SCOM and the Exchange Test CAS Connectivity User Account

This is just a quick post to highlight an issue that I've seen in 3 out of the last 5 SCOM installations that I have been involved with that have Exchange 2010 as their messaging environment.

A pre-requisite for the Exchange 2010 Management Pack is that a test mailbox account be setup for synthetic transactions using an existing Exchange 2010 powershell script that comes bundled with the Exchange 2010 installation called:

'New-TestCasConnectivityUser.Ps1'

Below are the instructions from the Exchange 2010 Management Pack guide on how to create the test account using the above script:
 
In this procedure you create test mailboxes for Outlook Web App, Exchange ActiveSync, and Exchange Web Services to monitor connectivity by using PowerShell to run the New-TestCasConnectivityUser.ps1 script.

1. Open the Exchange Management Shell.

2. In the Shell, change directory to the C:\ Program Files\Microsoft\Exchange Server\V14\Scripts folder by running the following command:

Set-Location “C:\Program Files\Microsoft\Exchange Server\V14\Scripts”

3. Run the test-user script using the following command:

New-TestCasConnectivityUser.ps1

4. Follow the on-screen installation instructions in the Shell to create the test mailbox. You'll be prompted to enter a temporary secure password for creating test users. You'll also be prompted to specify the Mailbox server where you want the test user created. 
5. Repeat this process on an Exchange 2010 Mailbox server in each Active Directory site that you want to test.

When following these instructions, you might get hit with the following error:

CreateTestUser : Mailbox could not be created. Verify that OU (Users) exists and that password meets complexity requirements.

The solution that I have found to this problem has been to modify the New-TestCasConnectivity.Ps1 script and remove the parameter '-OrganisationalUnit:$OrganisationalUnit'

This parameter is responsible for specifying the OU that the new account will be created into and when it is removed from the script, the script simply runs and installs the account into the default 'Users' OU as it should.

I came across this solution from the following blog post:

http://www.definit.co.uk/2011/03/exchange-2010-createtestuser-mailbox-could-not-be-created-verify-that-ou-users-exists-and-that-password-meets-complexity-requirements/

Hope this helps!

New SCOM Exchange 2010 SP1 Management Pack

Microsoft have just released (well 2 days ago but I didn't get around to blogging until today about it!), the updated Microsoft Exchange 2010 Management Pack which includes support for Microsoft Exchange 2010 Service Pack 1 and the associated roll-ups that SP1 comes with.

There are quite a few significant changes to this Management Pack that makes it even better than the original Exchange 2010 MP that was released last year.

Here's some of the highlights that are included in this new update:

• Capacity planning and performance reports - New reports dig deep into the performance of individual servers and provide detailed information about how much capacity is used in each site. 

• SMTP and remote PowerShell availability report - The management pack now includes two new availability reports for SMTP client connections and management end points. 

• New Test-SMTPConnectivity synthetic transaction - In addition to the inbound mail connectivity tasks for protocols such as Outlook Web App, Outlook, IMAP, POP, and Exchange ActiveSync, the Management Pack now includes SMTP-connectivity monitoring for outbound mail from IMAP and POP clients.

• New Test-ECPConnectivity view - Views for the Exchange Control Panel test task are now included in the monitoring tree. 

• Cross-premises mail flow monitoring and reporting - The Management Pack includes new mail flow monitoring and reporting capabilities for customers who use our hosted service. 

• Improved Content Indexing and Mailbox Disk Space monitoring - New scripts have been created to better monitor context indexing and mailbox disk space. These new scripts enable automatic repair of indexes and more accurately report of disk space issues. 

• The ability to disable Automatic Alert Resolution in environments that include OpsMgr connectors -    When you disable Automatic Alert Resolution, the Correlation Engine won't automatically resolve alerts. This lets you use your support ticketing system to manage your environment.

• Several other updates and improvements were also added to this version of the Management Pack, including the following. 

• Suppression of alerts when the alerts only occur occasionally was added to many monitors. 

