Nuttin but Exchange

My Blog is Moving…

2010-05-03T09:23:00.001-05:00

I know there are like 2 people (including myself) that actually read this blog, but due to the Spam filters that hate blogspot.com and because of a bit better flexibility found elsewhere, I will be moving this blog to WordPress.com very soon. My new blog is located at http://ExchangeRanger.WordPress.com.

Feel free to subscribe to this in your favorite RSS reader by using the link http://ExchangeRanger.WordPress.com/feed.

Tests Prove: Windows 2008 R2 Much Better for Exchange 2010!

2010-05-03T09:17:00.001-05:00

Well, Microsoft has just released a new blog post showing their test results comparing Windows 2008 SP2 and Windows 2008 R2 and Exchange 2010 when under an Outlook Anywhere load. Lets face it, Outlook Anywhere is the way of the future! I know for me, I have to be able to work anywhere, anytime, and I don’t want to worry about VPN solutions and firewalls, so Outlook Anywhere is the answer.

So, how does R2 help you say? It provides 10 times smaller CPU usage for the same number and type of OA users, thanks how. This appears to be due to the significant performance improvements made to the RPC/HTTP feature in R2. And in case your wondering, this should also benefit Exchange 2007 SP3 (when it becomes publicly available).

Another way to look at this, as pointed out by the Microsoft blog post is that using identical hardware for both OS versions, R2 supported 14,000 OA users, while SP2 only supported 6,500!

Check out the source at: http://msexchangeteam.com/archive/2010/04/30/454805.aspx

Technorati Tags: Exchange Server 2010,Exchange 2010,Windows Server 2008 R2,Windows 2008 R2,Client Access Server,Exchange CAS,Exchange Performance

Office 2010 RTM’ed

2010-04-19T09:12:00.001-05:00

I received an email from Microsoft last Friday (4/16/10) exclaiming that they have Released to Manufacturing Office 2010. I have been using a pre-release beta for many months since I have been part of the thousands Beta-Testing this release and I can tell you that it is a fantastic product. In the release I have been using, and I mean using every day all day long, I have had no issues to report. I mean none, zero, no crashes, no compatibility problems, no problems at all! I HIGHLY recommend that organizations still stuck on Office 2003 or earlier upgrade immediately once this becomes publicly available. The email from Microsoft is included below, for your enjoyment.

Technorati Tags: Microsoft Office 2010,Office 2010,RTM,Beta,Shipping Party

Exchange 2010 SP1 Coming…

2010-04-08T11:16:00.001-05:00

So, I have been waiting and waiting and waiting to finally start talking about what is coming in Service Pack 1 for Exchange Server 2010. Although the NDA I am held to will not allow me to tell you everything that is coming in SP1, I can still talk a bit about the features already revealed by this EHLO blog article.

First of all, what can we say is coming in SP1?

Feature enhancements to OWA
Mobile user and management improvements
EMC UI enhancements
Online Arching and Discovery enhancements
Server side PST export/import (without Outlook)
Message Records Management (Retention Tagging) tool improvements in EMC
ActiveSync Enhancements including tether-free IRM support
The usual hotfix inclusions
And so many more (that darn NDA!)

There are so many changes and improvements, that I hardly know where to start. So, I will just dive right in and start at the top of this list.

Outlook Web App

This set of changes is the most visible to end users and is a very welcome set of updates. To start with, OWA once again has themes. These themes are many and varied and are selectable right from the main OWA page by clicking on “Options”

Within OWA, you can also select multiple messages for action (similar to Gmail or your iPhone/iPAD). Exchange CAS server will also allow for your browser to pre-fetch message content within OWA so that actions users take will feel instantaneous and will not slow down their browsing experience.

The entire interface has been simplified and cleaned up a lot. I showed the new interface to my children (ages 15 – 7) and they felt right at home in the new interface without much instruction from me at all. One of the most asked about feature in OWA was to once again enable the reading pane to be placed at the bottom or the right side (RTM only enabled the right side). This has been updated in SP1.

Archiving and E-Discovery

To start with, we can now create the Online Archive mailbox on a different database than the users primary mailbox (YEAH!!). This enables us to design the system with tiered storage and availability policies. And to go one step further, if you provision the archive with the intention of consuming the users PST archives, we can now import the PST file directly into the Archive right on the server and without Outlook being installed on the server. Once last note, Microsoft is also planning on releasing an update to Outlook 2007 that will enable it to see and participate in the Online Archives.

On the E-Discovery front, a few changes exist there as well, including search preview and search result de-duplication. Also, when reviewing the search results, you can now add annotations to your review to make your task more efficient.

Archiving and E-Discovery

Since many administrators prefer to use the Exchange Management Console (EMC) instead of Powershell (EMS), Microsoft has placed a great deal of emphasis on UI improvements in SP1 including those in EMC and ECP. Some of the improvements are:

Create/configure Retention Tags + Retention Policies in EMC

Configure Transport Rules in ECP

Configure Journal Rules in ECP

Configure MailTips in ECP

Provision and configure the Personal Archive in ECP

Configure Litigation Hold in ECP & EMC

Configure Allow/Block/Quarantine mobile device policies in ECP

RBAC role management in ECP

Configure Database Availability Group (DAG) IP Addresses and Alternate Witness Server in EMC

Recursive public folder settings management (including permissions) in EMC

Wrap-Up

So, to close this blog post, I have to say that this Service Pack is one of the best ones in recent memory and since I know for a fact that most of what it contains are a direct consequence of the feedback many customers and architects like myself have provided.

I sincerely thank the Exchange Product Group for listening and taking what your customers say to heart and then doing what is needed to make the product that much better.

As time and my NDA permits, I will blog on more features and improvements coming in SP1. Until then, you can look forward to obtaining your own copy of Exchange Server 2010 Service Pack 1 beta around the TechEd timeframe in June.

Technorati Tags: Exchange,Exchange Server 2010,Service Pack,Service Pack 1,SP1,E14 SP1,Exchange Server 2010 Service Pack 1,Exchange Server 2010 SP1

Microsoft Releases Exchange 2010 Installation Guides

2010-04-08T09:58:00.001-05:00

Microsoft has officially released (on 4/7/2010) the Exchange Server 2010 Installation Guide Templates. These are beginning points for organizations to use to create server built procedure documentation. These are well written and a great starting point for any organization to begin their install docs from!

You can download them at: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=5f9dbd88-dadf-4ad9-9f28-ad35a1ab1da2

Free/Busy Federation Troubleshooting

2010-03-18T11:20:00.001-05:00

I have had the pleasure of being the administrator of the very first organization to implement the new Exchange 2010 Free/Busy Federation (from now on I will call it F/B Fed) infrastructure last year during the Exchange 2010 TAP (Technical Adaption Program). In doing so, I have been given the opportunity to work directly with a couple of the Microsoft Exchange Product Group members (thank you Ladislau and Matthias!!!) that guided me through the initial implementation and troubleshooting of Free/Busy Federation when it occasionally went awry. I could probably write a small whitepaper on what I have learned, however for the purposes of this blog post, I wanted to delve into the latest issue I had.

Recently, the public certificate we had been using for OWA, etc… and therefore for F/B Fed was going to expire and the cert vendor had made some changes to the UC certs they offered so we had to make a cert change, not just a renewal. After we installed the new certificate and began using it for all the other web services (OWA, OA, EAS, etc…), we turned to F/B Fed and ran two commands with the intent of rolling to the new certificate.

Set-FederationTrust -Identity MyFederationTrust -Thumbprint <your new cert thumbprint here>

Set-FederationTrust "MyFederationTrust" –PublishFederationCertificate

The problem is, it didn’t work. The new certificate didn’t get rolled to as it should have. Instead, I received the error shown below.

An error occurred accessing Windows Live. Detailed information: "The request failed with HTTP status 403: Forbidden.".

+ CategoryInfo: ResourceUnavailable: (:) [Set-FederationTrust], LiveDomainServicesAccessException

+ FullyQualifiedErrorId: 7CDAC73F,Microsoft.Exchange.Management.SystemConfigurationTasks.SetLiveFederationTrust

Next, I validated that the new certificate was in fact valid and that the certificate was enabled for Server Authentication.

So Far, everything looked ok, but we still couldn’t roll the cert properly and federation had stopped working as well. ARGH..

After a bit more trial and error, it had seemed like the Set-FederationTrust command shown earlier had finally worked, at least it didn’t give me an error when I ran it, however, F/B Fed still wasn’t working and when I ran Test-FederationTrust –Verbose, I received the following error in response.

RunspaceId : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Id         : OrganizationPreviousCertificate
Type       : Error
Message    : Certificate referenced by property OrgPrevPrivCertificate in the FederationTrust object is expired.

With the help of Matthias, I ran the following script in order to attempt to push the old certificate completely out of the Federation system.

$a = Get-FederationTrust

Set-FederationTrust -Identity $a.Identity -Thumbprint $a.OrgPrivCertificate

Set-FederationTrust -Identity $a.Identity –PublishFederationCertificate

Unfortunately, when I ran the second command, I received a new error.

Federation certificate with thumbprint "C54359E291F10213…" must have a unique Subject Key Identifier. The Subject Key Identifier "1A29F0C8C62971EA524BE4…" is already used by the certificate with thumbprint "C54359E291F10213…".

+ CategoryInfo: InvalidArgument: (:) [Set-FederationTrust], ProvisionerConfigException

+ FullyQualifiedErrorId: 4CFC5CA6,Microsoft.Exchange.Management.SystemConfigurationTasks.SetLiveFederationTrust

So, it seemed at the time that the issue was more of a security one due to the beta we are running for Service Pack 1, so we tried a different approach.

$a = get-federationtrust

$b = "LDAP://" + $a.DistinguishedName

$c = [ADSI]$b

If ($c.msExchFedOrgPrevPrivCertificate -ne $null) { $c.PutEx(1, "msExchFedOrgPrevPrivCertificate", 0) }

If ($c.msExchFedOrgPrevCertificate -ne $null) { $c.PutEx(1, "msExchFedOrgPrevCertificate", 0) }

$c.SetInfo()

I ran that script (without error) and waited for AD to replicate. Afterwards, I ran Test-FederationTrust –Verbose again, this time with a slightly different error, yet still related to the “msExchFedOrgPrevPrivCertificate” attribute.

RunspaceId : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Id : OrganizationPreviousCertificate

Type : Error

Message : Unable to find certificate referenced by property OrgPrevPrivCertificate in the FederationTrust object.

Hmmm… that is interesting, now I don’t have a value in that attribute at all! So I checked that by running Get-FederationTrust | fl and sure enough, this attribute was empty from Exchange’s point of view. However, not fully convinced, Ladislau recommended I run the script below just to ensure it really was missing from AD.

$a = get-federationtrust

$b = "LDAP://" + $a.DistinguishedName

$c = [ADSI]$b

$c | fl * -force

And of course, it was actually missing from AD as well….

Come to find out, I had hit a new unknown bug on cert rolling and had to run this final script to set the msExchFedOrgPrevPrivCertificate attribute and get F/B Fed working again.

$a = get-federationtrust

$b = "LDAP://" + $a.DistinguishedName

$c = [ADSI]$b

$c.msExchFedOrgPrevPrivCertificate = $c.msExchFedOrgPrivCertificate

$c.SetInfo()

Now, when I run Test-FederationTrust –Verbose I get a “Success” on all tests! And our users are happy because Free/Busy Federation is once again working as advertised. I hope these little insights are helpful to others when they use their favorite search engine to find answers to their own Federation issues.

Until next time…

Download the updated E2010 Mailbox Server Role Calc!

