Windows LiveWindows Live™
 
 
Shijaz 的个人资料Technically Speaking日志列表SkyDrive 工具 帮助

日志
    1月29日

    Upgrading address lists created in Exchange Server 2003

    EHLO again.

    Hope you enjoyed my previous post that explains how to upgrade Exchange 2003 recipient policies for use with Exchange Server 2007.

    This post deals with the "art and science" of upgrading Exchange 2003 Address Lists to its Exchange Server 2007 form. I say "art and science" because it can be a little tricky to understand for those who havent worked much on Powershell or any scripting/coding environment.

    If you click on an address list created by Exchange 2003 in the Exchange Management Console, you will receive the following error:

    Unable to edit the specified E-mail address policy. E-mail address policies created with legacy versions of exchange must be upgraded using the 'Set-EmailAddressPolicy' task, with the Exchange 2007 Recipient Filter specified. specified.

    Exchange 2003 Address Lists have a recipient filter that is made up of an LDAP filter. Exchange Server 2007, on the other hand, understands only OPATH filters. The trick is to convert the LDAP filter to an OPATH filter, and this needs to be done manually.

    I'm going to explain this with the help of an example. Lets open an Address List in Exchange 2003 System Manager and examine the LDAP filter:

    (& (& (& (mailnickname=*) ( (& (objectCategory=person) (objectClass=user) (homeMDB=CN=Mega MailStore (EXCH01),CN=SG01,CN=InformationStore,CN=EXCH01,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mydomain,DC=com) ) ) ) ))

    To refresh our brains, this LDAP filter basically creates an Address list out of all users that have a mailbox in the 'Mega MailStore' mailbox store on EXCH01 server.

    Before we convert this LDAP to OPATH, lets write this in a better way:

    (&
    (&
    (&
    (mailnickname=*)
    ( (&
    (objectCategory=person)
    (objectClass=user)
    (homeMDB=CN=Mega MailStore (EXCH01),CN=SG01,CN=InformationStore,CN=EXCH01,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mydomain,DC=com)
    ) )
    )
    )
    )

    Now, carefully change all ampersands (&) to an -and. The ampersands are placed in a prefix fashion in LDAP filter, but in OPATH, its much simpler - you place -and between the two parameters. Similarly, change all equal signs (=) to -eq.

    (RecipientType -eq 'UserMailbox')
    -and
    (Database -eq 'CN=Mega MailStore (EXCH01),CN=SG01,CN=InformationStore,CN=EXCH01,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mydomain,DC=com')

    Notice that I have also replaced the property 'homeMDB' with 'Database'. This kind of change is required to convert LDAP property names to OPATH. You can get a complete list of properties here.

    So, I arrive at my full command:

    Set-AddressList "Mega users" -RecipientFilter { (RecipientType -eq 'UserMailbox') -and (Database -eq 'CN=Mega MailStore (EXCH01),CN=SG01,CN=InformationStore,CN=EXCH01,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mydomain,DC=com') }

    The guys at Microsoft Exchange Team have more to say about conversion from LDAP to OPATH, and is worth a peek.
    17:22 | 添加评论 | 固定链接 | 写入日志

    Upgrading recipient policies created in Exchange 2003

    After installing Exchange Server 2007 Mailbox server into an Exchange Server 2003 organization, you open Exchange Management Console and navigate to Organization Configuration > Hub Transport > Email Address Policies.

    You find all the legacy recipient policies that you created in Exchange 2003 over here, but when you try to edit a recipient policy, you get the following error:


    Unable to edit the specified E-mail address policy. E-mail address policies created with legacy versions of Exchange must be upgraded using the 'Set-EmailAddressPolicy' task, with the Exchange 2007 Recipient Filter specified.

    So just how do you fix your email address policy? Yup, you will need to use Exchange Management Shell, no matter how much you hate it.

