Accepted Domains Facts As part of the post installation process, you must configure accepted domains.

Accepted domains identify the SMTP namespaces domains for which the organization sends or receives e-mail. There are three types of accepted domains in Exchange 2007: Type Description A domain is considered authoritative if your Exchange organization hosts mailboxes for recipients within the domain.

Authoritative

When you install the first Hub Transport server, the fully qualified domain name (FQDN) for the forest root domain is configured as an authoritative accepted domain. If your external SMTP domain (for example mycompany.com) does not match the FQDN of the forest root (such as mycompany.local), you will need to add the external SMTP domain as an authoritative domain.

A relay domain is a domain for which a server accepts mail but is not authoritative. Messages are sent to the SMTP server, then relayed to the authoritative domain. Allowing relay of mail to all domains (known as an open relay) is not a good practice, and could overload your server and result in your server SMTP server being blacklisted. There are some occasions, however, when relay for non-authoritative domains is necessary. In Exchange, you would configure one of two types of relay domains:

Relay

An internal relay is an e-mail domain where some or all of the recipients do not have mailboxes in the Exchange organization. Internal relay is handled by Hub Transport servers. Examples of situations that require an internal relay include: o When your internal system deploys both Exchange and non-Exchange mail servers. The internal relay allows routing to the mailboxes on the non-Exchange systems. o When you have two forests configured with GAL synchronization. The internal relay allows routing of messages from one forest to another. An external relay is an e-mail domain where messages are routed outside of the Exchange organization and outside of the perimeter network. Messages are relayed by Edge Transport servers.

You should know the following about creating accepted domains:

You must be an Exchange Organization Administrator to configure accepted domains. It is recommended to configure accepted domains on the Hub Transport server and populate them to the Edge Transport server using the Edge Subscription process.

To create accepted domains, either use the New Accepted Domain Wizard in the Exchange Management console, or use the New-AcceptedDomain cmdlet in the Exchange Management Shell.

Use the -Name parameter to give the accepted domain entry a name. Use the -DomainName parameter to identify the domain name. Use the -DomainType parameter to identify the accepted domain type (Authoritative, InternalRelay, or ExternalRelay). Use the /MakeDefault option to specify that the accepted domain is the default domain, meaning that it is associated with outbound messages that have encapsulated addresses for non-Exchange e-mail system interoperability. o You don't have to set this parameter if you don't have to interoperate with a non-Exchange e-mail system in your organization. 1

o o

For the first accepted domain that is created in the organization, the default value is $true. For subsequent accepted domains, the default value is $false. You cannot modify a default accepted domain. If you want to change the default accepted domain, you must create a new accepted domain and set it as the default accepted domain in the Exchange Management Shell using the /MakeDefault $true option.

Infrastructure Preparation Facts Exchange 2007 uses Active Directory for authentication, storing configuration data, recipient addressing, and message routing. Active Directory has three partitions (also referred to as naming contexts). Each partition holds different kinds of Exchange data. Component Description The schema defines the rules for how objects are created (classes) and the properties and bounds for object properties (attributes). Installing Exchange 2007 extends (modifies) the Active Directory schema by adding the following: Schema

Classes to create Exchange-specific objects, such as agents and connectors. Attributes to configure the Exchange-specific objects as well as additional attributes for existing objects such as users and groups.

Each domain controller and global catalog server in the forest holds a replica of the schema. The configuration partition stores data that includes information that includes AD site configuration, Exchange global settings, transport settings, and mailbox policies. Configuration information specific to Exchange is stored in a subfolder under the configuration partition's Services container. It includes the following:

Configuration partition

Address lists Address and display templates Client access settings Connectors Global settings E-mail address policies System policies Transport settings

Each domain controller and global catalog server in the forest holds a replica of the configuration partition. The domain partition holds all data for individual users, contacts, and mailboxes. As Exchange runs, it stores and modifies data in the domain. The domain partition stores the largest amount of information in a typical deployment. Each domain controller holds a replica of the domain partition for the domain for which it is authoritative while each global catalog server in the forest holds a subset of the information in every domain partition in the forest.

Domain partition

Before installing Exchange, make sure your Active Directory structure meets the following requirements:

The domain controller that is the Schema Master must be running Windows Server 2003 SP1 (or later). In each site where Exchange Server 2007 will be installed, there must be at least one global catalog server running Windows Server 2003 SP1 (or later). 2

In each domain where Exchange Server 2007 will be installed, there must be at least one domain controller that is running Windows Server 2003 SP1 (or later). For all domains in the Active Directory forest where Exchange 2007 is installed or where Exchange 2007 recipients exist, Active Directory must be in Windows 2000 native mode or higher. To place the domain in Windows native mode, you must remove any NT4 domain controllers. If the organization includes a previous version of Exchange, you cannot have any Exchange 5.5 servers, and the organization must be running in native mode.

Preparing and installing Exchange makes the following changes in Active Directory:

Modifies permissions of existing Exchange 2000 or Exchange 2003 environments. Extends the schema to add Exchange classes and attributes. Creates the Exchange organization. Creates Exchange-specific objects and groups. Assigns permissions to groups used by Exchange.

Running the Setup wizard during the Exchange server installation makes all of the necessary Active Directory modifications as long as the account you use has the proper permissions. However, in large organizations, administrators with permissions to install Exchange servers typically do not have the permissions necessary to modify the schema or domain configuration. For the most granular control over the Active Directory preparation process, and to delegate these tasks to other administrators, run the Exchange server Setup.com program (with specific switches) in the following order, waiting for the changes to be propagated through Active Directory before proceeding to the next step: 1. If you have an existing Exchange 2000 or 2003 configuration, run Setup /PrepareLegacyExchangePermissions (or Setup /pl) to modify the existing Exchange 2000 or Exchange 2003 permissions. o If you are a member of the Enterprise Admins group, all domains will be modified. o To run this command for a single domain, include the domain name in the command. You must be delegated the Exchange Full Administrator role and you must be a member of the Domain Admins group. o Run the command on a Windows Server 2003 SP1 (or higher) server that can contact all other domains in the forest. 2. Run Setup /PrepareSchema (or Setup /ps) to extend the schema. o You must be a member of the Schema Admins and Enterprise Admins group to perform this step. o Run the command on a computer in the same site as the Schema Master. 3. Run Setup /PrepareAD /OrganizationName: Name (or Setup /p /on: Name) to create the organization, create global Exchange objects, and prepare the local domain. If the Exchange organization already exists, omit the /on switch. o You must be a member of the Enterprise Admins group to perform this step. o Run the command on a computer in the same domain and site as the Schema Master and that can contact all domains in the forest over port 389. 4. Prepare each additional domain where you will have Exchange 2007 servers or recipients. Use one of the following methods to prepare additional domains: o Run Setup /PrepareDomain (or Setup /pd) on each additional domain. You do not need to run this on the domain where you ran /PrepareAD. You must be a member of the Domain Admins group in the domain to perform this command if the domain that you are preparing existed before you ran Setup /PrepareAD. You must be a member of the Exchange Organization Administrators group and the Domain Admins group in the domain if it was created after you ran Setup /PrepareAD. o Run Setup /PrepareAllDomains (or Setup /pad) to prepare every domain in the forest. You must be a member of the Enterprise Admins group to run this command. 3

Note: The computer that is used to run Setup must have the Microsoft .NET, Framework 2.0, and the Microsoft Command Shell installed. Perhaps the biggest consideration in deciding how to prepare Active Directory is the permissions required to perform each specific task. The following table summarizes the permissions required for each: Option /PrepareLegacyExchangePermissions /PrepareSchema Required Permissions

Enterprise Admins group membership to modify all domains. Delegated the Exchange Full Administrator role and Domain Admins group membership to modify a single domain.

Schema Admins and Enterprise Admins group memberships.

/PrepareAD

Enterprise Admins group membership if the schema is already prepared. Schema Admins and Enterprise Admins group membership if the schema has not yet been prepared. In addition, you must be an Exchange Full Administrator if there are existing Exchange 2003 servers. Domain Admins group membership if the domain existed before you ran /PrepareAD. Exchange Organization Administrators group membership and Domain Admins group membership if the domain was created after you ran /PrepareAD.

/PrepareDomain

/PrepareAllDomains

Enterprise Admins group membership.

When you use Setup to prepare Active Directory for Exchange server installation, be aware of the following special cases:

If you run the Setup wizard with appropriate permissions, the following actions are performed: legacy permissions are modified, the schema is extended, the organization is created, and the local domain is prepared. This is the most efficient way to do the preparation and the installation if you have all of the necessary permissions. Running /PrepareAD modifies legacy permissions and extends the schema if those steps have not yet been performed (as long as you are a member of the Schema Admins and Enterprise Admins groups). Running /PrepareSchema modifies legacy permissions if that step has not yet been performed. Running /PrepareAllDomains is the most efficient way to prepare domains for Exchange installation, but requires membership in the Enterprise Admins group. Because you can only create a single organization in a forest, you must create a second forest to accommodate two organizations. Run Setup /PrepareAD /on in each domain to create the organizations. All domains with Exchange 2007 servers or recipients must be prepared. Domains are prepared for Exchange if you have run /PrepareAD or /PrepareDomain in the domain, or if you run /PrepareAllDomains.

In addition to preparing Active Directory, you must have a good DNS infrastructure prior to Exchange installation. Exchange Server 2007 uses DNS for the following:

An Exchange server contacts DNS to get service locator records (SRV) to locate Active Directory domain controllers. An Exchange server contacts DNS servers to retrieve MX (mailbox) records and to locate SMTP domains. Edge Transport servers must be configured as follows: 4

The internal interface must be configured to resolve internal addresses. The external interface must be configured to resolve Internet or public DNS names. An Exchange server uses DNS to resolve hosts names, especially when locating hosts on the Internet.
o o

Exchange Management Console Facts The Exchange 2007 Management Console is a graphic interface used to manage an Exchange environment. It has been simplified from previous versions of Exchange so it now focuses only on the most commonly executed tasks. Additional tasks that could traditionally only be performed in REGEDIT or ADSIEDIT were also added to the Exchange Management Console to improve ease of use. You should know the following about the Exchange Management Console:

In Exchange 2003, the information shown in the tree-pane was dependent on the configuration of your Exchange Server. This pane is now static in the Exchange 2007 Management Console so no matter how many servers you have, what options have been chosen, or what has been installed, the tree-pane will always be the same. Many tasks can't be performed through the Exchange Management Console, only through the Exchange Management Shell. The Exchange Management Console can filter views.

The console tree is organized into nodes and sub-nodes which can be expanded up to eight or more levels. The nodes in the console are as follows: Node Description

The Microsoft Exchange node allows you to view the Finalize Deployment and End-to-End Microsoft Exchange Scenarios tabs. These tabs help you to complete the required and optional configuration tasks for node the server roles you deployed. Organization The Organization Configuration node configures global and system-wide data for all servers and Configuration node users in the Exchange 2007 organization. Server The Server Configuration node configures the Exchange 2007 servers and their Configuration node components such as protocols, databases, and messaging records management. Recipient The Recipient Configuration node manages the recipients in the Exchange 2007 organization. Configuration node Edge Transport node The Edge Transport node is visible only from a computer that has the Edge Transport server role installed and is used to manage your organization's perimeter network. The Toolbox node contains the following tools:

Toolbox node

Queue Viewer Exchange Server Best Practices Analyzer Database Recovery Management Database Troubleshooter Performance Monitor Performance Troubleshooter Mail Flow Troubleshooter Message Tracking

Anti-spam and Antivirus Facts Exchange 2007 has included multiple anti-spam and antivirus agents to detect and reduce malware. The anti-spam agents work cumulatively to reduce the amount of unsolicited e-mail that enters an organization. The following table describes the various components in the order in which they are applied. Filter Description

The IP Allow List is an administrator-defined list of IP addresses, IP address ranges, or IP address and IP Allow List subnet masks. If an IP address or IP address range matches an entry on the IP Allow list, the Connection Filter agent forwards the message to the Sender Filtering process. The IP Block List is an administrator-defined list of IP addresses, IP address ranges, or IP address and subnet masks. If an IP address or IP address range matches an entry on the IP Block list, the IP Block List Connection Filter agent drops the SMTP connection and the message. You can set an expiration time for each entry on the IP Block list. When the expiration time is reached, the entry is no longer blocked. IP Allow List provider services (often referred to as IP safe lists or white lists) compile lists of IP IP Allow List addresses that are not spam producers. When you configure a list provider, the Connection Filter agent Providers queries the list provider to see if the IP address is on the approved list. If the list provider approves an IP address, the Connection Filter agent forwards the message to the Sender Filtering process. IP Block Provider services (often referred to as real-time block lists or RBLs) compile lists of IP IP Block List addresses from which spam originates. The Connection Filter agent queries the IP Block List provider Providers service to see if the connecting IP address is on the list. If it is, the Connection Filter agent drops the SMTP connection and the message. Sender Filtering compares a sender to an administrator-defined list of senders or sender domains that are not allowed to send messages to the organization. To block a sender, use one of the following methods:

Sender Filtering

To block a single sender, use the format: username@domainname.com. To block an entire domain, use the format: *@.domainname.com. To block an entire domain and all subdomains, use the format: *@*.domainname.com.

You can configure two different actions for a message from a blocked sender:

Reject message deletes the message and sends a Non-Delivery Report (NDR). Stamp message accepts the message, but labels the message as having come from a blocked sender.

Recipient Filtering examines the recipient address to make decisions about accepting or rejecting messages. Recipient Filtering uses two data sources:

Recipient Filtering

The Recipient Block List identifies specific recipients that are blocked from receiving messages. Recipient Lookup compares the recipient address with the list of valid recipients within your organization. To use Recipient Lookup on an Edge Transport server: 1. Subscribe the server to an Active Directory site. The server can then search for recipient information in the ADAM database. 2. In Recipient Filtering, select the Block messages sent to recipients not listed in the Global Address List option. This compares the recipient address with valid addresses within your organization.

Note: The Recipient Filter agent only performs lookups for authoritative domains. An Edge Transport Server that is not configured as authoritative but accepts and forwards messages for another domain does not perform recipient lookups. It still blocks non-authoritative recipients specified in the Recipient 6

Block List, though. When the Recipient Filtering agent processes a recipient, it will take one of two actions:

If the recipient does not exist in the organization, if it is on the block list, or if it is prevented from receiving mail from the Internet, a User unknown message is sent to the sending server. If the recipient is enabled to receive Internet mail, is a valid recipient, and is not on the block list, a Recipient OK message is sent.

The automatic sending of responses to the sending server regarding recipient status could allow spammers to stage a directory harvest attack where messages are sent to common recipients in your organization, looking for valid and active accounts. To prevent the effectiveness of these attacks, Exchange includes a feature called tarpitting. Tarpitting delays the return of the status messages (by default 5 seconds), making automated processing on the sending system difficult to implement. To configure the response time, use Exchange Management Console or Exchange Management Shell to set the TarpitInterval value on the Receive connector. Sender ID is designed to quell spoofing which occurs when a spammer impersonates a legitimate sender and domain. Sender ID depends on the IP address of the sending server, which is also known as the purported responsible address (PRA). Sender ID uses Sender Policy Framework (SPF) records published on DNS servers to identify the valid mail senders for a specific domain.

When the Edge Transport server receives an incoming connection, it queries the sender's domain for an SPF record. If an SPF record exists, the Edge Transport server determines if the sending server's IP address is authorized to send e-mail from that domain.

Sender ID Filtering

You can configure the following actions to take if the sender fails the checks:

Reject the message and send an NDR message to the sending server. Delete the message and send a fake OK message to the sending server. This prevents the sending server from retrying message delivery. Stamp the message with a Sender ID status and continue delivery. The Sender ID status is used by the Content Filtering agent to compute the Spam Confidence Level (SCL). This is the default action.

Note: If the From: IP address is missing, the Sender ID status cannot be set. In this case, Exchange continues to process the message without updating the Sender ID, but the message is not deleted or rejected. Content Filtering uses the Intelligent Message Filter, a machine-learning technology that evaluates email messages based its knowledge of both legitimate and spam e-mail characteristics. The Content Filter evaluates messages, calculates the likelihood of the message's legitimacy, and assigns the message a Spam Confidence Level (SCL) of 0-9, with 9 most likely being spam. Content Filtering You configure the Content Filtering agent to take specific actions on messages that reach a certain threshold value. If the SCL is equal to or greater than the threshold value you can:

Quarantine the message on the server. Reject the message with a rejection notification sent to the originator. Delete the message without a rejection message being sent to the originator.

Note: The Intelligent Message Filter does not scan messages over 11 MB. Messages over 11 MB pass 7

through the Content Filtering agent without being processed. You can further customize the Content Filter agent in the following ways:

Allow Phrases are approved words or phrases. They automatically get an SCL of 0. Block Phrases are unapproved words or phrases and get an automatic value of 9. You can add SMTP e-mail addresses, senders, and sender domains as exceptions to which filtering does not apply. If you have a subscription on the Edge Transport server, you can configure safelist aggregation. Safelist aggregation collects the Safe Senders List, Safe Recipients List, and trusted contacts from individual Outlook users and aggregates (combines) these lists into a single exception list to the Content Filtering rules.

Note: You can configure allowed recipients (exceptions) through the Management Console. The only way to configure allowed senders is by using the Set-ContentFilteringConfig cmdlet with either the BypassedSenderDomains or -BypassedSenders switches. Sender reputation is determined using persisted data about the IP address of the sending server. From this data, the system generates a Sender Reputation Level (SRL). SRLs are calculated using the following statistics:

Sender Reputation

HELO/EHLO analysis uses the HELO and EHLO commands to retrieve information about the domain name or IP address of the sending SMTP server. Spammers frequently forge the HELO/EHLO to use it for malicious purposes. Reverse DNS lookup submits the sending server's IP address to DNS and compares the result with the domain name in the HELO/EHLO command. Previously calculated SCL ratings are used to identify servers that send a high proportion of spam messages. An open proxy test checks to see if the sending server is configured as an open SMTP proxy. The Edge Transport server attempts to connect back to itself from the sending SMTP server. If the connection is successful, the sending server is identified as an open proxy. IP reputation anti-spam updates from Microsoft Updates is also used to calculate the SRL.

The SRL is a number between 0 and 9 that indicates if a sender is likely a source of spam. The closer to 9 the assigned SRL is, the more likely the sender is a source of spam. When you configure Sender Reputation, you set a threshold and a time duration.

The threshold identifies the SRL block value. For messages at or above the threshold, the sender is added to the Blocked Senders list. The action taken on the message depends on the settings for Sender Filtering. The duration time identifies how long the sender remains on the Blocked Senders list.

Note: Sender reputation only takes effect after a sender has sent 20 or more messages. Attachment filtering applies filters to e-mail attachments based on MIME content type, file name, or file extension. Actions taken by the filter include: Attachment Filtering

Reject the message and the attachment. In this case, the sender receives a failure message. Silently delete the message and the attachment without notifying the sender or recipient. Strip the attachment but allow the message through. Stripped attachments are replaced with a text file that indicates the action take. This is the default action.

As a best practice, you should avoid stripping attachments from the following types of messages: 8

Digitally signed, as this invalidates the digitally signed message. Encrypted, as this renders the message unreadable. Rights-protected, as this renders the message unreadable.

Note: Messages and attachments that have been blocked and attachments that have been stripped cannot be retrieved. Virus scanning is performed by Forefront Security for Exchange Server. When Forefront Security for Exchange detects an infected message, it deletes the message, generates a notification, and sends it to the recipient's mailbox. Exchange Server 2007 ships with a 120-day trial version of Forefront Security for Exchange Server. After 120 days, you must license it separately. Antivirus Scanning Additional antivirus defenses should be deployed to scan all e-mails within your Exchange organization, both in transit and those already in the store. Exchange provides support for antivirus vendors through:

VSAPI which provides a standard method of accessing messages within an organization. Transport agents which scan messages with antivirus and anti-spam filters as they pass through Hub and Edge Transport servers.

As a final step in securing your environment against viruses, you should ensure that all individual computers have virus protection running on them. The Outlook Junk E-mail filter operates on client machines. Messages are evaluated based on several factors (arrival time, message content, message structure), including metadata collected by the antiOutlook Junk spam filters (such as the SCL settings added to messages). Individual users can customize settings to E-mail move messages to the Junk E-mail folder or delete messages automatically. Users can also create their own Safe and Blocked Senders lists, which function in conjunction with the Safe Sender list aggregation.

Filtering Process Facts As you troubleshoot mail delivery (or failure), it is important to understand the order in which agents run and what happens when specific conditions are encountered. Exchange 2007 uses the following process to apply anti-spam filtering: 1. The Connection Filtering agent is the first agent to run. It does the following: 1. If the sending server's IP address is on the IP Allow list, the message is sent to the Sender Filtering agent. Additional connection filters are not applied. 2. If the sending server's address is not on the IP Allow list, the agent checks the IP Block list. If the sending server's address is on the list, the message is rejected and no further processing takes place. 3. If the sending server's address is not on either list, the agent checks the IP Allow List. If the sending server's address is on the allow list, the message moves to the Sender Filtering agent. 4. If the sending server's address is not on the IP Allow List, the agent checks the Real-Time Block Lists (RBLs) of the configured IP Block List providers. If the sending server's address is on one of the RBLs, the message is rejected. 2. If the message makes it through the Connection Filtering agent, the message moves to Sender Filtering. o If the sender is on the blocked senders list, the message is either rejected (deleted) or stamped as having come from a blocked sender. o If the sender is not on the list, or if the message is stamped, the message moves to Recipient filtering. If Sender Filtering does not reject the message, the Recipient Filter agent checks the Recipient Block List and also compares the recipient to the list of valid recipients (if so configured). o If the recipient is blocked or does not exist, Exchange rejects the message and sends a response to the sending server. 9

If the recipient is not blocked and exists, Exchange sends a confirmation to the sending server and the message moves to the next anti-spam agent.

If the message is addressed to multiple recipients, the blocked or nonexistent recipients are removed and the message moves to the next anti-spam agent.) If the message still contains valid recipients, Exchange runs Sender ID filtering. Depending on the configuration, the system can reject, delete, or stamp the message and send it to the next anti-spam agent. Prior to applying Content Filtering, the Content Filter agent checks the following five conditions: o The sender's IP address is on the Connection Filtering IP Allow list. o The message recipient(s) are on the exceptions for content filtering. o All recipients' mailboxes have the AntiSpamBypassEnabled parameter set to $True. o All recipients have the sender on their Outlook Safe Sender lists (updated to the Edge Transport server through safelist aggregation). o The sender is a trusted partner or on the organization's list of senders that are not filtered. If any of the above conditions is true, the message is sent to antivirus processing. If none of the conditions are true, content filtering is applied, and the messages is assigned an SCL. Based on the SCL, the following actions can occur:
o o o

The message is deleted. The message is rejected and a rejection response is sent to the sending server. The message is quarantined.

If no action is taken, the message continues to the next anti-spam agent. If connection, sender, recipient, or sender ID filtering has taken an action, then sender reputation filtering is activated. o If less than 20 messages have been received from the sender, the sender reputation filter takes no action. o If more than 20 messages have been received, the sender reputation filter assigns the sender an SRL. If the rating level is at or above the threshold, then the sender is temporarily placed on the Blocked Sender list, and the action specified for Sender Filtering is applied to the message. If the message is allowed, the message moves to the next anti-spam agent. If attachment filtering detects a content type that has been blocked, it takes the configured action. If the attachments are approved or stripped, the message moves to antivirus scanning. After virus scanning, the message moves to the client where local virus scanning is applied, and where the message is subject to the scrutiny of the Outlook Junk E-mail folder threshold. If the threshold is met or exceeded, the message is put in the Outlook user's Junk E-mail folder. If it is not met, it is delivered to the user's Inbox. Anti-spam and Antivirus Configuration Facts Be aware of the following when implementing anti-spam and antivirus solutions:

Filtering is typically configured on Edge Transport servers. However, you can also configure filters on Hub Transport servers. Filtering is controlled through various agents that run on transport servers. o The Connection Filter agent applies IP Block/Allow and IP Block/Allow List provider filters. However, each feature can be enabled or disabled individually. o Each remaining filter type has its own agent. 10

By default, all agents are enabled on Edge Transport servers, but disabled on Hub Transport servers. To enable a filter agent or feature, use a cmdlet similar to the following: Set-ContentFilterConfig -Enabled: $true The specific cmdlet you use depends on the filter type. For example, use Set-IPAllowListProvider to enable the IP Allow List feature, Set-IPBlockListConfig to enable the IP Block List, or SetRecipientFilterConfig to enable recipient filtering. You must configure filtering settings on each Edge Transport server individually. IP Block and Allow lists identify IP addresses of servers that are blocked or allowed to send mail. They do not identify individual senders by e-mail address. Because IP Block and IP Allow lists can be difficult to maintain, you should use allow and block list providers for connection filtering. o Use IP Allow lists to create temporary exceptions to block list providers, such as when a sender has been incorrectly listed. o Use IP Block lists to temporarily block senders until they can be added to the provider's list. Outages or delays at the list provider can cause delays in processing messages on the Edge Transport server, which in turn can cause mailflow bottlenecks. The only way to retrieve stripped attachments or attachments on rejected or deleted messages is to resend the message. Be sure to modify the filter settings before resending to allow the attachment through. To have messages written to a quarantine mailbox, best practice dictates that you use the following steps: 1. Create a dedicated quarantine storage group. 2. Create a dedicated quarantine mailbox store. 3. Create a mailbox in the quarantine mailbox store. 4. Delegate rights to the quarantine mailbox to the appropriate personnel. 5. Create a profile in Outlook to view the messages. 6. Enable message quarantine and designate the quarantine mailbox in Content Filtering. To use Safelist aggregation: o Run Update-SafeList for each user. This cmdlet pulls Safelist information from the mailbox and stores it in Active Directory. Use pipelining to run the cmdlet for all user mailboxes. For example: Get-Mailbox | where {$_.RecipientType -eq [Microsoft.Exchange.Data.Directory.Recipient.RecipientType]::UserMailbox } | UpdateSafeList The command must be periodically run to pull new information from the Safe Senders list. To do this, create a script and use the AT command to schedule the script to run on a schedule. o Run the content filter agent on the Edge Transport server. o The Edge Transport server must have an edge subscription to pull the information from Active Directory.
o o

Use the following commandlets to configure Receive connectors in the Exchange Management Shell:

Use Enable-AntispamUpdates to retrieve antispam updates from the Microsoft Update Server. Use Get-AntispamUpdates to view the status of antispam updates. Use Add-AttachmentFilterEntry to configure a filter for a specific file or extension. Use SetAttachmentFilterListConfig to modify the action to take when a matching attachment is found.

Exchange Recovery Methods The table below compares the various availability and recovery methods you can use with Exchange 2007. Method Deleted Item Retention Description Deleted item retention allows deleted items to be recovered. Deleted items only appear deleted to the user. However, a copy of the item is maintained in the user's mailbox for a specified time (14 days by default), allowing you to recover the item should that prove necessary. To recover a message after 11

the retention period has passed, you must restore the mailbox database and extract the required messages from the mailbox. Deleted Mailbox Retention Deleted mailbox retention flags a mailbox for deletion but retains it for 30 days (by default) for recovery. The mailbox is not available for access by users, but any time prior to the end of the mailbox retention period, you can reconnect the mailbox to a user object. You can also purge the mailbox (permanently delete it) any time after marking it for deletion, or you can simply let the mailbox retention period expire, at which point the system purges it. The mailbox server role is the only role that can be installed in a failover cluster. To reduce the impact of disaster for the remaining server roles, you should do the following:

Server Redundancy

For Client Access servers, add a server in each site to improve access. Use a hardware or software load balancing solution for server redundancy. For Hub Transport servers, deploy multiple Hub Transport servers in each site. Load balancing and failover are performed automatically by Active Directory sending messages only to active servers. For Edge Transport servers, deploy multiple Edge Transport servers in each site. Use multiple DNS MX (Mail Exchanger) records for round robin DNS load balancing. For Unified Messaging servers, deploy multiple Unified Messaging servers and use round robin DNS.

Exchange 2007 offers three types of replication and clustering to maintain high availability:

Replication and Clustering

Local Continuous Replication (LCR) provides data redundancy by maintaining a copy of a storage group on a second set of disks on the same server. Single Copy Cluster (SCC) provides service redundancy by using a single disk subsystem shared by multiple servers. Cluster Continuous Replication (CCR) provides both service and data redundancy by replicating data between two servers, each with its own disk system.

Database Portability

The database portability feature allows you to mount a mailbox database on any server in the same organization. This feature derives from the concept that mailbox data, being non-server specific, should be accessible despite the server on which it resides. Database portability allows you to reduce the time it takes you to recover from a disaster. If you must move a mailbox database, the Outlook 2007 client and the Exchange 2007 Autodiscover feature allow users to connect to the mailboxes in the new location automatically. Dial tone recovery allows you to create an empty (or dial tone) database on a server to replace a failed database. This provides a temporary mailbox users can access for sending and receiving mail after a disaster. Users don't have access to messages prior to the disaster until you merge the temporary database with the historical database, but they do have immediate e-mail service. Best practice dictates that you always try to recover to the same server that the failed database is on because it's a simpler process with fewer steps and a smaller margin of error. Keep in mind that when you use a dial tone database, you lose the rules, forms, views, and all other mailbox metadata in addition to the messages. You can recover this data when you merge the two databases. You can choose one of three recovery options in the event of a server failure:

Dial Tone Recovery

Server Recovery

Rebuild the server. As long as the Active Directory directory service is available, you can rebuild the server by performing a new installation of Windows Server, then install Exchange 2007 using the /m:RecoverServer option. Complete the process by restoring databases and server-specific configuration settings. Restore the server. Use a full backup set (backups of System State data, Exchange binary 12

files, data on the hard disks) to restore the server, followed by a restore of your Exchange databases. This option can only be performed on the same (or significantly similar) hardware. Use a standby server. Maintaining standby servers with the operating system and mission critical software installed allows you to reduce the time it takes to replace (or rebuild) a damaged server.

You can take the following additional steps to protect your Exchange organization:

Perform regular backups at regular intervals, even if you employ LCR or CCR. Store the log files on a RAID 1 disk, and store the database files on a RAID 0+1 disk. Use multiple Mailbox servers to minimize disaster impact even when you're using clustering and replication.

Backup Types Facts While Local Continuous Replication (LCR) and Cluster Continuous Replication (CCR) can provide your system with a level of protection by offering near-time copies of the running database, they cannot replace regular database backups. Where LCR and CCR offer fast recovery options, backups allow you to recover a database to a past point in time, and protect against complete disk or system failure or catastrophic failures that affect an entire location. The following table identifies the different types of backups: Backup Type Description A full backup:

Backs up the entire database including the log files. Purges the log files. Reduces the amount of restore time, but requires the longest amount of time for each backup.

Full

You should know the following about full backups:

When restoring from a full backup, restore only the last full backup. Most backup strategies combine periodic full backups with incremental or differential backups (but never with both at the same time).

Note: Best practice dictates that you perform daily full backups if you do not run LCR or CCR. If you use a replication strategy, best practice dictates that you perform weekly full backups. A copy backup:

Copy

Backs up the entire database including the transaction logs. Does not delete the log files.

You should perform a copy backup to get a copy of the current data without interrupting the backup schedule. For example, you might perform a copy backup before a restore or before you make significant changes to your system such as installing a service pack. An incremental backup: Incremental

Backs up only the transaction log files since the last time a full backup or incremental backup was run. Purges the log files. This means that each incremental backup only backs up information that 13

has been changed since the last full or incremental backup. You should know the following about incremental backups:

When restoring from an incremental backup, you restore the last full backup and each incremental backup made since the full backup. Combining full with incremental backups gives you the quickest backup strategy, but takes the longest to restore. An incremental backup will not back up the .edb files. You cannot do incremental backups if you use circular logging. Because the incremental backup deletes the log files each time the backup is done, this option minimizes disk space used.

A differential backup:

Backs up the transaction log files since the last full backup. Does not delete the log files.

You should know the following about differential backups: Differential

When restoring from a differential backup, you restore the last full back up and then the last differential backup. Differential backups take a little longer to back up than incremental backups, but restoration is faster. You cannot do differential backups if you use circular logging.

Note: When using third-party backup tools, the interaction of the backup software with the log files might differ from the backup types described here. A backup strategy identifies the type and the frequency of backup operations, as well as the operations necessary to restore data. Acceptable backup strategies are:

Perform full backups every night. Perform a full backup each week, with incremental backups every other day. Perform a full backup each week, with differential backups every other day.

Note: Do not mix differential and incremental backups. When choosing a backup strategy, consider:

The amount of time each day you have to devote to backups (called the backup window). Because backup operations affect system performance, most backups are performed at night during periods of little or no activity. Depending on your system load, you might find that you have a very short backup window each night, with longer windows on weekends. How quickly you need to be able to restore data in the event of an incident. For example, restoring a full backup is the quickest recovery method, followed by full with differential backups, followed by full with incremental backups. The effect of backup operations on the log files. Depending on your requirements, you might want backup operations to purge the log files to conserve disk space. The amount of data you must recover in a disaster. For example, if a day's loss of data is unacceptable, best practice dictates daily backups. 14

Any recovery service level agreements (SLAs) in place.