2010-02-17T21:19:00.001-06:00

Well, the boys in Redmond (thanks Ross and the soon to be Greg) for another fantastic update to the Exchange 2010 ~~Storage~~ Server Role Calculator! There are a bunch of fixes in this version since the release of version 3.5. According to the Version Notes, these include:

Version 3.6 - Fixed Number of Mailboxes per Database (I/O Driven) calculation formula to round down thereby adding additional IO buffer in the max number of mailboxes per database that could be supported in JBOD scenario (Perry Thompson); comment fixes
Version 3.7 - Fixed processor core calculations for secondary datacenter that resulted in error when only lagged copies are deployed; formatting fixes
Version 3.8 - Fixed number of lagged copy server calculation to round (Justin Brown)
Version 3.9 - Fixed required mailbox core CPU calculations to take into account that certain site resilient scenarios result in neither datacenter supporting a single server failure
Version 4.0 - Fixed /DAG LUN Size calculation to calculate based on number of servers and not total number of database copies (Wilfried van Oosterhout)
Version 4.1 - Added better explanation in JBOD scenario when disk selection falls short either via capacity or IO reasons (Jeremy Gagne)
Version 4.2 - Added Restore LUN RAID parity options (Robert Gillies and Rick Shire)
Version 4.3 - Conditional Formatting fixes (Robert Gillies)
Version 4.4 - Added minimum number of global catalog cores (James Reed)
Version 4.5 - Improved formatted capacity calculation formula (Kyryl Perederiy)

Lets just say it is well worth the download! So… What are you waiting for…. http://msexchangeteam.com/files/12/attachments/entry453145.aspx

OCS 2007 R2 Workload Architecture Poster

2010-01-28T22:18:00.001-06:00

I ran into a poster that Microsoft published a few days ago that details the traffic flow of protocols and ports used in each workload within Office Communications Server 2007 R2 (OCS 2007 R2). OCS 2007 R2 supports the following workloads: IM and Presence, Conferencing, Application Sharing, and Enterprise Voice. These filtered views can assist you in architecting your deployment of Communications Server 2007 R2. The different server roles are described along with server certificate requirements. Firewall and DNS configuration requirements are also described.

Get your copy at: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=af2c17cb-207c-4c52-8811-0aca6dfadc94

Newly updated Exchange 2010 Mailbox Requirements Calculator

2010-01-22T20:04:00.001-06:00

Microsoft (thank you Ross and Matt!) have released a much needed update to the Exchange 2010 Mailbox Requirements Calculator.

This version includes the following improvements and new features:

Added processor core guidance for Hub Transport and Client Access server roles.
Added the ability to define a custom number of databases that you would like to implement in the solution.
Added support for 2-node site resilient Database Availability Groups.
Added 1 and 6 processor cores as selectable options.
Improved breakdown of the activation scenarios in a site resilient solution.
Improved breakout of the role requirements section.
The Storage Design tab now indicates that when you select a custom RAID configuration that the calculator ignores RAID-5 and RAID-6 for 5.xK and 7.2K spindles due to performance concerns.
Updated processor utilization results to show the processor utilization even if it is above the recommended threshold.
Made conditional formatting improvements throughout the calculator to warn you when you have a configuration that will not work.
Improved various cell comments.

This version also corrects the following bugs:

Fixed LUN Requirements tables to accurately reflect space requirements when database copies are deployed as each server may not host all database copies.
Fixed conditions that resulted in -1 lagged copies.
Improved the active database copies after first/second server failure calculations:
- We now calculate and expose the worst case scenario (the server that has to host the most active databases) is used in sizing memory and CPU.
- We now ensure that the secondary datacenter calculations only consider double server failures when there are 3+ HA copies located in the secondary datacenter.
Removed maximum memory stipulation in the minimum ESE cache memory calculation.

For more information on this new update: http://msexchangeteam.com/archive/2009/11/09/453117.aspx

You can download the update from: http://msexchangeteam.com/files/12/attachments/entry453145.aspx

Exchange Server 2010 Deployment Assistant Expanded

2010-01-15T09:46:00.001-06:00

In November, Microsoft launched the Exchange Server 2010 Deployment Assistant. In the initial version of the Deployment Assistant, content was available for customers upgrading from Exchange 2003. Microsoft has now announced that they have released content for the following scenarios to http://technet.microsoft.com/exdeploy2010:

Upgrading from Exchange Server 2007
Upgrading from a mixed Exchange Server 2003/2007
New Exchange Server 2010 installation

The Deployment Assistant allows you to create Exchange 2010 deployment instructions that are customized to your environment. The Deployment Assistant asks a small set of questions, and based on your answers, it provides a set of instructions that are designed help you install and complete a basic configuration on Exchange 2010. Instead of reading dozens of topics in the Exchange 2010 Technical library, you simply answer a few questions, and the Deployment Assistant gives you customized content to install Exchange 2010.

I would recommended however that you also read the Technical Library later on as the instructions provided are basic and may not meet all of your needs if you already have an older install of Exchange that isn’t a standard installation or if you have another mail system such as Lotus Domino or GroupWise.

New uses for DiskPart CLI

2010-01-14T22:34:00.001-06:00

So, here I am, reading new email (at 10pm I might add) from within the Exchange Master and Architect Community when I came across a thread started by one of the other long time Exchange Masters (thanks Derrick!) around the topic of using DiskPart for automation. Now, many of us remember using DiskPart or DiskPar in older versions of Exchange when we were running it on Windows 2003 and earlier Operating Systems. We used to use it to align the disk offset with the recommended settings from the disk subsystem manufacturer, often 64 or 128 instead of the default for Windows back then of 63. And to be honest, I haven’t really thought much about DiskPart lately since we don’t require it for Windows 2008 (the default now in Windows is 64 – Yeah!).

As the email pointed out, DiskPart now supports a Command Line Interface (CLI) that can be used for automation of Disk subsystem configuration and management. Way cool eh!?

Microsoft has posted a TechNet article called “DiskPart Command-Line Options”.

So, what is new in the current release of DiskPart? Read on:

1. One nice addition to diskpart scripting file is they finally have the NOERR parameter, so when a single typo dumps you out like before causing the user to create a second file with the fixed entries minus everything that worked. Major Pain.

Ex: assign [{letter=d|mount=path}] [noerr]

2. Format: you can now format from inside Diskpart. So the need for a second script file to Format all those drives is no longer needed.

Ex FORMAT FS=NTFS LABEL="New Volume" QUICK

3. AUTOMOUNT: be careful. This could really mess up clustering (if not in exchange) if used at the wrong time.

How does this make your life simpler? If you have lots of drives, having to do each one manually, creating partitions, then assigning mount points through disk manager UI takes forever. Formatting through the UI (selecting each drive and waiting) also takes forever. Now it all can be done in one place, and you are sure that you are selecting the correct drive for naming since its in the same command set.

To run the answer file with diskpart

C:\DISKPART /s ANSWERFILE.txt

Diskpart answer file example:

select disk 10

online disk noerr

attributes disk clear readonly noerr

create partition primary noerr

select partition 1

assign mount C:\EXCHANGE_MOUNT_POINTS\MDB1 noerr

FORMAT FS=NTFS unit=65536 LABEL="New Volume" QUICK noerr

Results:

Exchange 2007 SP2 RU1 – Raising diagnostic logging for “Message Access” causing calendar issues for users

2010-01-12T12:51:00.001-06:00

Microsoft posted yesterday a new issue that administrators can cause with user calendaring just by increasing the diagnostic logging for “Message Access” to anything other than “Lowest”. This seems to impact Exchange Server 2007 Service Pack 2 implementations up through Roll Up 1. A KB article is not available yet, but appears to be in the works. Based upon this Microsoft EHLO Blog article, the following information has been released on this issue.

What the users may see

Symptoms before applying the pending update:

Access to recurring appointments (which have attachments for the instances) is broken - Outlook in online mode receives an "Item cannot be opened" error.
Sending an embedded message in cached mode results in the attachment being stripped.
Availability is not shown for some users.

The following symptoms may persist, even after applying the update or manually setting the Message Access diagnostic level back to Lowest:

Certain users show no availability information from Outlook or OWA scheduling assistant. Also, event id 4009 for MSExchange Availability is logged on servers with the CAS role

Exception returned:

Microsoft.Exchange.Data.Storage.ObjectNotFoundException: Cannot open embedded message.

Delegates viewing calendars receive the error:

Cannot read on instance of this recurring appointment. Close any open appointments and try again, or recreate the appointment

Messages are sent to ActiveSync devices with the following text:

Microsoft Exchange was unable to send the following items to your mobile device. These items have not been deleted. You should be able to access them using either Outlook or Outlook Web Access.

When accessing Calendar from OWA, the day, week or month viewing will fail with the error:

The item that you attempted to access no longer exists.

We have determined these symptoms are primarily due to calendar items affected between the time logging was increased and when the pending update or workaround is implemented. Recurring calendar items with no end date that have had an occurrence modified seem most susceptible. A quick method to find these visually is to look for the circling arrows with a line through it.

Does this apply to you?

Before the release of the pending update, if any Exchange Server 2007 SP2 server with the Mailbox role has the following new event log level raised from Lowest, this applies to you.

MSExchangeIS\9000 Private\Message Access

How to check your Organization for the problem

You can determine if your MBX servers are at risk by looking in the following places:

1) The new GUI introduced in SP2 - in the Exchange Management Console under Server Configuration, Mailbox, select the server and choose Manage Diagnostic Logging Properties...

2) In the registry for each MBX server [Lowest = 0]

3) Run the following Exchange CMDlet to find all Exchange 2007 MBX servers and this specific diagnostic logging level for Message Access:

Get-MailboxServer | foreach {Get-EventLogLevel -id ($_.name + "\MSExchangeIS\9000 Private\Message Access")}

How to correct the problem

If any MBX server is found to have logging above the default before the pending update is applied, you should reset it to Lowest manually. Note which MBX servers are configured with the non-default level and then run this CMDlet to ensure they are all set to "Lowest"

Then either remount the databases or restart the Information Store service.

Get-MailboxServer | foreach {Set-EventLogLevel -id ($_.name + "\MSExchangeIS\9000 Private\Message Access") -Level "Lowest"}

A sample PowerShell script is available here to track down calendar items contributing to the symptoms that persist after applying the workaround detailed above. This script will identify the day containing problem appointments and can be run against a specific mailbox or all Exchange 2007 mailboxes. The requirements for running the script are detailed in the script comments. The sample script uses the $true argument to enumerate all Exchange 2007 mailboxes and user42@contoso.com to initialize the Autodiscover portion of the Web Services object:

[PS] C:\Powershell\scripts> .\Find-BadCalendarItems.ps1 user42@contoso.com $true
Checking mailbox: user01@contoso.com
Checking mailbox: user02@contoso.com
...
Checking mailbox: user42@contoso.com
Checking mailbox: repro01@contoso.com
Failed: 11/30/2009 - 12/30/2009
Error: Mailbox logon failed., inner exception: Cannot open embedded message.

Day failed: 12/2/2009
Checking mailbox: repro02@contoso.com
Failed : 11/30/2009 - 12/30/2009
Error: Mailbox logon failed., inner exception: Cannot open embedded message.

Day failed: 12/23/2009
Checking mailbox: user43@contoso.com
Checking mailbox: lastuser@contoso.com
Problems found:
repro01@contoso.com: 12/2/2009
repro02@contoso.com: 12/23/2009
Done!

Now that 12/23/2009 has been identified as the problem date for user repro02@contoso.com, you can use Outlook to find any recurring calendar items with no end date that have had an occurrence modified on that day. Copy that occurrence [either to a temporary Calendar folder or even to a different time that day] then delete just that occurrence. Moving the copy back or manually recreating the instance will resolve the symptom for that user.

Happy whatever…

2009-12-30T16:12:00.001-06:00

To All My Liberal Friends and Colleagues:

Please accept with no obligation, implied or implicit, my best wishes for an environmentally conscious, socially responsible, low-stress, non-addictive, gender-neutral celebration of the winter solstice holiday, practiced within the most enjoyable traditions of the religious persuasion of your choice, or secular practices of your choice, with respect for the religious/secular persuasion and/or traditions of others, or their choice not to practice religious or secular traditions at all. I also wish you a fiscally successful, personally fulfilling and medically uncomplicated recognition of the onset of the generally accepted calendar year 2010, but not without due respect for the calendars of choice of other cultures whose contributions to society have helped make America great. Not to imply that America is necessarily greater than any other country nor the only America in the Western Hemisphere. Also, this wish is made without regard to the race, creed, color, age, physical ability, religious faith or sexual preference of the wish.

To My Conservative Friends and Colleagues:

Happy New Year, in the year of our Lord, 2009/2010!!