    First, lets fix the Default policy using the Set-EmailAddressPolicy cmdlet:

    Set-EmailAddressPolicy "Default Policy" -IncludedRecipients AllRecipients

    Hit 'Y' when you are asked to confirm the upgrade.
    If you have additional recipient policies, you need to upgrade them as required. One important thing to remember is that, in Exchange 2007, you can specify only from the following 'filter' fields, as far as email address policies (recipient policies) are concerned:
    • Department
    • Company
    • CustomAttribute1, CustomAttribute2, ... , CustomAttribute15
    In Exchange 2003, it was possible to define recipient policies from complex LDAP queries, but I see that kind of flexibility is unavailable in Exchange Server 2007. For instance, in Exchange Server 2003, you could create a recipient policy for all users who have mailboxes in a particular mailbox store.

    Anyways, lets upgrade our policy using one of the available tactics - lets say - based on Department. If I have an Exchange 2003 recipient policy that gives all users from the sales department email addresses of the form @sales.mydomain.com, my Set-EmailAddressPolicy command would look like this:

    Set-EmailAddressPolicy "Sales Dept Recipient Policy" -ConditionalDepartment 'Sales' -IncludedRecipients AllRecipients

    Note that I do not need to specify the email address format for upgrading the recipient policy.
    16:19 | 添加评论 | 固定链接 | 写入日志
    1月28日

    When Setup fails: Exchange Server 2007 Mailbox Server Role

    I went ahead to install the mailbox server role on one of the brand new servers commissioned for Exchange Server 2007.

    The prerequisite checks went OK, and setup began doing the 'real stuff'. Happiness was shortlived, because, towards the end setup showed that it failed. The following error was thrown:

    An unexpected error has occurred and a Watson dump is being generated: The Exchange server address list service failed to respond. This could be because of an address list or email address policy configuration error. It was running command '$error.Clear(); $count=0; $ExchangeServers = Get-ExchangeServer -DomainController $RoleDomainController; foreach($server in $ExchangeServers) { if(($server.AdminDisplayVersion.Build -gt 641) -and ($server.IsMailboxServer -eq $true)) { $count++; } } if( $count -eq 1) { Set-OrganizationConfig -DomainController $RoleDomainController; }'.

    I closed the Setup program, and tried to assess what's been done. I could see that Exchange Management Console and Exchange Management Shell have been installed and that I could open both, but I could not edit the existing address lists or recipient policies from Exchange Management Console.

    Upon further investigation, it dawned on me that Exchange Server 2007 does not use LDAP filters for recipient policies! It uses OPATH instead. How to make this change from LDAP to OPATH filters will be discussed in another post, but in order to make this change I need setup to complete successfully, otherwise I get an error that the Address List service is not responding. Now we have a deadlock situation.

    We can trick Exchange 2007 setup into believing that the filter is alright by removing parenthesis "(", ")"and ampersand "&" symbols from the filter. To do this,
    • Open ADSIEDIT
    • Navigate to CN=Configuration, CN=Services, CN=Microsoft Exchange, CN=, CN=Recipient Policies
    • You will find all your Exchange 2000/2003 recipient policies here. Open each and find the purportedSearch attribute. Click Edit to open the value. Note the original value of this field and save it in a notepad file. Then hit the Clear button to change the value to (not set).
    • Do the previous step for each recipient policy
    • Re-run Setup. You will find that setup completes successfully!

    The next question is, what do I do with the original values of purportedSearch? I put them back as they were before setup, so that I can upgrade the policies to Exchange 2007 later without disturbing the current Exchange 2003 users.

    21:14 | 添加评论 | 固定链接 | 写入日志
    1月27日

    A few things to check in AD before moving to Exchange 2007

    Here are a few things to check in your Active Directory before you co-exist Exchange Server 2007 in a Exchange Server 2003 environment.
    • For all your Exchange users and groups, make sure Exchange mailbox alias field does not contain spaces or characters other than a to z (uppercase or lowercase), digits from 0 to 9, !, #, $, %, &, ', *, +, -, /, =, ?, ^, _, `, {, , } or ~. One or more periods may be embedded in an alias, but each one of them should be preceded and followed by at least one of the other characters. The @ symbol is not allowed in an alias.
    • For all your Exchange users, make sure the UserPrincipalName (aka Logon name) is "user@domain.com" and not just "user". I have seent that this problem is usually found on users that are created in Active Directory by Cisco Unity.
    • Make sure your display names do not contain leading or trailing white spaces, i.e. the first and last characters in a display name cannot be a white space.