• Most of the event monitors in the Exchange 2010 Management Pack are automatically reset by the Correlation Engine. Automatic reset was added to those event monitors so that issues aren't missed the next time they occur.

• Monitoring was added for processes that crash repeatedly. 

• Additional performance monitoring was added for Outlook Web App. 

• Monitoring of Active Directory access was improved. 

• Monitoring of anonymous calendar sharing was added. 

• Reliability of database offline alerts was improved. 

• Monitoring for the database engine (ESE) was added.

Also, Microsoft had promised that they would update their documentation guide for the original Exchange 2010 MP to include information on making the Microsoft Exchange Monitoring Correlation Service Highly Available in a cluster environment but I didn't see anything in the new and updated guide in relation to this. See my earlier blog posts on this if you want to make the Correlation Service Highly Available:

http://kevingreeneitblog.blogspot.com/2011/04/clustering-scom-microsoft-exchange.html

If you are one of the many thousands who have already deployed the original SCOM Exchange 2010 MP, then you will need to download the new updated one from the link below and import it into your SCOM infrastructure as you had done previously with the older MP (you can't update this MP from the SCOM Catalog automatically - it needs to be downloaded first and then have it's .MSI file run to accomodate the Correlation Service installation)

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=7150bfed-64a4-42a4-97a2-07048cca5d23

As always, don't forget to read the MP guide fully before you install the MP into your live environment and implement any recommendations that the guide gives around configuration and alert tuning.

Happy SCOMming!!!

Clustering the SCOM Microsoft Exchange Monitoring Correlation Service Part 2

In part 1 of this guide, I explained what the Microsoft Exchange Monitoring Correlation Service was and in this part, I will demonstrate what is needed to make this service Highly Available.

Follow the steps below to begin your configuration:

• Run the .msi installer for the Exchange 2010 MP on all cluster nodes first as this creates the ‘Microsoft Exchange Monitoring Correlation’ service

• Go to the ‘services.msc’ snapin on each cluster node and stop the ‘Microsoft Exchange Monitoring Correlation’ service 

• Set the startup type for this service on all nodes to ‘Manual’ 

• Edit the CONFIG file located at 'C:\Program Files\Microsoft\Exchange Server\V14\Bin\Microsoft.Exchange.Monitoring.CorrelationEngine.exe' for the Microsoft Exchange Monitoring Correlation Service to reflect the Virtual RMS Cluster name (it is set as 'Localhost' initially and this is what needs to be changed)

• Provision a LUN from your shared storage and present it to the cluster nodes (1GB or 2GB should be more than enough)

• From one of the cluster nodes, open 'Failover Cluster Manager' from the 'Administrative Tools' menu, expand your cluster name, right mouse click on 'Services and Applications' and then click on 'Configure a Service or Application' to open the 'High Availability Wizard'

• Select 'Next' and then click on 'Generic Service'

• Click 'Next again and then select 'Microsoft Exchange Monitoring Correlation' from the 'Select Service' window

• Click 'Next and then input in the name and IP address that you are going to assign to the newly clustered service

• Select your shared storage that you had presented to the cluster previously

• Don’t bother selecting any registry settings to transfer over as the service is already installed on the other nodes. 

• Click on ‘Next’ until you come to the review page, then click on ‘Finish’ to complete the service clustering. 

• Test service cluster failover by moving the service between nodes using ‘Failover Cluster Manager’ and keep an eye on the service state from the ‘services.msc’ snapin as this should go from started to stopped on the current node, then from stopped to started on the new node you have chosen to move the service to. 

This completes your Microsoft Exchange Server 2010 Monitoring Correlation Service clustering.

All that’s left to do now is to import the Exchange 2010 MP into your environment and then tune away those noisy alerts (if any!)

Clustering the SCOM Microsoft Exchange Monitoring Correlation Service Part 1

It's not often I get to install SCOM into RMS clusters and this week was no exception. I'm finishing off a project that involves the installation of a SCOM 2007 R2 Highly Available environment configured as an RMS cluster on an SQL 2008 R2 cluster.