Exchange 2010 Transport Architecture Diagrams

2009-12-29T21:10:00.001-06:00

The Exchange 2010 transport server role architecture diagrams are now available for download. The Hub Transport Role Architecture diagram can help you understand the different transport components involved in processing and routing messages, the different transport and routing agents that act upon messages and the SMTP events on which they are triggered, and visualize the mail flow.

The Hub Transport Extensibility diagram can help you understand how different transport agents process a message in the Exchange 2010 transport pipeline.

Both diagrams can be downloaded from Microsoft Exchange Server 2010 Transport Server Role Architecture Diagrams.

Note that Exchange 2010 includes internal or built-in transport agents which are not visible when you use the Get-TransportAgent or Get-TransportPipeline cmdlets. The list includes transport agents that implement Information Rights Management (IRM) functionality- the RMS Protocol Decryption agent, Journal Report Decryption agent, RMS Encryption agent, and Prelicensing agent, as well as the Journaling agent. To learn more about transport agents, see Understanding Transport Agents in Exchange 2010 documentation.

It’s Official: RIM/BES Supports Exchange 2010!

2009-12-10T22:36:00.001-06:00

It has been announced on the EHLO Blog yesterday that RIM now fully supports Exchange Server 2010.

In order to enable full support, three updates are required:

Roll-Up 1 (RU1) for Exchange Server 2010
MAPI v6.5.8147
BlackBerry Enterprise Server 5.0.1 Maintenance Release 1 (MR1)

All three of these updates are available to customers of Exchange Server 2010 and BlackBerry Enterprise Server v.5.0 with Service Pack 1 at no cost. BlackBerry Enterprise Server v5.0 Service Pack 1 and Maintenance Release 1 can be found here: http://www.blackberry.com/support/downloads

Additional information on the solution requirements, preparing the BlackBerry environment for Microsoft Exchange Server2010, can be found on the BlackBerry site here.

Today's roll up also includes other minor updates to areas including calendaring, OWA, and transport. You can read more about Exchange Server 2010 RU1 here.

Source: http://msexchangeteam.com/archive/2009/12/09/453486.aspx

Office 2010 Beta Released to the Public

2009-11-17T07:25:00.002-06:00

Office 2010 (or more importantly Outlook 2010) Beta has been released to the public on Technet, MSDN, the Beta Connect site now!

Here are the apps available
Search Server 2010 Express Beta (x64) - (English)
SharePoint Foundation 2010 Beta (x64) - (English)
Office Web Applications Beta (x64) - (English)
Visio Premium 2010 Beta (x64) - (English)
Visio Premium 2010 Beta (x86) - (English)
FAST Search Server 2010 Beta for SharePoint (x64) - (English)
Project Server 2010 Beta (x64) - (English)
Project Professional 2010 Beta (x64) - (English)
Project Professional 2010 Beta (x86) - (English)
Office Professional Plus 2010 Beta (x64) - (English)
Office Professional Plus 2010 Beta (x86) - (English)
SharePoint Designer 2010 Beta (x86 and x64) - (English)
SharePoint Designer 2010 Beta (x86 and x64) - (English)
SharePoint Server 2010 Beta (x64) - (English)
Business Contact Manager for Microsoft Outlook 2010 Beta (x64) - (English)
Business Contact Manager for Microsoft Outlook 2010 Beta (x86) - (English)

These are the new icons…

One of the many new feature changes from the earlier Office 2010 CTP release is the ability to enable color schemes and specifically black. I do like this feature and this color choice since it allows for more emphasis on the document and less on the menus.
MS Word 2010 in Black color scheme

MS Outlook 2010 in Black color scheme

Message Reviewer showing social networking features

This is pretty awesome as it shows you the RSS feeds from this person, the emails received, the attachments they have sent me, the appointments I have with them, and the OCS IM transcripts we have had together. (kinda brings a lot of Xobni into Outlook by default)

I think this download is a great thing for everyone to try out… Come and get it!!!

Exchange 2010 Deployment Assistant

2009-11-10T12:21:00.002-06:00

Microsoft has released an updated "basic" Deployment Assistant to aid organizations with guiding them through the basic process of implementing Exchange 2010 in an existing Exchange 2003 or Exchange 2007 organization as well as a newly created organization. It does give good information for those organizations that are smaller or only needing some basic information. I think it is a good start for those organizations that are complex in nature or for those that do not have very experienced on site engineers. Of course, I might be a bit biased ;-) based upon my consulting background.

The Deployment Assistant is available at http://technet.microsoft.com/exdeployment2010

Exchange Server 2010 Reaches Public Beta

2009-04-14T23:39:00.001-05:00

I can't believe it is finally time for me to openly (well sort of) announce and discuss the Exchange Server 2010 product which has now gone into its first public Beta as of today (04/14/2009). You can now download the public beta at this site! So, let's get down to a few of the features coming in Exchange 2010 (at least those I can opening discuss so far J ).

Exchange 2010 should be in full release mode by the end of the year (according to this PCWorld article)
Rumors have also been floating around the Internet recently that the forthcoming Office 14 (most likely will be Office 2010) will not ship until sometime in calendar year 2010.
- Both product names would seem to be accurate since Microsoft typically names its products after the fiscal year in which they ship, not the calendar year. Microsoft begins its fiscal year each July 1^st.
Microsoft's stated direction for new server products is to release both an On-Promise server solution as well as a hosted service based solution (currently known as BPOS).
It appears that for those existing BPOS customers, they will be given the option of upgrading to the new Exchange 2010 capabilities online starting in the first half of 2010.
When Exchange 2010 ships, it is expected that organizations will be able to support both an On-Premise and a Service or hosted solution seamlessly within the same company. This provides many companies I have worked with in the past the ability to support year round employees "On-Premise" and yet offer a Hosted solution for temporary or seasonal workers. This could very well benefit organizations that have large seasonal work forces that didn't or couldn't move to Exchange because of the cost involved in ramping up servers for the seasonal workers. It will be interesting to see the eventual licensing model that Microsoft chooses to use for this…

With this new version of Exchange, there are a large number of significant changes to the product that I will be discussing in some detail over the next few weeks/months. For now, I will focus on one new feature that enables organizations to create and easily support a more granular administration model. With Exchange Server 2007, Microsoft published White Papers such as Configuring Permissions in Exchange Server 2007 and Exchange 2007 Permissions: Frequently Asked Questions. With Exchange 2010, although no White Papers are yet available, the permission model is much simpler and is based upon the Roles (not the Exchange permission set as it has been in all previous versions of Exchange). For example, an organization might need to grant specific permissions to search and access specific mailboxes if they are a Compliance Officer or Human Resources Manager in the company (according to Julia White, director of the Exchange product management team). What took a great deal of effort in Exchange 2007 and often with only limited success will be done in Exchange 2010 with relative ease.

I am very excited about this Exchange version, more so than I remember being about any other version in the history of Exchange. And yes, for those of you who don't know me, I have been working with and implementing Exchange since the Early Adopter program for Exchange 4.0 (the very first version) and also worked with MS Mail, CC:Mail, and others before that. The Exchange Product Group has come a long way with this product and has really listened to customers with regard to some of the key pain points they experienced in earlier versions of Exchange. The Product Group, in my opinion, has worked hard to resolve these pain points in Exchange 2010, often in very creative ways that I think will "Just work".

In future posts, I will be covering these topics related to Exchange 2010:

Storage goals and design changes
OWA Feature Updates
Management and Permission Changes for users and administrators
Compliance with Exchange 2010
High Availability and Disaster Recovery
Unified Messaging Improvements
Migration to Exchange 2010
Developer API Changes

Stay tuned…

Exchange 14 Web Services Preview

2009-04-01T10:33:00.001-05:00

Ok, so Microsoft finally has release some information I have been dying to talk about with respect to Exchange 14. Microsoft is preparing to release with Exchange 14 a managed API for Exchange Web Services that can be utilized by developers to access Exchange data within mailboxes such as folders, email, calendar, contacts, etc… The Web Services approach is nothing new as it existed in Exchange Server 2007, but most applications written for Exchange Server 2003 or 2007 still used WebDav. Exchange Web Services is the new WebDav. There is already a sample Vista Gadget available today to demonstrate this functionality.

Go here to get more information on Exchange 14 Web Services and the announcement

Here is the PDC2008 presentation on Exchange Web Services Managed API

Go here to read more about the Managed Web Services API from MSDN.

Microsoft makes available Outlook 2007 Pre-SP2 Performance update

2009-03-26T08:29:00.001-05:00

Microsoft has released (in February of this year) a cumulative update for Office that is a pre-release of fixes due in Service Pack 2. I have been running this for a few weeks now and the biggest changes in this update are these:

Outlook Improvements

Improved responsiveness (reduced I/O disk usage and improved UI response time)
Decreased Outlook startup time
GREATLY improved exit/shutdown time (this one is HUGE since it resolves the issue with Outlook not really shutting down when you ask it to).
Improved performance for folder and view changes
General reliability of calendar updates especially in delegate manager scenarios

General Improvements

Reduced Data File Checks (this is noticed when you see the message "The data file <file name> was not closed properly…")
Improved search reliability
Fewer duplicate RSS items
General security improvements

A full list of improvements and fixes included in this update are available at: http://support.microsoft.com/kb/968009/

The update is available on request from this site: http://support.microsoft.com/?kbid=961752

Using PowerShell to Provision Active Directory Users

2009-03-25T08:56:00.001-05:00

In the last two issues of TechNet Magazine, Don Jones of Concentrated Technology, has written about scripting (and therefore automating) the creating of users accounts within Active Directory. He does use the Quest Active Roles PowerShell cmdlets to accomplish his goal, so if you don't have that, some of the details might not work for you as described. However, he does go into good detail on some basics of PowerShell scripting such as using Process blocks, and imputing data into the pipe by way of a csv file. He also includes video demonstrating the techniques. So far, 2 of the 4 parts to this story have been published, so keep watching here or on the TechNet Magazine site for the last 2 parts. All in all, it is worth the read.

Source: Automating User Provisioning, Part 1 and Automating User Provisioning, Part 2

UM and Directory Access

2007-05-04T16:54:00.001-05:00

I ran into an interesting and bizarre issue today when working to set up a new UM server for the Exchange User Group presentation next week. Everything was working well, on an old IBM Thinkpad A30p, except when I tried accessing the Directory using OVA. UM would respond with a short (1 second or less) delay and then say "Sorry I can't help with that" and then hang up. OUCH! Nothing was originally in the event logs that defined the issue. No TAP info or Google query found anything like this. After reading the logs and CHM file again, I still found nothing. I played with changes to the UM settings, OAB settings, added a PF for OAB to rest in (just in case), nothing helped. I turned up event logging levels to medium, then maximum, still nothing.

Finally I turned up logging to level 7 on the different UM aspects and got two event log warnings stating that GAL.CFG and DistributionList.CFG couldn't be found in the path C:\Program files\Microsoft\Exchange Server\UnifiedMessaging\grammar\en. I looked on the install CD and there the files were. I copied the files into the directory from the CD image and the Directory access worked immediately. This was a 32 bit RTM build, so maybe this only happens in 32 bit and not 64 bit.

I will have to try a clean install with SP1 and see if this happens again.

Filling the "Direct Push" Gap for Windows Mobile 2003 Devices

2006-09-22T14:20:00.000-05:00

Similar to the Messaging Security & Feature Pack (MSFP) for Windows Mobile 5.0 devices, RoadSync is now available for Windows Mobile 2003 SE handsets.
• Secure, wireless and "Direct Push" synchronization of corporate e-mail, attachments, calendar and contacts with Microsoft Exchange Server 2003 SP2
• Global Address List (GAL) Look-up
• IT Policies including Remote Wipe & Device Passwords
• Mass Configuration Tool available for faster and more managed deployments
Looks like I may have to dig out one of my old 5600's to give this a test. If someone out there using a 2003se device and exchange, has the chance, give this a shot and let us know what you think. I will try it myself, schedule permitting once I can find a phone to get charged up.

