Thursday, 27 February 2014

Exchange 2013 Service Pack 1

The Exchange Team have announced Exchange 2013 SP1 is now available for download! -  Exchange Team Blog

The service pack includes the following enhancements:

  • DLP Policy Tips for Outlook Web App
  • S/MIME support for Outlook Web App
  • Windows 2012 R2 Support for Exchange 2013 SP1
  • Exchange Admin Center Cmdlet logging
  • Edge Transport server role
  • SSL Offloading
  • Enhanced text editor for Outlook Web App
  • Plus many more…

As with previous CUs, SP1 is a full build of Exchange 2013, prior to upgrading or deploy SP1 onto a server, you must update Active Directory!!!

The final build number for Exchange 2013 SP1 is 15.00.0547.032, a full description of the service pack is here – KB2926248

Microsoft Exchange Server 2013 Service Pack 1 (SP1) - Download

the Exchange Team also announced updates for older versions of Exchange

Exchange 2010 SP3 RU5:

Description of Update Rollup 5 for Exchange Server 2010 Service Pack 3 – KB2917508

Update Rollup 5 For Exchange 2010 SP3 (KB2917508) – Download

Exchange 2007 SP3 RU13:

Description of Update Rollup 13 for Exchange Server 2007 Service Pack 3 – KB2917522

Update Rollup 13 for Exchange Server 2007 Service Pack 3 (KB2917522) - Download

Friday, 14 February 2014

Modern Public Folder Migration

There is a lot of information and guides out there about ‘Modern Public Folder” migrations, this post is steps recorded during a live migration of a public folder from Exchange 2007 to Exchange 2013.
 
This blog is to a real world view of migrating public folders to Exchange 2013.
All steps\actions are from the TechNet Article
 

Preparation

Create two folders on your ‘Legacy’ Server called “PFScripts” and “PFMigration”, I choose to keep these on the root of the C:\
Download the migration scripts:
  • Export-PublicFolderStatistics.ps1
  • Export-PublicFolderStatistics.strings.psd1
  • PublicFolderToMailboxMapGenerator.ps1
  • PublicFolderToMailboxMapGenerator.strings.psd1
Download Link

Prepare for Migration

It’s recommend to take a snapshot of the current Public Folder deployment, run the following command to take a snapshot of the original source folder structure:

## Get Public Folder Structure
Get-PublicFolder -Recurse | Export-CliXML C:\PFMigration\Legacy_PFStructure.xml

Run the following command to take a snapshot of public folder statistics of the public folders:

## Get Public Folder Statistics
Get-PublicFolderStatistics | Export-CliXML C:\PFMigration\Legacy_PFStatistics.xml

Run the following command to take a snapshot of the permissions:

## Get Public Folder Permissions
Get-PublicFolder -Recurse | Get-PublicFolderClientPermission | Select-Object Identity,User -ExpandProperty AccessRights | Export-CliXML C:\PFMigration\Legacy_PFPerms.xml

If the name of a public folder contains a backslash “\” the public folders will be created in the parent public folder when migration occurs. Before you migrate its recommend that you rename any public folders that have a backslash in the name.

Locate public folders with a backslash in Exchange 2007 and 2010:

## Public Folder with “\” Exchange 2007
Get-PublicFolderDatabase | ForEach {Get-PublicFolderStatistics -Server $_.Server | Where {$_.Name -like "*\*"}}

## Public Folders with “\” Exchange 2010
Get-PublicFolderStatistics -ResultSize Unlimited | Where {$_.Name -like "*\*"} | Format-List Name, Identity

If and folders are returned it’s recommended to rename them:

## Rename Public Folder
Set-PublicFolder -Identity <public folder identity> -Name <new public folder name>

Make sure there isn’t a previous record of a successful migration. If there is, you’ll need to set that value to $false. If the value is set to $true the migration request will fail.