Databases should not exceed a size that can be backed up within the backup window and that meets SLA and user performance requirements. Client Access Server Deployment Facts As you plan and implement the configuration of Client Access servers in your network, be aware of the following:

You must have at least one Client Access server in your Exchange organization, even if you only have internal Outlook users. The Client Access server is used for features such as Autodiscover and Availability. You must have a Client Access server in each site where there are mailboxes if you use anything but Outlook as the client application. If your Client Access server accepts connections for clients whose mailboxes are on both Exchange 2007 and Exchange 2000/2003 servers, do not install the Mailbox role on the Client Access server. To allow clients to retrieve mail from the Internet, you must allow the Client Access server to be contacted by Internet hosts. The Client Access server must have a DNS A record. The Client Access server must be a domain member. For this reason, it should not be directly exposed to the Internet. Put the Client Access server behind a firewall to protect it. Open the necessary firewall ports to allow traffic to the Client Access server: o Exchange ActiveSync, Outlook Anywhere, and Outlook Web Access use port 80 for HTTP connections. o Exchange ActiveSync, Outlook Anywhere, and Outlook Web Access use port 443 for HTTPS connections. o POP3 uses port 110. o IMAP4 uses port 143. After the Client Access server has been installed, run the Security Configuration Wizard to lock down the server. You will need to import the Exchange 2007 role definitions before using the Security Configuration Wizard.

IIS uses SSL to provide secure HTTP communications. By default, the Client Access server uses a self-signed certificate for SSL.

Outlook Web Access and ActiveSync can accept the self-signed certificate. To support Outlook Anywhere, you must get a third party certificate. To use SSL with Outlook Anywhere, you must install the RPC over HTTP component. Use Add/Remove Windows Components to do this. When requesting a certificate, make sure you include all DNS names for the server in the certificate. When you import the certificate, be sure to import it into the computer's certificate store (not the administrator's certificate store). After importing the certificate, use the IIS console to enable SSL on the virtual directories used by the clients. Certificates can be enabled for use with POP3 and IMAP4 in addition to Outlook Web Access and Exchange ActiveSync.

Use the following cmdlets to manage certificates:

Use New-ExchangeCertificate to create a new self-signed certificate or create a certificate request. You can also use the Request New Certificate wizard in the IIS console to create a certificate request. Use Import-ExchangeCertificate to import the certificate that you have received from your certification authority into the machine's certificate store. Use Get-ExchangeCertificate to view the certificates that are stored in the local computer store. Use Enable-ExchangeCertificate to specify which Exchange services will use a particular certificate. 15

Client Access Server Facts All access that is not done through a MAPI protocol is sent through a Client Access server. Client Access servers are similar to Exchange 2000 or Exchange 2003 front-end servers. E-mail clients using a protocol such as HTTP, POP3, IMAP4, or services such as Exchange ActiveSync or Outlook Anywhere, connect to a Client Access server, and the Client Access server handles all communication with the Mailbox server. The Client Access server uses the following general process to communicate with the client and the Mailbox server: 1. The e-mail client initiates a connection to the Client Access server. 2. The Client Access server contacts a domain controller and authenticates the user. 3. After authentication, the Client Access server queries Active Directory to identify the location of the user's Mailbox server. 4. The Client Access server communicates with the Mailbox server using RPC. 5. Data from the user's mailbox is sent to the Client Access server. 6. The Client Access server renders the data based on the type of client that has connected, then sends the data to the client. You should be aware of the following regarding how the Client Access server communication process works:

In most cases, the Client Access server is responsible for rendering the mailbox data in a format compatible for the e-mail client. This places a greater load on the Client Access server than was required for front-end servers in previous Exchange versions. If you are upgrading an existing Exchange server for use as an Exchange 2007 Client Access server, it is important that the server has the proper hardware requirements to be able to support the increased processing demands. An Exchange 2007 Client Access server can be configured as a front-end server for an Exchange 2003 mailbox server. When this is the case, the Client Access server acts like a front-end server; mail data rendering occurs on the Exchange 2003 server. Clients using Outlook Web Access (OWA) use one of the following URLs to connect to the Client Access server: o Exchange 2007 servers now use http://servername/OWA. o Clients retrieving mail on Exchange 2000/2003 servers must use http://servername/exchange. If Exchange 2007 clients use this URL, they will be redirected to the http://servername/OWA URL after authentication. Communication between the e-mail client and the Client Access server uses one of the following protocols: o RCP over HTTP or HTTPS for Outlook Anywhere o HTTP or HTTPS for Outlook Web Access and ActiveSync o POP3 (port 110) or IMAP (port 143) for other clients The Client Access server communicates with the Mailbox server using one of the following protocols: o RPC for Exchange 2007 Mailbox servers o RPC over HTTP for Exchange 2003 servers You must have a Client Access server in each Active Directory site where you have Mailbox servers. The Client Access server communicates only with Mailbox servers within its own site. POP3 and IMAP clients use SMTP to send messages. To send mail, these clients must be able to connect to a Hub Transport or an Edge Transport server. o If possible, clients should connect using port 587. This new port allows for authentication before sending mail, and is used by many ISP's to control who can send mail. o Connections can also use port 25. Servers typically connect using port 25.

Exchange Clients Facts 16

An e-mail client is a software application that supports specific protocols and provides the user with an interface to a server. Exchange Server 2007 supports the following e-mail clients: Client Application Outlook Description Microsoft Outlook is a desktop e-mail client application. You can use Outlook to connect to Exchange servers, or to POP3 or IMAP servers. Outlook is typically used in a corporate environment to connect to an Exchange organization. When connecting to an Exchange server within a firewall, Outlook uses RPC to communicate directly to the Mailbox server. Outlook Anywhere is a feature of Outlook that lets you use Outlook to connect to Exchange through a firewall.

The client computer running Outlook Anywhere requires Windows XP SP2 or higher. Outlook Anywhere connects to a Client Access server using RPC over HTTP. You must manually enable Outlook Anywhere support on the Client Access server.

Outlook Anywhere

Outlook Anywhere on the client lets you use Cache mode. With Cache mode:

Messages are downloaded to the client computer. Messages are available even when the client is not connected to the Internet. You can reply to and compose new messages, even when a connection to the Exchange server is not present. When a connection is re-established, new messages are downloaded and any composed messages are sent.

Outlook Web Access (OWA) is a browser-based method of accessing your mailbox. The client system only needs a compatible browser to send and receive e-mail. For example, with OWA you can use a public kiosk with an Internet connection and a browser to access your mailbox.

Outlook Web Access (OWA)

The interface within the browser is similar to the Outlook interface. Advanced features in OWA that mimic the Outlook experience are available only with Internet Explorer 6.0 or higher. When you install a Client Access server, OWA is installed and enabled by default. Clients access mail using the URL: http://servername/OWA.

Note: Outlook Web Access no longer provides access to public folders in Exchange 2007. If you wish for Outlook to continue having the ability to access public folders, you must maintain an Exchange 2003 server within your organization. Exchange ActiveSync is a protocol used by Internet-enabled mobile devices to send and retrieve Exchange data.

Exchange ActiveSync

ActiveSync synchronizes e-mail messages, calendar items, contacts, and tasks. With Direct Push, a connection is initiated by the Exchange server and changes are sent to the mobile device. This allows for notification of new mail without the end-user having to initiate a connection with the server. With Remote Wipe, if the mobile device is lost or stolen, you can issue a command remotely and all data on the mobile device will be deleted. ActiveSync is installed and enabled by default on the Client Access server.

POP3/IMAP clients

E-mail clients that use POP3 or IMAP, such as Outlook, Outlook Express, and Eudora, can connect to a Client Access server. 17

Clients communicate with the Client Access server using POP3 (port 110) or IMAP (port 143) for retrieving messages. Clients use SMTP for sending mail. This means that clients do not communicate with a Client Access server when sending mail. When you install a Client Access server, POP3 and IMAP are installed but disabled. You must enable these services to provide access to these clients. Clients must connect to a Client Access server in the same site where their Mailbox server is located.

Be aware of the following regarding communication between the e-mail client and the Client Access server:

Outlook clients inside the private network communicate directly with the Mailbox server using RPC for both sending and receiving mail. However, the Client Access server is still required for features such as Autodiscovery and Availability. All clients (except internal Outlook clients) use the Client Access server for retrieving mail. POP3 and IMAP clients must connect to a Hub Transport or Edge Transport server for sending mail. This connection uses SMTP over port 25 or 587.

Configuring Client Support Depending on the client and the connection type, you might need to perform configuration tasks on both the Client Access server and the client. The following table describes the configuration tasks required for each client. Client Configuration Outlook is used by internal clients to send and retrieve mail. Outlook uses RPC to communicate directly to the Mailbox server. A Client Access server is used for the Autodiscover and Availability services. Configuring Outlook for internal clients requires no configuration at the client or the Client Access server:

Outlook

When you install a Client Access server, Autodiscover is already configured for internal clients. After installing Outlook on the client, when you run it for the first time it retrieves configuration information from the Autodiscover service and configures itself for the user automatically.

Outlook Anywhere is a feature in Outlook that allows for external access to the user mailbox. Outlook Anywhere communicates with the Client Access server for mail access. To configure Outlook Anywhere:

Outlook Anywhere

On the client, enable Outlook Anywhere and point it to use the Client Access server. On the Client Access server, you must enable Outlook Anywhere and configure an external host name. The external host name is the DNS name that Outlook Anywhere uses when connecting to the Client Access server. o You can perform both tasks in the Management console. o Use Enable-OutlookAnywhere to perform both tasks at once. Use SetOutlookAnywhere to change the external host name.

To use Autodiscover on external clients, you must also set an external URL for additional virtual directories:

To configure the Offline Address Book, use Set-OABVirtualDirectory -externalurl 18

https://mail.mycompany.com/OAB For Unified Messaging, use Set-UMVirtualDirectory -externalurl https://mail.mycompany.com/UnifiedMessaging/Service.asmx For Exchange Web Services, use Set-WebServicesVirtualDirectory -externalurl https://mail.mycompany.com/EWS/Exchange.asmx

Outlook Web Access (OWA) provides browser access to e-mail. To configure OWA: Outlook Web Access (OWA)

The client only requires an Internet connection and a Web browser. Although most browsers are supported, Internet Explorer 6.0 or later is required for certain advanced features or when using redirection or proxy. On the server, OWA access is enabled by default. To allow Internet access, you must configure an external URL for the OWA virtual directory (such as mail.mycompany.com/owa).

ActiveSync is used by mobile devices to connect to Exchange data. To configure ActiveSync:

ActiveSync

Connect the client device to a Windows system and use the Windows Mobile Device Center to configure connection parameters. On the server, ActiveSync is enabled by default. You must configure an external URL for the /Microsoft-Server-ActiveSync virtual directory (such as mail.mycompany.com/MicrosoftServer-ActiveSync). You must also complete the configuration for Autodiscover as noted above.

Note: To disable ActiveSync, use the IIS console to disable the Web application. To configure POP3 or MAPI access:

POP3 or MAPI

Configure the client application with: o The IP address or DNS name of the Client Access server for receiving mail. The Client Access server must be in the same site as the user's Mailbox server. o The IP address or DNS name of a transport server for sending mail. If the client is used only internally, point it to a Hub Transport server. If it is used from the Internet, point it to an Edge Transport server. If possible, configure the client to use port 587. On the server, you must start the POP3 or MAPI service. In addition, you should change the service startup action to Automatic. o Use the Services MMC snap-in to perform both tasks. o In the power shell, use Set-PopSettings, Set-ImapSettings, or Set-Service to change the service startup type, and Start-Service or Stop-Service to start or stop the services. (For example, Start-Service -service msExchangePOP3.) o From a command prompt, use Net start or Net stop to start or stop the service (for example Net start MSExchangeIMAP).

On the server, you can also modify the IP address and port number used for POP3 or IMAP. Use SetPopSettings or Set-ImapSettings with the UnencryptedOrTLSBindings and SSLBindings options to configure the IP address and port. After making these changes, you must restart the service. In addition to enabling and configuring access on the Client Access server, you can control user access using specific client applications through settings in the user mailbox. By default, all access methods are enabled for all user mailboxes. Use the Management console or the following cmdlets to manage client access on a per-mailbox basis:

Use Set-CASMailbox to enable or disable specific access methods. Use Get-CASMailbox to view the status of each method for all users. 19

To configure settings for all users, use a command similar to the following: Get-CASMailbox | SetCASMailbox -owasenabled $false.

Use the following cmdlets to manage the Autodiscover service:

Use New-AutodiscoverVirtualDirectory to create a new Autodiscover virtual directory if you have multiple domains in your organization. Use Remove-AutodiscoverVirtualDirectory to remove an existing Autodiscover virtual directory. Use New-OutlookProvider to create a new Autodiscover object within Active Directory. Use Set-OutlookProvider to configure an existing Autodiscover object within Active Directory. Use Get-OutlookProvider to query Active Directory to view the information contained within the current SCP object which resides in Active Directory.

Use the following cmdlets to manage the Offline Address Book:

Use Get-OABVirtualDirectory to return the information available about the current configuration of an existing Offline Address Book virtual directory on the Client Access server. Use New-OABVirtualDirectory to create a new Offline Address Book virtual directory on the Client Access server. Use Set-OABVirtualDirectory to configure an Offline Address Book virtual directory on the Client Access server. Use Remove-OABVirtualDirectory to remove an existing Offline Address Book virtual directory on the Client Access server.

Client Services Facts Exchange server uses the following features to enable and control client access through various client e-mail applications: Feature Description When you install a Client Access server, several virtual directories are created in IIS. These virtual directories are used by client applications and services to connect to the Client Access server. Virtual directories include:

IIS Virtual Directories

/Autodiscover is used by clients to retrieve information about servers and services and retrieve user profile settings. /EWS is used by the Exchange Web Services /Exchweb is used by Exchange 2000/2003 clients /Exchange is used by Outlook Web Access clients /Exadmin is used for administrator access to virtual directories /Microsoft-Server-ActiveSync is used by ActiveSync clients /OAB is used to access the Offline Address Book /owa is used by Outlook Web Access to connect to Exchange 2007 servers /Public is used by Outlook Web Access to access public folders /UnifiedMessaging is used to support Unified Messaging features

Clients connect to the various services by including the virtual directory name with the URL. For example, clients using Outlook Web Access to connect to an Exchange 2003 mailbox use a URL such as http://mail.mycompany.com/Exchange. Internal and For each virtual directory, you can configure both an internal and an external URL to connect to the External service. URLs 20

The internal URL is used for communication within the Exchange organization. During installation, the internal URL is created automatically using an internal fully-qualified domain name based on the servername and the domain, plus the appropriate virtual directory. By default, internal clients connect automatically using the preconfigured internal URL. The external URL is the address that will be used by users to access their accounts through an e-mail client outside of the organization (through the Internet). The external URL (for example, mail.company.com/owa) must be manually configured. To allow Internet access to mail clients, you must configure the external URL for the virtual directory on at least one Client Access server.

Virtual directories exist in IIS. As an Exchange administrator, you can use the Exchange Management console or the Management Shell to manage the Exchange virtual directories. Some properties can also be managed through the IIS console. Client applications must be able to communicate with a Client Access server in the same site where the Mailbox server resides. If your organization includes multiple sites, you could simply enable an Internetfacing Client Access server in each site and have external clients connect to the server at that site. In some cases, however, you might not want to provide an Internet-facing Client Access server in each site, or you might have users who connect to Client Access servers in sites other than where their mailbox resides. When a Client Access server receives a connection request from a user whose mailbox is in a remote site, the following takes place:

Redirection and Proxy

If the Client Access server in the site with the mailbox is configured with an external URL, the client request is redirected to that Client Access server. The client communicates directly with the Client Access server in that site. If the Client Access server in the site with the mailbox is not configured with an external URL, the first Client Access server acts as a proxy for the client. Requests are forwarded from the connecting Client Access server to the Client Access server in the remote site. The remote Client Access server then contacts the Mailbox server, and returns responses back to the first Client Access server. The client remains connected to the first Client Access server, and that server coordinates all communications with the remote Client Access server.

Be aware of the following regarding redirection and proxy:

Redirection is only supported for Outlook Web Access (OWA) clients. Proxying is not supported for POP3 and IMAP clients. POP3 and IMAP clients must connect to a Client Access server in the same site as their Mailbox server. ActiveSync clients can use proxying, or they should connect to a Client Access server in the same site as their Mailbox server. Both redirection and proxy requires that Windows Integrated authentication is used. This means that the client must be a domain member. If a browser is used, Internet Explorer 6.0 or higher must be used. For this reason, you would not use redirection or proxy to allow OWA access from public computers. If you rely on proxy or redirection, users can only connect with computers that are domain members.

In Exchange 2007, the Service Connection Point (SCP) object in Active Directory contains the information for Exchange in the organization. When an Outlook or ActiveSync client connects, it queries Active Directory for the SCP object to retrieve service and profile settings. When an internal client Autodiscover connects, the following process takes place: 1. Outlook queries the SCP object in Active Directory. 21

2. The Client Access server returns the Autodiscover URL to the client. 3. The client connects to Autodiscover using HTTPS. 4. Autodiscover returns the addresses of services and profile settings. External clients connect using a slightly different process: 1. The client tries to query Active Directory. Because the client is external, it can't communicate with Active Directory. 2. The client then tries one of two URLs to contact the Autodiscover service: o https://mycompany.com/autodiscover/autodiscover.xml o https://autodiscover.mycompany.com/autodiscover/autodiscover.xml 3. If a connection is successful, Autodiscover returns the addresses of services and profile settings. Note: Both of these Autodiscover URLs use an SSL connection. For this reason, it is important that you have a trusted third-party certificate installed on your Client Access server so that those on an external network can have access to the SSL connection.

Receive Connector Facts A Receive connector is a logical object that controls the inbound flow of SMTP messages from e-mail clients and servers, both internally and from the Internet.

Receive connectors apply to specific servers, and control how the server listens (and accepts) inbound mail. Receive connectors for Hub Transport servers are stored in Active Directory beneath the server object. Receive connectors for Edge Transport servers are stored in ADAM. During installation of a Hub Transport server, two Receive connectors are automatically created: one for receiving mail from clients, and a second (Default) for receiving mail from other mail servers. During Edge Transport server configuration, two Receive connectors are created: one for receiving mail from the Internet, and a second for receiving mail from internal mail servers. Each Receive connector is configured to listen for messages sent to a specific IP address and port combination from a range of IP addresses. For each Receive connector on a server, the IP address, port, and address range combination must be unique. You can modify the default Receive connectors, or create new ones to control message processing. For example, create custom Receive connectors to: o Assign specific servers to process messages received from specific clients. o Configure special connectors to apply custom features to specific source addresses, such as message sizes, number of recipients, or number of inbound connections allowed.

To configure Receive connectors, you must have the Exchange Server Administrator role on a Hub Transport server, or be a member of the local Administrators group on an Edge Transport server. Receive connectors have the following properties: Category Description On the General tab, you can configure: General

The connector name. The logging level. The fully qualified domain name (FQDN). This is the value that will be supplied by the server in response to HELO and EHLO queries (requests to get the attention of a mail server). By 22

default, the FQDN is the authoritative domain. Use the Network tab to configure the IP address, port, and recipient IP address ranges.

Network

You can configure multiple IP address and port combinations. You can configure multiple IP address ranges. Use the following formats: o a.b.c.d to specify a single IP address. o a.b.c.0/24 to identify a subnet address and a mask value using the mask bit count. o a.b.c.0-255.255.255.0 to identify a subnet address and a mask value. The combinations of address, port, and recipient ranges must be unique between all connectors on that server. For Hub Transport servers, the two default connectors are configured as follows: o The Client connector is configured to listen on all assigned (local) IP addresses on port 587. It will accept mail from all IP addresses (0.0.0.0-255.255.255.255). o The Default connector is configured to listen on all assigned IP addresses on port 25, accepting mail from all IP addresses.

Use the Authentication tab to identify the accepted method(s) of authentication. On a Hub Transport server: Authentication

The Client connector accepts TLS, Basic with TLS, and Integrated Windows authentication. The Default connector accepts TLS, Basic with TLS, Exchange Server, and Integrated Windows authentication.

Permission Groups identify the clients and servers that are allowed to use the connector. Permission Groups use the user account or group membership to identify the type of user that is connecting. Permission Groups have preset permissions. Permission Groups are:

Permission Groups

Anonymous users are unauthenticated users. Users or computers who authenticate with the Anonymous user account belong to this Permission Group. Exchange users are all authenticated users. Exchange servers include Hub Transport servers, Edge Transport servers, Externally Secured servers, and (on Hub Transport servers) other Exchange Servers. Legacy Exchange Servers are members of the Exchange Legacy Interop group and include all Exchange 2000/2003 servers. Partners are identified by the Partner Server account. Partners are members who belong to identified domains when using Domain Security for authentication.

Note: You cannot add or remove Permission Groups, modify how members are identified, or change the preset permissions. When you create a new connector, you select a connector type. Authentication and Permission Group settings are configured based on the type you choose. After the connector is created, you can modify and customize all settings. The following table lists each type: Connector Description Type Select the Internet type to accept mail from anyone on the Internet or from Internet SMTP servers. Internet

A Receive connector on an Edge Transport is automatically configured to accept mail from all locations. 23

You can create a Receive connector on a Hub Transport server using this option, but this configuration is not recommended. This option uses TLS authentication and allows Anonymous users.

Choose the Internal type to accept mail from Exchange servers. Use this connector type when configuring cross-forest connectors or to receive mail from a third party transfer server.

Internal

Both Hub Transport and Edge Transport servers are automatically configured with a connector with this configuration to accept mail from other Exchange servers. During configuration, the port is automatically set to 25. TLS and Exchange Server authentication is used. Allowed Permission Groups are Exchange servers and Legacy Exchange Servers.

Choose the Client type to accept e-mail from Exchange clients or clients using POP3 or IMAP4. Client

The port is automatically set to 587. TLS, Basic with TLS, and Integrated Windows authentication is accepted. The Exchange users Permission Group is allowed.

Choose the Partner type to accept e-mail from partner organizations. Partner

TLS with Domain Security is used for authentication. The Partners Permission Group is allowed. Following the configuration of the Receive connector, you must use the Set-TransportConfig cmdlet to identify allowed partner domains.

Custom

Choose a Custom type to manually configure authentication and Permission Groups during creation. Select this type when configuring Receive connectors on an Edge Transport server to accept mail from third party transfer servers, external relay domains, or a Microsoft Exchange Hosted Services server.

Use the following cmdlets to configure Receive connectors:

Use New-ReceiveConnector to create a new Receive connector. Use Get-ReceiveConnector to view the configuration information for an existing Receive connector within the Exchange organization. Use Set-ReceiveConnector to modify an existing Receive connector. Use Remove-ReceiveConnector to delete an existing Receive connector. Use Set-TransportConfig to identify partner domains when using Domain Security.

Foreign Connector Facts A Foreign connector is a logical object that controls the sending of messages to non-SMTP mail systems or to fax systems. Foreign connectors act much like Send connectors. Foreign connectors use the following properties to control how mail is sent:

The address space lists destination domains to which the connector applies. Source servers are identified that can process mail sent using the Foreign connector. Like Send connectors, you can identify multiple source servers for availability or load balancing. The drop directory identifies a file system location where messages are placed awaiting retrieval by the nonmail system. The drop directory must be accessible to all source servers as well as the foreign messaging server. 24

In addition, the Hub Transport server uses the Replay directory to receive messages from a foreign system. The foreign system places messages in the Replay directory. The transport server checks this directory periodically for messages that it needs to process.

Note: You cannot create Foreign connectors on an Edge Transport server. You must use cmdlets to create and manage Foreign connectors. Be aware of the following regarding the drop directory:

The drop directory location is identified using two values: o RootDropDirectoryPath is a server-wide value that identifies a parent path that can store multiple drop directories. By default, this value will be blank, which is interpreted by Exchange to be the Exchange installation directory (by default C:/Program Files/Microsoft/ExchangeServer). o DropDirectory identifies the drop directory name. This value can contain an absolute or a relative path. If it is a relative path, RootDropDirectoryPath and DropDirectory are combined to get the drop directory location. If it is an absolute path, the drop directory path will be used (however, the root drop directory must not be specified). When you create a new Foreign connector, the DropDirectory name will be the same as the connector name (unless you explicitly configure it). Each Foreign connector uses its own drop directory. The foreign system must be configured to retrieve messages from the drop directory. When you create the Foreign connector, the file system directory will not be created. You must create the directory before or after defining the Foreign connector. If you change the drop directory location used by the Foreign connector, the new directory must exist or be manually created. You must also manually move any items from the old directory to the new directory. You can configure a UNC path or a local path for the root drop directory.

Use the following cmdlets to configure Foreign connectors:

Use New-ForeignConnector to create a Foreign connector. Use Get-ForeignConnector to view the configuration information for a Foreign connector. Use Set-ForeignConnector to modify a Foreign connector, including the DropDirectory path. Use Remove-ForeignConnector to delete a Foreign connector. Use Set-TransportServer to set the RootDropDirectoryPath or the Replay directory for the server.

Send Connector Facts A Send connector is a logical object that controls the delivery of mail sent from an Exchange server to another mail server (both Exchange and non-Exchange servers).

Send connectors apply to all servers in the organization and are therefore stored in Active Directory beneath the Exchange organization. When you install a Hub Transport server, no Send connectors are created. Instead, implicit Send connectors are automatically computed as required for internal mail delivery. When you configure an Edge Transport server for end-to-end mail flow, two Send connectors are created automatically (if they do not already exist) to allow sending mail to the Internet and sending mail to internal mail servers. Each connector is configured with a list of domain names. Servers use connectors to identify how to deliver messages to the listed domains.

In addition to the connector name, logging level, and FQDN, you can configure the following properties for a Send connector. 25

Category

Description The address space identifies the destination SMTP domains for which the Send connector will be used. When a server needs to send mail, the domains in available connectors are examined. The connector with the best domain match is then used. You can list individual domains, or use one of the following conventions:

Use * to designate all domains. A Send connector on an Edge Transport server is created to send mail to Internet hosts with * as the address space. Use *.domain.domain to identify all subdomains of the listed domain.

Address space

Using the Management Console, you can only configure the domain names, and the connector will use SMTP as the transport type. Using cmdlets you can:

Add a cost to the address space. The cost is used to select a connector when two connectors equally match the destination domain. Set the connector scope so that the connector can only be used by Hub Transport servers within the same site. By default, connectors are used by any Hub Transport server in the organization.

The Network tab identifies where to send message when the connector is used. Messages are forwarded in one of two ways:

Network

When DNS MX records are used, the transport server queries DNS to locate an MX record that is authoritative for the destination domain. The message is then forwarded to the mail server. When a smart host is used, messages are forwarded to another mail server for delivery. For example, you might forward all outbound Internet mail to a mail server located at your ISP.

When using a smart host, you can configure the authentication that will be used to communicate with the smart host. When using DNS, you have the option of using Domain Security for authentication. The Source Server tab identifies transport servers that are responsible for processing mail sent to the connector. Connectors use the address space, network, and source server settings as follows for sending mail: 1. When a transport server receives mail, it checks applicable Send connectors to find the connector that best matches the destination domain. 2. Once the appropriate connector is identified, it uses the list of source servers to locate a transport server that is responsible for the connector. 3. If the mail server is listed as a source server, or if the source server is in the same site, the message is forwarded to the source server. Otherwise, the message is forwarded to a Hub Transport server in a site with a source server, and then forwarded again (if necessary) to a source server. 4. The source server uses either DNS to deliver the message to a mail server that is authoritative for the domain, or it forwards the message to a listed smart host. You can list multiple source servers to provide for redundancy and load balancing. If more than one source server is listed, the closest source server (using Active Directory sites) will be used. If multiple source servers are in the same site, message processing will be shared by all listed servers. Permissions Send connectors have a limited set of permissions that control how headers are handled in outgoing mail.

Source Server

26

Permissions identify specific header characteristics. If the header characteristic is not allowed, the header is stripped from the message before forwarding. Send connector permissions can only be set through cmdlets.

A linked connector is a Send connector that is linked or associated with a Receive connector. When a Linked Receive server with a linked connector uses a Receive connector to accept inbound mail, it will use the linked connectors Send connector to forward the message without using any other selection criteria. Linked connectors can only be configured through cmdlets. When you create a new Send connector, you choose from the following types. The connector type automatically configures some of the network and source server settings. Connector Type Internet Description Choosing the Internet type configures * as the address space. This configuration typically uses Edge Transport servers as source servers to relay messages to the Internet. Choosing the Internal type configures the connector to use a smart host for message relay.

Internal

Hub Transport-to-Hub Transport servers use implicit Send connectors for sending internal mail. A Send connector using an Edge Transport server as a source server and Hub Transport servers as smart hosts routes inbound Internet mail to the internal organization. Choose the Internal type to configure an Edge Transport server to relay mail to an Exchange 2003 bridgehead server, or to configure a Hub Transport server to relay to bridgehead servers in the same forest.

Partner

Choosing the Partner type configures the connector to use DNS lookup with mutual TLS for authentication. The Set-SendConnector -RequireTLS command enforces that messages are only sent when a TLS connection has been established. Choosing the Custom type lets you change all connector properties during connector creation. Select this type to:

Custom

Manually configure Send connectors with Edge Transport servers and the Exchange organization. Configure Send connectors to Hub Transport or bridgehead servers in other forests. Send mail to a third party transfer agent or an external relay domain.

Use the following cmdlets to configure Send connectors:

Use New-SendConnector to create a new Send connector. Use Get-SendConnector to view the configuration information for an existing Send connector. Use Set-SendConnector to modify an existing Send connector. Use Remove-SendConnector to delete a Send connector.

Storage Management Facts To create a storage group, the account you use must be delegated as the Exchange Server Administrator role and local Administrators group for the target server. Use the following commands to manage storage groups in the Exchange Management Shell: 27

Use New-StorageGroup to create a new storage group or a new recovery storage group on a Mailbox server. Use Get-StorageGroup to view the information about the storage group that was created. Use Remove-StorageGroup to delete a storage group. Use Set-StorageGroup to set a storage group's attributes in Active Directory directory service. Use CircularLoggingEnabled with a value of $true to enable circular logging (the default value is $false). When using circular logging, you should only perform full backups. Reserve this option for storage groups that support Network News Transfer Protocol (NNTP) folders (in public folder stores), which do not require log files. Use Move-StorageGroupPath to move storage group log files to a specified location. All mailboxes are dismounted before the move and are inaccessible until the move completes. o Use the -LogFolderPath switch to indicate the folder where log files will be stored. These files need to be on a disk that is very large. o Use the -SystemFolderPath switch to indicate the folder where system files will be stored. This file needs to be on a disk that is very fast. By default, the system path and transaction log locations are the same.

To create a mailbox, the account you use must be delegated as the Exchange Recipient Administrator role and the Account Operator role for the applicable Active Directory containers. Use the following commands to manage mailbox databases in the Exchange Management Shell:

Use New-MailboxDatabase to create a mailbox database object in the Storage Group container under the specified server object. Note: Only one database can be added to a storage group that has local continuous replication enabled. Use Get-MailboxDatabase to view one or more mailbox database objects from a storage group, server, or organization. Use Mount-Database to mount a database in a storage group on a Microsoft Exchange Server 2007 Mailbox server. Use Dismount-Database to dismount a database in a storage group on a Microsoft Exchange Server 2007 mailbox server. Use Move-DatabasePath to set a new path to the location of a database on the specified Mailbox server and to move the related files to that location. Note: The location of database files cannot be configured from a remote server. Use Set-MailboxDatabase to set the attributes of a mailbox database. Use Remove-MailboxDatabase to delete a mailbox database object. Note: Remove-MailboxDatabase removes the database object from Active Directory, but it does not remove the physical database files. You must remove the database files manually after you run the Remove-MailboxDatabase command.

Database settings are described in the following table: Setting Description Journaling is the ability to record and retain all communications in an organization. This is done so that departments within an organization such as financial services, insurance, and healthcare industries can maintain records of communication that occurs between employees as they perform daily business tasks. Journaling recipients are assigned to receive copies of the communications so they can be archived and reviewed at a later time if needed. If a journal recipient is specified for a mailbox database, every message that enters or leaves the mailbox database will be sent to the journal recipient. Examples of journal recipients are:

Journal recipient

Another mailbox A shared mailbox A Sharepoint site Third-party journaling solution 28

A public folder

Note: When the recipient is a user mailbox, the user must be enabled in Active Directory. You should know the following about journaling and recipients:

Standard journaling (called per-mailbox database journaling) enables journaling on the entire mailbox database. All messages to and from the database are journaled. Premium journaling (also called per-recipient journaling) lets you configure journaling for specific recipients or senders or on an organization-wide basis. You must configure standard journaling individually on each mailbox database in your organization. Journaling functions are actually performed by Hub Transport servers. o Enabling journaling saves information in Active Directory. o The Journaling agent on the Hub Transport server uses this data to direct messages to the journal recipient. o The Journaling agent must be running on the Hub Transport server to perform journaling tasks.

Deleted items and mailboxes are stored in a queue marked for deletion before they are permanently deleted. Saving items in the queue lets you restore deleted messages or mailboxes. You can set the amount of time deleted items will be retained by using the following command options: Deletion settings

Use -DeletedItemRetention to specify the length of time to keep deleted items. Use -EventHistoryRetentionPeriod to specify the length of time to keep event data in the event history table in the Exchange store. Use -MailboxRetention to specify the length of time to keep deleted mailboxes. Use -RetainDeletedItemsUntilBackup to specify whether to retain deleted items until the next backup occurs. The two possible values for this parameter are $true or $false.