    Usually these kind of problems are found in large environments where user provisioning is automated by a third party application or script. If any of the above conditions apply, Exchange Management Console (or get-recipient shell command) will warn you of inconsistent Active Directory objects.

    13:19 | 添加评论 | 固定链接 | 写入日志
    1月24日

    Internet Explorer 7 to be distributed via WSUS on February 12

    On February 12, 2008 Microsoft will release the Windows Internet Explorer 7 Installation and Availability update to Windows Server Update Services (WSUS). IE 7.0 will be distributed as an Update Rollup package.

    The update is an installation package that will completely upgrade Windows machines running IE 6.0 to IE 7.0.

    If you have configured WSUS to "auto-approve" Update Rollup packages, IE 7 will be automatically approved for installation after February 12, 2008 and consequently, you may want to take the actions below to manage how and when this update is installed. You will need to take action if:
    • You use WSUS 3.0 to manage updates in your organization.
    • You have Windows XP Service Pack 2 (SP2)-based computers or Windows Server 2003 Service Pack 1 (SP1)-based computers that have Internet Explorer 6 installed.
    • You do not want to upgrade Internet Explorer 6 machines to Windows Internet Explorer 7 at this time.
    • You have configured WSUS to auto-approve Update Rollups for installation.

    See the Microsoft KB article for more information.

    19:49 | 添加评论 | 固定链接 | 写入日志

    Bill Gates' last day at Microsoft

     

     

     


    This is a humorous video of Bill Gates' last day at Microsoft shown during Microsoft CES 2008. Starring Bill Gates, Brian Williams, Steve Ballmer, Matthew McConaughey, Robbie Bach, Jay-Z, Bono, Steven Spielberg, George Clooney, Jon Stewart, Kevin Turner, Hillary Clinton, Barack Obama, Al Gore, Ray Ozzie and Craig Mundie.

    11:03 | 添加评论 | 固定链接 | 写入日志 | Bill Gates
    1月23日

    AutoRuns from SysInternals


    AutoRuns is a Microsoft SysInternals utility that lets you take a deep-down look at what lurks under the hood when your computer/server starts. You can use Autoruns to identify programs that automatically start when your computer starts and you can disable them by unchecking the box.

    This is especially useful when you are trying to boost the startup performance for your system, or even if you're trying to locate some kind of unidentified malware or a spy program. Autoruns categorizes the images into various tabs like logon, IE plugins, Drivers, Winsock providers, etc to help you easily find what you're looking for. The new version also has a tab that displays the Windows Vista gadgets that are loaded at startup.



    I think it's really an awesome tool. You can download Autoruns from the Microsoft SysInternals website.
    10:51 | 添加评论 | 固定链接 | 写入日志 | Utilities
    1月20日

    Exchange Server 2007: Problems during PrepareAD

    I was all set last Thursday to upgrade my Active Directory schema for my Exchange Server 2007 implementation. I opted to use the GUI for installing one of the servers. If all prerequisites are met, the GUI installation normally upgrades the schema and prepares the domain for Exchange Server 2007.

    I ran into a glitch during the preparation process. I got the following error, and the preparation failed:

    CN=All Groups,CN=All Address Lists,CN=Address Lists Container,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=, DC= The object already exists.

    To take a closer look, I ran setup.com from the command line using the /PrepareSchema switch and it was successful. No problem there. Next, I proceeded with the /PrepareAD switch.
    This is where the above error message surfaced.

    I opened up ADSIEDIT and found the above object in the Configuration partition. The All Groups object is an Exchange 2003 view that lists out all the distribution groups in your organization in the GAL. Probably there was some change done to the object which Exchange 2007 Setup did not understand. So, in order to let Exchange 2007 create its own "All Groups" object, I renamed the existing object to "All Groups1".

    The organization preparation process now completed without a glitch, and it created its own "All Groups" container.