## Check for previous migration
Get-OrganizationConfig | Format-List PublicFoldersLockedforMigration, PublicFolderMigrationComplete

If the status of the PublicFoldersLockedforMigration or PublicFolderMigrationComplete properties is $true, run the following command to set the value to $false.

## Change PF migration status
Set-OrganizationConfig -PublicFoldersLockedforMigration:$false -PublicFolderMigrationComplete:$false

NOTE: After resetting these properties, you must wait for Exchange to detect the new settings, This may take some time to replicate.

Prerequisites for Exchange 2013

Make sure there are no existing public folder migration request:

## Check Exchange 2013 for migration request
Get-PublicFolderMigrationRequest | Remove-PublicFolderMigrationRequest -Confirm:$false

Confirm there are no public folders on Exchange 2013:

## Check Exchange 2013 has no public folders
Get-Mailbox -PublicFolder
Get-PublicFolder

If public folders are returned, run the following command to remove them:

## Remove Exchange 2013 Public Folders
Get-Mailbox -PublicFolder | Where{$_.IsRootPublicFolderMailbox -eq $false} | Remove-Mailbox -PublicFolder -Force -Confirm:$false
Get-Mailbox -PublicFolder | Remove-Mailbox -PublicFolder -Force -Confirm:$false

Generate the CSV file for migration

On the legacy Exchange server, run the Export-PublicFolderStatistics.ps1 script to create the folder name-to-folder size mapping file:

## Generate CSV file for migration
.\Export-PublicFolderStatistics.ps1 <CSV File Name> <FQDN of source server>

Run the PublicFolderToMailboxMapGenerator.ps1 script to create the public folder-to-mailbox mapping file:

## Exchange 2013 Public Folder mapping
.\PublicFolderToMailboxMapGenerator.ps1 <Maximum mailbox size in bytes> <Folder to size map path> <Folder to mailbox map path>

i.e.

.\PublicFolderToMailboxMapGenerator.ps1 1GB PFStats.csv  FolderToMailbox.csv

Copy the generated file to the Exchange 2013 server

Create the public folder mailboxes on Exchange 2013

Create a new public folder mailbox on 2013:

## Exchange 2013 new public folder
New-Mailbox -PublicFolder <Name> -HoldForMigration:$true

The migration I was working wasn’t very big, so I only required a single public folder mailbox, if you require additional mailboxes run:

## Exchange 2013 additional public folder mailboxes
$numberOfMailboxes = x;
for($index =1 ; $index -le $numberOfMailboxes ; $index++)
{
    $PFMailboxName = "Mailbox"+$index;  if($index -eq 1) {New-Mailbox -PublicFolder $PFMailboxName -HoldForMigration:$true -IsExcludedFromServingHiearchy:$true;}else{NewMailbox-PublicFolder $PFMailboxName -IsExcludedFromServingHierarchy:$true}
}

Public Folder migration

Legacy system public folders such as OWAScratchPad and the schema-root folder subtree in Exchange 2007 won’t be recognized by Exchange 2013 and will be treated as bad items. This will cause the migration to fail. As part of the migration request, you must specify a value for the BadItemLimit parameter. This value will vary depending on the number of public folder databases you have. The following commands will determine how many public folder databases you have and compute the BadItemLimit for the migration request.

## Get 2007 Public Folder
$PublicFolderDatabasesInOrg = @(Get-PublicFolderDatabase)

## Set Bad Items
$BadItemLimitCount = 5 + ($PublicFolderDatabasesInOrg.Count -1)

Start Public folder migration (Exchange 2007):

## Start Public Folder Migration – Exchange 2007
New-PublicFolderMigrationRequest -SourceDatabase (Get-PublicFolderDatabase -Server <Source server name>) -CSVData (Get-Content <Folder to mailbox map path> -Encoding Byte) -BadItemLimit $BadItemLimitCount

Start Public folder migration (Exchange 2010):