Setting a maintenance schedule increases the efficiency of an organization by performing the following tasks on a set schedule:

Online defragmentation. Remove files, messages, and data objects that have passed their retention period from the databases and public folders in an organization.

You should know the following about maintenance schedules:

Maintenance schedule

Use the -MaintenanceSchedule option to specify when maintenance will be done on the mailbox database. It is recommended to perform maintenance on your system daily at a time when there is little activity. The maintenance window refers to the amount of time configured for performing maintenance tasks. If all necessary maintenance tasks cannot be performed in the amount of time allotted in the maintenance schedule, the next session will start where the last maintenance activity left off.

Not mounting a store after a reboot is beneficial if you want to perform an offline maintenance procedure on the store. You should know the following about mounting a store:

Use the -MountAtStartup switch to specify whether or not the mailbox database will be 29

mounted when the Microsoft Exchange Information Store service starts. The two possible values for this parameter are $true or $false. Use -AllowFileRestore to specify whether a restore on the database is allowed to overwrite data. The two possible values for this parameter are $true or $false. Set this value to $true prior to starting a database restore operation.

Note: If no users can access mailboxes in the store, you should verify that the store is mounted. A storage quota is a storage size limit for a mailbox or a public folder. Storage quotas allow administrators to:

Control the size of mailboxes. Manage the growth of mailbox databases.

Use the following switches to configure storage quotas:

Storage limits

The following attributes apply to all mailboxes in the mailbox database that do not have their own prohibit send quota attributes set: o Use -ProhibitSendQuota to specify the mailbox size at which users associated with mailboxes in this mailbox database can no longer send messages. o Use -ProhibitSendReceiveQuota to specify the mailbox size at which the user associated with this mailbox can no longer send or receive messages. Use -QuotaNotificationSchedule to specify when quota messages are sent to mailboxes that have reached one of the quota values. Use -IssueWarningQuota to specify the mailbox size at which a warning message is sent to the user.

The quota limits configured for a mailbox database are used as the default limit for all mailboxes in the database. More or less restrictive settings can be applied on a per-mailbox basis. These settings take precedence over the database setting.

Availability Configuration Facts The following table lists the configuration tasks to perform to enable each type of availability solution for Mailbox server data. Replication or Cluster Type Description When implementing LCR:

Local Continuous Replication (LCR)

To enable LCR, you can have only one database in the storage group. To avoid running out of possible drive letters, consider using volume mount points. The passive copies of files should be on different physical disks and use a different disk controller than the active copies. The amount of disk space available in the passive copy should be similar to that used by the active copy. When using LCR, you can create larger databases (up to 200 GB instead of the recommended 100 GB limit).

To enable LCR on an existing storage group, use the Management Console or the following cmdlets in this order: 30

1. Run Enable-DatabaseCopy and identify the database name and the path to the database copy. 2. Run Enable-StorageGroupCopy and identify the storage group name and the path to the log file copies. Use the following steps to create an SCC two-node cluster: 1. Install Windows Server 2003 Enterprise Edition on two nodes. 2. Install Network Interfaces on both servers, one connected to a private interface that provides a heartbeat functionality which runs between both cluster nodes, the other connected to a public interface which is accessible to clients. 3. Install a shared storage subsystem so that the quorum drive and the data drive are shared. The shared storage subsystem must be validated and it must be on the Windows Server Cluster Compatibility List. 4. A virtual Exchange server is created between the two nodes. Use the following steps to configure a CCR solution: Install Exchange on the active and passive nodes. Create a cluster between the active and passive nodes. Mount the database to the active node. Each storage group and its database are copied to the passive node from the active node in an operation called seeding. 5. Log copying and replay are continuously performed. The Microsoft Exchange Replication Service on the passive node connects to the secured file share on the active node and uses the Server Message Block (SMB) protocol to pull (copy) the log files. 1. 2. 3. 4.

Single Copy Cluster (SCC)

Cluster Continuous Replication (CCR)

Site Link Cost Facts During the message delivery process, the Hub Transport server performs a process called categorization. Categorization includes the following processes:

With recipient resolution, the server examines the message recipient to determine its location. For addresses inside the organization, Active Directory is queried to identify the site of the Mailbox server. The server then analyzes Active Directory site information to make a routing decision and identify the site path to the destination Active Directory site. The server also performs message conversion, and applies any configured filters.

When Exchange starts, it calculates a set of routing tables that identify the Active Directory site topology. When a message is received for delivery, the routing process uses the topology map to determine how to best reach the destination site. When multiple paths exist to a destination, Exchange selects a single path with the lowest cost. To understand how this route is selected, you should be aware of the following:

An Active Directory site is a group of well-connected computers, typically at the same physical location. Sites are connected by logical paths or connectors called site links. The site link cost is a relative number that corresponds to the underlying network reliability, speed and available bandwidth. The default link cost is 100. You can use Active Directory Sites and Services to modify the site link cost for specific links (between 1 and 99,999). 31

Faster or more preferred links are assigned a lower cost. To force traffic over one link, set a lower cost. For example, set a lower cost for high-speed links to force traffic over the high speed link. Configure a higher cost for dial-up links that are used as backup links.

Exchange uses site membership and site link costs to select a single best route to the destination server.

The cost to the destination is calculated by adding the site link costs of all links connecting the sites along the path. The path with the lowest aggregate site link cost to the destination site is selected. If two paths have the same aggregate cost, Exchange selects the route with fewer hops. If two paths have the same cost and the same number of hops, the system compares the names of the Active Directory site nearest to the destination by alphabet (or by number). It then chooses the site name lowest in alphabetic (or numeric) order. If the same site is nearest to the destination in two equal paths, Exchange moves back along the path until a unique site is found.

By default, Exchange uses the Active Directory site link costs for message routing decisions. If the existing costs are insufficient for Exchange message routing, you have two options:

Modify the site link costs in Active Directory Sites and Services. Most Exchange administrators will not have permission to modify these costs, and changing the costs might negatively affect other services that rely on these costs. Assign Exchange costs for each link. The Exchange link cost provides an alternate link cost that is used by Exchange. The Exchange link cost is used instead of the Active Directory link cost (if it exists). Use the SetADSiteLink cmdlet to configure an Exchange site link cost.

When considering site costs, be aware of the following:

After the Hub Transport server identifies the destination site for a message, the message is sent directly to the destination, disregarding the site route. For this reason, you must have a Hub Transport server in each site that has a Mailbox server. Once a path is determined, alternate paths are not considered. This means that under normal circumstances, if delivery fails, an alternate path is not identified. Alternate delivery is only calculated at regular intervals or for specific changes that affect the Active Directory topology or the Exchange configuration. The Hub Transport server forwards messages to the next hop in the path to the destination. The next hop is not the same as the next Active Directory site in the path, nor is it the next site with a Hub Transport server. In most cases, the next hop is the destination site for the Mailbox or other server. While Active Directory site links can use either the IP or SMTP protocols, Exchange 2007 uses only the IP protocol because there are limitations on the types of data that can be replicated over SMTP. IP has no such limitations.

Data Recovery Facts To minimize restore from backup operations, Exchange server includes the deleted item and deleted mailbox retention features. When the user deletes a message or an administrator deletes a mailbox, they are kept in the mailbox database for a specified period of time. During that time, the user can recover the deleted message, or the administrator can recover the deleted mailbox. Deleted item retention is configured on both the client system and the mailbox store, with recovery taking place on the client from within Outlook. Be aware of the following facts regarding deleted item retention:

The deleted item retention is configured by a setting on the mailbox store for all mailboxes. The default value is 14 days. 32

You can configure a deleted item retention value for a mailbox. This setting overrides the mailbox store setting. A soft delete occurs when a user deletes a message in Outlook. The message is placed in the Deleted Items folder. Items in the Deleted Items folder can still be viewed and recovered my simply moving the message to the destination folder. A hard delete occurs when a user deletes a message with the Shift key or deletes the item from the Deleted Items folder. These items are not placed in the Deleted Items folder, but they still exist and can be recovered. By default, you can recover hard-deleted items only from the Deleted Items folder. To enable recovery from folders other than the Deleted Items folder, create the following registry DWORD value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options\DumpsterAlwaysOn = 1 (decimal) After changing the registry value, restart Outlook. To recover a hard-deleted item, select the folder in Outlook, then choose Recover Deleted Items... from the Tools menu in Outlook. You can then select the messages you want to recover. To retrieve messages that have past the deleted item retention time, you must restore the mailbox from backup to an alternate location, then extract the messages you want to retrieve.

Deleted mailbox retention is configured and recovery is performed on the Mailbox server. Be aware of the following facts regarding deleted mailbox retention:

The deleted mailbox retention is configured by a setting on the mailbox store. The default value is 30 days. Mailboxes are disconnected when you: o Use Disable or Remove in the Management Console. o Run the Disable-Mailbox cmdlet or the Remove-Mailbox cmdlet without the -Permanent $true switch in the Management Shell. Disconnected mailboxes can be recovered. Mailboxes removed with the -Permanent $true switch cannot be recovered and must be restored. To recover a disconnected mailbox: o Go to the Disconnected Mailbox folder in the Management Console. o Run the Connect-Mailbox cmdlet. When you recover a mailbox, the target recipient cannot already have a mailbox. To merge messages from disconnected mailboxes into an existing mailbox, use the Export-Mailbox cmdlet. To recover a mailbox that is past the mailbox retention time, you must restore the mailbox from backup.

Previous Version Facts Exchange 2007 has made many advancements and improvements to the previously-released versions of Exchange. The previous versions of Microsoft Exchange Server are described in the following table: Version Description Microsoft Exchange Server 5.5: Microsoft Exchange Server 5.5

Ran on the Windows NT4 platform which stored all of the user accounts and provided authentication. Used its own directory service. Hosted a mailbox database (priv.edb) and a public folder database (pub.edb). The server could only host one database of each type.

Microsoft Exchange Server 2000 (version 6.0) ran on the Windows 2000 platform instead of the Microsoft NT4 platform and includes some integration with Active Directory. It provided the following Exchange Server improvements from Exchange 5.5: 2000 33

Raised the maximum sizes of databases and increased the number of servers in a cluster from two to four. Allowed multiple mailbox databases on a single server. Introduced Outlook Web Access (OWA). Used front-end servers for SSL and authentication traffic. Used back-end servers for databases and MAPI.

Exchange 2003 included multiple compatibility modes to allow an easier transition for upgrading from Exchange 2000. Exchange 2003 upgraded the following components: Microsoft Exchange Server 2003

Added usability features for OWA. Enhanced disaster recovery. Added Outlook Mobile Access and server-side ActiveSync. Enhanced antivirus and antispam protection. Improved management tools for mailbox and messaging.

Server Backup Facts Exchange 2007 has simplified the server backup and recovery process. For most server roles, the majority of data is stored in Active Directory, with only the Mailbox server databases and some custom settings being stored locally on the Exchange server. To protect your Exchange server configuration, you should back up:

Active Directory data on domain controllers. Be aware that having multiple domain controllers reduces the need to restore Active Directory data from a backup. System state data on the Exchange server. The system state data includes the Windows operating system configuration information as well as some Exchange-specific information. A good way to back up system state data is to perform an Automated System Recovery (ASR) backup. This backs up the operating system files, system state data, and drive configuration information. Server role configuration information that is stored locally, including Mailbox server storage groups and databases and custom configuration settings.

The following table lists the various types of data you should back up for each server role. Role Critical Data In addition to backing up the system state data, you should back up the following on a Mailbox server:

Mailbox server

Mailbox and public folder databases. You must use an Exchange-aware backup utility to back up the databases. In NTBackup, you can back up the entire database store or specific databases. If you are using public folders for the offline address book (OAB) distribution, no additional backup is necessary. If you are using Web distribution for the OAB, use a file-level backup of the OAB. The default location is C:\Program Files\Microsoft\Exchange Server\ExchangeOAB. There is also an OAB directory on the Client Access server that you could back up to speed recovery time, but this is not required as the data will be rebuilt.

You do not need to back up search indexes. Following the Mailbox server restore, search indexes will be rebuilt. Hub Transport For a Hub Transport server, backing up system state data is typically sufficient to protect the server. Role configuration information will be copied from Active Directory during the recovery process. Be 34

server

aware of the following:

Message queues are temporary and are not backed up. If the Hub Transport server fails, and you still have access to the disks, you can move the queues and mount them on a second Hub Transport server to recover the messages that were currently queued. If you need to keep protocol logs for auditing or tracking purposes, perform a file-level backup. Their default location is C:\Program Files\Microsoft\Exchange Server\File System\TransportRoles\Logs.

Unlike other Exchange server roles, an Edge Transport server does not store configuration information in Active Directory. Instead, all data is stored locally in the Active Directory Application Mode (ADAM) database. To back up an Edge Transport server, back up the system state data and the ADAM configuration using one of the following methods: Edge Transport server

Use the ExportEdgeConfig.ps1 script to export custom server settings and custom IP filtering settings. The resulting .xml file is saved to C:\Program Files\Microsoft\Exchange Server\Scripts. Because this process does not back up transport rules, you should also run Get-TransportServer and record the current settings. Instead of saving configuration information, you can reinstall the Edge Transport server and resubscribe to Active Directory. Any custom IP filtering information will be lost.

Like a Hub Transport server, delivery queues are not backed up, but you can back up the protocol logs if required for auditing or tracking purposes. In addition to storing configuration information in Active Directory, a Client Access server stores information in IIS. Backing up and restoring IIS data on a Client Access server could result in errors within Exchange. For this reason, the recommended method of protecting the Client Access server is to manually record custom settings in IIS, then manually make necessary changes following server recovery. To manually back up IIS information, back up the following items based on the services provided by the Client Access server. Only back up those items where you have custom virtual directories or custom settings (if you have not changed the default settings, then you do not need to back anything up): Client Access server

Export the IIS metabase to save Autodiscover and ActiveSync settings (mostly related to authentication settings). To save custom Outlook Web Access (OWA) settings, back up the C:\Program Files\Microsoft\Exchange Server\ClientAccess\owa\Web.config file. To save custom ActiveSync settings, back up the C:\Program Files\Microsoft\Exchange Server\ClientAccess\Sync\Web.config file. To back up custom POP3 or IMAP4 settings, back up the Microsoft.Exchange.Pop3.Exe.Config or Microsoft.Exchange.Imap4.Exe.Config files in the C:\Program Files\Microsoft\Exchange\ClientAccess\PopImap\ directory. To back up custom availability service settings, back up the C:\Program Files\Microsoft\Exchange Server\ClientAccess\exchweb\ews\Web.config file.

Unified Messaging

Besides the system state data, the only content on a Unified Messaging server that you need to be concerned with is backing up custom audio prompts. Audio prompts for all servers are saved in a single location called a prompt publishing point. By default, the C:\Program Files\Microsoft\Exchange directory on the first Unified Messaging server is the publishing point, although you can redirect this point to any networked location.

To back up custom prompts, perform a file-level backup of the prompt publishing point directory. 35

When you restore custom prompt data, restore it to the publishing point. Each Unified Messaging server then synchronizes its information with the prompt publishing point.

Edge Subscription Management Facts Use the following cmdlets to manage Edge Subscriptions:

Use New-EdgeSubscription on the Edge Transport server to create the subscription file. Use the cmdlet with the -FileName parameter on a Hub Transport server to import the subscription. Use Get-EdgeSubscription to retrieve information about the Edge subscription. Use Start-EdgeSynchronization to force immediate synchronization between the Edge Transport server and Active Directory.

Be aware of the following regarding Edge Subscription configuration:

The Edge Transport server is subscribed to an Active Directory site. Each Edge Transport server can only be subscribed to a single site in a single Exchange organization. Each site can have multiple subscribed Edge Transport servers. You must perform the subscription process on each Edge Transport server. When there are multiple Edge Subscriptions for a site, load balancing will be used to evenly distribute outgoing mail between all Edge Transport servers. As you add Hub Transport servers to a site or to the forest, automatic implicit Send connectors allow the Hub Transport server to locate and route mail to the Edge Transport server. No additional configuration is required as you add Hub Transport servers. If a site does not have an Edge Subscription, the Hub Transport server in that site will forward mail to a Hub Transport server in a site with an Edge Subscription. To improve outbound mail flow, consider subscribing one (or more) Edge Transport servers to each Active Directory site. Adding and removing Hub Transport servers from a site does not affect mail flow unless you remove the last Hub Transport server from a site. Without a Hub Transport server in the subscribed site, the Edge Transport server is left orphaned, and mail cannot flow between the internal organization and the Edge Transport server. It is possible to enable end-to-end mail flow into and out of your organization by installing an Edge Transport server and manually creating the necessary Send connectors. However, without a subscription you cannot take advantage of features available through Active Directory (anti-spam, recipient lookup, safelist aggregation, mutual TLS). If desired, you can create a subscription and suppress Send connector creation. This replicates Active Directory information to ADAM, but does not create the Send connectors. Following subscription, create necessary Send connectors manually. You might need to do this if you have accepted domains that are configured as external relay domains. After subscription, you can no longer create connectors or configure accepted domains on the Edge Transport server. Instead, configure these settings within the Exchange organization. The EdgeSync process replicates these changes to the Edge Transport server.

When you create a subscription, you run New-EdgeSubscription on one Hub Transport server in the site. After a subscription has been established, Active Directory information is replicated to the ADAM database on the Edge Transport server.

The first time synchronization takes place could take a significant amount of time due to the amount of data that needs to be copied. Active Directory data is periodically copied to the ADAM database at the following intervals: o Accepted domains, connection configurations, internal Hub Transport servers, and message classification are replicated hourly. o A list of valid recipients is synchronized every four hours. 36

The topology is synchronized every 5 minutes. If Active Directory data is not appearing in the ADAM database, use the Start-EdgeSynchronization cmdlet to force immediate synchronization. When you create a subscription, all Hub Transport servers in that site will participate in the EdgeSync process, making them available to synchronize data with the Edge Transport server. When you add a new Hub Transport server to a site with a subscription, that Hub Transport server will not automatically participate in the EdgeSync process with the Edge Transport server. To enable new Hub Transport servers to participate in synchronization, resubscribe the Edge Transport to the site.
o

Because of the way that Edge Transport servers are linked to Active Directory sites, you should be aware of special processes that should be followed when modifying the subscription configuration. The following table lists various procedures to follow. Task Process You might need to resubscribe an Edge Transport server to a site to allow new Hub Transport servers to participate in the EdgeSync process or if the security credentials of the Edge Transport server have changed or been compromised. To resubscribe to the same site, use the same process as creating an original subscription: Resubscribe an Edge Server to the same site 1. On the Edge Transport server, run the New-EdgeSubscription cmdlet. 2. Copy the XML file to a Hub Transport server in the same site. 3. Run New-EdgeSubscription on the Hub Transport server, or use the New Edge Subscription wizard in the console to import the subscription. When resubscribing within the same site, you do not need to remove the existing subscription. The initial synchronization process will be faster because the ADAM database is not deleted. If you need to permanently remove an Edge Transport server, use the following process: Permanently remove a subscription 1. Disable all Receive connectors on the Edge Transport server. 2. From a Hub Transport server, run Remove-EdgeSubscription. Allow the process to complete. 3. Run Remove-EdgeSubscription on the Edge Transport server. This deletes the ADAM database on the Edge Transport server. To move a subscription from one site to another, you first remove the existing subscription, and then resubscribe in the new site. Complete the following process: 1. Disable all Receive connectors on the Edge Transport server. 2. From a Hub Transport server, run Remove-EdgeSubscription. Allow the process to complete. 3. On the Edge Transport server, run the New-EdgeSubscription cmdlet. 4. Copy the XML file to a Hub Transport server in the new site. 5. Run New-EdgeSubscription on the Hub Transport server, or use the New Edge Subscription wizard in the console to import the subscription. When resubscribing to a new site, you do not remove the subscription from the Edge Transport server. By keeping the ADAM database on the server, you reduce the time required for the initial synchronization.

Subscribe to a different site

37

Edge Transport Server Facts The Edge Transport server controls mail flow into and out of the Exchange organization. The Edge Transport server is designed to be implemented in a perimeter network as the Internet-facing gateway. It acts as an SMTP relay and smart host for your organization. In addition to controlling mail flow to and from the Internet, you can configure antivirus and anti-spam filters and implement other message restrictions on the Edge Transport server. Implementing these restrictions at the network perimeter reduces the amount of unwanted e-mail traffic entering your internal network. When you first install an Edge Transport server, a Receive connector is automatically created to enable it to receive mail from both the Internet and the internal network. However, to configure end-to-end mail delivery, you must link the Edge Transport server to the Exchange organization. You do this through the Edge Subscription process.

To improve security in the perimeter network, the Edge Transport server does not have direct access to a domain controller for Active Directory information. Active Directory information is stored on the Edge Transport server in an instance of the Active Directory Application Mode (ADAM) database. This is a read-only database that contains only the objects needed by the Edge Transport server. ADAM provides the Edge Transport server with an LDAP directory service that provides the server with the benefits of Active Directory without putting the organization at high risk by placing domain controllers or global catalog servers in the perimeter network. After the subscription has been established, any relevant changes in Active Directory are copied to the ADAM database. Edge Subscriptions link an Edge Transport server to an Active Directory site that contains one or more Hub Transport servers. Hub Transport servers use the EdgeSync protocol to transfer Active Directory information to the ADAM database. While you can deploy an Edge Transport server without creating a subscription, you must create an Edge Subscription to use anti-spam filters, recipient lookup, safelist aggregation, or Domain Security (mutual TLS authentication with partner organizations).

Use the following process to configure an Edge Transport server and create an Edge Subscription: 1. Install the Edge Transport server. 2. On the Edge Transport server, run the New-EdgeSubscription cmdlet. This exports information about the Edge Transport server to an XML file. 3. Copy the XML file to a Hub Transport server in the site you want to link to the Edge Transport server. 4. Run New-EdgeSubscription on the Hub Transport server, or use the New Edge Subscription wizard in the console to import the subscription. Note: You must complete the subscription process within 24 hours of creating the subscription file on the Edge Transport server. After that time has elapsed, restart the subscription process by resubscribing from the Edge Transport server. During the installation and Edge Subscription process, the following things happen:

The Edge Transport server is made a member of the Exchange organization. The following settings are transferred from Active Directory to the ADAM database: o Accepted domains o Remote domains o Message classifications o Safe Senders lists o Recipients o TLS Send and Receive Domain Secure lists o Internal SMTP Servers list o List of Hub Transport servers in the subscribed Active Directory site The following connectors are created: 38

Connector Type

Connector Function

Settings Network = Listen on port 25 for all configured IP addresses. Accept mail from all IP addresses. Authentication = TLS, Domain Security, Exchange Server authentication. Permission Groups = Anonymous users, Exchange servers, Partners

Receive

Accept mail from the Internet

Send

Implicit connector allowing send to Hub Transport servers in the N/A forest Send mail to Hub Transport servers in the subscribed site Send mail to the Internet Address space = * (meaning all domains) Network = Use DNS records. Note: If you route mail through a smart host in your ISP, be sure to modify this setting accordingly. Address space = -- (meaning all authoritative domains) Network = -- (meaning all Hub Transport servers in the site)

Send

Send

Note: If Send connectors already exist, for example if an Edge Transport server is already subscribed to the site, the new Edge Transport server is added to the list of source servers for the connectors.

When placing an Edge Transport server in a firewall, use the following firewall settings to allow necessary communications between the Internet, the Edge Transport server, and the internal network: Firewall Open port Protocol/Function External 25/TCP Internal External 53/TCP External 80/TCP Allows SMTP traffic between the Edge Transport server and the Internet, and between the Edge Transport server and the internal network. Allows the Edge Transport server to perform DNS resolution and reverse DNS lookup for outgoing mail recipients. Allows the Edge Transport server to update virus signatures and protocol definitions from Internet servers. Allows the Hub Transport server to replicate recipient and configuration data using LDAP S or LDAP over SSL to ADAM on the Edge Transport server.

Internal 50389/TCP Allows the LDAP tools to communicate with ADAM instance on the Edge Transport server. Internal 50636/TCP

Internal 3389/TCP Standard RPD port used for remote management through internal services.

E-mail Address Policy Facts E-mail Address policies are used to automatically generate e-mail addresses for Exchange recipients within your organization. Policies can be used to generate e-mail addresses for a number of environments, such as SMTP, X400, Lotus Notes, or Novell GroupWise. When you create an e-mail address policy, the following properties must be specified: Property Recipient types Description You can choose the types of recipients to which the policy will apply, including:

Users who have Microsoft Exchange Server 2007, Exchange Server 2003, and 39

Exchange 2000 Server mailboxes. Users who have external e-mail addresses. Users who have Exchange resource mailboxes. Contacts with external e-mail addresses. Security groups or distribution groups that have been mail-enabled.

Conditions apply additional filters to recipients based on recipient properties. The e-mail address policy will only apply to those recipients that meet the conditions. You can filter on the following properties:

States or provinces Department Company Custom attributes (1-15) defined on each recipient

Conditions The above conditions are the predefined conditions in the Exchange Management Console. You must (filters) use the Exchange Management Shell to create a custom query for the e-mail address policy if you wish to specify additional conditions. After selecting conditions that will be applied, you must configure values for each condition. Note: The State or Province, Department, and Company conditions are based on attributes that are applicable only to mailboxes, mail users, and mail contacts and thus do not apply to mail-enabled distribution groups. If you configure conditions for an e-mail address policy, you will in effect be excluding all mail-enabled distribution groups. To define conditions that match distribution groups, use conditions that match custom attributes. The e-mail address setting identifies the format that will be used to generate the e-mail address. When choosing the e-mail address format, you have two choices:

E-mail address

Select SMTP Address to choose from a list of precanned (predefined) e-mail address formats. You can choose one of the following local (left side) formats: o Alias (alias@mycompany.com) o FirstName.LastName (john.smith@mycompany.com) o FirstInitial + LastName (jsmith@mycompany.com) o FirstName + LastInitial (johns@mycompany.com) o LastName.FirstName (smith.john@mycompany.com) o LastInitial + FirstName (sjohn@mycompany.com) o LastName + FirstInitial (smithj@mycompany.com) If you have multiple accepted domains configured, you can also choose the domain portion of the address to use. You can choose any authoritative domain or internal relay domain (external relay domains cannot be selected when using the precanned formats).

Select Custom Address to configure non-SMTP addresses or SMTP addresses using a format other than the precanned formats. When configuring e-mail addresses, you can use variables to customize the format as explained in the following link: E-mail Address Variables.

Schedule

By default, e-mail address policies are applied when you create or modify the policy. If desired, you can configure the policy to be applied on a schedule.

To configure e-mail address policies in the Management Console, beneath Organization Configuration select the Hub Transport node, then use the E-mail Address Policies tab. Use the following cmdlets to create and manage email address policies: 40

Use Get-EmailAddressPolicy to return all of the attributes on a policy or set of policies. Use New-EmailAddressPolicy to create a new e-mail address policy. Use Remove-EmailAddressPolicy to remove an existing e-mail address policy. Use Set-EmailAddressPolicy to set the Active Directory directory service attributes for an e-mail address policy. Use Update-EmailAddressPolicy to apply an e-mail address policy immediately. When the cmdlet is run, the e-mail address policy is applied to all applicable recipients.

You should know the following about e-mail policies:

A default policy is created automatically. It applies to all recipients and uses the e-mail address format of alias@domain where alias is the Exchange alias and domain is the authoritative domain created during installation. You can edit the default policy to modify the address format or add additional addresses. You cannot modify the recipients or the conditions, and you cannot delete the default recipient policy. You can create multiple e-mail address policies. Each policy has a priority. o Policies are applied in order (highest to lowest). o Policies apply only to the recipients specified in the policy that meet the filter conditions. o Only a single policy applies to each user. The policy used for the recipient is the policy with the highest priority that meets the filter criteria. o The default policy has the lowest priority. Its priority cannot be changed. If no other policies have been applied to a recipient, the default policy will be used (it matches all remaining recipients). Policies are applied at the following times: o When you create or modify a policy using the Management Console, the policy is applied immediately or according to the schedule. Select Do not apply to modify the policy without applying it immediately. Note: Modifying an existing policy with Set-EmailAddressPolicy does not automatically apply the changes. o When you create or modify a recipient, e-mail address policies are evaluated and applied as necessary. o Immediately, by using the Update-EmailAddressPolicy cmdlet or by applying the policy manually in the Management Console. You cannot use the Exchange Management Console to view the members of a policy if you used the Exchange Management Shell to create the policy. You must use the Get-Recipient cmdlet in the Exchange Management Shell. To prevent e-mail address policies from being applied to specific recipients, disable the Automatically update e-mail addresses based on email address policy setting in the properties for the recipient. You can configure a policy to create more than one address for a recipient. When more than one address exists, one is designated as the primary address. The primary address is the address used as the return email address when a recipient sends mail. When you view the properties for a recipient, the primary address will be designated in bold. To change the primary address for a recipient, you must first prevent the recipient from receiving e-mail addresses from a policy. Then select the new primary address from the list and click Set as Reply. You can define e-mail addresses for specific recipients in addition to those created by the applicable e-mail address policies. When the e-mail address policy is applied, existing e-mail addresses are not deleted or modified. New addresses will be generated if necessary, and the primary address set according to the policy.

E-mail Address Variables Variables allow you to use names other than the user account name in an e-mail address policy. The following table lists the available variables: Variable %g Description Given name (first name) 41

%i %s %d %m %number+variable

Middle initial Surname (last name) Display name Exchange alias Uses the specified number of characters in the variable

The following table lists several examples of using variables in the address string of the e-mail address policy. Each example uses the following information from a sample user account:

Given name = Mary Middle initial = R. Last name = Smith Display name = Mary R. Smith Resultant E-mail Address MarySmith@westsim.com Mary.Smith@westsim.com MR.Smith@westsim.com The first character of the given name is used, followed by the middle initial value, followed by the surname. Notice how the middle initial field contains two characters (R followed by a period). MRSm@westsim.com The first character of the given name and middle initial are used followed by the first two characters of the surname field. MaryR.Smith@westsim.com

Policy Entry %m@westsim.com %g.%s@westsim.com %1g%i%s@westsim.com

%1g%1i%2s@westsim.com %d@westsim.com

Keep in mind the following when working with variables in e-mail address policies:

Spaces are removed automatically. Invalid e-mail address characters will automatically be removed.

Exchange Concepts The following table lists some of the basic components that are used to organize and administer Exchange. You will learn more details about each throughout this course. Object Description The organization is the top Exchange infrastructure object. The organization defines your messaging environment. It includes the following: Organization

Exchange server Domain controllers Global catalog server Users

Server role

A server role is a logical set of features and services that allow users to perform specific tasks. Exchange 2007 offers the following five server roles: 42

Client Access Mailbox Unified Messaging Hub Transport Edge Transport

Mailbox

A mailbox is a logical storage location associated with a recipient. The mailbox is where all e-mail messages are stored. The inbox and all other associated folders make up the mailbox. A recipient is a mail-enabled Active Directory object to which Exchange can send messages. A recipient has Exchange attributes, but it does not have to have a mailbox. Examples of recipients include the following:

Recipient

Mailbox users Mail users Resource mailboxes Mail contacts Distribution groups Dynamic distribution groups

Store

A store is a database of Exchange information. The store contains individual recipient mailboxes. All mailboxes in the store share common configuration settings. The domain controller is the server within the Windows server domain that responds to authentication requests such as logging in and permissions assignment. The domain controller is effectively a database server. It contains a file called NTDS.dit which contains:

Domain controller

The NT Directory service The directory information tree which is part of the X500 directory naming standard.

Storage group

A storage group is a collection of stores. All stores in the storage group are held on the same physical server. A queue is a temporary holding space for messages waiting to enter the next stage of processing. Each queue is a logical set of messages that an Exchange transport server handles in a specific order. Queues only exist on machines that have the Edge Transport or Hub Transport server roles installed. An address list is a list of recipients. The global address list is an address list that is automatically generated by Exchange and which includes all recipients in the Exchange organization. In addition, you can define custom address lists. Microsoft Outlook is the premier messaging and collaboration client for the Internet and Microsoft Exchange Server. Outlook:

Queue

Address lists

Outlook

Helps users communicate with others through e-mail, telephone, group scheduling, and realtime Microsoft NetMeeting conferencing software. Allows users to share information with others via Internet connectivity, Microsoft Exchange Server, and electronic forms, and as a component of customized collaborative solutions. Integrates and organizes communications and shared information in one application.

Outlook Web Access

Outlook Web Access (OWA) allows clients to access e-mail, calendars, contacts, tasks, and other mailbox contents when access to the Microsoft Outlook desktop application is unavailable. OWA: 43

Offers read-only access to documents stored in Microsoft SharePoint sites and network (UNC) shares. Is provided as part of Exchange Server 2007 to allow users to connect remotely via a Web browser. Can perform many of the functions of Outlook. Requires a network connection to function.

A public folder is a repository for data that can be accessed by multiple users. Public folder

A public folder is a recipient that can have an associated e-mail address. Users can e-mail or post content into the public folder. Content in the public folder is accessible through the Outlook clients.

Exchange 2007 uses the following protocols: Protocol Simple Mail Transfer Protocol (SMTP) Description SMTP is the Internet standard protocol for transferring e-mail messages between hosts. SMTP assumes that both host and client are constantly connected, but you can use both permanent and dial-up connections to an SMTP host.