Get the Full Detail from Dataviz

Source: MoDaCo

Updated (ver 8.0) of the MS IT Message Hygiene

2006-09-18T10:42:00.000-05:00

An updated detailed discussion on how Microsoft IT manages the large quantities of unwanted e-mail (a.k.a. spam) and malware-infected messages in its inbound Internet e-mail traffic. The paper documents how Microsoft IT uses Microsoft Exchange Server 2003 technologies, Microsoft Office Outlook 2003, and third-party solutions to both reduce the quantity of spam routed through the corporate messaging infrastructure by filtering at the gateway layer and then remove the threats in remaining messages posed by viruses, worms, and their common distribution vectors, such as file attachments.

Get the updated Version 8.0 here:

http://www.microsoft.com/downloads/details.aspx?familyid=17dc35ad-8ba1-48b1-91f3-563313ee878a&displaylang=en

The Size of UM Messages in Exchange Server 2007

2006-06-29T07:17:00.000-05:00

Recently, Michael Wilson posted this blog entry on the size of UM messages….

When talking about Exchange Server 2007 Unified Messaging (UM), we often get a question: "Just how big will those messages be?"

The size of UM voice messages depends on the size of the attachment that holds the voice data. In turn, the size of the attachment depends on three factors:

(1) the duration of the recording

(2) the audio codec used

(3) the audio storage format

UM uses one of three codecs for creating voice messages: WMA (Windows Media Audio), GSM 06.10 and G.711 PCM Linear. The WMA codec is always stored in Windows Media format (the attachment is a file with a .wma extension). Audio encoded as GSM or PCM is always stored in RIFF/WAVE format (the attachment is a file with a .wav extension).

The graph below shows how the size of the audio depends on the duration, for the three codecs used:

PCM is uncompressed, and therefore occupies the most space at a given duration (just over 160,000 bytes for each 10 seconds of audio). It has the highest audio quality of the three. However, WMA and GSM are both acceptable to the vast majority of listeners.

GSM is compressed (just over 16,000 bytes for each 10 seconds).

WMA is the most highly compressed codec (about 11,000 bytes for each 10 seconds). However, the WMA format has a much larger header section than the WAV format (about 7K, compared to less than 100 bytes). WMA recordings become smaller than GSM recordings for durations of about 15 seconds and above. The average call-answered voice message is about 30 seconds long.

WMA is the default setting. GSM or PCM can be used where interoperability with other platforms is of great importance (the WAV format and GSM codec are widely supported).

More Exchange analyzer TLA's*

2006-06-21T16:23:00.000-05:00

* TLA = Three Letter Acronym

In September 2004, we released the Exchange Best Practices Analyzer (ExBPA). We followed up on this success in November 2005 with the Performance Troubleshooter (ExPTA) and the Disaster Recovery Analyzer (ExDRA). Over recent months we have been working on a new analyzer called the Mailflow Troubleshooter (ExMFA). Looking at our overall tool set, we decided that rather than continue to ship these tools as entirely independent entities, we would unify most of them together under a single umbrella application. This is how the Exchange Troubleshooting Assistant (ExTrA) was born.

ExTrA is essentially a union of ExDRA, ExPTA, and the new ExMFA, with a few additional things thrown in. ExBPA is not currently part of ExTrA. While we may consider this in the future, the current thinking is that ExBPA is a more proactive tool to be run at any time, and the others are more reactive to be run in response to a particular problem occurring. All of our analyzer/troubleshooter tools are built off of the same configuration-driven engine, so combining them together was actually a very simple process that did not require us to do any rewriting of the existing logic. We have essentially just packaged them all together and added a single additional screen that allows you to choose which tool to launch. This first screen has two sections: a set of symptom-based selections, and a set of related functionality selections. The initial symptom-based selections will be for troubleshooting mailflow issues, performance issues, or database issues (such as storage mounting problems). The related functionality will include things like trace control, message tracking search and disaster recovery management (some may be available only for Exchange 2007 servers, however).

Over time, we will be adding to these selections, and creating deeper integration between the components (like ExBPA, ExTrA is configuration driven and will be updated on a regular - probably monthly - basis). Initially, when you select, for example, performance troubleshooting, the experience from that point on will be exactly the same as if you had launched ExPTA independently. We will eventually blur the lines a little bit to make them function more as a whole. For instance, mailflow and performance troubleshoot overlap to some degree. Both areas will eventually branch back to the same symptom/root cause branch when tracking down the same type of problem (i.e. slow mailflow). Another example of this would be if you are troubleshooting a store mounting issue and it concluded a database corruption was the root cause, it would branch automatically over to disaster recovery management to allow you to begin that process seamlessly.

ExTrA is intended to eventually become the one-stop shop for all Exchange troubleshooting needs, and in turn it will get more heavily integrated into the Exchange product itself. We are very excited about releasing this tool, and are committed to following through with it over the upcoming years in the same way we've done with ExBPA in the past.

Now, a little more about the new mailflow troubleshooting functionality we're adding. Like performance, mailflow is controlled by many interacting processes and settings, and when something is not working right discovering the root cause can be quite difficult and requires a good deal of product expertise to do. The mailflow troubleshooter attempts to walk a user through the process by starting with a symptom and working towards root cause. The initial set of symptoms we will deal with are:

·         Non-delivery reports (NDR's) are being received.
·         Mail from an external source is slow or blocked.
·         Mail to an external source is slow or blocked.
·         Mail queues are backing up.

For example, when a remote delivery queue is backing up, the mailflow troubleshooter analyzes DNS for incorrect configurations, checks network connectivity (e.g. black hole routers), throws a series of SMTP commands to remote hosts, diagnoses link state data and more to identify possible root causes. Similarly, different sets of troubleshooting steps are prepared to tackle each symptom.

Like the other troubleshooters, we will be adding more sophistication into the logic over time. New symptoms will be added and more root causes will be automatically identified. We have been beta testing this functionality within our support team, and the early results indicate that this will have as immediate and positive an impact as ExBPA and ExPTA have had.

ExDRA has not yet enjoyed the same kind of success as the other analyzer/troubleshooter tools have had, largely due to the nature of the area it is addressing: disaster recovery. We are investing quite a bit of effort in this area, however, particularly for Exchange 2007. Most of the top Exchange disaster recovery experts at Microsoft are involved in the design and development of this tool. We think the expanded feature set will make this as useful as any of the other tools we have. A couple of examples of new functionality are steps to reset the log generation number, and a set of database repair steps that includes running defrag and isinteg to get the database consistent again. We are also branching out some functionality from this area to do more symptom based analysis, such as identifying root causes of store mounting problems. We are particularly eager to hear from anyone who has experience using this tool and are looking for feedback - both positive and negative - on its effectiveness and what we can do to make it even more useful. If you have such feedback to give, please post a reply to this entry or to our newsgroup at microsoft.public.exchange.tools.

ExPTA development continues apace as well. We are adding more and more sophistication in this area, and this will continue for both the Exchange 2003 scenarios and the new Exchange 2007 scenarios.

There are no major new features coming up in the next release of ExBPA; just more rules, but the next release is going to be fully localized, (for ExBPA only - the other tools will be localized when Exchange 2007 releases). Another thing that is going to be new when Exchange 2007 Beta 2 hits the streets is a new 'Exchange 2007 Readiness Check' scan type. You can run this against your existing Exchange 2000/2003 deployment to find out if there are any changes or decisions that need to be made before Exchange 2007 is introduced. This will allow you to plan for, and implement changes well-ahead of time, giving you a gentle glide-path to deploying Exchange 2007

All of the new functionality discussed here is expected to be released this summer. It should also be a part of the toolbox in Exchange 2007 and available directly from the Exchange Management Console. As I hope is apparent, we are devoting quite a large number of resources into the area of operational support tools here in Exchange, and we hope everyone who uses Exchange is happy with the progress we've made over the past couple of years, and we look forward to continuing this effort. We've gotten a lot of positive feedback on these tools, and that makes it all worthwhile. Thanks for the support.

New Blog test Post

2006-05-25T00:40:00.000-05:00

This is a post from the new Word 2007 Beta 2

Exchange Performance Troubleshooting Analyzer (ExPTA) 1.1 has shipped

2006-04-07T13:36:00.001-05:00

This release of ExPTA includes the following:

1. Perfmon data collection: Collect performance data to log file or analyze previously collected logs. ExPTA can collect for durations between 5 minutes to 8 hours. Collection works remotely. Data is analyzed in 20 minute time ranges, and results are grouped by the time in which the problem occurred. You can analyze logs previously collected by ExPTA or via perfmon. ExPTA will expect that the performance counters listed below are included in any log that is analyzed.

2. Queue thresholds: SMTP Server\Categorizer Queue Length, Epoxy(IMAP)\Queue length, EPOXY(POP3)\Queue length, LDAP times, MSExchangeIS Public\Replication Receive Queue Size, SMTP Server\Remote Queue Length, SMTP Server\Remote Retry Queue Length, SMTP Server\Local Queue Length, Virus scan queue length

3. Network thresholds: Network Interface\Packet Outbound errors, Network Interface\Output Queue Length, Network Interface\Bytes Total/sec

4. LDAP latency checks: MSExchangeDSAccess Domain Controllers\LDAP Search Time and MSExchangeDSAccess Domain Controllers\LDAP Read Time thresholds were added to detect problems due to bottlenecks on the AD server.

5. RPC requests: Max RPC requests, average RPC request thresholds are now dependent on the number of users per server

6. Memory changes: Validate that the Database Cache Size Peak < 1.2 GB. In addition, most of the memory rules have been changed to work off the maximum rather than the average values.

7. Improved reporting: Reporting of results between steps and the summary are now displayed in a consistent fashion, using tabbed pages for the different reports.

Pick up the latest version from here.

Performance counters analyzed by this version of ExPTA:

\Database(Information Store)\Database Cache Size

\Database(Information Store)\Database Page Fault Stalls/sec

\Database(Information Store)\Log Record Stalls/sec

\Database(Information Store)\Log Threads Waiting

\LogicalDisk(*)\Avg. Disk Queue Length

\LogicalDisk(*)\Avg. Disk sec/Read

\LogicalDisk(*)\Avg. Disk sec/Write

\LogicalDisk(*)\Disk Reads/sec

\LogicalDisk(*)\Disk Writes/sec

\Memory()\Available Mbytes

\Memory()\Free System Page Table Entries

\Memory()\Pages/sec

\Memory()\Pool Nonpaged Bytes

\Memory()\Pool Paged Bytes

\MSExchangeIS Mailbox(_Total)\Active Client Logons

\MSExchangeIS Public(_Total)\Active Client Logons

\MSExchangeIS()\Active User Count

\MSExchangeIS()\Exchmem: Number of Additional Heaps

\MSExchangeIS()\Exchmem: Number of heaps with memory errors

\MSExchangeIS()\Exchmem: Number of memory errors

\MSExchangeIS()\RPC Averaged Latency

\MSExchangeIS()\RPC Operations/sec

\MSExchangeIS()\RPC Requests

\MSExchangeIS()\VM Largest Block Size

\MSExchangeIS()\VM Total 16MB Free Blocks

\MSExchangeIS()\VM Total Free Blocks

\MSExchangeIS()\VM Total Large Free Block Bytes

\Paging File(_Total)\% Usage

\Process(*)\% Processor Time

\Process(emsmta)\Private Bytes

\Process(inetinfo)\Private Bytes

\Process(lsass)\Private Bytes

\Process(mad)\Private Bytes

\Process(store)\Private Bytes

\Process(System)\Private Bytes

\Processor(_Total)\% Processor Time

\System()\Context Switches/sec

\System()\Processor Queue Length

\Epoxy(IMAP)\Client Out Queue Length

\Epoxy(IMAP)\Store Out Queue Length

\Epoxy(POP3)\Client Out Queue Length

\Epoxy(POP3)\Store Out Queue Length

\MSExchangeIS Public(_Total)\Replication Receive Queue Size

\SMTP Server(_Total)\Categorizer Queue Length

\SMTP Server(_Total)\Remote Queue Length

\SMTP Server(_Total)\Remote Retry Queue Length

\SMTP Server(_Total)\Local Queue Length

\MSExchangeIS()\Virus Scan Queue Length

\MSExchangeDSAccess Domain Controllers(*)\LDAP Search Time

\MSExchangeDSAccess Domain Controllers(*)\LDAP Read Time

\Network Interface(*)\Output Queue Length

\Network Interface(*)\Current Bandwidth

\Network Interface(*)\Packets Outbound Errors

\Network Interface(*)\Bytes Total/sec

\MSExchangeDSAccess Domain Controllers(*)\LDAP Read calls/Sec

\MSExchangeDSAccess Domain Controllers(*)\LDAP Search calls/Sec

\MSExchangeDSAccess Caches(*)\Cache Hits/Sec

\MSExchangeDSAccess Caches(*)\LDAP Searches/Sec

\MSExchangeIS()\Virus Scan Files Scanned/Sec

\MSExchangeIS()\Virus Scan Files Quarantined/Sec

\MSExchangeIS()\Virus Scan Messages Processed/sec

Hope you like it! Let us know if you have feedback on the tool!