## Start Public Folder Migration – Exchange 2010
New-PublicFolderMigrationRequest -SourceDatabase (Get-PublicFolderDatabase -Server <Source server name>) -CSVData (Get-Content <Folder to mailbox map path> -Encoding Byte)

To check the migration has started, run the following command:

## Check public folder migration
Get-PublicFolderMigrationRequest | Get-PublicFolderMigrationRequestStatistics -IncludeReport | Format-List

image

Once the migration reached the AutoSuspended state as shown below, proceed to the next steps, otherwise you must wait as this may take some time based on your PF size.

image

Lock down the public folders on the legacy Exchange server for final migration (Downtime required)

On the legacy Exchange server run the following command:

## Lock Public Folders
Set-OrganizationConfig -PublicFoldersLockedForMigration:$true

Resume\Complete the public folder migration on the Exchange 2013 server, run the following command:

## Complete public folder migration
Set-PublicFolderMigrationRequest -Identity \PublicFolderMigration -PreventCompletion:$false
Resume-PublicFolderMigrationRequest -Identity \PublicFolderMigration

I found once I started the completion process the StatusDetail reported back as StalledDueToMailboxLock:

image

To get this started again I restarted the ‘Information Store’ on the legacy Exchange server:

image

The final status changes you should see are:

image

and

image

Test and unlock

After the final migration has completed, you should test to make sure the public folder hierarchy\permissions\content are correct, create additional folders and post content to folders to confirm folders are working.

To tell a mailbox to look at the new modern folders, run the following command:

## Exchange 2013 set mailbox to modern PF
Set-Mailbox -Identity <Test User> -DefaultPublicFolderMailbox <Public Folder Mailbox Identity>

Once test have been completed and you can confirm public folders are working as they should be, you can unlock the folders for the rest of the organisation, run the following command:

## Exchange 2013 Unlock PF’s
Set-OrganizationConfig -PublicFolderMigrationComplete:$true

Modern public folder migration complete !!!

Disclaimer: All scripts and other PowerShell references on this blog are offered "as is" with no warranty.  While these scripts are tested and working in my environment, it is recommended that you test these scripts in a test environment before using in your production environment.

Monday, 2 December 2013

Upgrade Groups - Universal Groups

Working on site with a customer I was asked if there was a way to upgrade their ‘Distribution Lists’ to be ‘Universal’?

This would be a simple task with a bit of PowerShell I thought…

After a couple of checks with the AD Management PowerShell cmdlets, I decided to use the Quest ActiveRoles Management Shell for Active Directory, I will explain why I used the Quest pack over the standard AD Management cmdlets.

First Stage: Add the Quest PowerShell to your PowerShell command window or script editor (I use the the PowerShell ISE, it makes things a lot easier).

## Add Quest Activeroles AD management
Add-PSSnapin quest.activeroles.admanagement

Second Stage: Create a collection of groups that isn’t a member of any other group (This is the first reason for using Quest), and then upgrade these to ‘Universal’

## Get all groups that are not a member of another group
$DL = Get-QADGroup -SizeLimit 0 | where {($_.PrimarySMTPAddress -ne $Null) -and ($_.MemberOf.count -eq 0)}

ForEach ($member in $DL)
{
    Set-QADGroup $Member -GroupScope Universal -ErrorAction Continue
}

Note: You will see that I have a filter ‘$_.PrimarySMTPAddress -ne $Null’  this was put into the script to get Distribution Lists only, as the Quest Get-QADGroup will get both Distribution and Security groups. This can be simply removed and replaced with ‘where {$_.MemberOf.count -eq 0}’ if you want to upgrade all groups.

I had to do this with my customer because even thou they had separated their Distribution and Security groups, they had a over time created the odd Security group nested into a Distribution group.

Third Stage: Get the ‘Members Of’ the collection from second stage, and put them in an array.