MAPI is a set of standard commands developed by Microsoft. Messaging services use these Messaging Application commands to communicate with other MAPI-compliant applications. In Exchange 2007, the Programming Interface Client Access Server is responsible for all MAPI access. The only protocol used to (MAPI) communicate to a Mailbox server in Exchange 2007 is the MAPI RPC protocol. Post Office Protocol version 3 (POP3) Remote Procedure Call (RPC) Internet Message Access Protocol version 4 (IMAP4) POP3 is a mail-drop protocol designed to work with clients that are not always connected to the network. It allows a mail server to receive mail messages and store them on a server until the client comes back online and requests them. Remote Procedure Calls are based on a client/server model in which one server runs processes on another server. Both servers assume the calls are local, when in reality they run over LAN connections and through software libraries on both servers. Like POP3, IMAP4 is a protocol that allows a client to download messages from a server. (It does not allow you to send messages.) IMAP4 is much more powerful than POP3. For example, with IMAP4, you can open all folders in your mailbox, not just the Inbox, as well as public folders on the server.

Exchange Management Shell Facts The Exchange Management Shell (also referred to as the Exchange PowerShell) is the primary platform for all administration (the graphical interface is simply running atop of the command shell). You should know the following about the Exchange Management Shell:

The PowerShell must be installed before Exchange 2007 is fully installed, then extensions are installed to the PowerShell during the Exchange 2007 installation to create the Exchange 2007 PowerShell environment. To manage your Exchange organization, make sure you load the Exchange Management Shell, not Microsoft Window's PowerShell. The Exchange.ps1 file includes setup for the PowerShell.

Management using the shell is done by typing cmdlets. 44

Cmdlets use a verb + noun-based syntax, for example: Get-AcceptedDomain. Commands are followed by one or more options. Options are identified by a hyphen and are typically followed by data. For example, Get-Mailbox -Server Server1 returns a list of mailboxes on Server1. To see the options available with a command, type help followed by the command. To get help within an environment, type get-help. Use the -detailed option with this command to get even more information. The tab completion feature automatically points you to the most likely command if you only enter part of a command then press tab. If you're not sure what the command is, or only know part of it, use tab completion to see options starting with the letters you have typed.

The following table lists the basic set of Management Shell commands: Command Set Get New Move Disable Enable Install Uninstall Remove Test Description Set modifies the properties of an existing Exchange 2007 object. Get retrieves information about a particular Exchange 2007 object. Pipe the command to the FormatList cmdlet to tell it to return verbose information when you run a command. New creates a new Exchange 2007 object. Move relocates the specified Exchange 2007 object from one container or server to another. Disable sets the Enabled status of the specified Exchange 2007 object to $False, which prevents the object from processing data even though the object exists. Enable sets the Enabled status of the specified Exchange 2007 object to $True, which enables the object to process data. Install installs a new object or feature on an Exchange 2007 server. Uninstall removes an object or feature from an Exchange 2007 server. Remove deletes the specified Exchange 2007 object. Test tests specific Exchange 2007 components and provides log files that you can examine.

Excommand Excommand lists all available commands that relate to Exchange Server 2007.

Use pipelining (also called piping) to string together the actions of two or more cmdlets. Output from the first cmdlet is fed into the second cmdlet (and so on). For example, the following cmdlet gets a list of mailboxes on a server, then moves all mailboxes to a new server: Get-Mailbox -Server Mail1 | Move-Mailbox -TargetDatabase Mail2\Executives When you execute a Get command, a default set of values is returned and the content is displayed in a specific order. Use the following cmdlets in combination with the Get command to format the output:

Use Format-List (fl) to take input from the pipeline and output a vertical columned list of all the specified properties of each object. This option is similar to the verbose option for command prompt commands. You can also follow fl with a list of properties to show only the desired properties. Use Format-Table to display items in a table format with label headers and columns of property data. Use GroupBy to group output by a specified property. Use Property to specify which properties you wish to be displayed. Use Sort-Object to sort information using a specific order.

Server Preparation Facts Before installing Exchange Server 2007, you must first evaluate the type of hardware that is available. The hardware and directory requirements of Exchange 2007 are outlined in the following table: 45

Component

Description Exchange Server 2007 supports only 64-bit processors in a production environment. This change increases the total amount of memory that can be used by Exchange. Supported processors are:

Intel processors that support Intel Extended Memory 64 Technology (for example Intel Xeon or Intel Opteron processors). AMD processors that support AMD64 (for example AMD Athlon processors).

You should be aware of the following information concerning processors: Architecture

You must choose a processor that works with the x64-based version of Windows Server 2003. Because Intel Itanium processors cannot be used with x64-based versions of Windows Server 2003, they cannot be used with Exchange 2007. Exchange Server 2007 shows significant performance benefits when employing dual-core processors. A 32-bit version of Exchange is available, but is only supported in testing and training environments. Management tools can be installed on 32-bit processors in production environments. To do this, you must download the 32-bit version of Exchange 2007.

You can install Exchange Server 2007 on the following operating systems: Operating system

x64-bit Windows Server 2003 SP1 or later. 64-bit versions of Windows Server 2008 is supported beginning with Exchange 2007 SP1. 32-bit versions of Windows Server 2003 are supported only in testing and training environments (and only with the 32-bit version of Exchange).

The minimum RAM requirement to support Exchange 2007 is 2 GB per server. Depending upon the server role being installed, the recommended RAM is:

RAM

Edge Transport server: 2 GB minimum or 1 GB per core (whichever is higher), with a maximum of 16 GB per server. Hub Transport server: 2 GB minimum or 1 GB per core (whichever is higher), with a maximum of 16 GB per server. Client Access server: 2 GB minimum or 1 GB per core (whichever is higher), with a maximum of 8 GB per server. Unified Messaging server: 2 GB minimum or 1 GB per core (whichever is higher), with a maximum of 4 GB per server. Mailbox server: Recommended 2 GB minimum, with an additional 2-5 MB per mailbox, with a maximum of 32 GB per server. Multi Role (Hub, CAS, UM, Mailbox): Recommended 4 GB minimum, with an additional 2-5 MB per mailbox, with a maximum of 8-32 GB per server (depending on the combination of roles installed).

You should know the following about selecting memory for your Exchange 2007 server:

32 GB is not a physical limitation; rather, it is currently the most cost-efficient memory configuration. The major advantage of having large amounts of RAM on a server is that it significantly lessens the workload of the disk subsystem. The disadvantage of implementing larger RAM is the cost of the RAM and installation is 46

high compared to the amount of performance gained. Depending on the system, you might need to choose slower memory in order to get up to the maximum supported memory. Installing more memory might require using slower RAM.

An Exchange Server 2007 installation requires:

Free disk space

At least 1.2 GB of available disk space for the installation. 200 MB of available disk space on the system drive. An additional 500 MB of disk space for each Unified Messaging (UM) language pack you install. On Hub Transport and Edge Transport servers, 4 GB of space for message queues. (This requirement has been reduced to 500 MB on Exchange 2007 SP1.)

To install Exchange 2007, the following disk partitions should be formatted as NTFS:

File System

System partition Partitions containing database files Partitions that store Exchange binary files Partitions containing storage group files, including transaction log files Partitions containing other Exchange files

The disk subsystem must have enough storage capacity to support the I/O operations of the server and also support the amount of mailbox space allotted to each user. Exchange server 2007 supports:

Locally-attached storage Storage Area Networks (implementation of Fibre Channel technology is ideal) IP SCSI Network-Attached Storage technology.

Disk subsystem Be aware of the following when designing disk use for Exchange 2007:

Although you can install Exchange 2007 on a single disk, for maximum performance you should use different disks for system files, database files, and transaction log files. Because of the increase in RAM in Exchange 2007, you can have a smaller number of large disks without seeing a decrease in performance.

A system must meet the following additional requirements to install Exchange 2007: Additional requirements

A local- or network-accessible DVD-ROM drive. Screen resolution set to 800 x 600 pixels or higher.

Before installing Exchange 2007, the following components are required for all server roles:

.NET Framework 2.0 PowerShell 1.0 Microsoft Management Console 3.0 All necessary hotfixes

Note: If you use the Setup wizard in the graphical installation, these components (except for the hotfixes) will be added automatically. 47

Once the common criteria is in place, you must install the individual required components of whichever server roles you install: Role Additional Components A Mailbox server requires the following components: Mailbox server

Internet Information Services (IIS) Enable network COM+ access in IIS World Wide Web Publishing Service (W3SVC)

A Unified Messaging server requires the installation of: Unified messaging server

The Microsoft Speech Engine service The Windows Media Audio Voice Codec The Windows Media Encoder Microsoft Core XML Services (MSXML) Version 6.0

The Client Access server requires: Client Access server

World Wide Web Publishing Service (W3SVC) RPC/HTTP proxy Windows networking component on any computer that provides Microsoft Outlook Anywhere access (recommended one per site) ASP.NET version 2.0 Distributed Transaction Coordinator Service

An Edge Transport server requires the Active Directory Application Mode (ADAM) to be installed before the Edge Transport server can be installed. It is best to accept all of the default settings Edge Transport during the ADAM installation. server Note: If you are installing Exchange 2007 SP1, install Active Directory Lightweight Directory Services (AD LDS) instead. Note: When installing an Exchange server role in Exchange 2007, it is not necessary to install the SMTP or the NNTP components before installation is initiated, as was the case in Exchange 2003. If you install the Hub Transport server role or the Edge Transport server role on a machine, it cannot have the SMTP service or the NNTP services installed on it. In addition, the NWLink IPX/SPX/NetBIOS Compatible Transport Protocol must not be installed on any Exchange server. Client computers or mobile devices must have the following installed to run certain applications: Application Additional Components To use Microsoft Outlook to access an Exchange 2007 mailbox, you must have one of the following versions of Outlook installed on the client's computer: Outlook

Outlook 2002 Outlook 2003 Office Outlook 2007

Outlook Web Access

The client computer must have a Web browser installed. Microsoft Internet Explorer must be installed if Integrated Windows authentication is employed. 48

For mobile devices access to mailboxes requires the following: Mailbox access for mobile devices

Windows Mobile 2003 Second Edition Windows Mobile 5.0 with the Messaging and Security Feature Pack (MSFP) A non-Windows operating system that are compatible with Exchange ActiveSync

High Availability Facts High availability solutions in Exchange 2007 rely upon the following technologies: Feature Description Continuous replication replicates Exchange data between two nodes.

Continuous Replication

With Local Continuous Replication (LCR), a copy of a storage group is created and maintained on a second set of disks that are connected to the same server as the production storage group. With Cluster Continuous Replication (CCR), two computers (called nodes) are configured in an active/passive cluster configuration. The active node maintains the production copy of the Mailbox server, and the passive node maintains the copy, which is kept current in case the active node fails over to the passive node.

Log Shipping Autodiscover

Log shipping applies the log files of a production database to a copy of the database. This allows you to create a copy of a storage group and maintain that copy current. Both LCR and CCR use automatic log shipping. Autodiscover allows a user to connect automatically to the mailbox after the mailbox database has moved from one server to another. Database portability allows a mailbox database to be mounted on any server in the same organization. When users try to connect, the Exchange 2007 Autodiscover service automatically directs them to the new location. Portability only applies to mailbox databases; public folder databases are not portable. You should replicate public folder data between servers to move it rather than copy it. Cached Exchange mode places a copy of the user's mailbox on the local machine. The copy synchronizes with the mail server when connections become available. This allows users to work offline, or to continue to work if the Mailbox server is unavailable. Load balancing distributes the resource load across the designated servers. You can implement network load balancing using hardware (a dedicated server) or by using a software solution, such as the Network Load Balancing (NLB) service in Windows. Round Robin DNS allows you to perform load balancing by using the DNS server to spread the work load between multiple servers. DNS round robin works as follows:

Database Portability Cached Exchange Mode in Outlook Load Balancing

Round Robin DNS

1. An A record identifies a specific service. The A record contains multiple server IP addresses. 2. When a user request is made for the IP address of the service name, DNS supplies the first IP address in the list. 3. The next request gets the second IP address in the list, and so on, rotating through each server in the A list. 49

DNS round robin provides load balancing only; not fault tolerance. If one of the listed servers goes down, the DNS server will still continue to supply its IP address in turn as clients request host name resolution. The table below describes the high availability solutions for each of the server roles. Role Description To provide load balancing and fault tolerance for Hub Transport servers, simply install multiple Hub Transport servers in each Active Directory site. To provide load balancing and fault tolerance for Send connectors, add multiple Hub Transport servers as source servers.

Hub Transport

Exchange automatically load balances mail processing tasks between all Hub Transport servers within the site. Exchange automatically determines when a Hub Transport server is unavailable and routes messages to the remaining Hub Transport servers in the site. If there is no Hub Transport server within the site available, messages move into the queue where they remain until a Hub Transport server does become available or the messages expire.

Note: If you install your Hub Transport server on the same machine as your Mailbox server, your Hub Transport server does not do true load balancing. This is because the local server is preferred for sending mail by all users that have mailboxes on that server. The Client Access server role is responsible for handling all non-MAPI communications, and is used for Outlook Web Access (OWA), POP3, IMAP4, and ActiveSync clients. To provide load balancing: Client Access server

Configure multiple Client Access servers and use round robin DNS. Configure a dedicated server (hardware solution) or a service like Windows Server 2003's Network Load Balancing.

The Edge Transport role is responsible for accepting e-mail from the Internet, performing message hygiene, and sending messages out to Internet recipients.

Edge Transport

To improve out-bound mail flow performance within a site, install at least one Edge Transport server in each site. To provide fault tolerance and load balancing, subscribe multiple Edge Transport servers in each site. Outbound requests will be routed evenly between available Edge Transport servers.

Note: If the Edge Transport server subscribed to a site is unavailable, messages will queue on a Hub Transport server at that site until the Edge Transport server comes back online. Messages will not be re-routed to other Edge Transport servers subscribed to other sites. Unified Messaging server The Unified Messaging server role is responsible for providing voice activated access to user's mailboxes and voicemail and providing integrated voicemail, calendars, faxes, and e-mail. High availability is provided by installing a second Unified Messaging server and implementing a dial plan that will be used by the VoIP gateway to direct requests to the first available server in a round-robin fashion. Mailbox servers provide e-mail storage, Public Folder databases, and other services. To maintain Mailbox server high availability, use one of the following solutions: Mailbox server

To provide data redundancy in the event of a disk failure, implement Local Continuous Replication. To provide service redundancy in the event of a server failure, implement a Mailbox cluster 50

with a shared disk subsystem. To provide both service and data redundancy, implement Cluster Continuous Replication.

Exchange Installation Facts Using a role-based server model simplifies the Exchange 2007 installation process. Instead of responding to multiple configuration questions, you simply choose the role(s) to install on a specific server. To install Exchange 2007 on a server, you need the appropriate permissions:

To install a server role after Active Directory has been prepared, you must be delegated the Exchange Organization Administrator role and have membership in the local Administrators group on the server. Additional permissions are required if you need to prepare legacy permissions, extend the schema, create the Exchange organization, or prepare the domain for Exchange installation. After the first Exchange server has been installed, you can designate other administrators who can install the server by provisioning the server. Provisioning identifies a user account that is allowed to perform the installation. Users are added to the Exchange View-Only Administrator role and are given the necessary permissions to install Exchange on the server (similar to the permissions given through the Exchange Server Administrator role).

Exchange 2007 provides two methods of running the server installation: Method Description The Setup wizard is the graphical installation tool for Exchange 2007. Start the Setup wizard by running Setup.exe from the Exchange installation disc. You can choose between two installation types:

Choosing a Typical installation installs the Mailbox role, Hub Transport role, Client Access role, and Management Tools. Choosing a Custom installation lets you choose the specific role(s) to install, implement clustering, or install only the Management Tools.

Be aware of the following when using the Setup wizard. Setup wizard

Active Directory preparation tasks will be performed if they have not already been completed (as long as you have the appropriate permissions). If the server prerequisites (such as the Microsoft Command Shell, MMC Console 3.0, and the .NET framework) have not yet been installed, you will be provided with links to add these components. After you install a role on the server, you cannot use the Setup wizard to add any additional server roles. To install additional server roles, you must use Add or Remove Programs from Control Panel or install the role(s) from the command line prompt.

An unattended setup uses the Setup.com program with various switches to customize the installation. With Setup.com you can: Unattended setup

Install any supported combination of server roles. Add or remove server roles. Configure clustering. Install the management tools. Create the Exchange organization (if the installation is the first install). 51

Save the Setup command and options as a script for running on other servers.

The management tools will be installed automatically when any server role is installed. Use the following switches with Setup.com to install Exchange 2007 from a command line in unattended mode: Command Description /roles (/r) specifies which server roles will be installed. Apply the following switches:

/roles (/r)

ET or E specifies the Edge Transport server. HT or H specifies the Hub Transport server. CA or C specifies the Client Access server. MB or M specifies the Mailbox server. UM or U specifies the Unified Messaging server. MT or T specifies the Management Tools.

For example, to install Exchange 2007 with the Client Access and Mailbox server roles, enter Setup.com /roles:MB,CA or Setup.com /r:M,C into a command prompt. /mode specifies the setup mode.

/mode

Install is the default mode used to install a new Exchange 207 server or to add server roles to an existing server. Upgrade is used to upgrade an existing Exchange server that predates Exchange 2007. Uninstall is used to uninstall Exchange 2007. Add the /roles parameter to remove an individual role. RecoverServer is used to restore Exchange files and local configuration settings on a failed Exchange 2007 server.

If you do not specify a mode, the default Install mode will be used. /OrganizationName (/on) specifies the name of the organization. This parameter is required if you are installing the first server in an organization and you have not run Setup /PrepareAD. This parameter cannot be used if you are installing a server in an existing Exchange organization or if you have already run Setup /PrepareAD. Note: You must be a member of the Enterprise Admins group to use the /on switch. /SourceDir /TargetDir (/t) /SourceDir specifies the location of the install files. /TargetDir (/t) specifies the directory in which Exchange 2007 will be installed. /DomainController (/dc) specifies a domain controller to use. The domain controller that is specified must be:

/OrganizationName (/on)

In the same Active Directory site as the server on which Setup is run. Running Windows Server 2003 SP1.

/DomainController (/dc)

You should know the following about the /dc parameter:

You can use NetBIOS or a fully qualified domain name (FQDN) format to specify a domain controller. Setup will select a domain controller to use if /dc is not used. When you prepare Active Directory and domains for Exchange 2007 or when 52

you install Exchange 2007 into an environment which contains domain controllers that are running Windows Server 2000, you must run Setup with the /dc parameter to specify the domain controller that is running Windows Server 2003 SP1. /AnswerFile specifies the location of a file that contains the setup parameters. Use this file to install the same parameters on multiple computers. An example of the Setup command to use the answer file is: Setup.com /Mode:Install /Roles:Mailbox /AnswerFile:C:\AnswerFile01.txt. /DoNotStartTransport Setup starts the Microsoft Exchange Transport service after installing either the Hub Transport or Edge Transport server role by default. The /DoNotStartTransport parameter specifies that the Microsoft Exchange Transport service will not start when Setup completes. /EnableLegacyOutlook specifies that you have client computers that are running Microsoft Outlook 2003 or earlier and will cause Exchange 2007 to create a public folder database on the Mailbox server. /EnableLegacyOutlook

/AnswerFile

This can only be used if you are installing the first Mailbox server in an organization. This command is done by default when you install the first Mailbox server in an existing Exchange 2003 or Exchange 2000 organization.

/LegacyRoutingServer

/LegacyRoutingServer specifies the Exchange 2003 or Exchange 2000 bridgehead server on which you will create a routing group connector. This will allow Exchange 2007 to coexist with either Exchange 2003 or Exchange 2000. /EnableErrorReporting enables the Microsoft Error Reporting Service to collect information about how you use Exchange 2007 and about any issues you may encounter. /DisableErrorReporting causes the Microsoft Error Reporting Service to stop collecting information about how you use Exchange 2007 and about any issues you may encounter.

/EnableErrorReporting

/DisableErrorReporting

/NoSelfSignedCertificates is used if you have a PKI in the organization and you do not /NoSelfSignedCertificates want Setup to create self-signed certificates in the case where no other valid certificate is found for Secure Sockets Layer (SSL) or Transport Layer Security (TLS) sessions. /AdamLdapPort specifies the Lightweight Directory Access Protocol (LDAP) port to use for the Edge Transport server role Active Directory Application Mode (ADAM) instance. Know the following about this command: /AdamLdapPort

You can specify any valid unused port number. The default port is 50389. You can use this command only if you are installing the Edge Transport server role.

/AdamSslPort specifies the SSL port to use for the Edge Transport server role ADAM instance. Know the following about this command: /AdamSslPort

You can specify any valid unused port number. The default port is 50636. You can use this command only if you are installing the Edge Transport server 53

role. /PrepareAD (/p) /PrepareAD (/p) is used to prep the Active Directory schema manually. This switch is optional because the schema is created automatically during installation. /NewProvisionedServer: <server name> (/nprs: <server name>) creates a placeholder server object in Active Directory so you can delegate the setup of a server. Know the following about this parameter:

/NewProvisionedServer

Setup.com creates a placeholder server object in Active Directory for the local server if you do not specify a server name with this parameter. The server that you specify must have a machine account in Active Directory. To run this parameter, you must have an existing Exchange organization in Active Directory, you must be delegated the Exchange Organization Administrator, and you must have at least one Exchange 2007 server installed in the organization. Use the /ServerAdmin: <user or group> parameter to identify a user or group account that will have permissions to a provisioned Exchange server. Permissions allow for installing a server role, but do not allow uninstalling Exchange.

The following CMS switches allow you to manage a new mailbox cluster.

Cluster Mailbox Service switches

/NewCms creates a new Exchange 2007 clustered Mailbox server. /RemoveCms specifies that you want to remove an Exchange 2007 clustered Mailbox server. /RecoverCms specifies that you want to recover an Exchange 2007 clustered Mailbox server. /CMSName specifies the name of the Exchange 2007 clustered Mailbox server. /CMSIPAddress specifies the static IP address of the Exchange 2007 clustered Mailbox server. /CMSSharedStorage specifies that this cluster node uses shared storage. /CMSDataPath specifies the path for shared disks.

Note: You can install only the Mailbox server role on a cluster.

Post Installation Tasks After you have prepared Active Directory for Exchange installation, and before installing the first Exchange server, verify the following Active Directory configuration:

The Exchange Install Domain Servers group is a member of the Exchange Servers USG in the root domain. There is a new organizational unit (OU) in the root domain called Microsoft Exchange Security Groups which contains the following new Exchange USGs: o Exchange Organization Administrators o Exchange Recipient Administrators o Exchange View-Only Administrators o Exchange Servers o ExchangeLegacyInterop The Exchange Servers USG on each domain controller in a domain in which Exchange 2007 is installed has permissions on the Manage Auditing and Security Log policy. 54

There is a new global group in the Microsoft Exchange System Objects container called Exchange Install Domain Servers.

Following Exchange server installation, use the following steps to complete the installation:

Run the Get-ExchangeServer cmdlet in the Exchange Management Shell to verify the installation. You should see a list of all Exchange 2007 server roles that are installed on the specified server. Examine the Application log for any error messages. Troubleshoot accordingly. Review the setup log files using the Get-SetupLog files command. Use the following commands to check the setup log files: o Get-SetupLog c:\exchangesetuplogs\exchangesetup.log -error generates a list of only the errors and warnings logged during setup. o Get-SetupLog c:\exchangesetuplogs\exchangesetup.log generates a list of all events logged during setup in a format that can be sorted or explored in the Exchange Management Shell. o Get-SetupLog c:\exchangesetuplogs\exchangesetup.log -tree generates a list of all events logged during setup and presents the results in an indented tree format. o Get-SetupLog c:\exchangesetuplogs\exchangesetup.log -error -tree generates a list of only the errors and warnings logged during setup and presents the results in an indented tree format. Check the Exchange server documentation to verify that all necessary services used by the Exchange role(s) have been installed and started. Run Exchange Server Best Practices Analyzer to verify that the Exchange configuration meets Microsoft best practice standards. Complete the tasks under the Finalize Deployment tab in the Exchange Management Console under the Microsoft Exchange node. These tasks are required to complete the installation and include the following: o Entering the product key o Configuring the offline address book for distribution o Configuring ActiveSync and SSL for the Client Access server o Creating a subscription for the Edge Transport server o Configuring authoritative domains for the organization and the Edge Transport server o Configuring Unified Messaging o Configuring DNS Optionally, you can complete the suggested tasks under the End-to-End Scenario tab. Run the Security Configuration Wizard to check the security of your configuration.

Following server installation, you must perform additional tasks to configure recipients and enable end-to-end mail flow in the organization. Recipient Properties Facts The settings you can configure on specific recipients depends on the recipient type. In most cases, you can use the Management Console or the Management Shell to configure all recipient properties. The following table lists common recipient properties that you can configure. Setting Description Message size restrictions limit the size of messages that can be sent or received. In addition to configuring settings on recipients, size restrictions can also be set on the following objects in Exchange:

Settings for all recipients

Message size restrictions

Organizational limits apply to all Exchange 2007 servers that exist in the organization. Global limits apply to all Exchange 2007 and Exchange Server 2003 servers that exist in the organization. 55

Connector limits apply to any messages that use the specified Send connector, Receive connector, or Foreign connector for message delivery as defined on Hub Transport servers or Edge Transport servers. Server limits apply to a specific Hub Transport server or Edge Transport server.

The maximum message size that can be sent or received by a specific recipient is the most restrictive (smallest) size set on the various objects. For example, setting a larger message size restriction for a mailbox will not have an effect if a smaller size is set on the Hub Transport server used to send the message to the mailbox. In addition to setting the maximum send and receive sizes, you can use the -MaxSafeSenders switch to specify the maximum number of senders that can be included in the safe senders list. This property can only be set through the Management Shell. Message delivery restrictions accept or reject messages based on the sender. Use message delivery restrictions to:

Message delivery restrictions

Only accept messages from a specific list of senders. Reject messages from a specific list of senders. Require that all senders are authenticated (accept messages only from users within the organization).

From the command prompt:

Use -AcceptMessagesOnlyFrom or -RejectMessagesFrom to identify allowed or blocked users or contacts. Use -AcceptMessagesOnlyFromDLMembers or -RejectMessagesFromDLMembers to identify allowed or blocked distribution lists (groups).

When mail cannot be delivered to a recipient, one of the following responses can be configured to take place: Non-delivery

Out of office messages can be sent to external senders. Microsoft Outlook and Exchange Server Non-Delivery Reports (NDRs) are generated when e-mail cannot be delivered to a recipient. o Mailboxes can be configured to accept NDRs when they are created. o NDRs can be forwarded to internal mailboxes.

Use Set-Mailbox -HiddenFromAddressListsEnabled to specify whether this mailbox is hidden from other address lists. The two possible values for this parameter are $true or $false. Hide from address lists This setting is useful in instances when a mailbox address should not be made public in the global catalog server, for example, special inboxes that are only used for communication between the senior members of a company. Settings for mailboxes, rooms, and equipment A quota is a set restriction on the size of mailboxes. Use the following cmdlets to set quotas:

Quota

Use Set-Mailbox -ProhibitSendQuota to specify the mailbox size at which the user associated with this mailbox can no longer send messages. Use Set-Mailbox -ProhibitSendReceiveQuota to specify the mailbox size at which the user associated with this mailbox can no longer send or receive messages. 56

Note: The quota limits configured for a mailbox database are used as the default limit for all mailboxes in the database. When quotas are configured on a per-mailbox basis, those settings take precedence over the default settings for the database. Messaging Records Management (MRM) allows you to:

Remove content that has no legal or business value. Create policies that will simplify the process of complying with company policy, government regulations, or legal needs in regards to e-mail communications.

Messaging Records Management (MRM)

To configure MRM, you must be a member of Exchange Organization Administrator role. MRM entails the following process: 1. An administrator applies managed content settings to a user's mailbox folders. 2. An administrator or the user places these managed folders in the user's mailbox. 3. The user sorts individual messages or entire folders into the managed folders according to organization policy. 4. Messages in managed folders are periodically processed by Exchange according to the folder content settings. 5. When a message reaches a retention limit, it is archived, deleted, or flagged for user attention, or the event is simply logged. Use delivery option settings to:

Configure a forwarding mailbox. Messages are forwarded or copied to the designated recipient. Allow other users to send e-mail using a specific account, add authorized users to the Send on behalf list. Messages sent from authorized users will show "Sent on behalf of OriginalUser by DelegatedUser" in the From field of a message. Set a limit on the maximum number of recipients for a message.

Delivery options

Use the following cmdlets to configure delivery options:

Use Set-Mailbox -DeliverToMailboxAndForward to specify whether messages sent to this mailbox will be forwarded to another address. Use Set-Mailbox -ForwardingAddress to specify a forwarding address where messages will be sent if the -DeliverToMailboxAndForward switch is set to $true. Use Set-Mailbox -GrantSendOnBehalf to specify the distinguished name (DN) of other mailboxes that can send messages on behalf of this mailbox. Use Set-Mailbox -MaxBlockedSenders to specify the maximum number of senders that can be included in the blocked senders list.

Mailbox features control the allowed client access methods for the recipient. The following features can be enabled on a per-mailbox basis:

Mailbox features

Outlook Web Access ActiveSync Unified Messaging MAPI

By default, all users are allowed all access. Use the Set-CASMailbox cmdlet to enable or disable access for specific features. Settings for rooms and equipment 57

Resource settings identify specific characteristics of the room or the piece of equipment. By default, both room and equipment mailboxes have a capacity property that you can configure. Use the console or the Set-Mailbox -ResourceCapacity cmdlet to specify the capacity of the resource mailbox. In addition, you can define custom properties that apply to the object. To define a custom attribute: Resource settings 1. Use Set-ResourceConfig to define the property. The property is created in Active Directory by extending the schema. Each property must be identified as either a Room property or an Equipment property. For example, you could define a property called Whiteboard that applies to a Room. 2. Add the specific property to the resource mailbox. You can select the resource from a list in the Console, or use Set-Mailbox -ResourceCustom to identify the custom properties associated with the resource. Resource mailbox calendar settings allow you to:

Calendar settings

Retrieve the Calendar Attendant configuration on the target mailbox. Enable calendar processing for a mailbox. Specify a list of users who can approve or reject requests sent to this resource mailbox. Enable or disable calendar processing on the mailbox.

Use Get-MailboxCalendarSettings to retrieve the Calendar Attendant configuration and SetMailboxCalendarSettings to enable calendar processing for a mailbox. Settings for distribution groups A member of a distribution group receives all messages that are sent to the distribution group. To view group membership:

Members

Use the Management Console or Get-DistributionGroupMember to view members of distribution groups. To view members of a dynamic distribution group, use the Management Console to view the properties of the group. On the Conditions tab, click the Preview button to generate the list of members based on the current conditions.

To modify group membership, use the Management Console or:

Use Add-DistributionGroupMember or Remove-DistributionGroupMember for distribution groups. Use Set-DynamicDistributionGroup to change group filter criteria.

Expansion servers perform the functions necessary to send messages to distribution groups. When a message is sent to a distribution group, the expansion server performs the following process: Expansion server 1. The server receives a message. 2. The server accesses the distribution group membership. 3. The server sends the message to each recipient in the membership list. In Exchange 2007, distribution groups are configured to use any Hub Transport server as a distribution group expansion server by default. Specific servers can be specified as expansion servers by using Set-DistributionGroup -ExpansionServer. 58

Managed by

The Managed by property identifies a user who is in charge of the group. This user receives delivery reports for the group.

Note: To allow a user to modify recipient settings, add the user as an Exchange Recipient Administrator. Message Flow Facts Mail flow is the term used to describe the movement of incoming and outgoing mail within an Exchange organization. In Exchange 2007, all mail is routed (including mail sent and received on the same Mailbox server) through a Hub Transport server before it is delivered to a Mailbox server. All external mail must additionally go through an Edge Transport server. The use of transport servers for all mail delivery allows you to apply transport rules to mail, regardless of its origin or destination. With these rules you can control delivery or apply filters, such as anti-spam and antivirus, to all mail. Exchange transport servers use connectors to define how inter-server communication takes place. The connector describes how the transport servers communicate with other transport servers, with legacy Exchange servers, with other messaging systems, and with devices on the Internet. There are three types of connectors:

Send connectors control outbound communications. Receive connectors control inbound communications. Foreign connectors control outbound communications with servers that do not use SMTP for communication.

