are planning to migrate Onpremise Exchange to Exchange Online, you may need to configure Hybrid Exchange. I think the importance of Autodiscover is even greater in Hybrid Exchange scenario because Autodiscover helps user connect to mailbox in Exchange Online without any manual profile setting after migration. You may wonder how Outlook detect correct target Exchange server even if mailbox is moved from Onpremise Exchange to Exchange Online. The secret is remote mailbox in Onpremise Exchange. If you move mailbox to Exchange Online under Hybrid environment, moved mailbox turns into “Remote mailbox”, which is basically mail enabled user. This mailbox conversion process is a part of mailbox migration and is done automatically.

The process of finding Autodiscover end point does not rely on mailbox location (Onpremise or cloud) but is consistent as I explained earlier. Domain-joined client first looks up SCP and attempts to connect to Onpremise Exchange servers defined in SCP. If the mailbox is moved to Exchange Online or the mailbox becomes remote mailbox, Outlook client make another autodiscover request based on RemoteRoutingAddress parapeter of the remote mailbox.

Here is how Outlook attempts to make Autodiscover request.

//// User account

Primary SMTP address:User1@contoso.com

RemoteRoutingAddress;User1@contoso.mail.onmicrosoft.com

You can check RemoteRoutingAddres by the following command-let.

Get-RemoteMailbox <User name> | FL RemoteRoutingAddress

1) Detect Autodiscover end point (URL) of SCP based on User’s primary SMTP address

(Example https://onpremEx01.contoso.com/Autodiscover/Autodiscover.xml)

Client may subsequently make autodiscover request based on contoso.com domain

2) Detect Autodiscover redirect (User1@contoso.mail.onmicrosoft.com)

3) Autodiscover tohttps://contoso.mail.onmicrosoft.com/autodiscover/autodiscover.xml

4) Autodiscover to https://autodiscover.contoso.mail.onmicrosoft.com/autodiscover/autodiscover.xml

5) Local autodiscover to contoso.mail.onmicrosoft.com

6) Redirect check to http://autodiscover.contoso.mail.onmicrosoft.com/autodiscover/autodiscover.xml

7) Autodiscover URL redirection tohttps://autodiscover-s.outlook.com/autodiscover/autodiscover.xml

8) Autodiscover tohttps://autodiscover-s.outlook.com/autodiscover/autodiscover.xml

9) Redirect check to http://autodiscover.contoso.mail.onmicrosoft.com/autodiscover/autodiscover.xml

If clients are domain-joined, Step1 is always performed and client attempts to connect to Onpremise Exchange servers.

If you enable AutoDiscover registry on Outlook Client, client skips looking up SCP even if it is domain-joined.

HKEY_CURRENT_USER\Software\Microsoft\Office\<Outlook version (Note)>\Outlook\AutoDiscover

Value Name: ExcludeScpLookup

Type : REG_DWORD

Value : 0x00000001 (1)

Note:

14.0 for Outlook 2010,15.0 for Outlook 2013 and 16.0 for Outlook 2016

Troubleshooting Autodiscover

So far, we covered a basic autodiscover behavior and how Outlook client makes autodiscover request under a few well-known scenarios.

Now I want to walk you through some troubleshooting steps so that you understand if autodiscover is working or what is going wrong.

Check with Test E-mail AUtoConfiguration

Test E-mail AutoConfiguration is your friend. Test E-mail AtoConfiguration helps you to check if Autodiscover succeeds or how far AUtodiscover process goes till it fails.

1) Start Outlook.

2) Logon to Outlook profile and then right click on Outlook icon in Task tray.

3) Click “Test E-mail AutoConfiguration”

4) Enter correct email address if needed and provide credential if asked.

5) Check only “Use Autodiscover”

6) Check “Results” tab if autodiscover succeeds and check “Log” tab to see where autodiscover fails.

Here is a sample.

7)
If you are familiar with Autodiscover response (XML), checking “XML” tab helps you see if client receive expected response.

-------------- Additional tips -----------------

You can utilize Test E-mail AutoConfiguration even if you don’t have any Outlook profile.

Here are the steps.

1) Delete all profiles and start OUtlook

2) Enter Outlook profile name and click "OK".

3) Click "Cancel" and then "OK" for dailogue box not to create a profile.