## Get the members of the groups in $DL
$Nest = @()
ForEach ($member in $DL)
{
       $membersof = Get-QADGroupMember -SizeLimit 0 $member -Indirect | where {$_.GroupScope -eq "Global"}
       foreach ($membersofmembersof in $membersof)
       {
              if ($Nest -notcontains $Membersofmembersof)
              {
                     $Nest += $Membersofmembersof
              }
       }
}

Note: This is the other reason I used the Quest cmdlets, as you will see on the cmdlet Get-QADGroupMember I've used the switch –Indirect, this means it will get the members of all the nested groups including the groups that nested to those groups, this has been tested to 9 levels of nesting.

Fourth Stage: Using the array from third stage upgrade the groups to ‘Universal’

## Upgrade groups in $nest
ForEach ($member in $Nest)
{
    Set-QADGroup $Member -GroupScope Universal -ErrorAction Continue
}

Note: this will loop round the array upgrading the groups to ‘Universal’, if gets a group that it can’t upgrade because its a member of a 'Global’ group you will see a message appear:

Set-QADGroup : The server is unwilling to process the request

You will simply need to repeat stage four, until all groups have been upgraded.

This is a working script and maybe updated over time, I’ll let you know of any updates done to the script.

Download Full Script
Quest ActiveRoles Management for Active Directory – Link

Disclaimer: All scripts and other PowerShell references on this blog are offered "as is" with no warranty.  While these scripts are tested and working in my environment, it is recommended that you test these scripts in a test environment before using in your production environment.

Wednesday, 27 November 2013

Exchange Server 2013 Cumulative Update 3

With the Exchange Team announcement last week that Exchange 2013 Service Pack 1 will be coming in early 2014, this is essentially CU4, you knew CU3 announcement was due at any point.
That point was Monday, this cumulative update brings a number of fixes found KB2892464.

This CU can be applied directly to RTM version of 2013, however the Cumulative Update 3 includes Exchange related updates to Active Directory schema and configuration changes.

It is also recommended to prevent installation issues you should ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed.

To verify the policy settings, run the Get-ExecutionPolicy cmdlet from PowerShell on the machine being upgraded, remember to reset once the update has been applied.

The Exchange Team Blog – Source
Description of Cumulative Update 3 for Exchange Server 2013 – KB2892464
Cumulative Update 3 for Exchange Server 2013 (KB2892464) – Download

Saturday, 23 November 2013

Exchange Server 2013 Service Pack 1 Coming in Early 2014

The Microsoft Exchange Server team has announced the upcoming availability of Service Pack 1 for Exchange Server 2013, scheduled for release in “early 2014″.
Service Pack 1 will include:
  • Windows 2012 R2 Support
  • S/MIME support for OWA
  • Edge Transport Role
More details to be released once the Service Pack release date is confirmed.
The Exchange team also said that Service Pack 1 is essentially CU4. Considering we are at CU2 right now that leaves open the question of when CU3 will be released. The Exchange Team Blog – Source

Wednesday, 28 August 2013

Re-Release of Security Update MS13-061

The Exchange Team have re-released the Security Update MS13-061 for Exchange 2013.
Download links for MS13-061:
Read the Q & A on the Exchange Team Blog, for the correct method to apply the Security Update.
The Exchange Team Blog – Source

Monday, 19 August 2013

Road to MCSE Messaging…

To gain a MCSE Messaging, I will first need a MCSA. Which at first glance meant three server exams (410,411 and 412) not having done any server exams was not looking forward to doing these.

Then I noticed on the Microsoft webpage that I’m able to upgrade my MCTIP: Enterprise Messaging Administrator 2010 to MCSA: Windows Server 2012 with a single upgrade exam 70-417.

The content of 70-417 covers the other three exams (410,411 and 412) but doing a single exam rather than three is better, having worked with Windows Server and AD since 2003, just not done the exams.

So first step to MCSE Messaging will be Exam 70-417, just need to find time get my head into a book for some study…