The following table describes how messages are routed in various scenarios. Mail Flow Description If a user sends a message to another user whose mailbox resides on the same server, the following steps are performed: Local Mail Flow 1. The message is received by the Mailbox server. 2. The Mailbox server submits the message to the Hub Transport server using RPC. 3. The Hub Transport queries the Domain Controller or the Global Catalog server to determine the location of the recipient and a method of delivery. 4. The message is forwarded to the user's mailbox on the Mailbox server. 5. The recipient is notified of new mail. Inbound mail flow are messages that have been received from the Internet. In a typical inbound mail flow scenario, the following steps take place: 1. A message is received by an Edge Transport server from an external host using SMTP over port 25. 2. The Edge Transport server verifies that the address is a valid address in the organization then applies message hygiene (such as antivirus and anti-spam scans) to the message. 3. The Edge Transport server transfers the message to a Hub Transport server using SMTP over port 25. 4. The Hub transport server queries the Domain Controller to locate the recipient's mailbox. 5. The Hub Transport server communicates with the Mailbox server using MAPI and RPC and delivers the message. Note: It is possible to deploy an Exchange environment without deploying an Edge Transport server. If you choose to create an environment without an Edge Transport server, you can choose to deploy the anti-spam and antivirus agents found on the Edge Transport server on the Hub Transport server instead. 59

Inbound Mail Flow

Outbound mail flow represents messages that are sent to an external entity, such as Internet recipients. In a typical outbound mail flow scenario, the following steps take place: 1. A message is received by the Mailbox server. 2. The Mailbox server sends the message to the Hub Transport server using RPC. 3. The Hub Transport server recognizes that the recipient is an external recipient and checks to see where to forward the message. If an Edge Transport server is present in the environment, then there will be a Send connector that identifies the Edge Transport server. The Hub Transport server sends the message to the Edge Transport server using SMTP over port 25. 4. The Edge Transport server will do one of the following, depending on its routing configuration: o If it is configured with a Send connector that uses another smart host (such as an email server at your ISP), it will forward the message on to the alternate smart host. o If it is configured to route messages using a DNS server: 1. The server queries the DNS server for an MX record that identifies the server(s) which are responsible for managing e-mail for the recipient domain. 2. The DNS server provides the Edge Transport server with the IP address and the name of the recipient mail server. 3. The Edge Transport server initiates a connection to the remote SMTP server using port 25. Remote mail flow represents messages that are being sent to other Exchange servers but are located in different sites. The following scenario demonstrates the default behavior of how Hub Transport servers relay messages between sites: 1. A message is submitted by a user to the local Mailbox server. 2. The Mailbox server submits the message to the Hub Transport server using RPC. 3. The Hub Transport server categorizer queries the Global Catalog server to identify the site location of the recipient's Mailbox server. 4. The Hub Transport server sends the message to the destination site. 5. A Hub Transport server in the destination site receives the message, then forwards it to the appropriate Mailbox server. Inter-site mail delivery typically uses implicit (automatic or built-in) Send connectors to identify the destination mail servers.

Outbound Mail Flow

Remote (Inter-site) Mail Flow

Communication Security Facts By default, communication between Exchange 2007 servers is secured as follows:

Communication between Mailbox servers and Hub Transport servers use RPC which includes a weak form of encryption. For added security, you can require IPSec on these connections. Communication between Hub Transport servers and between Hub and Edge Transport servers use mutual authentication and TLS. The TLS session uses the self-signed certificate that is created with each transport server when it is installed. You can replace the self-signed certificate with a third-party certificate. Communication between Internet hosts and Edge Transport servers is not secured.

You can customize the authentication used to communicate with an Exchange 2007 server by modifying the properties of the Send and Receive connectors. The following table describes the various options: Authentication Method Description 60

None Transport Layer Security (TLS) Domain Security

Does not require authentication. This option is most commonly used to communicate with smart hosts that allow anonymous connections, or on Edge Transport servers to receive mail from Internet hosts. When TLS is used, the server offers to establish a TLS connection with the communicating partner. Domain Security is an Exchange 2007 feature that provides for secure exchange of e-mail with partner domains. Domain Security uses TLS with mutual authentication to establish a session between Exchange servers. To configure Domain Security, enable TLS and then identify the list of domains with which communications are allowed. Basic authentication requires a user to submit a user name and password for authentication. These credentials are sent in clear text, so best practice dictates that you do not use Basic authentication without some form of encryption. This method requires the use of TLS before authentication can take place. After the TLS session is established, basic authentication is used for authentication. TLS protects the clear text username and password. Integrated Windows authentication is available only on Receive connectors. When enabled, the client negotiates the use of either NTLM or Kerberos. This option identifies the authentication used between Exchange servers.

Basic Authentication Basic Authentication over TLS Integrated Windows Exchange Server Authentication

When communicating with previous Exchange servers, either NTLM or Kerberos is used. When communicating with Exchange 2007 servers, TLS is used.

Externally Secured

An externally secured connection enforces no authentication or encryption. It is assumed that the connection between devices is secured using some other method. When choosing this option, make sure to implement security controls, such as IPSec, to protect traffic. Be aware that Exchange cannot verify the security of this type of connection.

Message Queue Facts In the Exchange 2007 messaging environment, messages are placed in queues as they wait to be sent. Queues are stored in an Extensible Storage Engine (ESE) databases on transport servers. Exchange 2007 queues can hold up to a million messages, so in the event of a server failure, the database can be retrieved and mounted onto another server, at which point the queued messages will be sent to their recipients. The method of routing for a message determines the type of queue in which the message will be stored. There are several types of message queues in Exchange 2007: Type Unreachable queue Description The Unreachable queue holds messages that cannot be routed to their destination because a route to the recipient cannot be determined (i.e. the recipient or recipient domain is unknown within the system). Messages where the destination SMTP server has been determined but where the server doesn't respond are not put in the Unreachable queue. Each transport server has only one Unreachable queue.

Mailbox Delivery queues only exist on Hub Transport servers. They hold messages for recipients Mailbox whose mailbox data is stored on a Mailbox server within the same site as the Hub Transport server. A Delivery queue Hub Transport server has a Mailbox Delivery queue for every unique destination Mailbox server. Submission queue The Submission queue holds messages routed through the Hub Transport or the Edge Transport server that are waiting to be processed. The categorizer processes messages in the Submission 61

queue and determines how they will be routed based on the recipient information. After the message is categorized, it is placed into a queue for delivery. Each Exchange 2007 transport server has only one Submission queue. Remote Delivery queues hold messages that will be delivered using SMTP to recipient mailboxes that reside on remote servers. A queue exists for each unique remote destination.

Remote Delivery queue

On a Hub Transport server, Remote Delivery queues hold messages to be sent to remote Active Directory sites. On an Edge Transport server, Remote Delivery queues hold messages that are routed to an external SMTP domain or smart host.

When a message is received from a new remote destination, a Remote Delivery queue is dynamically created. Once the messages have been successfully delivered, the queue expires and is automatically deleted three minutes later (you can configure this time to be longer or shorter). The Poison Message queue is used to isolate messages that contain errors that are potentially harmful to Exchange Server. When a fatal error occurs, Exchange server places currently-processing messages in the Poison Message queue to isolate the message from the rest of the system (just in case the message was the cause of the fatal error). Poison Message queue

This queue is only viewable in the case that messages have been directed to the queue. Delivery of all messages within the Poison Message queue is suspended. If you determine that a message is not harmful, you can resubmit it to the Submission queue for processing. Likewise, you can delete messages in the Poison Message that you consider harmful to the system. There is one Poison Message queue on each transport server.

Queue Management Facts Message queues can be configured by using the Queue Viewer in the Exchange Management Console or by entering cmdlets the Exchange Management Shell. The following table lists various queue management tasks: Task Suspend or resume queue Description When you suspend a queue, you suspend all outbound activities on a queue. Messages can still arrive in the queue, but no messages leave. When you resume a queue, you restart outbound activities for a suspended queue. In the Exchange Management Shell, use the Suspend-Queue and Resume-Queue cmdlets. When a queue fails to make a connection to the next hop, a retry timer schedules subsequent connection tries. The retry queue action forces an immediate connection attempt rather than waiting for the next scheduled try. In the Exchange Management Shell, use the Retry-Queue cmdlet. You can also use the Retry-queue Retry queue cmdlet with the Resubmit parameter to return messages to the Submission queue. You can do this for messages with the following status:

Mailbox or Remote Delivery queues with a Retry status (messages in the queues cannot be suspended). Messages in the Unreachable queue that are not suspended. 62

Messages in the Poison Message queue.

Suspend or resume message

When you suspend a message, you temporarily prevent its delivery. You can prevent its delivery to recipients in a specific queue, or you can prevent its delivery to all recipients in all queues. The resume message action reverses suspend and allows a message to be delivered. You can also use the resume message action to resubmit messages in the poison queue. In the Exchange Management Shell, use the Suspend-Message or Resume-Message cmdlets. Where the suspend action temporarily prevents delivery, the remove action deletes the message without delivery. You can prevent its delivery to recipients in a specific queue, or you can prevent its delivery to all recipients in all queues. You can configure the remove action to send an NDR (nondelivery report) to the sender or to delete the message without generating an NDS. In the Exchange Management Shell, use the Remove-Message cmdlet. The -WithNDR $true option sends the NDR, and the -WithNDR $false option does not send the NDR. The export action lets you copy a message from a queue on a Hub Transport server to a specified file path within the Exchange organization. The message is not deleted from the queue, but a copy is saved to the specified location. To perform the export action, use the following process:

Remove message

Export message

1. Suspend the message. 2. Export the message. 3. Resume (or remove) the message. In the Exchange Management Shell, use the Export-Message cmdlet.

You should also know these additional cmdlets for working with messages and queues:

Use Get-Message to view the details of one or more messages in a queue on a Hub Transport server or an Edge Transport server. Use Get-Queue to view the configuration of a queue on a Hub Transport server or an Edge Transport server.

Troubleshooting Mail Delivery As you troubleshoot problems in mail delivery, use the following process to identify and correct the problem: 1. Use one of the following tools to identify where mail delivery has failed: o Use the Mail Flow Troubleshooter tool to automatically analyze data, identify potential problems, and suggest possible fixes. o Use the Queue Viewer on a transport server to check the messages in the queue. Look for messages with a status of Retry. Also look for messages in the Unreachable queue. 2. If you can identify a transport server where messages are stopping, run the Test-ServiceHealth cmdlet to verify that all necessary services are running on that server. 3. Verify the configuration of all connectors. Make sure that source servers on Send connectors are listed correctly. 4. Check the Application Log in Event Viewer for any messages indicating an error. 5. For Exchange-related Resource Manager errors: o Verify that the server has sufficient disk space for the message queues (4 GB for Exchange 2007 RTM and 500 MB for SP1). o Check the memory utilization percentages to verify that the EdgeTransport.exe process has sufficient memory (less than 75% utilization) and that the overall system memory is adequate (less than 94% utilization). 63

Be aware that if resource utilization is high, mail flow can stop. 6. Check the non-delivery report (NDR) for delivery status notification (DSN) codes. These codes often indicate the server that reported the problem, as well as a description of the problem. For example, the DSN code might indicate that the destination SMTP server is unavailable, or that the recipient is unknown. 7. Verify the recipient information in Active Directory. 8. Verify that the global catalog information for the recipient matches the recipient information in the message, and that the global catalog server can be contacted. Message Tracking Facts The Message Tracking log records message activity as messages are transferred between servers and server roles. You can examine the message logs to help with mail flow troubleshooting. A message log exists on all Edge Transport, Hub Transport, and Mailbox servers. To configure the message tracking logs:

Use Set-TransportServer on Edge and Hub Transport servers. Use Set-MailboxServer on Mailbox servers. If a server has both the Hub Transport and the Mailbox roles, it will have two sets of logs. Use SetTransportServer to set the Hub Transport server log properties, and Set-MailboxServer to set the Mailbox server log properties.

The following table describes the log file settings: Parameter -MessageTrackingLogEnabled Description Enables or disables message tracking. Message tracking is enabled by default. Configures the path to the message tracking logs.

-MessageTrackingLogPath

The default location is C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\MessageTracking. This location must be a local path. Log files are named as follows: o On transport servers, the log file name starts with MSGTRK. On Mailbox servers, the name starts with MSGTRKM. o Following the prefix is the date. o Following the date is a sequence number. o Following the sequence number is the .log extension. If a server has both the Hub Transport and the Mailbox roles, it will have two sets of log files (with the corresponding prefix). When you change the log file location, existing logs aren't copied to the new location. When you change the location, the target directory will be created if it does not exist.

-MessageTrackingLogMaxFileSize -MessageTrackingLogMaxDirectorySize

Sets the maximum log file size. The default size is 10 MB. When the maximum size is reached, a new file is created. Its name is generated by incrementing the sequence number. Sets the maximum size of the log files within the directory. 64

The setting applies to all log files with the same prefix (MSGTRK or MSGTRKM), not to the total of all files in the directory. Files in that directory without the corresponding prefix do not count towards the maximum. If the server is both a Hub Transport and a Mailbox server, there will be two sets of log files in the same directory, with the total size of each set being controlled by a different maximum log file setting. When the size of the log files in the directory reaches the maximum, older files are deleted to make room for newer files.

-MessageTrackingLogMaxAge

Sets the maximum age (in days) for the log files. The default is 30 days. Files older than the maximum age setting are automatically deleted. Enables or disables storing message subjects in the log.

MessageTrackingLogSubjectLoggingEnabled

Subject logging is enabled by default. Message logs store only details about the message (sender, recipient, date, etc.) and not the message contents. For increased security, you might want to disable storing message subjects in the log.

Message tracking logs contain details about each message that is processed by the server. The log is a text file in comma separated value (CSV) format. Information about each message that is recorded in the log includes:

The recipient and sender e-mail address. Client (sending device) hostname and IP address. Destination server hostname and IP address. The message subject (if subject logging is enabled). An EventID. The EventID identifies the action taken on the message. Events are: o BADMAIL is a message submitted by the Pickup or Replay directories that can't be delivered. o DELIVER identifies a message delivered to a mailbox. o SEND identifies a message sent to another server using SMTP. o SUBMIT identifies a message submitted by a Mailbox server to a Hub Transport or Edge Transport server. This is the only event type you will see on a Mailbox server. o RECEIVE identifies a message when it is put into the database (a queue). o RESOLVE identifies that the message recipient address was modified after performing an Active Directory lookup. o REDIRECT identifies that the message was redirected to a different recipient after performing an Active Directory lookup. o EXPAND identifies that recipient information was modified by expanding distribution group membership. o TRANSFER identifies a message whose recipients have been modified based on forked delivery. o FAIL identifies messages that could not be delivered. o DSN identifies messages that generated a delivery status notification. o POISONMESSAGE identifies a message moved into or out of the poison queue. A reference field. The reference field has additional data for messages with the DSN, SEND, or TRANSFER event IDs. Time and date of processing. The timestamp is in universal time code (UTC) format. 65

The MessageID and InternalMessageID.

You can view messages in the tracking logs through the Management Console using the Message Tracking option in the Toolbox or by using the Get-MessageTrackingLog cmdlet.

-Sender returns message tracking log entries with the specified sender's SMTP e-mail address. -Recipients returns any message tracking log entries with the specified recipient's SMTP e-mail addresses. -DomainController searches for the domain controller used to make changes to Active Directory, it does not identify the server whose logs you want to search. -Reference searches messages on the reference field which allows for searching on attributes such as the Internal-Message-ID or the Internet-Message-ID. -MessageSubject searches for messages with the specified text in the subject line.

By using the Get-MessageTrackingLog cmdlet, you can view all messages in the log or filter on the following criteria:

Recipient and/or Sender Server EventID and Reference MessageID and/or InternalMessageID Subject Start and/or End time

Tip: When using the command shell, use > "filename" to save results to a file. For example, the following command searches the message log for all messages with a DSN event, formats the information to include the sender and the recipient, and saves the results to a file: Get-MessageTrackingLog -EventId "DSN" | Format-List Send*,Receive* > "C:\dsnMessages.txt" Moving Mailboxes Facts When you move a mailbox, you move the data in the mailbox from one mailbox database to another. Be aware of the following when using Move-Mailbox:

You can move a mailbox to a different database on the same server, to a different server within the same forest, or to a different server in another forest. (To move a mailbox from one forest to another, you must use the Move-Mailbox cmdlet.) You can move mailboxes from Exchange 2000/2003 servers to Exchange 2007, or from Exchange 2007 to Exchange 2000/2003. To move a mailbox, the account you use must be delegated as the Exchange Recipient Administrator role and the Account Operator role for the applicable Active Directory containers. By default, when you move a mailbox the source mailbox data is not deleted. Use SourceMailboxCleanupOptions DeleteSourceMailbox to delete the source mailbox after the move. Only one instance of the Move Mailbox wizard can be run at a time from the Exchange Management Console. You can, however, run multiple instances of the Exchange Management Console and run an instance of the Move Mailbox Wizard from each. The move will fail if the size limit on the source mailbox exceeds the size limit of the target database. Use MailboxSizeLimitOptions PreserveSource to set the mailbox size limit for the source mailbox on the target mailbox. Use the -PreserveMailboxSizeLimit switch to keep the current user mailbox settings when moving a mailbox. Move-Mailbox does not change the user account association. You cannot use Move-Mailbox to move the mailbox from one user to another. 66

When moving mailboxes from Exchange 2007 to Exchange 2003, you might run into cases where the user rule size on the mailbox exceeds the maximum size limit for user rules on Exchange 2003 (Exchange 2007 supports 64 KB for rules, while Exchange 2003 only supports 32 KB). If the 2007 mailbox has rules larger than 32 KB, use the -IgnoreRuleLimitErrors switch to not move the rules.

While the Move-Mailbox cmdlet is useful, it does have its limitations. The following table describes the processes used to move and merge mailboxes for various situations: Action Move a single mailbox within a forest Description Use the Move Mailbox wizard or the Move-Mailbox cmdlet to move a mailbox and its contents from one mailbox database to another. You can use Move-Mailbox to move mailboxes across forests. Use the following process: 1. Move the user account from the source forest to the target forest using the Active Directory Migration Tool (ADMT) version 3.0. 2. Run $SourceCredential = Get-Credential to create a credential object that contains account information for the source forest. 3. Run $TargetCredential = Get-Credential to create a credential object that contains account information for the target forest. 4. Run the Move-Mailbox cmdlet to move the mailbox. In addition to the target database and the mailbox identity, you will need to supply the following: o -SourceForestCredential $SourceCredential o -TargetForestCredential $TargetCredential o Either the -GlobalCatalog switch (to identify a target global catalog server) or the -SourceForestGlobalCatalog switch. o The -NTAccountOU to identify the location of the user account. Move a mailbox across forests When moving mailboxes across forests, be aware of the following:

You must have the Exchange Recipient Administrator role for the Exchange organization and the Exchange Server Administrator role and local Administrators group for both the source and target forests and servers. You must have a domain controller running Windows Server 2003 in both the source and target domains. You can move from Exchange 2000/2003 to Exchange 2007, or from Exchange 2003 to Exchange 2007 across forests. You cannot move mailboxes from Exchange 2007 to Exchange 2000 across forests. Use -SourceMailboxCleanupOptions DeleteSourceNTAccount to delete the source user account and mailboxes if all three of the following are true: o You are moving a user's mailbox to a new forest. o You have already moved the user account to the new forest using the ADMT. o You want to delete both the source mailbox and the source user account after the mailbox is moved.

If you need to move an entire mailbox database and all of its mailboxes to a different location on the same server, use the following process: Move an entire mailbox database on the same server 1. If necessary, run Move-StorageGroupPath or the console wizard to move the log files. 2. Run Move-DatabasePath or the console wizard to move the database file. 3. Run Move-Mailbox with the -ConfigurationOnly switch to change the configuration information in Active Directory so that the mailboxes all point to the new location of the 67

database. If you need to move an entire mailbox database and all of its mailboxes to a different server, use the following process: 1. Commit any uncommitted log files to the database. o Use Get-StorageGroup myServer\myStorageGroup | fl LogfilePrefix to identify the log file prefix number. o At a command prompt, run ESEUTIL /R prefix. 2. Create the database on the target server. 3. Set the This database can be over written by restore attribute on the target database using the console or run Set-MailboxDatabase with the -AllowFileResore switch. 4. Copy the database files from the source server to the target server in the same location as the target server database files. 5. Mount the target database. 6. Run Move-Mailbox with the -ConfigurationOnly switch to change the configuration information in Active Directory so that the mailboxes all point to the new location of the database. Mailbox databases can only be moved between Exchange 2007 servers in the same Exchange organization. When you move mailboxes across forests, the user mailbox might be unavailable for a time. To move mailboxes with minimal interruption of mail service, use the following process: 1. Run Move-Mailbox to move the mailbox to the target forest. Do not delete the user account or the mailbox. 2. Run ADMT to migrate the user account to the target forest. Disable access to the source mailbox. This causes the user account to use the mailbox in the target forest. 3. Run Move-Mailbox with the -AllowMerge switch to merge the source mailbox with the target mailbox. Only messages that were sent or received during the transition will be merged into the target mailbox. 4. Manually delete the user account and the mailbox in the source forest. When you use the Move-Mailbox cmdlet, the mailbox is moved to a different location but is still associated with the same user account. If you have a mailbox for one user that you want to associate with another user: Move a mailbox to a different user 1. Run Disable-Mailbox to unlink the mailbox from the source user account or RemoveMailbox to delete the user account. 2. Run Connect-Mailbox to mail-enable the target user account and link the mailbox to the user. Note: You cannot connect a mailbox to a user that already has a mailbox. The target user account must not be mail-enabled, and must be in the same forest as the disconnected mailbox. If you want to move mailbox data to a different user who already has a mailbox, you will need to export the mailbox contents from the source mailbox and import it into the target mailbox. Export mailbox data to another mailbox

Move an entire mailbox database to a different server

Merge mailboxes across forests

Run the Export-Mailbox cmdlet to export and import the data in a single step. All data in the source mailbox is copied into a folder in the destination mailbox. You can export data from connected and disconnected mailboxes. The source mailbox and its data are not deleted. If connected, the source mailbox remains connected. 68

You can only export mailbox data within a forest. With Exchange 2007 SP1, you can also export data to a .pst file. You can then use the Import-Mailbox cmdlet to import the .pst file into a mailbox.

If a disconnected mailbox no longer exists, you can move mailbox data to the same or another mailbox by restoring the mailbox. To recover a lost mailbox: 1. Create a recovery storage group. 2. Create a mailbox database in the recovery storage group. 3. Set the This database can be over written by restore attribute on the target database using the console or run Set-MailboxDatabase with the -AllowFileResore switch. 4. Restore the mailbox database to the recovery database. 5. Mount the recovery database. 6. Run Restore-Mailbox to restore a mailbox from the recovery database to a target mailbox. When restoring data, be aware of the following:

Restore mailbox data

You can restore data from one mailbox to the same mailbox or to a different mailbox. You can only restore data to a mailbox in the same Exchange organization. When restoring to the same mailbox, you can either merge data into the existing mailbox, or copy all data into a target directory. Use the -TargetFolder switch to identify the target directory. Restored data does not overwrite existing data. When restoring to a different mailbox, you must include the -TargetFolder switch.

Exam Objectives Exam 70-236: TS: Exchange Server 2007, Configuring This certification exam measures your ability to act as an administrator for an Exchange Server 2007 organization. Before taking the exam, you should be proficient in the skills listed below: # Objective Module.Section 2.1 2.2 2.3 2.4 1.3 2.4 3.1 3.2 7.4 4.1 4.2 4.3 69

100 Installing and Configuring Microsoft Exchange Servers 101 Prepare the infrastructure for Exchange installation. 102 Prepare the servers for Exchange installation. 103 Install Exchange. 104 Configure Exchange server roles.

200 Configuring Recipients and Public Folders 201 Configure recipients.

202 Configure mail-enabled groups.

4.1 4.2 4.3 4.1 4.2 4.3 6.1 6.2 4.3 4.4 7.2 7.4 7.5 7.3 4.5 5.4 6.1 6.2 5.1 5.2 5.3 9.3 9.1 9.4 9.1 9.2 9.1 9.2 9.1 9.2 8.3 8.4 8.2 8.3 8.4 8.1

203 Configure resource mailboxes.

204 Configure public folders. 205 Move mailboxes. 206 Implement bulk management of mail-enabled objects. 300 Configuring the Exchange Infrastructure 301 Configure connectors. 302 Configure the antivirus and anti-spam system. 303 Configure transport rules and message compliance. 304 Configure policies. 305 Configure public folders. 306 Configure client connectivity. 400 Monitoring and Reporting 401 Monitor mail queues. 402 Monitor system performance. 403 Perform message tracking. 404 Monitor client connectivity. 405 Create server reports. 406 Create usage reports. 500 Configuring Disaster Recovery 501 Configure backups. 502 Recover messaging data. 503 Recover server roles. 504 Configure high availability.

Client Features Facts Exchange 2007 has introduced a number of new features for clients, as listed in the following table: 70

Feature

Description Outlook Web Access has been completely rewritten for Exchange 2007. The goal of Outlook Web Access is to provide an Outlook environment for users who are working remotely or from a laptop. The following features are available in Outlook Web Access in Exchange 2007:

Improved drag-and-drop support. The ability to browse through user's address books. The ability to view SharePoint sites without the user needing a VPN or any other type of connectivity to the network. The ability to view file shares on the network.

Outlook Web Access (OWA)

Outlook Web Access comes in two editions:

A light version is available for users who are not running the newest Web browsers. A premium version which requires Internet Explorer version 6.0 or later. This premium version includes: o Access to drag-and-drop. o The ability to right-click to get context-sensitive menus within a Web browser. o Additional features such as spell check.

Note: Outlook Web Access no longer provides access to public folders in Exchange 2007. If you wish for Outlook to continue having the ability to access public folders, you must maintain an Exchange 2003 server within your organization. The Calendar Concierge Service in Exchange 2007 is made up of four components:

Calendar Concierge Service

The Calendar Attendant is a service that processes meeting requests for users. The Scheduling Assistant is available for users with the premium version of Outlook Web Access or who use Outlook on a desktop. The scheduling system analyzes the availability of those who are invited to a meeting to recommend the best available time to schedule the meeting. The Resource Booking Attendant works with resource mailboxes which are used to manage resources such as conference rooms or projectors. The Availability Web Service analyzes the contents of a user's calendar to manage their free/busy availability and make this information live to others in the organization. In previous versions of Exchange, public folders were used to facilitate free/busy information, but were only updated every hour. This caused for information to frequently be outdated. For this reason, Exchange 2007 has replaced the use of public folders with the Availability Web Service.

In previous versions of Exchange, offline address books were distributed through the use of a public folder on the Exchange server.

Offline Address Book Distribution

Exchange 2007 implements a virtual directory on the Client Access server. When a user wants to download a copy of the global address book, they can contact the CAS, then locate the virtual directory from which they can download the virtual address book. This is done using Background Intelligent Transfer Service (BITS), which uses HTTP for data transfers and will only download when there is available bandwidth. The format for the Offline Address Book in Exchange 2007 offers better compression and better support for delta updates and changes.

Autodiscover

The Autodiscover service in Exchange 2007 is designed to make it easier for users to set up their 71

profiles in Outlook (Outlook Anywhere) or for their Exchange ActiveSync devices. The Autodiscover service automatically adds the following information to a user's profile:

The server on which the user's mailbox resides The user's display name Separate connection settings for internal and external connectivity The URLs for Exchange features associated with the user Outlook Anywhere server settings

The Autodiscover service must be deployed and configured for Outlook 2007 clients to automatically connect to Microsoft Exchange features such as the offline address book, the Availability service, and Unified Messaging (UM).

Exchange 2007 Features The primary goals of Exchange 2007 are:

Increased security Easier setup and deployment Higher availability

The following features were implemented to achieve these goals: Feature Description A server role is a unit that logically groups required components and features that are needed to perform functions within a messaging environment. The implementation of server roles simplifies installation and management by grouping necessary features according to the role the server plays within the organization. With the role-based setup: Role-based setup

Multiple roles or a single role can be installed on a server (with exception of the Edge Transport server). Installation only requires the components needed for each particular role that is installed. Maintenance needs to be performed only on the server hosting a specific role.

Exchange 2007 uses a simplified administration management console which includes:

New administration model

Exchange Management Shell (Windows PowerShell) is a command line environment designed for automating administration and maintenance. The Exchange Management Shell is the primary management interface of Exchange 2007. The Exchange Management Console is the graphical administration tool. It is comprised of a three-paned view that includes a tree view, results, and an actions pane. It cannot perform many of the administrative tasks that can be performed in the Exchange Management Shell.

Additional compliance features

Compliance and journaling focuses on the requirements that many organizations now face for messaging, archiving, and controlling the flow of messages within the environment. Compliance and journaling allows you to:

Set up an ethical wall that can prevent certain members of your organization from e-mailing one another. 72

Restrict communication and messaging or cause all messages to be archived and maintained between certain members or groups of the organization.

Improved availability in Exchange 2007 is made possible by features such as:

High availability

Local Continuous Replication (LCR) maintains a copy of the production storage group on a second set of disks that are connected to the same server using built-in asynchronous log shipping and log replay technology. Cluster Continuous Replication (CCR) provides a new, simplified type of cluster implementation that utilizes passive nodes as backups for the information being used on the active node. The databases on the active node are copied to the passive node using file sharing. This allows the passive node to maintain the Exchange services and availability for all users in the event of primary Exchange server failure.

64-bit environment Messaging

Exchange 2007 employs a 64-bit environment. The additional memory in the 64-bit architecture reduces I/O operations by nearly 80% and increases the amount of RAM that the system can use. Unified Messaging improves a mobile user's ability to stay connected by combining e-mail, voicemail, calendar, and fax communications into a single store which is available from a telephone or computer.

The following features are no longer supported in Exchange 2007:

Exchange 5.5 support. Connector types. You need to maintain an Exchange 2003 server within your environment if you wish to continue using applications, such as X400, GroupWise, or Lotus Notes. Admin and routing groups. Outlook Mobile Access has been replaced by ActiveSync. Active/Active clustering. Exchange 2007 supports Active/Passive clustering exclusively.

Exchange 2007 comes in two different versions: Standard Edition and Enterprise Edition. Version Features The Standard Edition has: Standard Edition

Up to 5 storage groups Up to 5 databases 16 TB per database

The Standard Edition supports Local Continuous Replication. The Enterprise Edition has:

Up to 50 storage groups Up to 50 databases 16 TB per database

Enterprise Edition

The Enterprise Edition supports:

Local Continuous Replication Single Copy Clusters Cluster Continuous Replication 73

Public Folder Client Access Facts With the release of Exchange Server 2007, Microsoft is decreasing support for public folders and are encouraging customers to use the SharePoint Platform for collaboration applications. For this reason, Outlook 2007 is the first version of Outlook that does not require public folders. A number of changes have been made to Exchange 2007 to compensate for this shift: Feature Description An Offline Address Book (OAB) is used by users to access their address book when offline. In the past, public folders were used to locate user information when offline. In Exchange 2007, the Client Access server acts as a Web distribution point which utilizes the Background Intelligent Transfer Service (BITS) to download offline address books using the HTTP protocol. This functionality is not available by default, so it must be set up during configuration of the Client Access server if it is to be implemented. Users can find the Offline Address Book publication point using the Autodiscover feature. When a user wished to schedule a meeting and check the availability of colleagues in previous versions of Outlook, Outlook would contact the Exchange server, retrieve the free/busy information for the recipients, then return that information to the user. The problem with this scenario was that information might have been out of date due to multiple public folders replicated on different servers. For this reason, free/busy information is now retrieved using the Availability service that runs on the Client Access server. The Availability service queries the user's mailbox server to verify availability.

Offline Address Book (OAB)

Free/Busy

Outlook security settings also no longer use public folders. The Outlook client is now configured Outlook security through the registry. Group policies are used to push information out to clients thus removing the settings need for using a public folder. Organizational forms library The organizational forms library has been replaced by Microsoft InfoPath forms.

Outlook is the preferred client application for accessing public folders. Support for accessing public folders through clients other than Outlook (including Outlook Web Access) depends on the Exchange 2007 version: Version Description To provide public folder access to clients other than Outlook (including Outlook Web Access) in the RMT version of Exchange 2007: Exchange 2007 release to manufacturing (RTM)

The mailbox database's home public folder server must be running Microsoft Exchange Server 2003 or Microsoft Exchange 2000 Server. The Client Access server role must be on a dedicated server. Because public folders do not appear in the default Outlook Web Access user interface, you must use the /public virtual directory on the Client Access server to reach public folders. This means that OWA users must log on using a URL such as https://mail.mycompany.com/public instead of https://mail.mycompany.com/owa.

Exchange 2007 service pack 1 (SP1)

Exchange 2007 SP1 supports public folder access using Outlook Web Access. Users continue to use the normal OWA URL for access (https://mycompany.com/owa), and you do not need to keep an Exchange 2003 server for public folder access. Exchange 2003 public folders will be available to Exchange 2007 mailboxes only if the following 74

conditions are true:

SSL is disabled on the home public folder server that is assigned to the user's mailbox. The /owa and /public virtual directories must have the same SSL setting. The Client Access server role must be on its own designated server. The /public virtual directory has not been renamed.

Content can be submitted to a public folder in the following ways:

Users can submit content through Microsoft Outlook 2007 using standardized public folder forms. Users and outside organizations can send content to public folders which are mail-enabled. Mail-enabled public folders are e-mail recipients that can also be used for message journaling. Public folders are not mailenabled by default; they must be manually mail-enabled by entering the Enable-MailPublicFolder cmdlet into the Management Shell's command prompt.