- Nicole Allen

Microsoft Exchange Server Profile Analyzer Web Release 2.5 Now Available

2006-04-07T13:36:00.000-05:00

A while ago, I blogged about Exchange Server Profile Analyzer tool here. We now have some updates!

We are pleased to announce the availability of the Exchange Server Profile Analyzer WR2.5. The new version can be downloaded from the Microsoft Download Center.

List of enhancements included in EPA WR2.5:

- Dumpster collection - EPA now includes message content from mailbox "dumpster" folders when calculating message frequencies. Dumpster folders contain deleted content which has not yet been purged out of the database. The frequency data is reported with and without the additional dumpster content analysis in the output report.

- Message permanently deleted frequency - Because of the our new ability to analyze content in dumpster folders, EPA will now report how often messages are deleted permanently.

- Overall mailbox size reported regardless of time restriction - The calculation of overall mailbox size, rules and folder related statistics is not restricted by timeframe anymore. The timeframe restriction will only be applied to statistics related to individual messages, such as message frequency, attachment, recipient, etc. This change should result in faster EPA analysis runs and also removes the need to potentially run EPA twice against the same environment to gather statistics.

- Timestamp in the log - EPA now shows a time stamp for each entry in the log and console output. This allows tracking of how much time is spent on collecting data from individual mailboxes.

- Immediate data report before Ctrl-C - EPA will save whatever data it collects at the time a scan is cancelled with Ctrl-C to exit from the program for any reason. This feature allows you to still take advantage of any statistics that EPA has collected up to that point.

Feedback is appreciated!!

- Jessie Zhu

ExBPA 2.6 released - many great changes!

2006-04-05T22:03:00.000-05:00

We wanted to announce the new major build of ExBPA that we released today: v2.6 (U.S. English).

We did a lot of work to improve usability of the tool in this release. Here are the major differences and improvements that we have made since ExBPA v2.5:

1. Tabbed reporting interface instead of a drop-down control. Viewing reports is now much more intuitive with this cool reporting structure.

2. Scan types are presented through radio buttons, so the different scan types available are much more obvious.

3. Group by "Issue" option when viewing list reports. For example, if you find that multiple servers are showing the same Error, you can now easily display a list of all servers affected rather than having to manually go through the entire list of items.

4. An ExBPA shell extension which allows you to right-click on an XML in Explorer (or apps like WinZip) and "View with Exchange Server Best Practices Analyzer".

5. ExBPA now works through proxy servers that require authentication.

6. New 'Permission Structure Check' scan type. This iterates through both the domain naming context and Exchange section of the configuration naming context and will notify you if inheritance has been blocked at any level. In addition, ExBPA will also check for inheritance blocks in the configuration naming context during a regular 'Health Check'.

7. Better reporting of cluster resources and groups. In the detailed view, you will now see a great hierarchical display of:

          - Cluster resource groups with current owner

                   - Cluster resources and properties

                             - Dependent resources

                             - Antecedent resources

                             - Possible owners

We have also implemented dependency checks. For example, if the System Attendant is not dependent on every physical disk resource in the same resource group, a warning will be displayed.

8. Very latest rule set, including all the updates made to v2.5, which include the IIS metabase / transport event sink checks. In addition, we have introduced some new rules including:

- If you look in the "Information Items" report, the very first info rule details the version of ExBPA that was used to capture and analyze the data.

- A new object processor that uses DsGetSiteName to ascertain the AD site membership of the Exchange server and all DC/GCs in the DSAccess topology.

- Certificate checking. For every SMTP domain defined, we attempt to obtain the SSL cert. If we find it, we'll check that the principal matches the host name and if the cert is close to expiry (or has already expired).

- For connectivity errors, ExBPA now displays the underlying exception (e.g. Access Denied) in the Error rule itself. You no longer need to manually go through the Run Time log to see the actual error string.

9. All XML files are digitally signed to improve security and prevent tampering/spoofing. On startup, ExBPA will check that a valid signature (and Microsoft certificate) is on each XML. If the XML has been modified, a popup error will be seen and ExBPA will refuse to run.

As usual, to get ExBPA, please go here or just go to www.exbpa.com! The direct download is here.

- Paul Bowden

U.S. Census Bureau buys 500,000 Windows Mobile Devices

2006-04-05T08:08:00.000-05:00

http://www.bloomberg.com/apps/news?pid=10000103&sid=aI7yq3d0SdrY&refer=us

Microsoft Wins Biggest Phone-Software Order, Rivals BlackBerry

April 4 (Bloomberg) -- Microsoft Corp. won its biggest-ever contract for mobile-phone software, an order from the U.S. Census Bureau that covers 500,000 handsets.

Microsoft, the world's biggest software maker, plans to unveil the deal today, general manager Scott Horn said in an interview. Redmond, Washington-based Microsoft expects to increase its mobile unit's sales to $1 billion in one to three years, from $337 million last year, and break the dominance of Research In Motion Ltd.'s BlackBerry.

``Up until now, BlackBerry had the market for themselves,'' Peter Knook, a Microsoft senior vice president, said in an interview. ``That landscape has changed.''

Sales of handsets with Windows will double to 20 million units in 2007 as corporate customers opt for those devices instead of the BlackBerry, Knook said. They still would be just a fraction of Microsoft's almost $40 billion in annual sales.

The company declined to disclose the value of the Census Bureau contract for Windows Mobile phones, which can link to the Internet, run Office, read e-mail and play music. Census takers will use them in collecting information door-to-door during the 2010 U.S. census.

Microsoft already won contracts to supply software for Palm Inc.'s Treo and Motorola Inc.'s new Q, after five years of delays and problems with its product.

Playing Catch-Up

It's still an uphill challenge for Microsoft. Researcher IDC expects shipments of Windows-based phones to double in each of the next two years. Even then, the software will account for only 13 percent of the total market, which includes business and consumer users, Framingham, Massachusetts-based IDC said.

``They're nowhere right now,'' said analyst Kevin Burden at IDC. ``RIM is still the mobile enterprise solution that all others should be measured against.''

Research In Motion spokeswoman Marisa Conway declined to comment. The Census Bureau phones will be built by Taiwan's High Tech Computer Corp.

The first sign that Microsoft was cracking the market came in September, when Palm said its new Treo would use Windows, after three years of clandestine meetings. During the project code-named Hendrix, staff referred to Microsoft as Woodstock and Palm as Purple Haze to keep it secret, Knook said. The companies had been rivals, and they didn't want workers to find out too soon.

Close Call

The secret almost came out in March 2004 in a private dining room at Arnaud's Creole restaurant during the CTIA trade show in New Orleans. In the next room, a Microsoft salesman met with phone retailers the companies didn't want to know about the pact, Knook said.

As six executives from Microsoft and Palm sat in the bar pretending not to recognize each other, restaurant workers ran upstairs to shut windows and doors connecting the rooms. Over a platter of oysters, executives hashed out sales, marketing and pricing strategy for the device.

The result: Microsoft won a spot in a device that sapped the strength of BlackBerry. Palm's Treo gained 564,000 users last quarter, almost as many as BlackBerry. Palm doesn't break out how many Treos have Windows. Research In Motion forecast BlackBerry user growth of 620,000 to 630,000 last quarter.

Being in the Treo is ``critical for Microsoft,'' said Page Murray, Palm's vice president of marketing. ``Nobody came out with a terribly viable Windows Mobile device prior to this. There was plenty of hardware out there, but nothing that captured the hearts and minds of people.''

Microsoft shares rose 35 cents to $27.56 yesterday in Nasdaq Stock Market composite trading. They've risen 9.1 percent since the Palm deal was announced.

Motorola Inc., the world's No. 2 mobile-phone maker, was the first company to put the software in phones in the U.S., in 2003. In the next several weeks, Schaumburg, Illinois-based Motorola will begin selling its BlackBerry rival, the Q, with a full keyboard and fast Web access.

Getting it Right

``We had a good understanding that sooner or later Microsoft would get it right,'' said Scott Durchslag, general manager in Motorola's mobile-devices division. ``We thought we could help make it sooner. It was a bet that paid off.''

Some analysts are optimistic. Delivering e-mail to Windows phones will cost less and the devices offer a wider array of features, Forrester Research Inc. analyst Ellen Daley said.

Windows runs 5 percent of high-end devices, which cost $300 or more, at large businesses in North America, she estimated. By 2010, Microsoft may have 60 percent, taking customers from BlackBerry, which now has 80 percent, according to her estimates.

Out of Parking

Knook added 150 people to his staff of more than 2,000 this year. Parking hasn't been able to keep up. With almost two cars for every space, one of his four buildings moved to valet parking.

He wants to enter the consumer market, where he also will fight top handset maker Nokia Oyj, which focused on software for consumer phones and is now also targeting BlackBerry. Espoo, Finland-based Nokia in February bought e-mail software maker Intellisync Corp. and formed a joint venture with Sanyo Electric Co. to improve sales of high-end phones in the U.S.

Knook's group is spending $25 million through June 30 on its first advertising campaign targeted at users. Since February, banners in airports and bus stops in cities from New York to Los Angeles to Paris ask travelers whether that's ``Microsoft Office in your pocket.''

``You may have the best technology, but if you've never told anybody you don't get any credit for it,'' Knook said. ``That's not something you fix overnight.''

Direct Push is just a heartbeat away

2006-04-04T23:10:00.000-05:00

Another good explanation of Direct Push posted at EHLOâ€¦

Background

Exchange 2003 introduced the Always Up To Date notification feature (AUTD) that kept devices up to date by sending SMS triggers to the device. The triggers were sent from the enterprise as SMTP messages to the SMTP front end at the mobile operator. They were then sent through the SMS gateway as SMS messages to the device. This approach had some limitations since not all mobile operators did the SMTP to SMS conversion. Even when they did, there was latency involved with SMS messages and there were end-to-end reliability issues. Also some mobile operators charged for each incoming SMS message so that added an extra dimension to the cost of staying up to date. To alleviate these issues, Exchange 2003 SP2 introduced Direct Push.

Direct Push Architecture

Direct Push is a client initiated HTTP connection to the server where the device opens a connection to the Exchange Server and keeps it alive for a duration known as the heartbeat interval.Â Basically the client sets up the connection, chooses the appropriate heartbeat interval and tears down and reestablishes the connection if and when necessary. The server sends notifications about new items over this connection and the client synchronizes to get the new items.

A new AirSync command called PING has been introduced for Direct Push. This command is sent as part of the POST request from the device.

Summary of Interaction between the client, EAS server and Exchange

1. Device issues a PING command.

2. When the EAS server receives a PING command it does the following:

Ã‚Â·         If the Ping command contains the heartbeat interval or folder list, it stores the information in AUTDSTATE.XML in the user's mailbox. The device does not need to send these parameters up again unless they change.

Ã‚Â·         If the Ping command did not contain the heartbeat or folder list, it retrieves them from the mailbox server.

Ã‚Â·         EAS subscribes to notifications for the folders. It issues DAV subscriptions using the SUBSCRIBE command.

Ã‚Â·         Since there is a small window between the last SYNC and the SUBSCRIBE where changes could have occurred, EAS checks for changes. If there is a change, the server immediately notifies the client to sync by issuing a response to the PING command with a Status of 2. It does an UNSUBSCRIBE to delete the DAV subscription. If no changes have occurred, the server continues to wait for UDP notifications from the mailbox server.