    Of course, this will result in two "All Groups" showing up in the GAL in Outlook, so you might want to delete the older one eventually.


    A word of caution here - this post, like all my other posts does not carry any endorsement from Microsoft. This happened to work well for me, and is my based on my belief and understanding of the implications.
    9:45 | 添加评论 | 固定链接 | 写入日志 | Exchange Server

    Windows Vista always logs you on with a temporary profile?

    If you're facing problems logging in with your domain account to Windows Vista computer joined to a domain, and you're wondering why you're always getting logged on with a "temporary profile" on your Windows Vista computer, you need to read this post.

    You've tried it all, deleting and recreating the profile, deleting the C:\users\%username% folder, etc. But the problem still remains.

    This is because your domain user account is a member of either the Guests or Domain Guests local user group in the Windows Vista computer. Remove yourself from the group and feel the magic! :)

    If that doesn't work, here is another tip:

    Open up Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    You will find one entry for each profile. Check the following for the user account in question:
    1. Ensure the key name doesn't end in ".bad"
    2. Ensure the RefCount value is 0
    3. Ensure the State value is 0

    Thanks goes to my colleague Georgee for this tip!
    9:33 | 添加评论 | 固定链接 | 写入日志 | Windows Vista
    1月9日

    Opening blocked attachments in Outlook

    Some file extensions are blocked by Microsoft Outlook for the potential damage that they may cause. File types blocked include EXE, COM, MDB and many others.

    Outlook displays a message that it has blocked the attachment:


    Sometimes it becomes necessary to "unblock" a particular file extension. One of the most common requests is to unblock Access database files (*.mdb). Let's see how this can be done:
    1. On the desktop running Outlook, open Registry Editor.
    2. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\xx.x \Outlook\Security where xx.x is your Outlook version number (9.0, 10.0, or 11.0)
    3. Add a new string named Level1Remove
    4. Add value to this string with all the extensions that you want to unblock, separated by a semicolon. (For example: .mdb;.url ) Remember to put the dot before the extension.

    It should, however, be kept in mind that unblocking a particular file type introduces new risk, as the user can also receive a malicious file of the same type from another user or the internet and he/she might inadvertently open it.

    For Outlook 2007, you need to insert the string in the following key HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Outlook\Security. If the key path doesn't exist, you can create it.

    11:23 | 添加评论 | 固定链接 | 写入日志 | Outlook
    1月8日

    No more MSTSC.exe /CONSOLE

     

    Thats' right. No more /console switch on the Windows Remote Desktop Connection tool, MSTSC.exe, starting from Windows XP Service Pack 3, Windows Vista Service Pack 1 and Windows Server 2008.

    This is because of the design enhancements in Windows Vista and Windows Server 2008, by virtue of which you cannot connect to Session 0, which is the default session. Running services and user applications together in Session 0 poses a security risk because services in Session 0 run at elevated privileges and therefore can be targeted by malware that attack by attempting and exploiting a privilege escalation.

    The new generation of the Windows operating system mitigates this security risk by isolating services in Session 0 and making Session 0 non-interactive to the user. In Windows Vista (and Windows Server 2008), only system processes and services run in Session 0. The first user logs on to Session 1. Subsequent users log on to subsequent sessions (Session 2, Session 3 etc). This means that services (like printer drivers loaded by spooler service, UMDF drivers, user/window interactive services, etc) never run in the same session as users' applications and are therefore protected from attacks that originate in application code. [More info]


    Session Zero in Windows XP/Windows Server 2003: The first user logs in to Session Zero itself.


    Session Zero Isolation in Windows XP SP3/Windows Vista SP1/Windows Server 2008: First user's Session is not within Session Zero, a separate session is created, thereby improving security.

    Since there is no longer the ability to connect to Session 0, the /console switch is no longer required. But, what if I want to connect to Session 0 on a Windows Server 2003/XP or earlier machine using RDP 6.1? Let's find out.