Users typically manage public folders through Outlook. In Outlook 2007, public folders do not show by default. Use the Folder List option to show public folders. Users can create folders, specify the type of content that can be posted in a folder, post content, and manage permissions. When specifying permissions, the following options are available: Role Owner Editor Author Reviewer Contributor None Permissions All permissions (including Folder owner and Folder contact), Edit and Delete all items Same as Publishing Editor except without Create subfolders Same as Publishing Author except without Create subfolders Read items, Folder visible, Edit and Delete None Create items, Folder visible, Edit and Delete None Folder visible, Edit and Delete None

Publishing Editor Create items, Read items, Create subfolders, Folder visible, Edit and Delete all items Publishing Author Create items, Read items, Create subfolders, Folder visible, Edit and Delete Own items Nonediting Author Create items, Read items, Folder visible, Edit None and Delete Own

Note: If you manually choose a permission combination not represented by a role, the role is listed as Custom. Keep in mind the following regarding managing client permissions:

By default, the Anonymous user is configured with Contributor permissions. This means that anyone can add content to a public folder. This permission allows users to submit items to mail-enabled public folders. When you create a child folder, permissions from the parent folder are copied to the child folder. Changes made to the parent folder permissions are not automatically propagated to the child folders. Use Get-PublicFolderClientPermission to retrieve the user permissions for a public folder. Use Add-PublicFolderClientPermission to add permissions to public folders. Use Remove-PublicFolderClientPermission to remove permissions from public folders. Use Get-PublicFolderAdministrativePermission to get the administrative permissions for a public folder or a public folder hierarchy. Administrative permissions control configuring settings for the public folder. Use Add-PublicFolderAdministrativePermission to add administrative permissions to a public folder or a public folder hierarchy. Use Remove-PublicFolderAdministrativePermission to remove administrative permissions for a public folder or a public folder hierarchy. 75

Performance Monitoring Facts One of the main tools you will use in monitoring Exchange Server performance is the Performance Monitor. The following table lists specific counters to watch to evaluate server and Exchange performance: Counter Processor Processor\%Processor Time (_Total) reports the processor utilization. You can track utilization for all processors, for a specific processor, or for a specific process. Processor\%Processor Time (_Total)

Description

This counter should be below 90% for the total processor. This counter should be below 70% for Exchange utilization.

System\Processor Queue Length Network

System\Processor Queue Length identifies the number of threads that are waiting in the processor queue. There is a single queue for all processors. This counter should be less than 2 on a consistent basis. Network Interface\Bytes Total/sec reports the rate that the network card processes data. It includes all network traffic, not just Exchange traffic.

Network Interface\Bytes Total/sec

For a 100 Mbps network card, the value should be below 6-7 MBps. For a 1000 Mbps (gigabit) network card, the value should be below 60-70 MBps.

Network Interface\Packets Outbound Errors RPC operations MSExchangeIS\RPC Requests outstanding

Network Interface\Packets Outbound Errors shows the number of outbound packets that were not transmitted because of errors. This value should be 0. MSExchangeIS\RPC Requests outstanding reports the number of RPC requests that are waiting to be processed. A consistently high number could indicate a problem (check the following latency statistic to verify). MSExchangeIS\RPC Latency average reports the delay (in millisecond) for RPC traffic. This value should be less than 70 ms. MSExchangeIS\RPC Requests reports the average RPC requests.

MSExchangeIS\RPC Latency average

MSExchangeIS\RPC Requests This value should be less than 50. Logical Disk Logical Disk\Average Disk Queue Length Logical Disk\Average Disk Queue Length reports the number of disk access requests waiting to be processed. This value should reach 0 every minute or less (this means that the queue is being cleared on a regular basis). 76

The disk read and write statistics report the latency (delay) in reading from or Logical Disk\Average Sec/Read writing to the disk. Logical Disk\Average Sec/Write This value should be less than 50 ms. Take the following actions to correct any problems that are found:

To reduce the CPU load: o Offload tasks to other servers and stop all unnecessary services running on the Exchange server. o Perform maintenance and backup tasks during off-peak hours. o Stage the startup of maintenance tasks to reduce sudden peaks in CPU load. o Upgrade processors or add additional processors to multi-processor systems. To reduce the load on the network card: o Replace faulty network cards. Upgrade to faster cards if possible. o Restructure the network with switches or routers to reduce collisions and broadcast traffic. o Install two network cards in the server to create a separate network for server-to-server traffic (used by the Exchange server to communicate with a global catalog server) and client-to-server traffic (used by clients to communicate with Exchange servers). RPC traffic problems have a direct negative impact on the user experience. If users report slow Exchange response, examine the RPC statistics. o If both RPC requests and operations/second are low, check for problems in the network or at the client. o If either or both statistics are high, troubleshoot the Exchange server.

Back Pressure Facts Back pressure is an automatic system resource monitoring feature on Exchange 2007 transport servers. When resource utilization for tracked statistics reaches specific levels, the server takes corrective action or stops accepting new connections and messages until resource utilization returns to an acceptable level. Exchange servers automatically monitor the following statistics and assign a rating (Normal, Medium, or High) to the resource utilization: Resource Free disk space for queue database files Free disk space for queue log files Uncommitted transactions in memory (transactions waiting to be written to disk) Physical memory used by EdgeTransport.exe Calculation formula 100 x (disk_size - 4GB)/disk_size) Yields a percentage of free disk space 100 x (disk_size - (25 x 20MB)/disk_size) Yields a percentage of free disk space n/a 100 x (EdgeTransport.exe_Memory/Total_Memory) Normal level 96% 96% 40 71% 90% Medium level 98% 98% 60 73% 92% High level 100% 100% 100 75% 94%

Total system physical memory utilization 100 x (Used_Memory/Total_Memory) Note: Virtual memory is not used when calculating memory statistics.

The resource monitor checks system statistics every 2 seconds. When a problem is found, Exchange takes steps to correct the problem. During subsequent monitoring intervals, if the problem still exists or gets worse, additional actions 77

are taken. The following table lists various conditions and the actions taken by the server. Conditions are listed in the order taken; if the first action does not resolve the problem, subsequent actions could be taken. Condition EdgeTransport.exe memory above Normal Uncommitted transactions above Normal Action If the percentage of physical memory used by EdgeTransport.exe is above Normal, memory garbage collection is triggered. If the total number of uncommitted transactions in memory (called a version bucket) is above Normal, Exchange forces uncommitted transactions to be written to the log file. If any resource utilization level on a Hub transport server reaches a Medium level, the following actions are taken: Any resource on a Hub Transport server at Medium

New connections to non-Exchange servers are not accepted. Messages in the Pickup or Replay directories are not processed.

Local mail delivery within the Exchange organization is still possible, meaning that the Hub Transport server still accepts messages from Mailbox servers. If the resource utilization for any statistic on a Hub Transport server is High, or if any resource on an Edge Transport server is Medium or High, the following actions take place:

Any resource on a Hub Transport server at High Any resource on an Edge Transport server at Medium or High

No new connections from any server are accepted (including from Mailbox servers). Messages in the Pickup or Replay directories are not processed.

Incoming mail flow essentially stops at this point. If the EdgeTransport.exe memory utilization percentage is still above Normal after preceding actions have failed to correct the problem, the following actions are taken:

EdgeTransport.exe memory still above Normal (after preceding actions have failed to correct the problem)

The Microsoft Exchange Transport service is restarted. Following the restart, messages in the submission queue are not automatically processed.

If the total number of uncommitted transactions remains high, the following actions are taken:

Uncommitted transactions remain high

The transport dumpster is disabled. The dumpster is used with CCR or LCR for activating replication and is only used if the service has an unscheduled outage. Message delivery to remote queues (including messages to remote Active Directory sites) is disabled. Delivery to local mailboxes still takes place.

EdgeTransport.exe memory at Medium or High, or total memory at High

If the EdgeTransport.exe memory remains at Medium or High, or the total memory utilization is at High, message dehydration occurs. With message dehydration, unnecessary portions of the message in memory, such as MIME content, are stripped in an effort to make more memory available.

78

To identify problems caused by the back pressure feature, check the Application log in Event Viewer. Look for log entries with MSExchangeTransport as the Event Source and Resource Manager as the Event Category. Following are some sample error messages

Error 15001: "The resource pressure changed from Normal to Medium." Error 15002: "The resource pressure is constant at High." Error 15003: "Private bytes consumption changed from Medium to High."

To correct the problem, use the Performance Monitor to identify the exact resource with the problem (memory or disk). Take the necessary actions to free up or add resources (such as stopping unnecessary services, deleting unneeded files from disk, adding memory, or adding disk space). As a temporary solution, you can also change the settings that control back pressure monitoring:

Settings are saved in the EdgeTransport.exe.config file. The default location of the file is at C:\Program Files\Microsoft\Exchange Server\Bin\. Edit the file to enable or disable resource monitoring, change the location of the queue database files, control how often the server checks resource utilization, or change the values that determine the Normal, Medium, or High values. By default, Exchange Server requires 4 GB free for queue database files (500 MB free for Exchange 2007 SP1). By default, Exchange Server requires 500 MB free for the database log files.

Performance Monitoring Tools You can use the following tools to monitor performance and gather information about Exchange or the operating system. Tool Description System Monitor (sometimes called Performance Monitor or PerfMon) is a Windows operating system monitoring tool that provides performance data on system resources, such as CPU usage, available memory, and disk activity. You can also use System Monitor to monitor system hardware, the operating system, or Exchange-specific processes. System Monitor uses objects and counters to identify statistics that can be tracked.

An object is a statistic group, often corresponding to a specific type of hardware device or software process (such as the number of users connected or the total number of logins started per second). A counter is a specific statistic you can monitor. Note: Counters that apply specifically to Exchange Server begin with the label MSExchange.

Performance Monitor

System Monitor includes the Performance Logs and Alerts snap-in with the following components:

Use Counter Logs to track counter statistics over a period of time. Counter logs can be saved to different log formats: o Use text files (comma or tab delimited) to import data into a spreadsheet program. o Use binary files to save data that is intermittent. Select a circular file to save all data into a single file, overwriting the contents when the log is full. o Use SQL database files to import statistics into SQL server in order to perform data comparisons or data archival. Use Trace Logs to capture events logged by software processes. Trace logs are stored in trace files. o Sequential files start new files when one file is full. 79

o Circular files save all data to a single file, overwriting data when the file is full. Use Alerts to configure triggers that take an action when a counter reaches a threshold value. When you configure an alert you specify: o The counter you want to watch. o A threshold limit (a counter value that you want to watch for). o An action to take when the threshold value is reached. For example, you can write an event to a log, send a message, or run a program.

Network Monitor is a network traffic capture and monitoring tool. You can use Network Monitor to capture traffic between two computers to help in troubleshooting communication errors and performance. To use Network Monitor:

Network Monitor

Install Network Monitor on the Exchange server or a host that communicates with the server. Run Network Monitor with an account that is a member of the local Administrators group. To analyze traffic between two computers, build a database of address pairs to help in filtering traffic. When you use an address pair, you will see only the traffic between the selected hosts. To analyze traffic, you should temporarily disable network encryption (such as IPSec).

Process Monitor is an advanced monitoring tool that combines the features of File Monitor and Registry Monitor. Use Process Monitor to view information about:

Process Monitor

Process and thread startup and exit DLL and kernel-mode driver loads File system and registry activity Thread stacks Process details

Advanced filtering options help you sort and filter data to narrow your search. The Exchange Load Generator simulates the load on an Exchange server from MAPI clients. Run the tool on client computers. The tool sends multiple messaging requests to the server to simulate an actual load. Be aware that the Exchange Load Generator:

Exchange Load Generator

Only simulates the load from one client. You can run the tool from multiple client computers. Only simulates messaging requests coming from the client. It does not take into account other types of loads such as logon/logoff, incoming mail (including spam), non-MAP protocol communications, loads from mobile devices, or public folder use. Can be used in Active Directory Users and Computers to export a list of user accounts to a test environment.

You should only use the Exchange Load Generator in a test environment. Exchange Stress and Performance simulates multiple concurrent client sessions over a wide range of protocols. ESP includes modules that test on a variety of protocols. You can run multiple modules from a single client computer to simulate separate clients. Use ESP to analyze the Exchange Stress following types of traffic: and Performance (ESP) SMTP Outlook Web Access (including WebDAV traffic) POP3, IMAP4 Lightweight Directory Access Protocol (LDAP) 80

Network News Transfer Protocol (NNTP)

ESP does not simulate MAPI protocols. You should only use ESP in a test environment. The Exchange Profile Analyzer collects statistics contained in mailboxes to create a user profile. The user profile identifies average statistics for average users doing typical mail tasks (such as sending mail or browsing a folder). EPA includes several tools:

EpaCmd.exe is the command-line tool. EpaWin.exe is the graphical version. EpaOWACmd.exe is a command-line tool for analyzing Outlook Web Access statistics. EpaSummarizer.exe is a command-line tool that combines data from multiple individual runs and combines them into a single aggregated file.

Exchange Profile Be aware of the following: Analyzer (EPA) You can collect data for a specific mailbox, all mailboxes on a server, or all mailboxes on all servers. To run EPA, the account must have full access to all mailboxes analyzed, have the Exchange View-Only Administrator role, and not be a member of the Domain Administrators or the Enterprise Administrators groups. Collection tools include a number of data collectors. Exchange Server collectors gather statistics about the Exchange mailboxes (such as the number of items, average sizes, number of recipients). OWA collectors gather statistics about specific actions (such as logon/logoff, send mail, edit mail).

You can also use the Get-Process cmdlet to retrieve information about the processes running on an Exchange server. Administrative Permission Facts Using the predefined Exchange administrator roles lets you easily assign permissions to users based on administrative tasks. When you install Exchange, Exchange-specific attributes are added to Active Directory. Assigning an Exchange role to a user gives that user the ability to manage the Exchange attributes included within the job role. Exchange administrator roles have permissions to manage the following types of data in both Exchange and in Active Directory:

Global data is data in an Active Directory configuration container that is not associated with a particular server. Global data generally affects the whole organization, so best practice dictates that only a few trusted users are allowed to configure or change global data. Global data includes data such as mailbox policies, address lists, and Exchange Unified Messaging configuration. Server data is contained in Active Directory under the specified servers node. Examples of server data include Receive connectors, virtual directories, per-server settings, and mailbox and storage group data. Recipient data consists of Active Directory objects that can receive or send e-mail messages. Examples of recipient data include user accounts, contacts, and distribution groups.

Notice that the Exchange Management Console organizes all tasks within one of three nodes, with each node designating both the type of data and the Exchange role necessary to perform management tasks for objects beneath that node: Console Node Data Type Exchange Role Exchange Organization Administrator 81

Organization Configuration Global data

Server Configuration Recipient Configuration

Server data

Exchange Server Administrator + Local Administrator for the server

Recipient data Exchange Recipient Administrator

Using a decentralized approach to administration, you assign users to specific roles based on the configuration tasks they need to perform. As a general rule, when deciding what permissions are required for specific tasks, identify the type of data that needs to be managed and then match that to the administrative role. The following table outlines the types of tasks that can be performed with the standard administrative roles: Role/Permissions Tasks Those with Exchange View-Only Administrator permissions can view all objects and their properties and have read-only access to domain containers that house Exchange recipients.

Exchange View-Only Administrator

This role generally allows the user to run most Get- cmdlets that involve reading properties from Active Directory objects. The role does not grant permission to read configuration information stored only on the server and not in Active Directory. The role does not grant permission to view messages held in mailboxes, messages held in queues, or information stored in transport logs. The role does not grant permission to run any Get- command on an Edge Transport server. This is because configuration information for an Edge Transport server is not stored in Active Directory. The role does not grant permission to run many of the Get- commands that show organization-wide Exchange settings (such as edge subscription or site information).

Exchange Recipient Administrators have permissions to manage Exchange attributes on recipient objects in Active Directory. This includes:

Exchange Recipient Administrator

Using Set- commands to change Exchange attributes for users, groups, and contacts (this includes setting mailbox settings that are stored in Active Directory as properties of the user or contact object) Enabling or disabling mailboxes, mail users, mail contacts, and distribution groups Connecting mailboxes to existing users Modifying dynamic group membership criteria Setting client access options for recipients (Set-CASMailbox) Managing public folder settings Updating Safe List Aggregation information (Update-SafeList)

Note: The Exchange Recipient Administrators group is a member of the Exchange ViewOnly Administrators group. This means that recipient administrators have all of the permissions assigned to view-only administrators. Exchange Recipient Administrator and Account Operator role for the applicable Active Directory containers Having only the Exchange Recipient Administrator role does not give permissions to create new Active Directory objects or modify non-Exchange attributes for objects. To perform these tasks, the Exchange Recipient Administrator must also have the Account Operator role for the applicable Active Directory containers where the Active Directory objects are located. This additional permission is required when doing the following:

Creating new user accounts, contacts, or groups (such as when using the New82

commands to create mailboxes, mail users, mail contacts, or distribution groups) Removing mailboxes, mail users, mail contacts, or distribution groups (using the Remove- commands deletes the Active Directory object) Modifying distribution group membership (group membership is a non-Exchange attribute of the Active Directory object) Running Set-User, Set-Contact, and Set-Group (these commands operate on the Active Directory object and not just the Exchange attributes)

Server configuration information is stored both in Active Directory as a property of the server object and on the server itself. For this reason, users who manage the server typically need the following permissions:

Membership in the Exchange Server Administrator role grants the ability to manage server properties in Active Directory. Membership in the local Administrators group for the server grants the ability to manage settings on the server. Membership in the Exchange View-Only Administrator role grants the ability to read properties from additional Active Directory objects. Note: When you assign a user to the Exchange Server Administrator role, the user is automatically assigned to the Exchange View-Only Administrator role.

Exchange Server Administrator and Membership in the local Administrators group for the target server

Server administrators with the necessary local Administrators membership can install Exchange on the server and perform the following tasks:

On Mailbox servers: manage storage group and database settings, configure replication, manage public folders, manage messages, and import and export mailboxes. On Client Access servers: configure MAPI, IMAP, and POP protocols; configure virtual directories (i.e. Autodiscover, OWA, OAB, and ActiveSync). On Hub Transport servers: manage queues, configure spam filters (such as connection, recipient, and sender filters), create Receive and Foreign connectors, and manage transport agents. On Unified Messaging servers: manage the custom prompts.

Get- commands that read data from the server and not from Active Directory require that you have the Exchange Server Administrator role to run the commands. Examples of Getcmdlets that require this role include:

Get-Message Get-Queue Get-IPAllowListEntry, Get-IPAllowListProvider, GetIPBlockListProvidersConfig

Membership in the local Administrators group for the target server Exchange Server Administrator, Membership in the local Administrators group for the server, Exchange Recipient

Management tasks performed on an Edge Transport server require only membership in the local Administrators group. The Exchange Server Administrator role does not apply to Edge Transport servers because these servers are not members of the Active Directory domain. Moving a mailbox affects the mailbox stored in the mailbox database on the server as well as configuration information for the mailbox stored in Active Directory as a property of the user object. For this reason, moving a mailbox requires permissions on the source and target server and the recipient object. 83

Administrator The Exchange Organization Administrator has permissions to manage all Exchange objects and properties. This includes all recipients and all Exchange servers. The Exchange Organization Administrator role is required to perform the following tasks:

Exchange Organization Administrator

Designating Exchange administrators Creating the Exchange organization and installing the first Exchange server Managing address lists, default and custom folders, and folder mailbox policies (assigning a policy to a user requires only the Exchange Recipient Administrator role) Managing the Offline Address Book Creating ActiveSync policies (assigning a policy to a user requires only the Exchange Recipient Administrator role) Setting accepted domains, e-mail address policies Configuring transport rules and journaling Managing Edge subscriptions and Send connectors Managing Unified Messaging policies

The Exchange Organization Administrator role is also required to run the following Getcommands:

Get-AdSite, Get-AdSiteLink Get-MailboxCalendarSettings

Public Folder Management Facts You should know the following about public folder management:

Public folder stores are not automatically installed on every server. A public folder database will be created on the Mailbox server when one of the following actions occurs: o If /EnableLegacyOutlook is used during installation in the Management Shell to specify that you have client computers that are running Microsoft Outlook 2003 or earlier. o If you answer Yes to the Do you have any client computers running Outlook 2003 or earlier in your organization? prompt in the installation wizard in the Management Console. The following client applications access public folders in the RTM version of Exchange 2007: o Microsoft Office Outlook 2007 o Microsoft Office Outlook 2003 o IMAP4 compatible applications such as Outlook Express All client computers running Outlook 2003 or older versions of Outlook require public folders to be deployed so that they can connect to Exchange to provide features such as free and busy information and offline address book (OAB) downloads. If Cluster Continuous Replication (CCR), Local Continuous Replication (LCR), or Standby Continuous Replication (SCR) are implemented, there can only be one public folder database in the organization (you cannot have a public folder database on more than one server). If you are implementing public folders, the Client Access server role and the Mailbox server role should not be deployed on the same server. Any mailbox databases that are associated with a public folder database that is to be removed must have another public folder database configured to be the default public folder database. The public folder inherits the parent folder's administrative and client access permissions when new public folders are created. 84

It is best practice to deploy dedicated public folder servers in large enterprise topologies where public folders are heavily used. Implementing fewer larger public folder databases is more scalable and manageable than having several smaller public folder databases. You can turn the commands that you use to manage public folders in the Exchange Management Shell into a script. Running scripts in the Exchange Management Shell allows you to automate complex or frequently performed tasks to make public folder administration faster and easier.

Use the following cmdlets to manage public folder databases:

To create a new public folder database, use New-StorageGroup to create the storage group (if it doesn't exist), then use New-PublicFolderDatabase to create the public folder database. You can only create a single public folder database on each Exchange 2007 Mailbox server. New public folder databases are created in a dismounted state. Use Mount-Database to mount the database. Use Get-PublicFolderDatabase to view public folder database settings. Use Set-PublicFolderDatabase to set attributes of public folder databases. Use Remove-PublicFolderDatabase to delete public folder databases. Removing a public folder database does not delete the database files. Before removing a public folder database, certain conditions are required. Use the following steps: 1. Change all mailboxes to point to another public folder database. 2. Move all public folder content to another server. 3. Delete unneeded folders. 4. Delete the store. Note: If you are removing the last public folder database in the organization, you must use Remove-PublicFolderDatabase -RemoveLastAllowed in the Management Shell. This task cannot be performed from the Management Console. Only remove all public folders from an organization if there are no remaining Exchange 2003 or earlier servers or Outlook 2003 clients.

Use the following cmdlets to manage folders:

Use Get-PublicFolder to retrieve the attributes of a public folder or a set of public folders. Use New-PublicFolder to create a new public folder with the specified name. Use Remove-PublicFolder to remove an existing public folder. Use Set-PublicFolder to set the attributes of public folders.

Use the following cmdlets to manage mail-enabled public folders:

Use Enable-MailPublicFolder to mail-enable public folders. Use Disable-MailPublicFolder to mail-disable a public folder. Use Get-MailPublicFolder to retrieve mail-related information about mail-enabled public folders. Use Set-MailPublicFolder to configure the mail-related settings of mail-enabled public folders.

Public Folder Replication Facts Public folder replication is the transferal of public folder data between public folder stores in the same top level hierarchy. Folder replication is also used to keep databases synchronized when multiple public folder databases which are located on separate servers support a single public folder tree. Replicating public folder data:

Increases the fault tolerance of the public folder data. Places copies of the data on local servers. Accessing data from local servers can reduce WAN link usage and improve access times.

Replication of the various public folder components takes place as described in the following table: 85

Component Replication method The hierarchy is the public folder tree or organization. The hierarchy for the default public folder tree is replicated automatically to other Exchange servers within the organization by the Information Store through hierarchy replication messages. Modification of the following public folder information results in hierarchy replication: Hierarchy

Replica list Folder's position in the public folder tree Permissions Folder name

Note: Changing the e-mail addresses for a mail-enabled public folder does not cause hierarchy replication to occur. Content replication occurs when messages are sent to public folders or when data is added. A content replica is a copy of the folder that includes content.

Content

Public folder data or contents are not replicated automatically. You must configure public folder content replication manually between servers. When you configure replication, you can configure the schedule and frequency that replication occurs. The content of folders is replicated through content replication messages between replicas of individual folders.

Directory entry

The directory entry is the Active Directory object and its properties. Directory entries are replicated automatically through Active Directory replication.

Use the following cmdlets to configure replication:

Use Set-PublicFolder with the -Replicas switch to identify specific servers that will hold replicas of a public folder. Use Update-PublicFolder to start content synchronization of a public folder. Use Update-PublicFolderHierarchy to start content synchronization of the public folder hierarchy. Use Suspend-PublicFolderReplication to stop public folder replication for the organization. Use Resume-PublicFolderReplication to resume content replication when it has been stopped. Use Set-PublicFolderDatabase -ReplicationPeriod to specify the interval at which replication of public folders or content updates may occur. You can select precanned replication intervals or you can create a custom schedule. By default, public folder replication is scheduled to run every 15 minutes. Use Set-PublicFolderDatabase -ReplicationSchedule to specify the time intervals during which replication of public folders or contents may occur. The replication schedule uses the format: Day.hh:mm AM/PMDay.hh:mm AM/PM to indicate the start time and stop time when replication is allowed. If you omit AM or PM, a 24 hour clock is used (for example, 23:00 = 11:00 PM). Use Set-PublicFolderDatabase -ReplicationMessageSize to specify the size of replication messages. o Small items may be aggregated into a single replication message that can be as large as this setting. o Items larger than this setting are replicated with messages larger than this size. In addition to configuring replication for the database, you can configure replication for specific folders. Use Set-PublicFolder to configure replication settings for a specific folder.

When a user connects to a public folder store and the store does not contain a copy of the content the user is requesting, Exchange automatically redirects the user to a server that does contain the content. This process is known as public folder referral. Accessing a public folder referral entails the following process: 1. A user connects to Exchange and uses a MAPI client application to request access to a public folder. 86

2. The MAPI client attempts to read the content for a specific public folder, initially querying the default public folder database for the content. If the default public folder database is a content replica for the folder in question, the process is complete. 3. If there is no replica on the default public folder database, Exchange returns a list of replicas to the client. The replica list is sorted by that servers perspective of connection costs to each of the other listed content replicas. 4. The MAPI clients attempt to access each replica in the list by doing the following: 1. Connecting to the server 2. Attempting to locate the folder 3. Attempting to read the folder's content 5. If a failure occurs, the client attempts to access the next replica server in the list. This action is repeated until the client has attempted to access all replica servers in the custom list. Public folder referrals have an associated cost number that is used to optimize message flow by calculating the most appropriate route that the client application can use to access public folders on remote servers. The numbers range from 1 to 100.

An administrator can specify a list of referral servers and assign routing costs to each server to redirect server traffic. The maximum public folder referral cost that Exchange administrators can set for a public folder database is 100, unless they are members of the Domain Admins group or the Enterprise Admins group in the Active Directory directory service, in which case they can set the Active Directory site link cost up to or greater than 500. Connection costs are determined by querying Active Directory Sites and Services for the site connector cost information of the other Mailbox servers in the organization on which a public folder database resides. Cost information is refreshed once every hour.

Use the following commands to configure public folder referrals:

Use Set-PublicFolderDatabase -CustomReferralServerList to manually assign public folder referral costs to individual servers. o Costs can be any positive number. o Servers not included on the list are not included for referrals. o If this parameter is set with no servers in the list, there are no public folder referrals. Use Set-PublicFolderDatabase -UseCustomReferralServerList to specify whether to use the server costs specified by the -PublicFolderReferralServerList switch. o If set to $true, the server uses the -PublicFolderReferralServerList switch costs to make public folder referrals. o If set to $false, the -PublicFolderReferralServerList switch is cleared and the server uses Active Directory inter-site costs to make public folder referrals.

Keep in mind the following facts about public folder data replication:

Even if you have not configured public folders to be replicated, public folder replication is occurring if you have two or more public folder databases in your organization. When a public folder or its contents is modified, the public folder database that contains the replica of the modified public folder sends a descriptive e-mail message to the other public folder databases that host a replica of the public folder. Only new information going into the original public folder is replicated. Because public folder replication and storage group replication cannot be combined, Cluster Continuous Replication (CCR), Local Continuous Replication (LCR), or Standby Continuous Replication (SCR) are available for a public folder database only if there are no other public folder databases in the organization.

87

Replicating public folder data can decrease the WAN traffic associated with data access. However, it does cause an increase in WAN traffic due to replication traffic. Depending on the number of users, replication traffic might be less than data access traffic. When configuring replication, you specify the public folder store that will host a replica of the public folder. The amount of time that data in two replicas is different is called replication latency. Replication latency is dependent on the replication schedule. It is also associated with the amount of time it takes to replicate. Determine the importance of current data being available in the replicated public folder, then adjust the replication schedule to reflect that level of importance. The replication process uses the Active Directory attributes of the public folder databases, not the Active Directory attributes of individual public folders.

ActiveSync Policy Facts An ActiveSync policy enforces ActiveSync settings for specific users. Use ActiveSync policy settings to:

Enable and disable device features such as Bluetooth, infrared (IrDA), Remote Desktop, Desktop Sync, POP3 or IMAP4 e-mail, browser, text messaging, or camera. Enforce mobile device password settings including alphanumeric passwords, password history, minimum password length and complexity, and failed password attempts. Requiring encryption settings for synchronization or S/MIME messages. Allow access to the storage card or installing unsigned applications. Configure settings for the size and frequency of downloading messages and attachments.

You can create policies through the Management Console, but only a limited number of password settings are available for editing. Use the PowerShell cmdlets to configure all policy settings:

Use New-ActiveSyncMailboxPolicy to create the policy and configure settings when the policy is created. Use Set-ActiveSyncMailboxPolicy to modify policy settings and Get-ActiveSyncMailboxPolicy to view policy settings. Use Set-CASMailbox with the -ActiveSyncMailboxPolicy switch to link a policy to a user. Each user can have a single associated policy. A user is not required to have a policy.

Note: With Exchange 2007 SP1, a default ActiveSync policy is created automatically. The default policy is automatically applied to new mailboxes. Use Set-ActiveSyncMailboxPolicy with the -IsDefaultPolicy switch to designate which policy is the default. You must be assigned the Exchange Organization Administrator role to manage ActiveSync policies, and the Exchange Recipient Administrator role to link a policy with a recipient. Messaging Records Management (MRM) Facts Messaging Records Management (MRM) is a feature of Exchange 2007 Enterprise Edition that can be used to manage e-mail and other content for government or regulatory compliance. With MRM, users can keep messages that they are required to retain and remove content with no legal or business value. MRM used the following components:

Content is managed by identifying managed folders. A managed folder is a mailbox folder to which settings are applied. A managed folder has the following settings: o The retention period identifies the length of time an item is held in the managed folder. o The retention period start action identifies when the retention period begins, either when the item is delivered or when it is moved into the folder. o The retention period end action identifies what takes place when the retention period length is past. Actions include deleting the item, moving it to another folder, or flagging the item as past the retention period. 88

The managed folder assistant is a service that runs and enforces the managed folder settings. It identifies messages that are past the retention period and takes the specified action. Managed folders are grouped together with managed folder policies. Each policy identifies one or more managed folders that are managed as a group. Policies are linked to user mailboxes. When you link a policy to a mailbox, the managed folders identified in the policy are added to the user mailbox (if they don't already exist). The managed folder assistant then applies the settings and takes actions on folders in the mailbox.

Managed folders can be administered through the Management Console or the Management Shell. Use the following process to configure MRM: 1. Create managed folders, or identify default folders that are to be managed with MRM. Use NewManagedFolder to create managed folders. 2. Configure managed content settings to the folder such as the retention period and action. Use NewManagedContentSettings and Set-ManagedContentSettings in the Management Shell. 3. Create a policy. Use New-ManagedFolderMailboxPolicy to create the policy and SetManagedFolderMailboxPolicy to modify folders associated with the policy. 4. Apply a policy to user mailboxes. Use Set-Mailbox with the -ManagedFolderMailboxPolicy switch in the Management Shell. 5. Run the managed folder assistant to enforce managed folder settings. Use Set-MailboxServer with the ManagedFolderAssistantSchedule switch to run the assistant on a schedule so that actions are taken on a periodic basis. You can also manually run the assistant using the Start-ManagedFolderAssistant cmdlet. Be aware of the following when using managed folders:

Messaging Records Management (MRM) requires Exchange 2007 Enterprise Edition. In addition, each mailbox that uses MRM requires an Exchange Server Enterprise client access license (CAL). Managed content could include files that are not e-mail messages. Implementing managing folders typically means that mailbox sizes will need to be bigger to hold the additional content. The first time the assistant runs, it might take a long time and a lot of system resources to create the necessary folders and apply the actions to messages already in the folders. Be sure to run it in off hours. Each policy can apply to multiple managed folders. Each user can only have one associated policy. To turn off MRM for a user, just unlink the user from the policy. Use Set-Mailbox with the RemoveManagedFolderAndPolicy switch. To disable MRM for an entire server, remove all managed folders or remove all managed folder policies.

Public Folders Facts A public folder is a repository for data that can be accessed by multiple users thus providing a simple and efficient way to collect, organize, and share Exchange 2007 collaborative applications such as calendars, contact lists, task lists, and message lists. Much like a mailbox store, public folders:

Are managed by the Information Store. Are an ESE database that uses transaction logging. Are subject to the same best practice rules that are applicable to mailbox stores, such as: o The database and log files should be stored on separate disks. o There should only be one store per storage group.

Note: Microsoft is encouraging Exchange 2007 users to switch to the SharePoint Platform to reduce the use of public folders for creating collaborative applications. 89

A public folder store is a database file that resides on an Exchange server. When a public folder is created, it is stored on the Exchange server in a public folder store. The components that are associated with a public folder store are as follows:

The hierarchy is a list of all of the public folders that exist within an organization. This is also referred to as the public folder tree. It is possible to nest multiple public folders within the public folder tree; however, it is best practice not to exceed 250 subfolders per folder. o A deep hierarchy consists of many vertically nested folders with few higher-level folders. o A wide hierarchy consists of many higher-level folders with fewer vertically nested subfolders. Note: Deep public folder hierarchies scale better and perform better than wide hierarchies. Content represents the data (addresses, contacts, messages etc.) that is stored within a public folder store. The directory is an object that is created in Active Directory to represent the public folder.