4) Click "Next" for Profile creation wizard.

5) Click "No" and then click "Next"

6) Check "Use Outlook without an email account" and click "Finish"

------------------------------------------------

Test with browser access

You can use any browser to access Autodiscover endpoint. If it fails, you may have network issue or other causes that prevent you from accessing it.

If Outlook client is non-domain joined,AutoDiscover endpoint is most likely  https://autodisocver.<SMTP-address-domain>/autodiscover/autodiscover.xml.

Open up any browser and try accessing that endpoint.

You will be asked for credential and if you provide correct credential and see the following response below, you can successfully access the endpoint. If not, you should troubleshoot further (It is most likely network related troubleshooting)

<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">

<Response>

<Error Time="06:32:34.3818286" Id="413347856">

<ErrorCode>600</ErrorCode>

<Message>Invalid Request</Message>

<DebugData/>

</Error>

</Response>

</Autodiscover>

Test with ExRCA

Remote Connectivity Analyzer or ExRCA helps you diagnose Autodiscover, Outlook connectivity or EWS related issues.

Here are the steps

1) Access the following URL

https://testconnectivity.microsoft.com/

2) If you want to check Autodiscover connectivity, check “Outlook Autodiscover”.

3) Enter SMTP address and credential for the user you want to test, and then Click “Perform test”

4) If you see “Connectivity Test Successful” as a result, you have no issue. If not, you should expand each test phase and you can get detail error like below.

Closing

Thank you very much for reading through this long blog and I hope you understand some basics of Autodiscover and are equipped with troubleshooting tips. It would be great if this content benefits those who plan, deploy and manage Exchange Server infrastructure.

Hi there,

we have multiple AD Sites and on each Site one MultiRole Exchange 2010SP3 Server. I have a question, regarding GrantSendOnBehalf Right Management for Shared Mailboxes. 

First type/usage for SharedMailboxes:

Shared Mailbox and one GlobalSecurityGroup for FullAccess on SharedMailbox.

The Global Security Group contains each Member who needs access to the Mailbox and has the FullAccess Right of the SharedMailbox. 

Second type/usage for SharedMailboxes:

All Settings of the first type. 

Additionally 1 universal security Group, which contains the Members who need to send E-Mails outside the SharedMailbox. 

This Universal Group with Type "Security" has the right "GrantSendOnBehalfTo" of the SharedMailbox. 

This works fine.

But, i´m a bit confused, about the two "Group Types" which can be used in EMC. There are "Security" and "Distribution". Both types are working well in my situation. I can use the Type "Security" or "Distribution" for Managing the "GrantSendOnBehalf" Permission. 

If i compare two groups, one "Universal Distribution Group" and one "Universal Distribution Group, Security Enabled"

There are a few attributes which are different. 

GroupType --> Universal,SecurityEnabled / Universal

MemberDepartRestriction --> Closed/Open

RecipientType --> MailUniversalSecurityGroup/MailUniversalDistributionGroup

UMDtmfMap --> 

Can someone explain a best practice for my situation? 

Thanks in advance. 

Hi folks,

I migrate from one Forest A to Forest B.

Ive a two way trust, mailbox move, free busy and mailbox delegations in coexistenz works perfect.

But if I want to map an Mailbox from a user in Forest "A" with a user in Forest "B" and Client in Forest "B" i get a credential popup.

If I log in with UPN from this same/old User Account from Forest "A" I can map the mailbox.

But why comes this credential popup?

In RPC Log in Forest A I see the following

2018-11-22T20:48:47.981Z,22,0,/o=Quelle Organisation/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=9aa389978b004cf298e264dc6541c3f3-stev,,OUTLOOK.EXE,16.0.4266.1001,Cached,10.3.110.132,::1,ncacn_ip_tcp,,Connect,1010 (rpc::LoginPerm),00:00:00,"SID=S-1-5-21-1313420124-2227428348-856588953-1350, Flags=None",RpcDispatch: [LoginPermException] 'User SID: S-1-5-21-1313420124-2227428348-856588953-1350' can't act as owner of a MailUser object '/o=Quelle Organisation/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=9aa389978b004cf298e264dc6541c3f3-stev' with SID S-1-5-21-3386154569-1807573594-3971606385-1185 and MasterAccountSid  (StoreError=LoginPerm)

Where S-1-5-21-33861.. is Forest "A"

I set ad-permissions full access on the mailbox on Forest "A" with User from Forest "B".