See the link below for the initial SCOM cluster installation steps:

http://kevingreeneitblog.blogspot.com/2011/02/clustering-scom-2007-r2-rms-role-on.html

The part of this project I am working on this week is based around a new Highly Available Exchange 2010 messaging environment and bringing this into the existing SCOM infrastructure.

Now, for those of you that are used to installing the Exchange 2010 Management Pack, you will be familiar with a new method that Microsoft have been pursuing in relation to management packs, and this is based around the new 'Microsoft Exchange Monitoring Correlation Service'.

The 'Microsoft Exchange Monitoring Correlation Service' is basically a noise reduction utility that sits between the Exchange 2010 and SCOM environments and filters out unnecessary alerts before you even need to start thinking about tuning!

It's based on nearly 2 years of in-house deployment from the MSIT team on their own SCOM and Exchange 2010 environment.

The Microsoft Exchange Monitoring Correlation Service installs itself as a standard Windows Service on the SCOM RMS and is viewable from within the 'services.msc' snap-in.

When I install a Management Pack into SCOM, no matter how often I have installed the same MP into other SCOM environments, I will always read the MP guide that accompanies the Management Pack as it can contain valuable information on configuration and initial tuning settings that need to be deployed to get the most out of your new MP.

When I started to read through the Exchange 2010 MP guide, I was looking specifically for instructions on clustering the Correlation Service as there's no point in having a HA environment for your RMS and SQL services and then not having the main noise reduction service for your Exchange 2010 MP not failing over to your other cluster nodes in the case of an emergency. The Exchange 2010 MP guide unfortunately has no information on clustering this service at all and after searching the web for some additional info, all I found was some references to it being added to the next version of the Exchange 2010 MP guide - whenever that gets released!! I set about clustering this service using the Failover Clustering Wizard that is built into Windows Server 2008 R2 and decided to blog about it for anyone else who finds that the Microsoft documentation falls just short of this type of information.

In part 2 of this short guide, I will demonstrate how to cluster this service and make it Highly Available within your SCOM environment.

Exchange 2010 Backup-Less Configuration

How would you like to never have to do another backup of your Exchange 2010 environment again? Well if you are using or intend on implementing DAG within your Exchange 2010 environment, then read on to revolutionize your backup strategy!!

When Exchange 2010 was in Beta I heard the rumours that if configured properly you could do away with traditional tape or disk based backups and use the High Availability functionality of DAG to achieve maximum up time. In fairness, since then I then thought nothing else of it and never looked into how exactly you could go about creating this type of solution - until now!

I received a request from a customer to investigate the possibility of implementing this within their existing DAG environement and I am very impressed with the information I found and the process involved in implementing it.

Here's a quick summary of whats involved in implementing the solution:

The requirements needed for a backup-less implementation of Exchange 2010 DAG are as follows:

• Windows Server 2008 Enterprise on all Exchange 2010 servers
• Exchange Server 2010 Standard or Enterprise Edition
• Circular Logging Enabled
• A minimum of 3 DAG copies of each active mailbox database within the DAG environment spread across different geographical locations for disaster recovery
• Lagged copies of each database preferably stored on a separate Exchange 2010 server within the DAG environment that has DAG Activation disabled
• Deleted Item Retention Policies to be reviewed
• Single Item Recovery Enabled on either each entire mailbox database or the top priority mailbox users within the organisation – i.e. Senior Management mailboxes
• Public Folder Replication Policies need to be in place if Public Folders are in use

The most comprehensive and intuitive source that I found on this topic comes from the guys over at msexchange.org. Exchange MCM and MVP Henrik Walther has created an excellent four part guide on this exact solution and you can view the entire postings from the links below:

http://www.msexchange.org/articles_tutorials/exchange-server-2010/high-availability-recovery/eliminating-traditional-backups-using-native-exchange-2010-functionality-part1.html

http://www.msexchange.org/articles_tutorials/exchange-server-2010/high-availability-recovery/eliminating-traditional-backups-using-native-exchange-2010-functionality-part2.html

http://www.msexchange.org/articles_tutorials/exchange-server-2010/high-availability-recovery/eliminating-traditional-backups-using-native-exchange-2010-functionality-part3.html

http://msexchange.org/articles_tutorials/exchange-server-2010/high-availability-recovery/eliminating-traditional-backups-using-native-exchange-2010-functionality-part4.html

Now, time to throw away those backup tapes...................................!!!