Public folders are managed using the following platforms: Platform Description Microsoft Outlook is the preferred tool for users to manage public folders in Exchange 2007. Through Outlook, a user can: Microsoft Outlook

Design and manage forms. Set permissions for control access. Create, rename, and delete public folders.

The Exchange Management Shell (PowerShell) is the primary tool for managing the public folder environment from the server. The following tasks can be performed from the Exchange Management Shell: Exchange Management Shell

Modify, create, delete, and query the status of public folders. Start, stop, pause, and query the status public folder application. Create, modify, or delete the public folder stores in the Exchange organization.

Because the Exchange Management Shell is the primary tool for managing public folders from the server, the Management Console only provides minimum tools for public folder management: Management Console

A wizard to create a new public folder if one doesn't already exist on the Exchange 2007 server. Access to a limited amount of management tasks related to existing public folder stores.

Note: Unlike previous versions of Exchange, the console does not allow administration of individual public folders or the public folder tree. A public folder is created using the following steps: 1. An instance (replica) of the public folder content is created on a public folder store on the server that will host it. 2. An object is created in Active Directory to represent the folder. 3. An entry is added to the public folder hierarchy (tree) and made visible to all Outlook users with access permission. 4. The Information Source Service (ISS) automatically replicates the hierarchy to every server in the organization that has a public folder store. You should know the following about public folders in Exchange 2007: 90

Previous versions of Exchange allowed multiple public folder trees and multiple public folder stores; however Exchange Server 2007 only allows one public folder tree and one public folder store to be created on any Exchange 2007 server. Exchange 2007 only supports the default MAPI folder tree which is divided into the following subtrees: o A default public folder (also known as the IPM_Subtree) can be accessed by users directly by using client applications such as Outlook. o A system public folder (also known as the Non IPM_Subtree) cannot be accessed by users directly by using conventional methods, but instead is used by client applications such as Outlook to store information such as offline address books, free and busy data, and organizational forms. The public folders tree contains additional system folders that do not exist in general purpose public folder trees, such as the EFORMS REGISTRY folder. A mail-enabled folder is a public folder that has an e-mail address. A mail-enabled folder can have messages posted to it, and it can also send e-mail messages to users and possibly receive e-mail messages from users as well. By default, public folders are not mail-enabled.

Recipient Management Facts You can manage recipients from both the Management Console or the Management Shell, although there are some features or settings that might not be available from the Management Shell. The following table describes various management tasks: Task Cmdlet(s) When you create a recipient, you create a new Active Directory object and add mail capabilities to that object. Use the following cmdlets to create new recipients:

Create a recipient

Use New-Mailbox to create a user mailbox or resource mailbox. Use the -Room or Equipment switches to create specific resource mailbox types. Use New-MailContact and New-MailUser to create contacts and mail users. Use New-DistributionGroup to create a mail-enabled group. Use the -Type switch to identify the group type (Distribution or Security). Use New-DynamicDistributionGroup to create a new dynamic distribution group.

When you mail-enable an object, you add mail capabilities to an existing Active Directory object. Use the following cmdlets to mail-enable an object: Mail-enable an object

Enable-Mailbox Enable-MailContact, Enable-MailUser Enable-DistributionGroup

Note: When you mail-enable a group, the group must be a universal group. Deleting a recipient removes the Active Directory object.

Delete a recipient

Use Remove-Mailbox to delete a mail-enabled user account. Use the -Permanent $true switch to delete the mailbox and its contents in addition to the user account (the default setting is $false). If you do not delete the mailbox, you can link it to another recipient. Use Remove-MailContact, Remove-MailUser, Remove-DistributionGroup, and Remove-DynamicDistributionGroup to delete other mail-enabled Active Directory objects. These objects do not have an associated mailbox, so only the object is deleted.

Mail-disable a recipient

When you disable an object, you remove Exchange recipient information from the object, but the object still exists in Active Directory. Use the following cmdlets to mail-disable an object: 91

Disable-Mailbox (the mailbox still exists but is not linked to a user) Disable-MailContact, Disable-MailUser Disable-DistributionGroup, Disable-DynamicDistributionGroup

Connect a disconnected mailbox

If you delete a recipient but do not delete the mailbox, or if you mail-disable a recipient, the mailbox still exists but is not associated with an Active Directory user. To connect a mailbox to a user, use the Connect-Mailbox cmdlet. The Active Directory object must already exist. If you do not specify an object, Exchange will search for a matching object. Use the following cmdlets to configure recipient properties (such as maximum send and receive message size or quotas):

Configure recipient properties

Set-Mailbox Set-MailContact, Set-MailUser Set-DistributionGroup, Set-DynamicDistributionGroup

To modify group membership:

Use Add-DistributionGroupMember or Remove-DistributionGroupMember for distribution groups. Use Set-DynamicDistributionGroup to change group filter criteria.

Use the corresponding Get command to view recipient settings:

Get-Mailbox Get-MailContact, Get-MailUser Get-DistributionGroup, Get-DynamicDistributionGroup

View recipient properties

To view group membership:

Use Get-DistributionGroupMember to view members of distribution groups. To view members of a dynamic distribution group, use the Management Console to view the properties of the group. On the Conditions tab, click the Preview button to generate the list of members based on the current conditions.

You can also use the Get-User and Get-Group cmdlets to view properties of Active Directory objects. Some Exchange properties will be listed for the users or groups. Mailbox objects in Exchange can be converted from one type to another. You can convert: Convert a recipient

A user mailbox to resource mailbox, or a resource mailbox to a user mailbox A user mailbox to shared mailbox, or a shared mailbox to a user mailbox A shared mailbox to user mailbox, or a shared mailbox to a resource mailbox

Use Set-Mailbox -Type with one of the following options: Regular, Room, Equipment, or Shared. You cannot convert a mailbox through the Management Console.

Recipient Bulk Management Facts The primary method of performing recipient management tasks on multiple recipients is by using Management Shell scripts that operate on multiple objects. The basic format for such scripts is to use a Get- cmdlet to retrieve a list of 92

objects, then use piping (also called pipelining) to feed that list into another command that performs certain actions. Use the | character to combine multiple cmdlets together. For example, the following cmdlet shows three cmdlets piped together: Get-Mailbox | where { $_.ResourceType -eq "Shared" } | Set-Mailbox -MaxSendSize "300KB" Cmdlets are executed in order, left to right, with the results of previous cmdlets being fed into subsequent ones. In the example listed above, the cmdlet performs the following actions: 1. Get a list of mailboxes. 2. From the list of mailboxes, filter out only those that have a ResourceType property of Shared. 3. From the list of filtered mailboxes, change the maximum send size to 300KB. The Where-Object cmdlet has the following syntax:

Use { } to enclose the script block that defines the filter. $_ is a special variable that contains the current pipeline object. ResourceType is a specific property of the object. The object property is added to the object variable with a period. -eq is a comparison operator. Operators include: o -lt Less than o -le Less than or equal to o -gt Greater than o -ge Greater than or equal to o -eq Equal to o -ne Not equal to o -like Like (used for string comparisons) o -notlike (used for string comparisons) When using -like and -notlike, you can use * for wildcard matching. When comparing text strings, enclose the text in quotes.

Shared is the value that will be compared when filtering the results.

The following table lists some additional settings you can use when executing cmdlets. Setting Description Use the -WhatIf switch to cause a command to display the objects that would be affected by running the command and what changes would be made to those objects. WhatIf

-WhatIf allows you to see whether the changes that would be made to objects match your expectations, without the worry of modifying those objects. Place -WhatIf at the end of a command.

Use the -Confirm switch to cause a command to stop processing before any changes are made.

Confirm

-Confirm allows you to step through changes to objects to make sure that changes are made only to the specific objects that you want to change. A confirmation prompt is displayed for each object before the Exchange Management Shell modifies the object. Use the -Confirm parameter with a value of $False if you want to override the default behavior of the Exchange Management Shell and suppress the confirmation prompt for cmdlets on which it is automatically applied. 93

Place -Confirm at the end of a command.

Use the -ValidateOnly switch to cause a command to evaluate all the conditions and requirements that are needed to perform the operation before any changes are applied.

ValidateOnly

The command runs through the whole process and performs each action as it would normally, but it does not change any objects when -ValidateOnly is applied. Run the command again without -ValidateOnly if the -ValidateOnly run was successful to make the changes. Place -ValidateOnly at the end of a command.

Write-Error

To report errors while a command runs, pipe a cmdlet to the Write-Error cmdlet.

Following are additional examples of using pipelining to perform bulk recipient tasks: Cmdlet: Get-Mailbox -Server Mail1 | Move-Mailbox -TargetDatabase "Mail2\First Storage Group\Executives" Function: Get a list of mailboxes on Mail1, then move each mailbox to the Executives database on Mail2. Cmdlet: Get-DistributionGroup | Set-DistributionGroup -RequireSenderAuthentication $true Function: Get a list of all distribution groups, then configure each group to allow only authenticated users to send mail to the group. Cmdlet: Get-User | where { $_.RecipientTypeDetails -eq "User" } | where {$_.DistinguishedName -like "*CN=Mrktg*"} | Enable-Mailbox -Database "Mrktg" Function: Get a list of Active Directory User accounts that are not mail-enabled but are enabled for logon (RecipientTypeDetails = User), then filter the list to include only user accounts that are in the Mrktg OU. Create a mailbox and mail-enable each user that meets the criteria. Cmdlet: Get-Group | where {$_.RecipientTypeDetails -eq "MailUniversalDistributionGroup"} | where {$_.Members -like "*Mary Cooper*" } | Remove-DistributionGroupMember -member "Mary Cooper" Function: Get a list of mail-enabled distribution groups of which Mary Cooper is a member. Remove Mary Cooper as a member of each group. As you work with the Management Shell constructing complex cmdlets, use the following process: 1. Use a Get- command to examine the available properties for one specific object. Identify properties that will help you construct filters that apply only to the specific objects you want to modify. 2. Construct a where clause to filter on the specific property and values. 3. Combine a Get- command with the where clause and execute the cmdlet. The list of objects returned are those objects that meet the cmdlet criteria. Verify that the list meets your expectations. 4. Add a Set- command to perform the actions you want. Execute the entire cmdlet with the -WhatIf switch to see what would happen when the cmdlet runs. 5. (Optional) If the results meet your expectations, run the cmdlet with the -ValidateOnly switch to make sure that any prerequisites are met. 6. Run the completed cmdlet. Recipient Facts A recipient is an Active Directory object that has Exchange mail capabilities. The following table explains the Exchange 2007 recipient types: 94

Recipient type

Description A user mailbox is associated with an Active Directory user account.

User mailbox

All of the messages, calendar items, documents, contacts, tasks, and other data that are associated with a mailbox-enabled user are hosted on one of the mailbox servers within an Exchange organization. A mailbox-enabled user can log on to the domain and access resources on the network according to the permissions and groups to which they are assigned. User mailboxes are the most common type of Exchange recipient.

Note: The mailbox data that is stored in the Exchange mailbox database is marked for deletion and the associated user account is also deleted from Active Directory when a mailbox is removed. The user account can be retained by disabling the mailbox. Mail user A mail user is a mail-enabled Active Directory user that has an e-mail address associated with an account, but whose mailbox is stored on an external mail system. For example, a contractor who is working for the organization but is using their own e-mail address. A mail contact is a mail-enabled Active Directory contact that contains information about people or organizations that exist outside an Exchange organization. Mail contacts are used to make it easier for users within an organization to locate the contact details of people outside of the organization. A mail contact is similar to a mail user, but a contact can't be used for logon. A universal distribution group is a mail-enabled Active Directory distribution group object that is used to distribute e-mail messages to a large number of people in an organization, such as entire departments or groups. Note: Unlike previous versions of Exchange, a distribution group in Exchange 2007 must be a universal group. A universal security group is a mail-enabled Active Directory security group object used to grant access permissions to resources in Active Directory in addition to distributing messages to departments or groups. Use a security group if you need to use the group to control access to resources in addition to using it for mail distribution. A dynamic distribution group is a distribution group whose membership is defined by the results of a query (as opposed to a defined set of recipients) which is executed every time a message is sent to the group. This is optimal for environments in which people move groups or buildings often and email groups need to be able to accommodate changes as they occur. Note: Because of the additional load that is placed on global catalog servers when a dynamic distribution group query is run, it is best to limit the amount of dynamic distribution groups that are created. A non-universal group is a mail-enabled Active Directory global or local group object which has been brought over from previous versions of Exchange. You can manage these groups with Exchange 2007, but not create them. A room mailbox is assigned to a meeting location. Use room mailboxes to schedule meeting rooms. When you create a room mailbox, a disabled user account is created for the room. You then specify a user who manages the room, or you can configure a calendar so schedule requests are handled automatically. An equipment mailbox is assigned to a resource that does not have a specific location. Examples include a portable projector or a company car. You can use equipment mailboxes for requesting and scheduling equipment use. Like a room mailbox, an equipment mailbox has a disabled user account and a managing user. You can also configure the calendar for automatic scheduling. A mail-enabled public folder is a public folder that can receive messages. Messages that are sent to e-mail addresses are posted in public folders. A linked mailbox is a mailbox that is assigned to an individual user in a separate, trusted forest. Multiple forests usually exist for the following reasons: 95

Mail contact Mail-enabled universal distribution group Mail-enabled universal security group

Dynamic distribution group Mail-enabled non-universal group Room mailbox

Equipment mailbox Mail-enabled public folder Linked mailbox

An organization deploys one forest for user accounts for the staff and deploys a second forest for the resources for the organization such a print services or Exchange. Administration requirements are distinct for different parts of the organization. Different areas of the organization require distinct schemas. Multiple companies have merged together.

You should understand the following about linked mailboxes:

When a linked mailbox is created, a mailbox and a disabled user account are created in the forest which hosts the Exchange organization. Once the mailbox has been created, it is then linked or associated with a user account that resides in the second forest. To assign an account from the second forest to the mailbox, a trust relationship must exist between the domain that contains the Exchange server and the domain in which the user account resides.

A shared mailbox performs the same functions as a user mailbox, but is associated with multiple Active Directory user accounts. Shared mailbox Note: Even though Exchange 2007 supports shared mailboxes, it is a de-emphasized feature that can only be managed through the Exchange Management Shell. It is recommended to use resource mailboxes or Microsoft SharePoint Portal Server portals for collaboration instead of shared mailboxes. Legacy mailbox A legacy mailbox is a mailbox which resides on an Exchange Server 2003 or Exchange 2000 Server. Mail forest contact A mail forest contact is a read-only recipient object from another forest that is created and managed by Microsoft Identity Integration Server (MIIS) synchronization. Mail forest contacts cannot be removed or modified through the Exchange Management Console or the Exchange Management Shell. The Microsoft Exchange recipient is a special recipient object that: Microsoft Exchange recipient

Differentiates system-generated messages from other messages. Replaces the System Administrator sender that was used for system-generated messages in earlier versions of Microsoft Exchange Server.

Server Recovery Facts The method you use to recover from a server failure depends on the server role. The following table describes the various restore options: Method Description The most efficient server recovery method is to apply configuration data from Active Directory to the server to restore server configuration information. Following server recovery, you then restore or reconfigure the server with custom settings that are stored locally. To recover a server, use the following process: 1. In Active Directory, reset the computer account for the Exchange server. 2. Reinstall Windows, joining the domain with the same computer name as it had before. 3. Reconfigure the drives using the same configuration as was used before, otherwise file paths can be lost for stores, storage groups, and log paths. 96

Recover the server

4. Apply any service packs, run any necessary updates, and install any prerequisites needed for Exchange 2007. 5. Run Setup.com /M:RecoverServer from the Exchange DVD. RecoverServer queries Active Directory for the configuration of the server, then rebuilds the server accordingly. 6. After RecoverServer finishes, restore server-specific data based on the server role: o For Mailbox servers: Restore the mailbox and storage group databases. If using Web distribution for the offline address book, restore the ExchangeOAB directory. Rebuild the search indexes. To rebuild the indexes, stop the MSExchangeSearch service (using the Services MMC snap-in or the SetMailboxDatabase -IndexEnabled $false cmdlet, delete the old catalog, then restart the service. Alternatively, you can run the ResetSearchIndex.ps1 script (stopping the service is not required). o For a Client Access server, reconfigure any custom settings in IIS (reconfiguration is preferred over restoring IIS data). If you do not want to manually change IIS settings: Import (not restore) the exported copy of the IIS metabase. Restore the necessary .config files that contain custom settings for services you are supporting. o For a Unified Messaging server, restore the prompt publishing point directory only if the server you are restoring was the distribution point. If the server you are recovering is not the distribution point, the custom prompts will be replicated automatically to the server from the distribution point. o For a Hub Transport server, if you still have the queue database files, use the /DoNotStartTransport switch to recover the server without starting the service. This allows you to reconnect the queue database files before starting the service. Be aware of the following when recovering server roles:

You cannot use RecoverServer to recover an Edge Transport server or a clustered Mailbox server. You can use RecoverServer to recover roles on the same server, or to a server with different hardware. For this reason, you can use RecoverServer to perform server migrations (moving roles to different server hardware). You cannot use RecoverServer if the original Active Directory computer object no longer exists.

To recover an Edge Transport server, you can import the saved Edge Transport server configuration. To recover using the import method, you should have first saved the current configuration by running the ExportEdgeConfig.ps1 script on the server before the failure. ExportEdgeConfig.ps1 saves server-specific settings to an .xml file. This includes spam filtering settings, but does not include the ADAM database or transport policies. (To save transport settings, run Get-TransportServer and note the settings.) Recover an Edge Transport server Complete the following steps to recover the server: 1. Reinstall the operating system and Exchange. Choose to install the Edge Transport role with the Setup /M:Install /R:E command. 2. Validate the exported configuration against the new server by running the following script: ImportEdgeConfig.ps1 -cloneConfigData "mySavedConfig.xml" -isImport $false CloneConfigAnswer "myAnswerFile.xml" 3. The script creates an answer file that contains settings from the old server configuration that must be changed for the new server. (If it doesn't require modifications, it won't have any 97

entries.) Edit the file to make the changes. 4. Import the configuration by running the following script: ImportEdgeConfig.ps1 -cloneConfigData "mySavedConfig.xml" -isImport $true CloneConfigAnswer "myAnswerFile.xml" 5. Resubscribe the server to the Active Directory site. 6. Reconfigure any transport rules on the server. This method is sometimes called a cloned configuration. You clone information using ExportEdgeConfig.ps1. If you lose one server in a CCR or SCC cluster, install Windows, then run Setup /r:Mailbox to install the server as a passive node in the existing cluster. The cluster service will recognize the new node and perform any necessary additional steps. If the entire cluster is lost, use the following process to recover the cluster: Recover a clustered Mailbox server 1. 2. 3. 4. Install Windows. Create the cluster. Run Setup /r:Mailbox to install the mailbox server into the cluster as a passive node. Run Setup /RecoverCMS to recover the server. Following this operation, restart the System Attendant service. 5. Restore the databases. Following the restore, mount the databases. 6. Install passive nodes by installing Windows, then running Setup /r:Mailbox on each additional passive node server. 7. If recovering a CCR cluster, reseed the replica and restart replication.

Note: You can also recover a lost server by using an Automated System Recovery (ASR) restore of the computer, the operating system, the disks, and all Exchange data. You must have a backup of all system state data and Exchange files, and you can only perform the restore on the same (or very similar) hardware. For this reason, using RecoverServer is the preferred method in most cases. Resource Scheduling Facts For Room and Equipment mailboxes, you can configure automatic scheduling so that meeting requests sent to the resource mailbox are processed automatically. There are two methods to enable automatic scheduling:

With Calendar Attendant scheduling, the Calendar Attendant is responsible for granting scheduling requests based on the resource calendar. With booking policies, you define policies that identify who can schedule resources, when the resource can be scheduled, and the message that users receive in response to a booking request.

You cannot use the Management Console to configure resource scheduling. Use the Set-MailboxCalendarSettings cmdlet to enable and configure scheduling requests. The following table describes various resource scheduling tasks: Task Configure automatic booking Description To configure automatic booking, you must enable the booking type. Use the -AutomateProcessing switch to enable or disable automatic scheduling on the mailbox.

The None parameter disables resource scheduling. The AutoUpdate parameter enables resource scheduling using the Calendar Attendant. The AutoAccept parameter enables scheduling using resource booking policies that you 98

define. Identify resource delegates A resource delegate is a user assigned to the resource that approves or rejects meeting requests that are not processed automatically. For example, the delegate approves requests that do not meet the defined policies. Use the -ResourceDelegates switch to identify one or more users who are resource delegates. When you enable resource booking, you manually identify who can submit meeting requests. Use the following switches to enable booking submissions from all users:

Identify who can schedule a resource Use the following switches to identify a list of users who are allowed to submit scheduling requests:

When -AllBookInPolicy is set to $true, all users can submit scheduling requests. Requests that meet the defined policies are approved (booked) automatically. When -AllRequestInPolicy is set to $true, all users submit scheduling requests. Requests that meet the policy conditions are sent to the resource delegate for approval. When -AllRequestOutOfPolicy is set to $true, users can submit requests that do not meet policy conditions. These requests must be approved by a resource delegate.

Use -BookInPolicy to identify a list of users whose requests are granted automatically as long as those requests meet the policy conditions. Use -RequestInPolicy to identify a list of users who can submit requests, but whose requests must be approved by the resource delegate. Use -RequestOutOfPolicy to identify a list of users who can submit requests that do not meet policy conditions. Requests must be approved by a resource delegate.

When using resource booking, use the following switches to configure when the resource can be scheduled: Configure policy settings

Use -ScheduleOnlyDuringWorkingHours to limit scheduling during normal work times. Use -AllowRecurringMeetings to allow or disable scheduling requests that occur on a regular basis. Use -BookingWindowInDays to require that booking requests be made the specified number of days before the scheduled time. Use -AllowConflicts to allow the resource booking agent to grant requests that conflict.

Additional command switches allow you to configure the response sent to meeting organizers, remove attachments or comments from the calendar entries, or delete non-calendar requests. Note: To run the Set-MailboxCalendarSettings cmdlet, users must have the Exchange Organization Administrator role. This is because settings affect not only the recipient, but also organizational-wide settings. Dial Tone Recovery Facts Dial tone recovery provides users with an empty mailbox that has basic e-mail functionality. Dial tone recovery minimizes the disruption of e-mail services for end-users by providing a mailbox as quickly as possible. This empty mailbox provides limited e-mail services for users until full services can be provided. Users will not be able to access data from their original mailboxes, but they will be able to send and receive e-mail using the new mailboxes. Dial tone recovery is not a feature of Exchange, but rather it is a recovery strategy that leverages the recovery storage group, database portability, and mailbox merge features in Exchange 2007. You can use dial tone recovery to provide e-mail service: 99

During a mailbox database restore operation. During a restore operation, users are unable to access the database that is being restored. Depending on the size of the database, the time to complete the restore operation might be unacceptably long. While a failed server is being rebuilt or is waiting for parts. During a move of mailboxes from one server to another, such as during a server upgrade or replacement.

Using dial tone recovery involves the following basic steps: 1. Create the dial tone database. The dial tone database can be on the same server as the failed database or on a different server. Users gain e-mail access through the mailbox in the new dial tone database. 2. Restore the failed database using your backups and recovery strategy. 3. Swap the dial tone database with the restored database. This step restores e-mail access through the original mailbox. Users now have access to all data in the original mailboxes. Messages sent or received while connected to the dial tone database are now unavailable. 4. Merge the databases. Merging the databases copies the data from the dial tone database into the original database. All data, including messages sent and received while connected to the dial tone database, are now available. The following table lists procedures for using dial tone recovery in different circumstances: Situation Description If you have a failure of a mailbox server, you can create the dial tone database on the same server to provide temporary access until the original database can be restored. To perform a dial tone recovery to the same server: Restore to the same server 1. Create a new database with the same name as the original database in the same storage group. This step assumes that the original database no longer exists. 2. Create the recovery storage group linked to the target storage group. 3. Restore the lost database to the recovery storage group. 4. Swap the restored database with the dial tone database. 5. Merge the dial tone database into the restored database. You can create a dial tone database on a different server, for example in the case of a server failure that makes the original server unavailable. To use a different server for dial tone recovery: 1. Create the storage group (if desired) and a new mailbox database on the new server. 2. Use Move-Mailbox with the -ConfigurationOnly switch to point all recipients from the original database to the dial tone database. Mailbox data is not moved. 3. Restore the original database to the original server. 4. Use Move-Mailbox with the -ConfigurationOnly switch to point all recipients from the dial tone database back to the original database. 5. On the original server, create the recovery storage group linked to the storage group that contains the restored database. 6. Move the dial tone database to the recovery storage group. 7. Mount the dial tone database. 8. Merge content from the dial tone database into the restored database.

Restore using a second server for the dial tone database

You can use a dial tone database to permanently move mailboxes to a new server, for Restore to a new server example if the original server is being upgraded or won't be repaired. To permanently move users to the new dial tone database: 100

1. Create the storage group and a new mailbox database on the new server. Use the same storage group and database names. 2. Use Move-Mailbox with the -ConfigurationOnly switch to point all recipients from the original database to the dial tone database. Mailbox data is not moved. 3. Create the recovery storage group on the new server linked to the storage group that contains the dial tone database. 4. Restore the original database to the recovery storage group. 5. Swap the restored database with the dial tone database. 6. Merge the dial tone database with the restored database.

Security Configuration Wizard Facts As part of the post installation process, you can use the Security Configuration Wizard to reduce security vulnerabilities. The Security Configuration Wizard provides a simple and easy way to lock down a Windows Server based on a predefined role. If the Security Configuration Wizard isn't already installed on your computer, install it through the Add/Remove Windows Components option of Add/Remove Programs in the Control Panel. Before you can run the wizard, you must first register your Exchange 2007 database. This is done by entering one of the following commands at the command prompt:

To register a standard knowledge base, enter scwcmd register /kbname:"ex2007kb" /kbfile: "C:\Program Files\Microsoft\Exchange Server\Scripts\Exchange2007.xml" /d. To register an Edge server, enter scwcmd register /kbname:"ex2007Edgekb" /kbfile: "C:\Program Files\Microsoft\Exchange Server\Scripts\Exchange2007Edge.xml" /d.

After you have registered your knowledge base, all of the applicable roles for Exchange 2007 should be listed when you view the security configuration database. Perform the following steps to use the Wizard to create your security policy: 1. Start the Security Configuration Wizard by entering run scw into a command prompt. 2. Select each of the roles that are installed on your server then click Next. 3. Select whichever features, options, and services you would like installed on your computer by following the successive prompts in the Security Wizard. 4. The rest of the Security Configuration Wizard will allow you to create the parameters that will be used for your security policy on your Exchange 2007 server. 5. You can save the policy settings and apply them later by running the wizard again. Consider using the Security Configuration Wizard to configure the following elements to improve your security policy:

Firewall ports Running services Authentication Registry settings Service packs to be employed Auditing IIS configuration

Server Role Deployment Facts You should know the following about server role deployment: 101

In a typical environment, a single server can be used to host the Hub Transport, Mailbox, Client Access, and Unified Messaging server roles. Coexisting server roles are administered as separate entities. If you deploy server roles on more than one machine, best practice dictates that you use the following installation order: 1. Client Access server role 2. Hub Transport server role 3. Mailbox server role 4. Unified Messaging server role For messages to flow correctly, you must install the Mailbox and Hub Transport server roles in each Active Directory directory service site. For client access to function properly, you must install a Client Access server in each Active Directory site that has a Mailbox server. The Edge Transport server must be deployed on its own server; it cannot coexist on the same computer with any other server role. You can run the Edge Transport server role in an existing Exchange 2000 or 2003 environment because it runs independently of all other server roles. Though the Edge Transport server can be deployed at any time during the deployment phase, it will not be fully functional until the Hub Transport server role is installed and the Edge Transport server is subscribed to it. Because the Unified Messaging server is very CPU-intensive, you should consider deploying it on its own server. If not, then the quality voice prompts and feedback may suffer. If the Unified Messaging server is deployed on a computer that does not have any other Exchange 2007 roles installed on it, the organization must contain other Exchange 2007 servers which have the Mailbox, Hub Transport, and Client Access server roles installed. Clustering can only be implemented for the Mailbox server role. If a Mailbox server implements clustering, it cannot share hardware with any other server roles. It is possible to only install the Exchange Management Console, the Exchange Management Shell, the help file, and the Management Tools on a computer that does not have any other roles installed on it. It is not possible to perform a direct upgrade from Exchange 2000 and 2003 to Exchange 2007; you must perform a transitional upgrade instead. To begin the transition, you should install the Client Access server role in each Active Directory site that has a Mailbox server. Front-end Exchange 2000 or Exchange 2003 servers cannot provide access to an Exchange 2007 Mailbox server.

Server-based Messaging Facts There are two messaging methods that have been used to deliver e-mail messages in Exchange environments: Version Description At a basic level, file-based messaging maintains a text file for each user. Every new message for a user is appended to the bottom of the user's text file. It is the user's responsibility to poll the server to see if any new messages had been sent. When a new message arrives, the user downloads it to the local machine, generally deleting the message from the server. Where the client/server system maintains a mailbox store that holds the user's messages on the server, file-based messaging is not intended to maintain messages on the server. To send or receive messages, the file-based system uses the following process: 1. 2. 3. 4. The sender creates an e-mail message. The message is sent to the server. The server receives the message and holds it, acting as a file-share. The recipient polls the server to see if any messages have been sent. 102

File-based messaging

5. The recipient retrieves the message from the server. A client/server messaging system distributes the processing of information between the user's machines (clients) and the central computer (server) that hosts the user's mailboxes. The process includes the following steps: 1. 2. 3. 4. A user initiates a connection to the server and creates an e-mail. The e-mail message is sent to the server. The server receives the message. The server notifies the recipient that they have received a message and places it in the recipient's mailbox.

Client/server messaging

The client/server messaging system is implemented in Exchange 2007 because it provides the following advantages:

Provides more security than file-based systems because the server is responsible for delivering messages, instead of allowing the user to access the user's mailbox to send a message. In file-based messaging the local machine must act as the mail transfer agent (MTA). In client/server messaging, the server takes that role. Reduces the amount of network traffic by eliminating the need to poll the server repeatedly to check for new messages. Increased scalability that allows thousands of users to be located on a single Mailbox server. Increased stability due to the added capacity of the network.

The main disadvantage of using a server-based messaging system is the cost of the high-capacity servers that are required to support the workload.

Server Role Facts A server role is a unit that logically groups required components and features that are needed to perform functions within a messaging environment. During installation, you choose the role(s) that the server will play within the organization. The following table describes the different types of roles in an Exchange 2007 environment: Server Role Description The Mailbox server role in Exchange 2007 contains the mailbox and public folder databases. Mailbox servers provide services such as:

Calculating e-mail address policies and address lists for recipients Enforcing managed folders.

Mailbox server

The Mailbox server interacts directly with the following:

Active Directory directory service server Client Access server Hub Transport server Microsoft Outlook clients Unified Messaging (UM) server

Client Access The Client Access server role allows a variety of different clients to communicate with the Exchange server 103

server. The Client Access server role hosts the following client applications and protocols:

Outlook Web Access Exchange ActiveSync Post Office Protocol version 3 (POP3) Internet Message Access Protocol version 4rev1 (IMAP4)

You should know the following about Exchange protocols in relation to Client Access servers:

In previous versions of Exchange, the back-end server could be accessed using MAPI or any Internet protocol (POP3, HTTP, IMAP4). The only protocol used to communicate to a Mailbox server in Exchange 2007 is the MAPI RPC protocol. In Exchange 2007, the Client Access server is responsible for all MAPI access. If a user wishes to use Outlook Web Access then they will use RPC/HTTP (Outlook Anywhere). If a user wishes to use POP3 or IMAP4, they will need to contact the Client Access server.

At least one Client Access server is required in every Exchange 2007 organization. In addition, each site that has a Mailbox server also requires a Client Access server. The Edge Transport server handles all Internet-facing ingoing and outgoing mail flow and provides Simple Mail Transfer Protocol (SMTP) relay and smart host services for the Exchange 2007 organization. You should know the following about Edge Transport servers:

Edge Transport server

In past versions of Exchange, the Exchange server was a domain member but could still be face-to-face with the Internet. If the Exchange server were compromised, the entire domain could be compromised as well. For this reason, the Edge Transport server in Exchange 2007 does not require domain membership, but is designed to be deployed within a perimeter network. The Edge Transport server does not have access to the Active Directory service, but instead runs a service called the Active Directory Application Mode (ADAM) which is a scaled-down, read-only version of Active Directory that can be deployed on a single machine, but does not require the DNS services and the supporting infrastructure that a full Active Directory implementation requires. The Edge Transport server stores all of its configuration in a local database. Agents run on the Edge Transport server which provide protection against spam and viruses and apply rules to overall mail flow control. It is possible to install more than one Edge Transport server in a perimeter network to provide redundancy in case of server failure.

The Edge Sync service makes it possible to set up Active Directory data synchronization between the Hub Transport server and the Edge Transport server. This allows the Hub Transport server to actually contact the Active Directory domain controller and global catalog server to retrieve information such as the recipients for the organization and the accepted domains and connectors, then it populates the information out to the ADAM instance on the Edge Transport server. The Hub Transport server role is responsible for processing and delivering all messages within the Exchange Organization. The Hub Transport server role: Hub Transport server

Is deployed inside the Active Directory service. Is responsible for applying organizational policies. Uses the store driver to: o Deliver mail to recipient's mailboxes within the organization. o Retrieve messages from a user's mailbox and place them in the Submission queue. Determines the routing path for all messages in the organization and routes messages to 104

recipient's mailboxes who reside outside of the organization. Uses the categorizer feature to perform recipient resolution, content conversion, and routing resolution for all messages within the organization.