Any ideas?

Regards

I've come across a weird instance where the journaling account we use to archive our email offsite has ballooned up the database but when you look at the mailbox statistics the mailbox size is normal but the AttachmentTableTotalSize is gigantic.  We have the mailbox policy set to purge Deleted Items every day but it doesn't seem to be clearing out attachments somehow.  I've tried googling what exactly the AttachmentTableTotalSize is but the results seem pretty limited.  Currently the only way I have been able to purge the mailbox is to migrate it do a different database and then migrate it back.  I'm running Exchange 2013 CU 20 and we first noticed the behavior back in CU 19.  I'm wondering if anyone else has come across this and has a better solution than just migrating the mailbox back and forth between databases.

Hi Everyone,

We've a Server 2012 Remote Desktop implementation with Outlook 2013 and Exchange 2013.

In Outlook users only get the last 30 days of emails when doing searches

-The Exchange has been rebooted and the indexing service is up

-The Content Index for the mail database is fine

-The Windows Search service is up on all RDS servers

-They're not in cached mode

-I've tried rebuilding the index

-They don't have a .ost with not being in cached mode

The one thing I can find that seems to be wrong is that Outlook is not listed in the User's indexing options as below. On the left is my local machine, with Outlook under indexing, on the right is what users in the RDS environment see.

Given everything else I suspect this is the problem but don't know how to get Outlook back into the list of indexed locations.

I've seen advice suggesting a repair install of Outlook but this did not help.

Does anyone have any other suggestions?

Thanks

Paddy

Dears,

I have  Exchange 2013 CU20, We have distribution groups where we assign users as owners so they can add/remove members in groups from outlook. It seems after upgrading to CU20 from CU 11 ,

they are not able to add/remove users using outlook but they can from OWA. Please help me to figure out how I can fix this issue.

Error on Outlook whey try to add/remove from group

"Changes to the public group membership cannot be saved"

Regards
Usman

Usman Ghani - MCITP Exchange 2010

Good afternoon,

We are currently experiencing an issue with one of our mail servers, where the Mailbox Assistants services is crashing and restarting 3-4 times a minute.

The error I get is as follows:

Watson report about to be sent for process id: 14596, with parameters: E12IIS, c-RTL-AMD64, 15.00.1367.003, MSExchangeMailboxAssistants, M.Exchange.StoreProvider, M.M.MapiContainer.SetSearchCriteria, M.E.D.Storage.StoragePermanentException-26257, b934-407a, 15.00.1367.000.
ErrorReportingEnabled: False

The last process to start up before it crashes is the Calendar repair service, every time.  This only starting happening after we migrated some users from an old 2007 server to a 2013 server.  previously it was working fine.

I've looked through the logs and all tried to google a result, but nothing is relative to this, especially since the Watson error cites a StoragePermanentException.

We do have other users who were on the 2013 server, who worked without any issues at all.

Thanks in advance

hi all,

we have a shared Mailbox with enabled auditing.

User X del a mail - no Information in auditlog

User X del a mail with SHIFT-DEL search-mailboxauditlog Show SOFTDELETE (i think this is harddelete)

User X create a appointment and cancel the appointment - no Information in Audit log

why

is this not enough: Set-Mailbox -Identity "xyz" -AuditEnabled $true

Chris

Hello folks,

We activated our secondary server (caretaker) in the DAG for the database in ECP servers/databases.

Migrated our primary server to different location (using VMware SRM), started up primary (paladin), but unable to fail the database back.  I ran these command on Paladin in attempt to resolve.

net stop clussvc

net start clussvc /forcequorum 

Now the database is Active on both servers and not working right, with error.  Our email is still functioning though.  Any suggestions for how to proceed?

Hello

Included two new servers to an existing cluster and while adding disks for databases I noticed that the numbers of system disks are the same. Because of this, when i add a disk to the second server, it is not defined as the server's own disk, but as a cluster disk.

Is it possible to change this number and won't it break the  servers?

hi all, 

we have exchange 2013 server node and currently we are facing issue that emails received to mobile and once received on on outlook it will appear .

any idea how to fix this issue .