Ã‚Â·         If a notification arrives within the heartbeat interval, the server will inform the client to sync. A response to the PING command is issued with a Status of 2 indicating that there are changes. Otherwise, after the heartbeat interval elapses, the server will return a response to the PING command with a Status of 1 indicating that there are no changes. It does an UNSUBSCRIBE to delete the DAV subscriptions before issuing the PING response.

Deployment Considerations for Direct Push

1. In order to use Direct Push, only the Exchange 2003 Front End servers need to be upgraded to SP2. However it is highly recommended that SP2 be installed on all Exchange Front End and back end servers.Â

If the Front End servers are load balanced, all the Front End servers need to be upgraded around the same time.

2. When there is new mail, the BE sends a UDP notification to the FE.Â Direct Push requires that UDP port 2883 be open from the BE to the FE. The port can be configured using the registry value UDPListenPort under HKLM\SYSTEM\CurrentControlSet\Services\MasSync\Parameters. If this value is set through the registry, the value must be greater than or equal to 1 and less than or equal to 65535.Â

3. With Direct Push, the device keeps a connection open to the Exchange server. If you have a firewall between the device and the Exchange server, you must increase the idle connection timeout on the firewall. Please note that this is the idle connection timeout (i.e.) when there is no data transfer between client and server. For more information, please refer to KB titled "Enterprise firewall configuration for Exchange ActiveSync Direct Push Technology" available at

http://support.microsoft.com/?kbid=905013

4. If you are using ISA 2000, you need to add a registry key on the ISA server to use direct push. Please refer toÂ the KB titled "The ISA Server response to client options requests is limited to a predefined" available at http://support.microsoft.com/?ID=304340 for information on how to add the registry key.

Heartbeat Interval

The device specifies the heartbeat interval as part of the PING command. This dictates how long the server must keep the connection alive. The device will dynamically converge to the highest possible heartbeat interval for a given network, based on the mobile operator timeouts, firewall timeouts etc. The higher the heartbeat interval, the better it is for battery life. So the heartbeat is optimized for a given network.

You can change the minimum and maximum heartbeat interval settings on the server through the registry.

The settings are MinHeartbeatInterval and MaxHeartbeatInterval under

HKLM\SYSTEM\CurrentControlSet\Services\MasSync\Parameters

The defaults are 1 and 45 minutes respectively. Note that the maximum is hard coded to 59 minutes since the maximum possible DAV subscription lifetime is 60 minutes.

You can also specify a heartbeat alert threshold. The server maintains a sliding window of the last 200 heartbeat intervals supplied by clients. If the average from this sample is less than or equal to the alert threshold, there will be a warning in the event log

"The average of the most recent heartbeat intervals used by clients is less than or equal to x. Please check your firewall settings to ensure that they permit requests to Exchange ActiveSync to live for at least 15 minutes."

The alert threshold and sample size can be configured through the registry. The settings are HBiSampleSize and HbiAlertThreshold under

HKLM\SYSTEM\CurrentControlSet\Services\MasSync\Parameters

Configuring Direct Push on the Server

By default, Direct Push is enabled in Exchange 2003 SP2. However you can enable/disable it in Exchange System Manager. In ESM expand Global Settings, right-click on Mobile Services, Properties and check/uncheck the box for "Enable Direct Push over HTTP(S)"

You can also change this setting on a per-user basis using Active Directory Users and Computers.Â In ADU&C, click on the user, Properties, Exchange Features tab, under Mobile Services enable/disable Up-to-Date Notifications. This controls both SMS based AUTD and Direct Push for the user.

Configuring Direct Push on the client

A Direct Push capable device will automatically negotiate the protocol with the server and configure itself to use Direct Push. The sync schedule is set to "As new items arrive".

Direct Push Initialization

1. Verify that Exchange ActiveSync is loaded and IP-based AUTD is initialized by checking the application log on the FE for events below. Exchange Activesync gets initialized on the first sync attempt.

Event Type: Information

Event Source:Â Â Â Â Server ActiveSync

Event Category:Â Â None

Event ID:Â Â 3002

Date:Â Â Â Â Â Â 3/19/2006

Time:Â Â Â Â Â Â 12:44:08 PM

User:Â Â Â Â Â Â N/A

Computer:Â Â 1B25A

Description:

Microsoft Exchange ActiveSync has been loaded: Process ID: [3048].

Event Type: Information

Event Source:Â Â Â Â Server ActiveSync

Event Category:Â Â None

Event ID:Â Â 3025

Date:Â Â Â Â Â Â 3/19/2006

Time:Â Â Â Â Â Â 12:44:19 PM

User:Â Â Â Â Â Â N/A

Computer:Â Â 1B25A

Description:

IP-based AUTD has been initialized.

2. Verify that the FE is listening on port 2883.

To check if the server is listening on the AUTD port, you can run "netstat -ano". Here are results before and after IP-based AUTD has initialized.

Before

ProtoÂ Â Â Â Â Â Local AddressÂ Â Â Â Foreign AddressÂ Â StateÂ Â Â Â Â Â PID

UDPÂ Â Â Â Â Â Â Â 0.0.0.0:1985Â Â Â Â Â *:*Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 1928

UDPÂ Â Â Â Â Â Â Â 0.0.0.0:3456Â Â Â Â Â *:*Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 3356

After

ProtoÂ Â Â Â Â Â Local AddressÂ Â Â Â Foreign AddressÂ Â StateÂ Â Â Â Â Â PID

UDPÂ Â Â Â Â Â Â Â 0.0.0.0:1985Â Â Â Â Â *:*Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 1928

UDPÂ Â Â Â Â Â Â Â 0.0.0.0:2883Â Â Â Â Â *:*Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 3048

UDPÂ Â Â Â Â Â Â Â 0.0.0.0:3456Â Â Â Â Â *:*Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 3356

Netstat provides the Process ID which matches the EAS process per the initialization event in the application log.

Another way to check if the server is listening on the AUTD port is to use PortQry(available on Microsoft.com). This lists the process that is listening on the port

Process ID: 3048 (w3wp.exe)

PIDÂ Â PortÂ Â Â Â Â Â Â Local IPÂ Â Â Â Â Â Â Â Â StateÂ Â Â Â Â Â Â Â Â Â Â Â Remote IP:Port

3048Â TCP 31479Â 172.29.8.222 Â Â Â Â ESTABLISHEDÂ Â Â Â Â Â 172.29.9.107:3268

3048Â TCP 31480Â 172.29.8.222 Â Â Â Â ESTABLISHEDÂ Â Â Â Â Â 172.29.9.107:389

3048Â UDP 2883Â Â 0.0.0.0 Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *:*

Troubleshooting using logs

1. Enable device side logging. The logs are saved in text format in the Windows\ActiveSync folder. PING commands will be logged in "Ping Exchange Server x.txt" where x =1,2,3. You should see commands similar to the one below.

POST Microsoft-Server-ActiveSync?User=administrator&DeviceId=6F24CAD599A5BF1A690246B8C68FAE8D&DeviceType=PocketPC&Cmd=Ping

MS-ASProtocolVersion: 2.5

The POST command is also logged in the IIS log on the FE.

The Ctrl log on the device can also be used to troubleshoot Direct Push although the format of this file may change with device updates.

2. Check the IIS logs on the BE to see if AUTDState.XML is being created or updated. You should see an entry something similar to the one below.

PUT /exchange/Administrator@1b1domain.lab/NON_IPM_SUBTREE/Microsoft-Server-ActiveSync/PocketPC/6F24CAD599A5BF1A690246B8C68FAE8D/AutdState.xml

Note: The AUTDState.XML is created on receipt of the 1^st PING request and is updated only when the heartbeat or folder list changes. So you may not see this command for every Ping request.

AUTD state information is maintained on the mailbox server in the NON_IPM_SUBTREE of each user's mailbox.Â

In IE, you can Choose File, Open, check the box to "Open as Web Folder" and type in

http://server/exchange/user/NON_IPM_SUBTREE/Microsoft-Server-ActiveSync/Autd-State.XML

Sample AUTDState.XML

<?xml version="1.0" encoding="utf-8"?>

-<AutdState xmlns="Ping:">

Â Â <Version>1.0</Version>

Â Â <HeartbeatInterval>680</HeartbeatInterval>

Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â -<Folders>

Â -<Folder>

Â Â Â Â Â Â Â <Id>7529a5b36290aa458b9e1fc2d5ff85a6-3aaa2</Id>

Â Â Â Â Â <Class>Email</Class>

Â Â </Folder>

Â - <Folder>

Â Â Â <Id>7529a5b36290aa458b9e1fc2d5ff85a6-2cfb8</Id>

Â Â Â <Class>Calendar</Class>

Â Â Â </Folder>

Â Ã¢â‚¬Â¦

Â </Folders>

</AutdState>

3. Â Check the IIS logs on the BE to see if SUBSCRIBE commands are being issued from the FE to the BE(ie) if DAV subscriptions are being created.

For example, you should see something similar to

SUBSCRIBE /exchange/Administrator@1b1domain.lab/Inbox/

4. You can run a netmon on the FE to see if UDP notifications are being sent over port 2883 from BE to FE.

551 16.781250 LOCAL 000E0C06CAC0 UDP Src Port: Unknown (33660); Dst Port: Unknown (2883); Length = 162 (0xA2) BE FE IP

UDP: Src Port: Unknown (33660); Dst Port: Unknown (2883); Length = 162 (0xA2)

Â Â Â UDP: Source Port = 0x837C

Â Â Â UDP: Destination Port = 0x0B43

Â Â Â UDP: Total length = 162 (0xA2)

Â Â Â UDP: UDP Checksum = 0xC233

Â Â Â UDP: Data: Number of data bytes remaining = 154 (0x009A)

00000:Â 00 0E 0C 06 CA C0 00 D0 B7 24 86 2B 08 00 45 00Â Â ....ÃƒÅ Ãƒâ‚¬.ÃƒÂÃ‚Â·$Ã¢â‚¬ +..E.

00010:Â 00 B6 C8 73 00 00 80 11 07 3A AC 1D 09 71 AC 1DÂ Â .Ã‚Â¶ÃƒË†s..Ã‚â‚¬..:Ã‚Â¬..qÃ‚Â¬.

00020:Â 08 DE 83 7C 0B 43 00 A2 C2 33 4E 4F 54 49 46 59Â Â .ÃƒÅ¾Ã†â€™|.C.Ã‚Â¢Ãƒâ€š3NOTIFY

00030:Â 20 68 74 74 70 75 3A 2F 2F 31 62 32 35 61 2E 31Â Â Â httpu://1b25a.1

00040:Â 62 31 64 6F 6D 61 69 6E 2E 6C 61 62 3A 32 38 38Â Â b1domain.lab:288

00050:Â 33 2F 33 35 33 39 35 63 65 34 2D 31 35 30 34 2DÂ Â 3/35395ce4-1504-

00060:Â 34 61 63 34 2D 39 37 32 31 2D 66 31 35 32 63 36Â Â 4ac4-9721-f152c6

00070:Â 34 36 65 61 33 35 20 48 54 54 50 2F 31 2E 31 0DÂ Â 46ea35 HTTP/1.1.

00080:Â 0A 53 75 62 73 63 72 69 62 65 2D 67 72 6F 75 70Â Â .Subscribe-group

00090:Â 3A 20 55 73 50 43 57 77 46 4C 32 30 71 37 44 2BÂ Â : UsPCWwFL20q7D+

000A0:Â 6E 61 76 6F 4D 71 79 41 3D 3D 0D 0A 53 75 62 73Â Â navoMqyA==..Subs

000B0:Â 63 72 69 70 74 69 6F 6E 2D 69 64 3A 20 32 37 0DÂ Â cription-id: 27.

000C0:Â 0A 0D 0A 00Â Â Â Â Â Â Â Â

Frequently Asked Questions and Answers

1.    Does Direct Push work for folders other than inbox?

Yes, Direct Push is available for mail folders, Contacts, Calendar and Tasks. The list of folders for Direct Push is the same as the list of folders that have been configured for sync.

2.    What devices support Direct Push?

Windows Mobile 5 devices require the Messaging and Security Feature Pack(MSFP) for Direct Push. MSFP is included with AKU2.2. So any Windows Mobile 5 device that has AKU2.2 supports Direct Push.Â The AirSync protocol has been licensed to several companies such as Palm, Motorola, Nokia, Symbian, Dataviz and SonyEricsson. Please contact the licensees to see if Direct Push capable devices are available.