    When I typed "mstsc /?" on my Windows Server 2008 machine, these are the options that are available to me:



    Notice that the /console option is not available, but there is a /admin option. The /admin option lets you connect to Session 0 on a remote computer that doesn't have Windows Vista SP1, Windows XP SP3 or Windows Server 2008 or later installed.

    However, if you try to pull the /admin switch on a Windows Server 2008 or Vista SP1 machine, you get an error "An unknown parameter was specified in the computer name field".

    9:51 | 添加评论 | 固定链接 | 写入日志 | Remote Desktop
    1月7日

    Never store PST files on network shares!


    Most administrators think the best way to back up user's Outlook PST files is to store it on a network share and let Outlook connect to it from a file share or mapped drive. This way all PST files are on a central location and backup is easy. Sounds like a nice strategy, doesn't it?

    Don't ever do it. Ever.

    Why? Here are two good reasons:

    1. This can cause your file server to hang!

    Believe it or not, the way Outlook access the PST files is aggressive. Let's take an example. Early in the morning, some user sends out an email to 500 employees in your company. Some of these 500 users may need to extend their PST file in order to accomodate the incoming email message. To extend a PST, an extra allocation on the disk has to be made via NTFS. During this process, the whole volume is locked out while free space is allocated and the Master File Table (MFT) is updated. While this is happening for one user, all I/O for the other 499 users is on hold. This includes other users' PST files as well as ordinary file shares on the same volume!

    Now imagine if each user had multiple PST files! The disks get overloaded and the server suffers from serious performance issues. The queues for writing data to disk build up. This ultimately amounts to a server hang or PagedPool memory depletion!

    2. It's not supported

    In case you were thinking - NO, it isn't supported by Microsoft for you to store PST files on network shares. This restriction is not new, and has been around since Microsoft Exchange 4.0. This means storing PST files on a network share is an unsupported configuration and you will not receive support from Microsoft. For details, see MSKB article 297019.

    Storing PST files on the file server is a very common mistake that administrators make and I thought it would be helpful if I posted it here.
    11:27 | 添加评论 | 固定链接 | 写入日志 | Outlook

    Windows Mobile 7: Is this it?

     
    In his InsideMicrosoft blog, Nathan Weinberg explains in great detail about next version of Windows Mobile, version 7.0.

    In addition to the stylus, iPhone-like touch interface, WM 7.0 will supposedly have one more mode of interaction - you can shake it!

    Nathan claims that this is inside information from his sources. Whether this is legitimate or not, only time can tell - but it sure looks amazing!


    9:08 | 添加评论 | 固定链接 | 写入日志 | Windows Mobile
    1月6日

    Scroll Windows Mobile like the iPhone

    Pointui is an "skin" application developed for Windows Mobile 5.0 and Windows Mobile 6.0. It adds the functionality to detect your "finger swipes" on the surface of Windows Mobile devices instead of the stylus, much like the iPhone.

    Pointui claims to run on any current Windows Mobile hardware. Who would have ever thought this is all just software?!

    Pointui is also a skin that redesigns the interface, gives you a better call log and also re-organizes menus, to make the WM interface easier to use.

    Oh yeah - and guess what?! It's free.
    8:29 | 添加评论 | 固定链接 | 写入日志 | Windows Mobile
    1月2日

    25 years of TCP/IP

     

    The TCP/IP standard for Internet communication, was established as a standard on January 1, 1983. In short, this is the networking technology that the world has been talking on for the past 25 years!

    TCP/IP has been the glue that sticks computers, networks and people together, enabling seamless communication across disparate geographical locations, cultures, climates, languages and regions spanning the entire globe. Over the years, TCP/IP has helped load millions of websites, transport trillions of ideas, thoughts and emotions, news and information across the barriers of time and distance. If it weren't for TCP/IP, the world today would have been very different.

    More on TCP/IP can be seen at http://january-1-tcp-ip.blogspot.com/

    8:49 | 添加评论 | 固定链接 | 写入日志 | TCP/IP
    12月31日

    How to disable the warning message in Windows Vista Remote Desktop Connection

    When you connect to a machine running Windows 2000 or Windows Server 2003 from Windows Vista RDP, you may have noticed the following warning:

    "Remote Desktop cannot verify the identity of the computer you want to connect to."