Exchange 2010 Tested Solutions

The guys over at the Exchange Team in Microsoft have come up with an initiative in conjunction with a number of hardware providers to create and test different solutions for Exchange 2010 deployments and then have produced white papers on each test environment.

For example, if you want to know how an Exchange 2010 installation running on 500 mailboxes in a single site based on Hyper V using Dell hardware is configured and operates, then you can download the white paper from the link below!

They have included a number of different scenario's incorporating different Exchange and hardware configurations and will be adding to this link some more white papers in the near future.

Download the white papers from here:

http://technet.microsoft.com/en-us/library/gg513520.aspx

Publishing Outlook Anywhere Using NTLM Authentication With Forefront TMG or Forefront UAG White Paper

Here's a brand new White Paper released by Greg Taylor - Microsoft Senior Program Manager on Exchange Server. It goes through all you need to know to publish Outlook Anywhere using either TMG or UAG.

I could have done with this white paper 7 months ago when I first deployed OA in UAG though!!!

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=040b31a0-9a69-4278-9808-e52f08ffaee3

Microsoft BPOS - How to configure an iPhone for BPOS Exchange Online

I came across this article in one of my all time favorite IT sites - Daniel Petri's http://www.petri.co.il/ - I started using this site way back when I started out studying for my old Windows NT 4 MCSE.

Anyhow, as more and more people have iPhones and more and more companies are moving to BPOS, here's the link to an article explaining what you need to do to configure your iPhone with BPOS:

http://www.petri.co.il/iphone-configuration-for-bpos-exchange.htm?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Petri+%28Petri+IT+Knowledgebase%29

Enjoy!

Exchange 2010 Virtualisation Support

I have decided to post this for those of you not familiar with Microsoft's stance on virtualising Exchange Server 2010 as there seems to be conflicting reports of what is and is not supported within a virtual environment.

Microsoft supports Exchange Server 2010 in a virtualised environment with just two exceptions.

Hyper V is of course supported as well as all vendors that are listed on the 'Server Virtualisation Validation Platform' listed here: http://www.windowsservercatalog.com/svvp.aspx?svvppage=svvp.htm

The Exchange 2010 UM role is the only role not supported in a virtual environment (it still works if you want to try it, just not supported by MS!)

Here's the catch however that most people are not aware of - Microsoft DO NOT support a virtualised DAG environment if the DAG servers are made Highly Available (HA) within the HyperVisor. Again, this configuration will work if you set it up this way, however, if you have problems and want to call Microsoft for support, they won't want to know if you have the DAG members Highly Available and configured to fail over to another host in the event of hardware failure.

Amazingly though, VMWare are quoted as recommending their VMWare HA Solution with the Exchange application-aware high availability solution which is an unsupported configuration!!

Here is a link from the Microsoft Exchange Team's Official Blog and it makes for some interesting reading on the subject!

http://msexchangeteam.com/archive/2010/11/09/456851.aspx

Exchange 2010 Personal Archive support in Outlook 2007 is here!

Finally, for those of you that are using Exchange 2010 Personal Archives and are tired of having to upgrade Outlook Clients to 2010 version, then Microsoft have recently released a rollup and hotfix that enables this support, here's the link:

http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=2458611

Active Directory and Exchange Topology Diagrammer

I came across this tool a couple of years ago, demo'd it, thought it looked great but forgot about it and never used it in a live environment.

Last week I started a project which required a full audit of a fairly large Exchange 2007 network that spread throughout 13 sites worldwide. As part of the audit, I set about creating a Visio diagram of the Exchange Organization but soon ran into trouble trying to map out all of the site links and detailed information.