3.    Is Direct Push supported over Wi-Fi?

No. Direct Push requires a cellular data connection. It is not supported over Wi-Fi or Desktop Passthrough(when the device is cradled).

Due to hardware limitations, Wi-Fi cannot go into standby mode and receive notifications. So in order to support Direct Push over Wi-Fi, the Wi-Fi connection would have to be kept alive which in turn would drain the battery very rapidly.

4.    Does Direct Push work with SecurID?

RSA has an update to their agent to allow it to work with Direct Push. RSA Authentication Agent 5.3 for Web for IIS enables you to use Exchange ActiveSync without having to reauthenticate every time ActiveSync is invoked. For more details, please read this and contact RSA.

5.    Does Direct Push have an impact on server performance?

A typical FE services several thousand connections from clients using OWA, OMA, EAS, and RPC/HTTP clients. Based on the testing done by Microsoft IT, the additional connections opened by Direct Push did not require the deployment of any additional FE or BE servers. It also did not require an upgrade of hardware on existing servers.

For more information please refer to the whitepaper titled "Microsoft IT Scalability Experience with Windows Mobile 2003 and Exchange Server 2003 Mobile Messaging" available at

http://www.microsoft.com/windowsmobile/business/strategy/scalability.mspx

- Vanitha Prabhakaran

Census Bureau to use HTC handhelds in 2010

2006-04-04T23:02:00.000-05:00

For the first census of the 21st Century, the US Census Bureau is finally entering the 20th. In 2010, when the next census is conducted, the agency will use handheld computers, rather than relying on notepads for door-to-door visits. The agency says the plan will keep costs down as well as making the count more accurate. The handhelds will be made by smartphone manufacturer HTC, and will run a version of Windows Mobile. Concerned Census Bureau officials have been assured that the HTC units won't replace their BlackBerrys, and will be used solely for data collection, not as smartphones (despite the fact that, coming from HTC, they'll probably be very capable smartphones with messaging and calling functions turned off for this project). The equipment is expected to be deployed this year or next by Florida-based Harris Corp., which won a $600 million contract to run the field operation. According to Census Bureau officials, the switch from paper to PDA will save money, though the total cost for the 2010 census is still expected to be as much as $12 million, double that of 2000.

View article...

Microsoft Exchange Server 2003 Service Pack 2 (SP2) Help

2006-02-16T16:22:00.000-06:00

Overview

The Exchange Server 2003 Help can help you in the day-to-day administration of Exchange. Use this information to guide you through Exchange Server 2003 features, tasks, and administration procedures. The Exchange Server 2003 Help augments the online articles, books, and release notes about Exchange Server 2003.

Download At http://www.microsoft.com/downloads/details.aspx?familyid=90bdb404-0f9b-4181-96fa-5871d9c26cf4&displaylang=en

Microsoft IT Showcase: IT Security at Microsoft Overview

2006-02-02T19:37:00.000-06:00

Discover the best practices and processes Microsoft IT uses to secure its network. Provides a brief overview of the many aspects of network security; including some of the technologies used to protect against viruses, unapproved access attempts and malicious attacks. Describes the threat analysis and business reasons why certain practices and procedures were put into action.

http://www.microsoft.com/downloads/details.aspx?FamilyID=e959f26c-1f5c-4331-b1fb-6c720795704d&DisplayLang=en

Microsoft IT Showcase: Providing Security for the Network Perimeter at Microsoft

2006-02-02T19:35:00.000-06:00

This article describes how Microsoft improves operational efficiency and productivity for security-enhanced and well-managed infrastructure through the deployment of Microsoft Windows Server 2003, the Active Directory directory service, Public Key Infrastructure (PKI), certification authority (CA), Microsoft Internet Security and Acceleration (ISA) Server 2004, and Microsoft Exchange Server 2003 with Intelligent Message Filter.

http://www.microsoft.com/downloads/details.aspx?FamilyID=ab2e9758-0671-4a8c-958a-b955d30d5677&DisplayLang=en

How does OABGen know what domain controller to connect to?

2006-01-31T11:27:00.000-06:00

Here is an article posted on EHLO by Dave Goldman.

In this article I will explain how the OAB Generation process discovers the domain controller that it will use for rebuilding an Offline Address List. Understanding this process can help you in troubleshooting.

As I have mentioned in other blog posts of mine, the System Attendant (MAD.exe) is the process that is responsible for invoking OABGen.dll (the OAB generation process). This happens one of two ways:

1. Via Schedule

To view the schedule for an Offline Address list you can do the following:

1. Open the ESM (Exchange System Manager)

2. Expand the Recipients Container.

3. Select the Offline Address List Container.

4. In the right hand pane highlight an Offline Address List.

5. Select Properties.

At the bottom of the Properties dialog box you will see an area that shows the Update Interval. This drop-down list box will control when the Offline Address List is generated. The list box will also show several predefined times:

· Run daily as 2:00 am

· Run daily as 3:00 am

· Run daily as 4:00 am

· Run daily as 5:00 am

· Never Run

· Use custom schedule

2. Via the ESM (Exchange System Manager)

1. Open the ESM.

2. Expand the Recipients Container.

3. Select the Offline Address List Container.

4. In the right hand pane right client an Offline Address List.

5. Select "Rebuild".

By selecting "Rebuild" you will force replication to occur. In doing so the System Attendant then becomes responsible for making sure that the selected Offline Address List is rebuilt.

But, the real question here is "how does the System Attendant find the domain controller??"

Well, in order for the OAB Generation process to connect to the Active Directory to make its NSPI queries, it must have a mechanism for doing so. This connection to the Active Directory will be facilitated by a MAPI profile.

What is a MAPI and what is a MAPI Profile?

MAPI stands for Messaging Application Programming Interface.

A MAPI Profile is a named list of message services and configuration data created by a user or service. A profile can contain any number of message services. Profiles will contain a session object and use service providers to do the work on the behalf of the user or system.

A MAPI Session is a period of fixed duration (logon time ---> logoff time) which the work is done. In the context of MAPI, work refers to a series of client requests to MAPI that are services by one or more service providers.

Once a scheduled rebuild or manual rebuild of an offline address list is performed, there are a few things that need to happen before OABGen.dll can even connect to the Active Directory:

1. The system attendant needs to force the Directory Service call to synchronize the Offline Address List.

2. After the Directory Service calls are made necessary security checks will be done to ensure that we have the proper credentials to make this call.

3. After the necessary security checks have been preformed we will make a call to the Active Directory to get the Configuration Domain Controllers DNS name. This is needed so we can obtain information like (Forest Name, Organization, Administrative Groups, Server Name, etc).

4. Once the Configuration Domain Controller's name is obtained a Session Object can be set up.

5. Now try to create one of the Directory Service objects, and read all of the information we need from the active directory (this is the data mentioned above).

6. Make a query to get the name of the offlineABServer.

7. Once the offlineABServer is found, get and use legacyExchangeDN to query that object in the active directory. (Example - "/dc=local/dc=OABGen/cn=Configuration/cn=Services/cn=Microsoft Exchange/cn=OABGen/cn=Administrative Groups/cn=First Administrative Group/cn=Servers/cn=W2K3-E2K3".

8. Next setup our tasks that are necessary for the OAB Generation (profile creation, obtain the public folder information store, etc).

9. Get the server name and add it to the MAPI Session that was previously created.

10. Logon to the Admin portion of the profile (System Attendant profile).

11. Obtain the system directory so we can find out where the MAPISVC.inf file resides.

12. Read in the service specific settings from the MAPISVC.inf file so the profile can be configured.

13. Check to see if we are a domain controller or not.

14. Get the mailbox name for this profile - "/o=OABGen/ou=First Administrative Group/cn=Configuration/cn=Servers/cn=W2K3-E2K3/cn=Microsoft System Attendant"

15. Now log profile on to our session object using the MAPILogonEx API. For more information on the MAPILogonEx API please refer to: http://msdn.microsoft.com/library/en-us/mapi/html/9764438a-0e36-4124-af1e-8296759ed216.asp

16. Open the Address Book provider by creating a new IAB interface object.

17. Associate this Address Book with this MAPI session.

18. Load all of our necessary providers here for the profile.

19. Open the profile sections and also initialize emsabp.dll.

20. Load the Address Book data.

21. Look up the AB Server that will be responsible for holding the Offline Address List.

Here is where the magic is:

22. Check to see if the Address Book server can be contacted and is online. If we find that we are online then we need to Logon to the Directory Service.

23. Check to see if this server is an Exchange 2000 server.

24. Check the registry to see if we are hard coding the profile by using the following registry key [HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Exchange Provider]. Please see this Knowledge Base Article for more information:

ID Q314737 - XADM: Offline Address List Generation Does Not Work on Exchange 2000 Server SP1

http://support.microsoft.com/default.aspx?scid=kb;EN-US;314737

NOTE: Using this registry key is not a recommended or supported method, and should not be used unless directed by a Microsoft PSS Support Professional for troubleshooting purposes only!!

25. Open Address Book profile section in the MAPISVC.inf file.

26. Read from the MAPISVC.inf file and see if we can find the following MAPI property tag 0x6602001e = PR_PROFILE_HOME_SERVER. If this value is present in the DS Section of the MAPISVC.inf file then this is the server that we are going to use for our Active Directory connections via our MAPI profile.

27. If this value is not present we are an Exchange 2000 server, we will then use the RFR Interface (Referral Service). Using the Referral Service will allow us ask the Exchange Server to connect to the Active Directory and find us another suitable domain controller that we can connect to.

28. If the server is not an Exchange 2000 server or our Referral failed to get the profile home server address we need to rebind back to the Active Directory again.

29. Once we find our data save it to the profile.

30. Now that we have the necessary profile information to connect to the Active Directory we pass this data along to OABGen.dll.

31. When OABGen.dll is invoked to rebuild an address list, it will have use the domain controller that is will use for its Active Directory queries.

Microsoft Network Load Balancing: Frequently Asked Questions for Windows 2000 and Windows Server 2003

2006-01-23T09:40:00.000-06:00

For those of us who implement Windows NLB on E2K3 Front End Servers, this is a good read.

NLB basics, NLB and other clustering technologies, NLB for scalability, NLB for high availability, NLB fundamentals, deployment issues, set up and configuration, management and operations, support for sessions, and application and protocol support.

Download At http://www.microsoft.com/downloads/details.aspx?FamilyID=3bc5c7d1-0c45-40a9-ac0a-84da23aa13b4&DisplayLang=en

Update for Intelligent Message Filter for Exchange Server 2003: 2006.01.05 released

2006-01-16T09:22:00.000-06:00

Update for Intelligent Message Filter for Exchange Server 2003: 2006.01.05 (KB907747) has bee eleased.

Get it through Microsoft Update or WSUS

For information how to setup automatic updates, see: http://support.microsoft.com/?kbid=907747

Microsoft IIS Diagnostics Toolkit

2006-01-16T09:17:00.000-06:00

Overview

The IIS Diagnostics Toolkit is a combined release of popular tools used by today's IIS users. These tools include tools aimed at resolving problems related to Secure Socket Layer (SSL) issues, permission or security problems, gathering data for your SMTP server included with IIS, as well as the famous Log Parser utility used to sift through hundreds or thousands of log files very quickly.

The toolkit consolidates all the tools into a convienant download and is supplemented by updates every 90-days to ensure that users have the most current diagnostics tools at their fingertips.

Version: 1.0
Date Published: JAN/14/2006
Language: English
Download Size: 6.1 MB

Available also in amd64 and ia64 versions (see bottom of source page document)

The tools that are included in this MSI package are:

Auth Diagnostics
Debug Diagnostics
SMTP Diagnostics
SSL Diagnostics
Trace Diagnostics
WFetch 1.4
Log Parser 2.2

Download At http://www.microsoft.com/downloads/details.aspx?familyid=9bfa49bc-376b-4a54-95aa-73c9156706e7&displaylang=en

Exchange Does Not Always Use Local GCs

2006-01-06T12:38:00.000-06:00

A good description from Jasper Kuria on why E2K3 does always use the local GC.