    This is good, but it's rather annoying to be notified each time you want to connect to a server! To turn off the warning,
    - Open the Remote Desktop Connection application and click Options.
    - On the Advanced tab, select the option Always connect, even if authentication fails.

    11:18 | 添加评论 | 固定链接 | 写入日志 | Remote Desktop
    12月30日

    Ask Uncle Bill for money

    What started out as a blog post regarding Bill Gates' idea to enforce postage stamps on email to reduce spam has now become a bulletin board for desperate people requesting money from the millionaire.

    See it for yourself - this is hilarious!
    http://geekswithblogs.net/tpatel/archive/2004/03/10/2718.aspx

    Thanks Arun, for catching this one!
    13:55 | 添加评论 | 固定链接 | 写入日志 | Bill Gates
    12月24日

    System Center Service Manager: Beta 1

     
    Microsoft System Center Service Manager is Microsoft's Service Desk software, currently in Beta 1. Key focus areas of this product include:
    • Deep integration with existing Microsoft technologies from System Center, Windows, Office, and Visual Studio product families
    • Enabling new scenarios via a powerful self-service portal to reduce helpdesk costs
    • A Configuration Management Database (CMDB) that provides an authoritative view of your managed IT infrastructure and services, including all relevant information about current and desired state, past history and future plans, associated incidents and problems, and related change requests.
    • A core set of automated IT processes that map to the ITIL-based Microsoft Operations Framework (MOF)
    • An extensible platform that enables customers and partners to extend the product with Management Packs and Microsoft Operations Manager

    I downloaded the System Center Service Manager Beta 1 from Microsoft Connect. I am planning to evaluate this product along with Nitrogen, as I mentioned in my earlier post.

    The Beta requires that you install .NET Framework 2.0, a series of hotfixes for .NET 2.0, SharePoint Server 2007, and SQL Server 2005 SP2. You also need to create a Shared Services Provider (SSP) on SharePoint Server 2007 before you can start installation of Service Manager.

    18:44 | 添加评论 | 固定链接 | 写入日志 | System Center Service Manager

    How to make out a Windows 3.1 veteran

     

    You can always tell a Windows 3.1 user by the way he closes a window, even in Windows Vista. A Windows 3.1 user almost always closes a window by double-clicking on the left of the window. That's because, back in the times of Windows 3.1, there was no close button on the right of the window.

    Take a look at the left of a window in Windows 3.1:


    The box with the big dash is called the control box and clicking on it will yield a menu showing options to minimize, maximize and close. Double-clicking on the control box closes the window! And that's where it all began.

    A user can activate the menu by pressing Alt+Spacebar. Why? Because the big dash on the control box is actually a representation of the spacebar. The MDI child window also has a control box, but with a smaller dash. So, how do we activate this menu? Yup, you guessed right - Alt+Hyphen!

    It is rather interesting to note that the 'double-click-on-the-left-to-close' functionality is still available in Windows Vista, and probably forever in every release of Windows. The Alt+Spacebar and the Alt+Hyphen features are still available too, even though the control boxes don't bear the dashes anymore. As for me, yes, I do close windows from the left at times. Ahem.

    13:40 | 添加评论 | 固定链接 | 写入日志 | Windows 3.x
    12月16日

    An electronic visa for Bahrain

    I'm off to Bahrain on Tuesday to spend the Islamic festival of Eid Al Adha with family & friends. Being an Indian resident of the UAE, I will need a visit visa to enter Bahrain.

    I was delighted to know that a Bahrain visit visa's can be applied for and received over the internet! The Bahrain government has taken a great step forward in simplifying the visa application process and making it available online.

    You simply visit the Bahrain eVisa website, enter the required passport information, make sure that you meet the eligibility and submit your application. The fees for issuing the visa is paid online by credit card. Within 3 days, the authorities will verify your application and you can print your visa online. Bon voyage!



    Eid Mubarak!

    15:28 | 添加评论 | 固定链接 | 写入日志