That's when I remembered Microsoft's Active Directory Topology Diagrammer. This is a really handy tool when you want to create Visio diagrams of your networks and it covers Active Directory Site Structure, OU Structure and brilliantly the Exchange Organization structure too!

Download the tool from here and try it out, you will need Visio installed and with the latest Exchange stencils though for the tool to draw the diagrams properly:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=cb42fc06-50c7-47ed-a65c-862661742764&displaylang=en

Increase Exchange 2010 DAG Failover Threshold

One of our clients has a 4 member node Exchange 2010 DAG spread across 4 different countries worldwide.

The client had reported to me that one of the sites that had a slight bandwidth issue was consistently failing it's Active Mailbox Store from the local site over to it's Dublin HQ site. When we manually moved the database back over to the original local site, it would randomly fail back over to the main Dublin HQ site presumably due to the intermittent latency on the Internet connection at that local site.

The customer requested that I find a way to increase the failover threshold or tolerance for the DAG so that it doesn't fail over as frequently without losing the functionality of High Availability.

After searching for quite a while on how to do this using Exchange Power Shell I found some information relating not to Exchange Server but to the Windows Server 2008 Cluster Service (which is essentially what the DAG uses when it is created for the first time) for it's clustering technology.

Using a standard Command Prompt (cmd), I started playing with the 'cluster' command and looking into what switches it used and what they could be applied to.

Here's what I came up with:

Type 'cluster /list' to display the name of the cluster that is present on the Server

When you run a 'cluster /prop' from the cmd line, it returns a number of values relating to the cluster, two of which are the following:

CrossSubnetDelay = 1000 (this is the default 1000 milliseconds which equals 1 second per heartbeat check)

CrossSubnetThreshold = 5 (this is the default number of heartbeats that can be missed before failover)

I changed the CrossSubnetDelay value to make the heartbeat check in every 2 seconds instead of the default 1 second by using the command below:

cluster /cluster:<ClusterName> /prop CrossSubnetDelay=2000

With this new setting along with the default value of 5 seconds for the CrossSubnetThreshold setting, this now allows the Cluster service to wait for 10 seconds before initiating a failover to a different DAG member.

This value can be increased to a maximum of 4000 milliseconds once the cluster is across subnets (it is a maximum of 2000 milliseconds if you are on the same subnet)

The CrossSubnetThreshold value can be modified with a value anywhere from 3 to 10.

This workaround / solution may need some tweaking with values until you reach the desired tolerance on your DAG.

It is also worth making sure you make a note of all changes that you make before and after the above commands and as always - make sure you have a full backup of your Exchange environment before you do anything like this!!!!

Exchange 2010 Remote Management using Powershell

I've been doing a lot of work recently with Exchange 2010 and Powershell and have come across this neat way of managing the Exchange Server within your network from a remote client PC without having to install the Exchange Management Tools and do it through the GUI.


You need to complete these commands from a Windows 7 client machine (or any machine that has Powershell installed) for it to work.


Firstly, you need to enable remote scripts to run on your Windows 7 machine by typing the following command from an elevated Powershell prompt:

Set-executionpolicy remotesigned

At this point, it's worth trying to input an administrative Exchange Powershell command into your client to see if it understands it. Try entering something like:  get-mailbox

Your Windows 7 client will come back with an error stating that the command is not recognisable as an internal Powershell cmdlet - this is correct as we haven't imported the Exchange 2010 session into the local client's Powershell Library yet

Once the 'set-executionpolicy remotesigned' command is completed, enter the following commands to get control of your Exchange 2010 server:

$session = New-PSSession –ConfigurationName Microsoft.Exchange –ConnectionUri http://servername.domainname.local/PowerShell -Authentication Kerberos

(This command makes contact with the Exchange 2010 server and initiates a new Powershell session -don't forget to substitute your own servername and domainname into the line above!)

Import-PSSession $session

(This command then imports the new Powershell session into the local client library)

Now try to run the get-mailbox command again or any other Exchange 2010 Powershell command for that matter and you should now be able to work through administering your server remotely from your client pc!