Unified Messaging allows users to access e-mail, voicemail, calendar information, and fax communications using an e-mail client such as Microsoft Outlook, Outlook Web Access, or a mobile device that has Microsoft Exchange ActiveSync. The Unified Messaging server allows the Exchange organization to connect to a Private Branch eXchange (PBX) system. Unified Messaging integrates voicemail, faxes, and calendars in the following ways:

All e-mail, voicemail, calendar, and fax communications are combined into a single store which is available from a telephone or computer. All voicemails are converted to Windows Media audio files which are sent to the user's Mailbox server and stored as attachments in an e-mail. When a fax is received, the fax can be converted into a .tif file which is saved as an attachment in a user's mailbox.

Users are provided with voice-based access to their mailbox through voice-prompts and queries. This allows users to perform the following tasks over the phone: Unified Messaging server

Access voicemail. Listen to calendar information. Listen, reply, or forward e-mail messages. Access or dial contacts stored in the global address list or their personal contact list. Accept or cancel meeting requests. Set a voicemail out-of-office message. Set personal options and security preferences.

The auto attendant feature allows external users to use the telephone keypad or speech inputs to navigate the Unified Messaging System to locate and/or call a user. It also allows the administrator to perform the following tasks:

Create a set of menus that can be customized for external users. Define schedules for holidays. Explain how to search the organization's directory to connect either directly or by using their extension. Allow external users to call the operator.

Inter-site Routing Facts For delivery of messages within a site, Hub Transport servers send messages directly to the Mailbox, Hub Transport, or Edge Transport server. For delivery of messages between Active Directory sites, Hub Transport servers identify the destination site and queue the message for delivery directly to that site. Hub Transport servers in the destination site receive these messages and forward them to other Hub Transport servers, Edge Transport servers, or Mailbox servers. It is important that you do not confuse the site routing decision with Network-layer routing that takes place to route packets from one destination to another. The purpose of the Exchange routing process is to identify an Active 105

Directory site route to the destination site. Under normal message processing, this site route is not used for relaying messages to the destination site. For example, 1. A Hub Transport server in Site A performs categorization and finds that the destination mailbox is located in Site E. 2. The Hub Transport server identifies the Active Directory site path as Site A-Site B-Site C-Site D-Site E. 3. The Hub Transport server in Site A initiates contact with a Hub Transport server in Site E. 4. The message is sent using normal Network layer routing directly to the Hub Transport server in Site E. Under normal circumstances, Hub Transport servers in sites along the site route do not receive or forward messages. The site route path is only used when direct delivery is not possible or when other special conditions exist. The following table describes three conditions that affect how messages might be relayed in transit. Feature Description After a Hub Transport server identifies the destination Active Directory site, it tries to initiate a connection directly with a Hub Transport server in that site. If a Hub Transport server in that site does not respond, Exchange uses the backoff process to attempt to deliver the message to a Hub Transport server as close to the destination site as possible. When the original delivery fails: 1. The sending server identifies the Active Directory site path to the destination with the lowest overall cost. For example, a message sent from Site A to Site E might identify the optimal path to be Site A-Site B-Site C-Site D-Site E. 2. The server steps backwards through the sites until it finds a site with a Hub Transport server. For example, it will attempt delivery to Site C if a Hub Transport server is not located in Site D. 3. It then attempts to initiate contact with the Hub Transport server in that site. o If successful, the message is delivered to the Hub Transport server in the path. In this example, if a Hub Transport server in Site C responds, the message is forwarded to that server. o If unsuccessful, the server continues to step backwards through the path, contacting Hub Transport servers until one responds. 4. After the message is delivered to an intermediary Hub Transport server, that server performs the categorization process to identify the recipient and the routing information. It queues the message for delivery and attempts to contact a Hub Transport server in the destination site. The goal of this feature is to deliver the message to a Hub Transport server to a site as close to the destination as possible. Once communications with the destination site are restored, the Hub Transport server delivers the message to the site. By default, Hub Transport servers send messages directly to a Hub Transport server in the destination Active Directory site. If there are multiple Hub Transport servers in the site path to the destination, Hub Transport servers along the path do not receive and process those messages unless the site is designated as a hub site. When you designate a hub site, you tell Exchange to forward messages to a Hub Transport server in the hub site instead of forwarding the message directly to the destination site. For example, if the path from Site A to Site E was Site A-Site B-Site C-Site D-Site E, and if Site C was designated as a hub site: 1. The Hub Transport server performs categorization and identifies the route to the destination. 2. Because the route contains a hub site, the server forwards the message to a Hub Transport server in Site C. 3. The Hub Transport server in Site C performs categorization, identifying the destination recipient and the route. 106

Queue at Point of Failure (Backoff)

Hub Sites

4. Because the remaining route does not include a hub site (i.e. Site D is not a hub site), the message is forwarded directly to Site E. Be aware of the following with hub sites:

Use the Set-AdSite cmdlet to designate a hub site. While you can designate any site as a hub site, the site must contain at least one Hub Transport server for messages to stop at the site and be processed before being forwarded. Hub Transport servers in hub sites will only process messages if the lowest cost route includes the hub site. For example, if the lowest cost path from Site A to Site E was Site A-Site F-Site E, and if Site C was designated as a hub site, the message would be sent directly to Site E and would not be routed through the hub site. You might need to designate a hub site when a firewall prevents SMTP communication directly between two Hub Transport servers, or when you want to configure message processing on a specific Hub Transport server for all messages sent between sites. For example, you could force all messages to go through a hub site where specific message restrictions are enforced.

Delayed fan-out is an Exchange 2007 feature that minimizes network traffic for messages that have multiple recipients. When a message with multiple recipients is received at a Hub Transport server, the following process takes place: 1. Each unique recipient is identified. This means that if the recipient is a group, individual group members are identified. 2. The lowest cost site path is calculated for each recipient. 3. To accommodate destinations in different sites, the message must be split (or copied). Delayed fan-out optimizes the splitting process by delaying the split until unique paths in the route are encountered. For example, 1. A user sends a message from Site A to recipients in Site C and Site D. 2. The Hub Transport server in Site A identifies the optimal path to both sites as follows: o To Site C, use Site A-Site B-Site C. o To Site D, use Site A-Site B-Site C-Site D. 3. The Hub Transport server forwards the message to the last shared site in the path. In this example, a single copy of the message is sent to Site C. 4. A Hub Transport server in Site C performs categorization. It splits the message and sends one copy to the Mailbox server within Site C, then forwards a second copy to Site D. 5. A Hub Transport server in Site D receives the message, performs categorization, and forwards it to the appropriate Mailbox server(s) in its site based on the recipient location.

Delayed Fanout

Client Monitoring Facts The following table lists various Management Shell cmdlets you can use to gather statistics for client and server reports: Task Mailbox Server Mailbox statistics Use Get-MailboxStatistics to view information about a specific mailbox, all mailboxes in a database, or all mailboxes on a server. If you use Get-MailboxStatistics with no parameters, it 107 Description

returns information for all mailboxes on all databases on the current server. Information displayed includes:

Number and storage size of items Number and storage size of deleted items Last logon user account with last logon and logoff date and time Client version The server, storage group, and database name If disconnected, the date the mailbox was disconnected Whether the mailbox is below or over the storage limit

Note: The Get-Mailbox cmdlet returns the configuration settings for a mailbox, not information about what is in the mailbox. Mailbox folder statistics Use Get-MailboxFolderStatistics to view information about folders within a specific mailbox such as the number and size of items and the number of subfolders. Use Get-PublicFolderStatistics to view statistics for public folders. Information shown includes: Public folder statistics

Number and storage size of items Number and storage size of deleted items Date and time of creation, last modification, and last access

Use Get-LogonStatistics to view currently active sessions for a recipient, a database, or a server. When used without parameters, shows statistics for all databases on the server. Information shown includes:

Logon statistics

Client MAC address, IP address, adapter speed and client version Currently open messages, folders, and attachments Username, logon time, and last access time Successful number of RPC calls

Note: Outlook Web Access (OWA) continually connects and reconnects as necessary. Running Get-LogonStatistics might not show users connected with OWA, even when there are many active users. Client Access Server Use Get-CASMailbox to view the enabled client access methods for a mailbox. Detailed information available with format-list include: View enabled client access features

E-mail addresses and primary SMTP address List of ActiveSync device IDs and partnerships OWA features that are enabled (calendar, contacts, tasks, notes, spell checker, signatures, public or private computer access) POP and IMAP enabled features

ActiveSync device information

Use Get-ActiveSyncDeviceStatistics to retrieve the list of devices that are configured to synchronize with a specified user's mailbox and return a list of statistics about the devices. You can retrieve statistics for a specific device, or for all devices associated with a mailbox. Information includes:

Device name, model, and operating system Date and time of last attempted and successful synchronization 108

The recovery password for the device

You can also gather statistics using Performance Monitor. You can view current and total statistics, or create a log to capture data over time. The following table lists common objects and counters for monitoring client connections. Object Counters MSExchange ActiveSync applies to the service, can't filter by device. MSExchange ActiveSync

Average request time Current, queued, total, and average requests processed Total number of specific commands processed by ActiveSync (such as Get Item, Send Mail, and Sync)

MSExchangeIS Mailbox gathers statistics about the information store process on a Mailbox server. You can gather statistics for all stores or specific stores. Statistics include: MSExchangeIS Mailbox MSExchangeIS Public

Active and peak number of client logons Average message delivery time Total and average number of messages and recipients Total and average number of reads, writes, and deletes Total and average number of messages submitted by clients or sent to transport servers

The MSExchangeIS Public object reports similar statistics for public folders. MSExchangePop3 gathers statistics about the POP3 service. Statistics include: MSExchangePop3 MSExchangeImap4

Current, failed, and rejected connections Total and active SSL connections Statistics for command rates and failures (commands include AUTH, LIST, QUIT, USER)

The MSExchangeImap4 object reports similar statistics for the IMAP4 service. MSExchange OWA reports overall statistics for all OWA users on a server. Statistics include: MSExchange OWA

Average response time Current and total number of users (you can also get user counts based on Light or Premium OWA) Logons per second Total messages sent

MSExchangeIS Client gathers statistics for Client Access servers. You can gather statistics for a specific client type (such as ActiveSync, POP3, or Outlook Anywhere). Statistics include: MSExchangeIS Client

RPC latency RPC bytes sent and received Database access statistics 109

Note: Most Performance Monitor objects apply to the entire server, not to individual objects such as recipients or mailboxes. Finally, you can use the Exchange Profile Analyzer (EPA) to gather mailbox and client access statistics:

Run EpaCmd.exe or EpaWin.exe to gather statistics about mailboxes. Exchange Server collectors gather statistics about the Exchange mailboxes (such as the number of items, average sizes, number of recipients). Run EpaOWACmd.exe to gather statistics about Outlook Web Access (OWA) access. OWA collectors gather statistics about specific actions (such as logon/logoff, send mail, and edit mail). Run EpaSummarizer.exe to aggregate data from multiple EPA sessions.

Server Monitoring Facts Most server monitoring is done through gathering statistics in Performance Monitor. You can view current and total statistics, or create a log to capture data over time. The following table lists common objects and counters for monitoring server performance related to Exchange. Object(s) Counters MSExchangeTransport Queues reports statistics for queues on a server. In most cases, counters are combined values for all queues on the server. Statistics include:

MSExchangeTransport Queues

Current, average, and total messages queued for delivery in all queues Total and average number of items delivered Number of items queued for delivery that have expired Number of items in the following queues: o All mailbox queues (you cannot filter on specific mailbox queues) o All remote queues o Poison queue o Submission queue o Unreachable queue

MSExchangeTransport SmtpSend reports statistics for sent SMTP messages. You can gather statistics for the entire server, or for messages sent to specific connectors. Statistics include: MSExchangeTransport SmtpSend MSExchangeTransport SmtpReceive

Current, total, and average messages, size, and number of recipients Current, total, and average connections Current, total, and average bytes sent

MSExchangeTransport SmtpReceive reports similar statistics for received SMTP messages. Spam filtering on Edge Transport servers is performed by various filtering MSExchange Connection Filtering Agent agents. Use the counters for the specific filter agents to gather serverwide statistics on spam filtering activities. MSExchange Content Filter Agent MSExchange Recipient Filter Agent MSExchange Sender Filter Agent Use counters for the Connection Filtering agent to gather MSExchange Sender Id Agent statistics about messages that match IP block or allow filters. Use counters for the Content Filter agent to gather statistics 110

about messages scanned, messages passed, and the total number of messages with each SCL rating. Use counters for the Recipient Filter agent to gather statistics about messages blocked by the recipient block list. Use counters for the Sender Filter agent to gather statistics about messages evaluated and filtered based on sender. Use counters for the Sender ID agent to gather statistics about messages marked with various sender ID statuses (such as NonExistent Domain, Malformed Domain, Not Permitted Sender, Neutral, or Pass).

As you gather server information, you might also need to verify server configuration, or identify servers with specific configuration parameters. Use the following Management Shell cmdlets to retrieve configuration information:

Use Get-ExchangeServer to view attributes of all or a specific Exchange server. This cmdlet returns information on all Exchange servers regardless of role. The attributes returned are those common to all Exchange server roles and includes: o The Exchange edition and version number o Roles filled by the server o Active Directory site and OU information Use Get-MailboxServer, Get-ClientAccessServer, or Get-TransportServer to view attributes for servers with a specified role. These cmdlets return attributes specific to the server role, in addition to returning the Exchange version number. Use Get-Mailbox to view mailbox configuration information. Use Get-CASMailbox to view enabled client features and associated settings.

In addition to viewing server information, you can verify the server configuration using the following commands and utilities:

Run the Best Practices Analyzer to examine the server and generate a report of recommended changes to make to the configuration. Run Test-SystemHealth to verify that all necessary services are installed and working based on the configured server roles. Run Test-ServiceHealth to query the roles installed on an Exchange server, then checks the status of the services that have a Startup value of Automatic. Run Test-OutlookWebServices to verify the Autodiscover service settings that are used by Outlook 2007 and some ActiveSync clients. Run Test-WebServicesConnectivity to perform basic operations to test and verify the functionality of Outlook Anywhere and the Exchange Web Services. Run Test-Mailflow on a Mailbox server to verify that the Mailbox server can send a message. You can send messages from a specific mailbox to a destination mailbox on the same or a different Mailbox server. This cmdlet verifies that the Mailbox server and any Hub Transport servers can communicate for mail delivery. On a Client Access server, verify client connectivity using the Test-OwaConnectivity, TestMapiConnectivity, and Test-ActiveSyncConnectivity cmdlets.

Storage Concepts Facts Databases within Exchange are organized as follows: Unit Store Description A store is a database of Exchange information. There are two types of Exchange stores: 111

A Mailbox store holds the information that comprise mailboxes in Exchange 2007, such as data, data definitions, indexes, checksums, and flags. Sent and received e-mails are held in the mailbox store. A Public Folder store holds information that can be shared by users. Messages posted to public folders are held in the public folder store.

A storage group is a collection of stores. There is no limit to the storage group size. All stores in a storage group:

Share the same transaction logs. Are handled by the same instance of the Exchange store.

Storage Group

A Recovery Storage Group (RSG) is a special storage group used for recovering Mailbox stores. With the recovery storage group you can:

Mount mailbox databases and extract data from them. Recover data from a backup or copy of a database without disturbing user access to current data.

Stores and storage groups exist only on Mailbox servers. The number of stores and storage groups your Exchange 2007 server can hold depends on the version of Exchange you're running:

Exchange 2007 Enterprise edition supports up to 50 storage groups and 50 stores. Exchange 2007 Standard edition supports up to 5 storage groups and 5 stores. Both editions support a maximum of five databases per storage group, and all five databases can be mailbox stores. However, the recommended configuration is to place each store in its own storage group. Both editions support only one storage recovery group and one Public Folder store per server.

Stores are made up of various files, as described in the following table: Database File .edb Description An .edb file is located in the actual database itself. All of a user's messages, folders, public folders, contacts, appointment information, etc. is all stored in the .edb file. A .log file is an ESE transaction log file. .log

File Size Can exceed multiple GB.

Log files are used to protect data that has not yet been backed up. Log files are deleted during a full or incremental backup.

All .log files are 1 MB.

.jrs .chk

A .jrs file is a reserve log file which is used to commit any transactions that are still All .jrs files are 1 MB. in memory in the event of the server running out of disk space. A .chk file is used to identify which log files have been committed to the database. The size of .chk file varies from 2-3 KB.

These files are managed by the Extensible Storage Engine (ESE). ESE is a transactional database that writes information into RAM memory and into a log file. Once it is in the log file, it will be written to disk. The ESE takes the following steps to write information into database files: 1. The ESE writes a message into memory RAM when it arrives at the server. 112

2. At the same time that information is written to RAM, it's written into the current .log file. All current log files are named E00.log. The information is written in a sequential format until the log file is full. What happens when the log file is full depends on the type of logging enabled on the storage group. Logging Method Default Logging Circular Logging Description When the E00.log file is full it is renamed and a new log file gets created. This method requires more disk space because there might be multiple log files on the server. This is the recommended configuration to ensure that no data is lost. When the E00.log file is full, the log file is overwritten with a new log file of the same name. This method saves disk space because there is only one log file at a time. However, recovery from a failed server can only be done up to the most recent full backup. Because of this, with circular logging enabled, you should only perform Full backups, and these backups should be very regular.

3. Once it has been committed to the log file, the information is written to the .edb file. 4. The checkpoint file is updated to indicate that the transaction log has been committed to the database. The ESE uses this process to compensate for the different ways in which data is written to database files and log files, such as:

Data is written to an .edb file non-sequentially. Data is written to a .log file from top to bottom sequentially.

Data that is written sequentially is much easier for a disk to read and thus is much faster. For this reason, data is always committed to a log file first before it is written to the database file. The checkpoint file is then updated to indicate that the log file has been used. Storage Design Facts When implementing stores and storage groups, keep in mind the following recommendations: Consideration Recommendations When choosing the disk interface for your Mailbox server, consider the following:

Disk interface

Serial ATA (SATA) are cheap and have large capacity, but are typically unsuited for a server environment. Before implementing SATA as a storage solution, be sure to research the vibration and heat characteristics of the specific drive. Be sure to also use a write caching controller for maximum performance. Small Computer System Interface (SCSI) disks are well suited for Exchange servers. They are faster than SATA disks, but have smaller overall capacity. Serial Attached SCSI (SAS) is a progression of parallel SCSI into a point-to-point serial peripheral interface in which controllers are linked directly to disk drives. SAS offers many advantages over both SCSI and SATA drives. Internet SCSI (iSCSI) is a network-attached storage device that uses Ethernet. iSCSI is the only network-based storage solution supported by Exchange 2007 (other NAS solutions are not supported). When implementing iSCSI, be sure to dedicate the Ethernet communication network to storage only. Fibre Channel creates a storage area network (SAN). Before implementing Fibre Channel, check the hardware documentation for Exchange support.

Disk speed

The number of operations per second is a much more important factor than the basic speed of the 113

disk. In a server environment, the most common action is a user opening an e-mail, which is a rather small operation. For this reason, it's more important to have a disk with high I/O per second capacity instead of a high transfer rate. Stores and storage groups Although you can create more than one store in a storage group, Microsoft recommends that you put each store in its own storage group. For example, if you need five stores, create five storage groups. Place the operating system, pagefile, log file, and database files on different disks. A sample configuration could be as follows:

C:\ = operating system files D:\ = pagefile E:\ = transaction log file F:\ = database files

Disk configuration

If you have multiple stores, put each log file and each database file on a different disk.

Putting the log file and the database file on different disks improves performance. Each file type requires a different disk access method (sequential vs. random). Putting each file on a different disk also allows the system to access multiple stores at the same time. Placing separate files on different disks limits the amount of data loss when a single disk fails.

For both log and database files, implement RAID 0 + 1 for fault tolerance and performance. Disk protection

For transaction logs, you can implement RAID 1 disks with acceptable performance. Using RAID 5 on a disk with a database file actually decreases performance because RAID 5 disks typically require extra time to write parity data to disk. Only consider using RAID 5 if you have small capacity and high speed disks.

The following clustering implementations can be implemented to increase availability of your Exchange 2007 databases:

Replication

Local Continuous Replication (LCR) maintains a copy of the production storage group on a second set of disks that are connected to the same server using built-in asynchronous log shipping and log replay technology. Cluster Continuous Replication (CCR) combines the asynchronous log shipping and replay technology of Exchange 2007 with the failover and management features provided by the Microsoft Windows Cluster service.

Recommended database sizes are as follows:

Database size

100 GB with LCR or CCR implementation 200 GB without LCR or CCR implementation

Splitting large databases into multiple smaller databases is advantageous in situations in which there is a large number of users or service level agreements that require faster restore times. The main disadvantage is the increased complexity in storage design. Exchange Server 2007 is offered in a Standard and Enterprise editions. Design your storage in accordance with the limitations described in the following table: 114

Feature Database Storage Limit Database Support Storage Group Support Local Continuous Replication Single Copy Clusters

Standard Edition 5 databases 5 storage groups Supported Not supported

Enterprise Edition 50 databases 50 storage groups Supported Supported Supported

16 TB per database 16 TB per database

Cluster Continuous Replication Not supported

Transport Policy Facts Transport policies provide an easy, flexible way for administrators to process, filter, store, and modify e-mail messages. Use transport policies to comply with legal or regulatory requirements on controlling or storing e-mail messages, or to enable message handling features to meet your organization's needs. Transport policies are applied to mail messages by a software process (called an agent) running on Hub Transport and Edge Transport servers. Exchange has two agents: Agent Type Description The Transport Rule agent applies filtering rules to e-mail messages. Individual messages are examined by the Transport Rule agent to look for predefined criteria such as: Transport Rule agent

Sender or recipient address Subject or body contents Header information Message size

There are two different Transport Rule agents: the Transport Rule agent runs on Hub Transport servers, and the Edge Rule agent runs on Edge Transport servers. The Journaling agent is responsible for recording all e-mail through a transport server. The e-mail record includes details about each message such as the sender, recipient, and the subject. There are two types of journaling:

Journaling agent

Standard journaling applies journaling actions to a specific mailbox database. For this reason it is also referred to as per-mailbox database journaling. Standard journaling is enabled on each mailbox database by adding a journal recipient. The journal recipient is the recipient who receives journal reports. Premium journaling allows you to apply journaling actions to specific recipients or groups. Premium journaling requires an Exchange Enterprise Client Access License (CAL) and is also called per-recipient journaling.

You configure Transport Rule policies by defining Transport Rules. A Transport Rule consists of the following components:

Conditions identify the characteristics to look for in an e-mail message. Conditions look for a predicate (such as the recipient address or the subject field) and match properties (or values) such as a specific recipient or certain words in the subject line. Exceptions identify characteristics that are excluded, even if the message matches the rule conditions. Like conditions, exceptions match predicates and properties. 115

Actions identify what should take place when a specific mail message matches all of the conditions without matching any exception. Possible actions include: o Logging an event. o Modifying the subject text. o Adding a recipient, CC recipient, or BCC recipient to forward the message to other recipients. o Setting values within the message, such as modifying the header or setting the Spam Confidence Level (SCL). o Rejecting the message (deleting the message and sending a Non-Delivery Report (NDR)). o Deleting the message without an NDR. o Quarantining the message. o Dropping the connection with the sending server.

The easiest way to create Transport Rules is to use the Transport Rules Editor wizard in the Exchange Management Console. Using cmdlets to create Transport Rules requires the following process: 1. Create a variable for each condition, identifying the predicate for the condition. 2. Assign one or more values to each condition variable. The value identifies the property for the predicate that must match. 3. Create a variable for each exception, identifying the predicate for the exception. 4. Assign one or more values to each exception variable. 5. Create a variable for each action, identifying the specific action to take. 6. If the action includes setting a value or modifying message properties, assign values to the action variable. 7. Create the Transport Rule, identifying the condition, exception, and action variables created previously. The following example shows creating a Transport Rule named DrugSpam that sets the Spam Confidence Level (SCL) for messages that match specific words in the subject unless they have come from a specific sender: $myCondition1 = Get-TransportRulePredicate SubjectContains $myCondition1.Words = @("viagra", "meds") $myException1 = GetTransportRulePredicate From $myException1.Addresses = @((Get-Mailbox "Betty Apple")) $myAction1 = Get-TransportRuleAction SetScl $Action.SclValue = 7 New-TransportRule -Name "DrugSpam" -Condition @($myCondition1) -Exception @($myException1) -Action @($myAction1) When managing Transport Rules, be aware of the following:

You can configure Transport Rules for Hub Transport and Edge Transport servers. However, there are differences for available predicates and values for each server type. Transport Rules are applied as part of the categorization process. To prevent rule processing on a server, disable the corresponding agent. o Use the Get-TransportAgent cmdlet to see if the agent is running on the server. o On the Hub Transport server, use Enable-TransportAgent -Identity "Transport Rule agent" to enable the agent. On the Edge Transport server, use Enable-TransportAgent -Identity "Edge Rule agent". o Use Disable-TransportAgent to disable the agent on the server. Configuring a Transport Rule on a Hub Transport server makes the rule available on all Hub Transport servers in the organization. Configuring a rule on an Edge Transport server applies only to that Edge Transport server. In other words, for Hub Transport servers, create the rule once to be available on all Hub Transport servers; for Edge Transport servers, you must create the rule on each applicable server.

116

Enabling, disabling, modifying, or removing Transport Rules on Hub Transport servers performs the action on the rules within the organization. Taking these actions on an Edge Transport server affects only the rules on the Edge Transport server. Use Get-TransportRule to view existing Transport Rules. Use Enable-TransportRule and Disable-TransportRule to enable and disable rules. Disabling a rule prevents it from being applied when the agent runs. By default, rules are enabled when they are created. Use Remove-TransportRule to delete a Transport Rule. Use Set-TransportRule to modify a Transport Rule. Use Export-TransportRuleCollection and Import-TransportRuleCollection to export and import rule collections. For example, use these cmdlets to clone transport rule configurations between Edge Transport servers. By default, Hub Transport servers send messages directly to a Hub Transport server in the destination Active Directory site. If there are multiple Hub Transport servers in the site path to the destination, Hub Transport servers along the path do not receive and process those messages unless the site is designated as a hub site. For example, if the site topology was Site A-Site B-Site C, if Site A sends a message to Site C, transport rules on Site B will not be applied. To force transport rules running on the Hub Transport server in Site B to be applied: o Designate Site B as a hub site (run Set-ADSite). o Make sure the site link costs force messages to use the route that includes Site B. If a condition or an exception uses a distribution group, the group should be created as a universal security group. If you create a rule with no conditions and no exceptions, the rule will be applied to all messages. To match messages with a blank subject line, use ^$ as the string to match. When deploying new rules or modifying existing rules, test rules before deploying them. To use a custom message in the NDR when rejecting messages, you must use a Transport Rule on a Hub Transport server. You cannot use a custom rejection message on Edge Transport servers.

Backup Facts There are two supported methods for accessing backup data in Exchange 2007: Backup method Description Legacy streaming is the traditional method of backup. The backup program included with Windows Server 2003 (NTBackup) is Exchange-aware and is capable of performing a legacy streaming backup of Exchange data. When a legacy streaming backup is initiated: 1. 2. 3. 4. 5. The backup application notifies the database engine that a backup is being started. The database engine creates a file that is used as a marker that the backup is occurring. The backup application freezes the database. The backup application backs up the database. The backup application copies the marker file which contains any additional transactions and log files which took place during the backup.

Legacy Streaming

The main disadvantage of a streaming backup is that it can take several hours to complete, and a full backup might be impossible to complete during the backup window. Volume Shadow Copy Service (VSS) is a component of Windows Server 2003 that takes a point-intime snapshot of files on the disk. By enabling VSS, you can quickly back up and restore files. An Volume Shadow Exchange Server 2007 backup with Volume Shadow Copy services uses the following process: Copy Service (VSS) 1. The backup program runs according to the established schedule. 2. The backup program uses a VSS Requestor to command VSS to make a shadow copy of the designated storage group(s). 117

3. To prepare to make the shadow copy, VSS communicates with the Exchange writer. Exchange performs the following actions: o It prohibits administrative actions against the designated storage groups. o It checks volume dependencies and prohibits write operations to database and transaction log files (but it does allow read-only access). 4. VSS contacts the appropriate storage provider to make the shadow copy of the volume(s) that contain the storage group(s). For an effective solution, this copy is completed within 20 seconds. 5. After completing the shadow copy, VSS contacts the Exchange writer and Exchange returns to its normal operational state. 6. The VSS Requestor verifies the shadow copy before it confirms a successful backup operation to Exchange. The main advantage to VSS is that it allows you to back up a large amount of data in a comparably small amount of time. Be aware of the following when performing backups:

Windows Backup uses legacy streaming to perform backups of Exchange data. You must use a third-party tool to perform VSS backups. Using Windows Backup, you can only back up data at the mailbox store level. You cannot back up individual mailboxes. Some VSS tools allow you to back up individual mailboxes (although backing up the entire mailbox database gets individual mailbox data as well). Because all mailbox stores in a storage group share the same log files, you should back up the entire storage group at once. When you do not back up all of the stores in the storage group, the log files may not be deleted properly. Windows Backup can only back up the active copy of the database. VSS solutions let you also back up the passive copy in a cluster. Legacy streaming backups can only be restored to the same database or to the Recovery Storage Group (RSG). VSS backups can be restored to the same location, a different location on the same server, or to a different server within the same organization. Legacy streaming backups can only restore the entire mailbox database. After the database is restored, you can merge or export selected data. Some VSS backup solutions allow you to restore individual mailboxes. Regardless of the backup tool you use, you can only have one active backup job at a time on a storage group, but you can have different jobs working on different storage groups.

Permissions required for backup are: Task Minimum permissions A basic backup of Exchange data requires membership in the following groups: Basic Exchange Backup and Restore

Backup Operators Local administrator group on the machine from which the backup is run Domain Administrators group

Back Up the System State and Exchange Program Files

A backup of the system state and Exchange Program Files requires membership in the following groups:

Backup Operators in the domain in which Exchange 2007 is installed 118

Local administrator group on the machine from which the backup is run Exchange View-Only Administrator role in the domain in which Exchange 2007 is installed

Exchange Administrator Roles It is possible to have more than one Exchange administrator in your Exchange 2007 organization. To better facilitate the implementation of multiple administrators, Exchange 2007 provides predefined administrator roles that minimize manual permission configuration. The following table describes the predefined roles offered in Exchange 2007 to manage configuration data: Role Description Users who are an Exchange Organization Administrators have the highest level of permissions within the Exchange organization, having full access to modify all Exchange properties and objects in the Exchange organization, including:

Full control as owner over the Exchange organization data in the configuration container in Active Directory and the local Exchange server Administrator group. Full control as owner over the local Exchange server configuration data. Read access to all Active Directory domain users. Write access to all Exchange-specific attributes in all Active Directory domain user containers.

Exchange Organization Administrator

You must be assigned as the Exchange Organization Administrator role to perform any task that will affect the entire organization, including:

Creating the Exchange organization and installing the first Exchange server Changing any global configuration settings Deleting connectors Changing server policies

You should know the following about the Exchange Organization Administrators role:

Setup will add the Exchange Organization Administrators role as a member of the local Administrators group on the computer on which you are installing Exchange. If you install Exchange 2007 on a domain controller, the users in the Exchange Organization Administrators role will have additional Windows permissions that they do not have if you install Exchange 2007 on a computer that is not a domain controller.

Users who are an Exchange View-Only Administrator have read-only access to: Exchange ViewOnly Administrator

The whole Exchange organization tree in the Active Directory configuration container. All the Windows domain containers that have Exchange recipients.

Exchange Recipient Administrator

Users who are an Exchange Recipient Administrator can perform the following functions:

Modify any Exchange property on an Active Directory object, including: o Users 119

Contacts Groups Dynamic distribution lists Public folder objects Manage Unified Messaging mailbox settings and Client Access mailbox settings.
o o o o

Additionally, Exchange Recipient Administrator role gives the following permissions:

Membership in the Exchange View-Only Administrator role. Read access to all the Active Directory Domain User containers that have been prepared for Exchange 2007. Write access to all the Exchange specific attributes on the Domain User containers in Active Directory domains that have been prepared for Exchange 2007.

Users who are an Exchange Server Administrator have permissions to server Exchange configuration data stored on the local server and in Active Directory. Members have the following permissions: Exchange Server Administrator

Members of the Exchange View-Only Administrators role. Full control as owner over the local server configuration data. Local administrator on the computer on which Exchange is installed.

When you assign this role, you designate the Exchange server(s) that the administrator is allowed to manage. Users who are an Exchange Public Folder Administrator have administrative permissions to perform the following tasks related to public folders:

Exchange Public Folder Administrator

Create and delete public folders Mail-enable public folders Manage public folder settings, such as: o Replicas o Quotas o Age limits o Administrative permissions o Client permissions

Note: Users who are an Exchange Public Folder Administrator cannot modify mail recipientrelated properties on public folders, such as proxy addresses. These Exchange Administrator roles (with exception of Exchange Server Administrators) are created in a new Microsoft Exchange security group Organizational Unit (OU).

120