Until last week I was under the impression that Exchange always uses local GCs (Global Catalog servers) and only uses out-of-site directory servers (GCs or DCs) if no local ones are available. I found out otherwise from working on the issue described below.

One of our customers had a server outage and Outlook clients could no longer connect to the Exchange server. In other words the server was hung and we had a critsit (critical customer situation case). When dealing with hangs, the first thing we normally ask customers to do is capture a few hang dumps a few minutes apart so that we can determine what the hung process is doing.

The customer dutifully sent us 3 hang dumps taken about 5 minutes apart. On opening the dumps, the first thing that stood out was that there were 6 threads with similar call stacks whose execution state remained completely unchanged in all three dumps. In just one second of execution a thread’s stack can change so drastically that it is almost unrecognizable as the same thread. Put in context, these threads had stayed at the same point for millions of years--in processor time. They each had a stack that looked like this (the stack grows upwards from kernel32!BaseThreadStart and only the relevant parts are included):

00 3386dbb8 74fd1394 NTDLL!NtWaitForSingleObject+0xb

...

05 3386ddc8 77955bb2 WLDAP32!LdapWaitForResponseFromServer+0x533

06 3386de04 77955a86 WLDAP32!ldap_result_with_error+0x101

07 3386de34 77959f71 WLDAP32!ldap_search_ext_sW+0x84

08 3386de90 77958f41 WLDAP32!LdapDetermineServerVersion+0x56

09 3386e22c 7795ef47 WLDAP32!LdapBind+0x1e4

0a 3386e25c 7795eed0 WLDAP32!LdapNonUnicodeBind+0x84

0b 3386e274 62ebcfbc WLDAP32!ldap_bind_s+0x17

0c 3386e2cc 62ebcefd dsaccess!CLdapConnection::BindToHost+0x100

...

16 3386e834 61ee2422 tokenm!CSearchResults::DoDCSearches+0x7b

...

21 3386f850 77d5d899 store!EcDoConnectEx+0x4c

22 3386f8c8 77d9c912 rpcrt4!Invoke+0x30

31 3386ffb4 7c57b388 rpcrt4!ThreadStartRoutine+0x18

32 3386ffec 00000000 KERNEL32!BaseThreadStart+0x52

From frame 05 (in bold), these threads were all waiting for a response from an LDAP server creating a convoy that was in turn blocking several other RPC threads. None of the threads was making progress and as a result the available RPC connections that Outlook clients rely on were maxed out. OWA clients worked fine while all this was going on because OWA does not use RPC.

So why wasn’t the LDAP server responding? First I dumped the LDAP connection object to determine what server these threads were querying. Interestingly, the server was named

                  aussydneygc1.au.company1.com

Per the naming convention, this was a GC in Australia yet the Exchange server was in the US. Hmmh, why were we going across the sea all the way to Australia when there were 16 healthy GCs in the US? The next thing I had them do was turn up diagnostic logging for DSACCESS (the Exchange component responsible for querying the AD) to find out what GCs were being discovered and in what order. DSACCESS uses an algorithm that discovers GCs in the local site first and then those in remote sites based on the cost of WAN (Wide Area Network) links and logs the list in the informational Event Id 2080 (viewable every 15 minutes when diagnostic logging for MSExchangeDSAccess à Topology is set to maximum). The table looked like this:

process INETINFO.EXE (PID=2380). DSAccess has discovered the following servers with the following characteristics:

(Server name | Roles | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data)

In-site:

wsdc1.us.company1.com CDG 7 7 1 0 1 1 7 1

wsdc2.us.company1.com   CDG 7 7 1 0 0 1 7 1

wsdc3.us.company1.com   CDG 7 7 1 0 0 1 7 1

wsdc4.us.company1.com   CDG 7 7 1 0 1 1 7 1

Out-of-site:

nydc5.us.company1.com   CDG 7 7 1 0 1 1 7 1

nydc7.us.company1.com   CDG 7 7 1 0 1 1 7 1

For more infomation on what these values mean see kb article 316300

Only the GCs/DCs in the US were listed (none of the ones in Australia were) and so DSACCESS could not have been the culprit.

I looked at the stuck threads a little more and determined that the users connected to the Exchange server via RPC had DNs (Distinguished Names) that looked like this:

"CN=John Doe,OU=Users,OU=Melbourne,OU=Company1 AUS,DC=au,DC=company1,DC=com"

"CN=David Boe,OU=Users,OU=Melbourne,OU=Company1 AUS,DC=au,DC=company1,DC=com"

…

"CN=Jane Zoe,OU=Users,OU=Sydney,OU=Company1 AUS,DC=au,DC=company1,DC=com"

For a moment I thought maybe these users in the Australian domain had mailboxes on the US Exchange server but the customer assured me that their mailboxes were properly located on Australian mailbox servers. The only other possibility was that these Australian users were logging on to the US server for public folder content. Looking at the code and dumping the mdb (store) GUID confirmed this.

To recap the scenario, Australian mailbox users were connecting to a US Exchange server for public folder content. In order to determine what permissions the users had on the public folder content, the US Exchange server was querying a DC in Australia. The threads sending queries to this DC were stuck waiting for a response and they were in turn blocking other RPC threads, maxing out available RPC connections and adversely affecting Outlook clients on the US server. The question still remains, why wasn’t the US Exchange server querying the local US GCs listed above in the DSACCESS table?

It turns out that Exchange does not always use the local GCs. For certain specific security related user attributes like tokenGroups and tokengroupsGlobalandUniversal (used to determine what security groups a user is a member of and therefore what permissions s/he has to secure resources such as public folders). Exchange MUST query a DC that is authoritative for the user’s home domain, which will likely be an out-of-site DC—in this case it happened to be a DC in Australia. This behavior was introduced around the Exchange 2000 SP2 time frame to address an issue where users from remote domains (sibling or parent) were denied access to public folders even when the security groups they were in should have allowed them access. Pre-SP2 we had made the false assumption (in the product) that a local GC can service ALL queries that Exchange issues. A local GC can (and should) service MOST queries in a well designed multi-site AD environment.

Now back to Company1’s situation. At the time of the outage the WAN link to Australia was, in the customer’s words, "having some serious issues", which is why the LDAP responses were severely delayed. The connection was really spotty but it wasn’t down, which is probably why the connections didn’t time out. "How could this have been avoided?" they wanted to know. One simple way would be using dedicated public folder servers. If the US Exchange server were only a public folder server the worst that could happen is the Australian users wouldn’t have had access to the public folder content stored on the server (and perhaps individual Australian Outlook Clients would display the infamous "retrieving information from the server" RPC dialog). This is a less serious problem any day than lots of users (US users in this case) having no access to email. Another possible way to avoid the situation would be setting up replicas of the US Public Folder content on an Australian public folder server to avoid referrals over the WAN link. "But what if we have too little public folder content to justify a dedicated public folder server?" the customer asked. Fair question, but the honest answer is you risk running into this kind of problem again. Hopefully the WAN link going down is a relatively rare occurrence. If cross site public folder referral is also rare, the two rarities multiplied make for a low probability of the event occurring, but, like an earthquake, when it does occur...you get the point.

BTW we might have some good news on this in a few weeks. Stay tuned!

Application Analyzer 2006 for Lotus Domino Beta

2006-01-05T09:00:00.000-06:00

The Microsoft Application Analyzer 2006 for Lotus Notes/Domino is a tool that is used to help size and scope a Lotus Notes/Domino application migration project. The tool will analyze Lotus Domino applications, provide reports about application characteristics and recommend possible target solutions on the Microsoft Collaboration Platform.

Download At Source: http://www.microsoft.com/downloads/details.aspx?FamilyID=20e88f5d-b885-4ee0-8530-de12e96504b6&DisplayLang=en

Scripting Center help for MONAD

2005-12-30T06:19:00.000-06:00

For everyone familiar with the scripting center that we have used for vbscripting and E2K3, there is now an extension to it for MSH scripting. Enjoy... http://www.microsoft.com/technet/scriptcenter/hubs/msh.mspx

Large Security Tokens and Kernel Memory Exhaustion

2005-12-29T13:12:00.000-06:00

This is a fantastic article posted by Mike Lee on EHLO. It describes the exact issues with Kernel memory and Token bloat. This is a MUST READ!

INTRODUCTION

This is the third CXP flash about Windows 2003 kernel memory issues and Exchange 2003.

The first flash provided technical background about the demands Exchange makes on kernel resources.

The second flash discussed hardware configurations that can restrict the kernel memory available for applications.

This flash explains the effect of large user security tokens on Exchange's kernel memory usage.

EXECUTIVE SUMMARY

Each client connection to a Windows server uses some paged pool kernel memory. The amount of kernel memory used per connection can vary widely. The size of the client's security token is the most important factor here.

Security tokens increase in size in proportion to the number of security groups to which a user belongs. This increase is generally linear, but there are sharp jumps in memory usage at certain thresholds.

There are an increasing number of Microsoft and third party clients and services that can connect to an Exchange server to provide expanded client, search and mobile functionality. Each of these clients may make multiple connections to the server, and each connection has token information associated with it. By reducing average token sizes, you can greatly increase the number of simultaneous connections that the server can manage.

CALL TO ACTION

Exchange administrators should monitor the amount of paged pool memory in use on Exchange servers during peak connection times, and reconfigure servers that are close to running out of pool memory.
Exchange administrators should calculate the effects on pool memory of adding new mailboxes, clients or services to an Exchange server.

Exchange administrators should coordinate with Active Directory administrators to manage the number of security groups to which Exchange users are assigned. This is especially critical if the number of security group memberships is near a threshold where token size could suddenly jump.

Environmental changes such as the implementation of a new client or an increase in the number of security group memberships can suddenly increase kernel memory consumption to a critical level, causing the Exchange server to suddenly become slow or unstable. This can happen even though no changes have been made or mailboxes added on the Exchange server

FREQUENTLY ASKED QUESTIONS (FAQ)

What is a user token?

A security token is the bundle of information that identifies the user and the security groups to which the user belongs. Each time the user tries to connect to a secured resource, the token must be presented to the resource so that it can determine whether access should be granted or denied. For detailed information about security tokens please refer to the Access Tokens Technical Reference in the Windows Server 2003 Technical Reference at:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/897db60d-a38e-40bc-a18e-f4ccafe190e9.mspx

How big is a user token?

It depends. The most important factor is the number of security groups to which a user account belongs. Making a user a member of an additional security group can add up to 68 bytes to the token.

Various factors affect total token size and how many bytes are added per group. There is no simple mathematical formula for calculating token size based on the number of group memberships.

Nonetheless, the token for a user who belongs to 60 security groups is very likely to be less than 4K in size. The token for a user who belongs to 80 security groups is likely to be slightly more than 4K in size.

With regard to kernel memory consumption, there is a critical difference between a token that is "slightly less" than 4K and one that is "slightly more" than 4K.

As soon as the size of a token goes above 4K, even by a few bytes, it will take 8K of kernel memory to hold the token. If the token grows to slightly larger than 8K, its memory requirement will suddenly jump to 12K.

This increase may not seem that significant until you multiply it by thousands of clients--each of whom may make several connections to the server.

How much memory is taken up by user tokens on a typical server?

Consider an Exchange server where 1000 clients are logged on using Outlook 2003 in cached mode. Cached mode is a new Outlook feature that greatly improves the end user experience across slow or unreliable connections. Cached mode clients typically will not notice server disconnections lasting several minutes while online mode clients would experience errors in the same circumstance.

The typical Outlook 2003 cached mode client holds open 3 to 5 connections to the Exchange server. Older versions of Outlook (and Outlook 2003 in online mode) will make 1 or 2 connections to the server. Multiple connections allow Outlook to perform multiple server tasks in parallel. As a general rule, more connections per client means a better user experience. But, more connections per client also means more kernel memory consumption.

Each client connection to the Exchange store operates independently and needs a copy of the user token. There is also some RPC overhead for managing these connections, and busy clients may have more than one RPC connection to the server. Each RPC connection to the server also needs a copy of the user's token. Thus, each cached mode client has multiple copies of its token in memory on the server.

For the purposes of this example, assume that each client has a total of 5 connections and a token that is just under 4K in size. Each client then needs 20K of kernel memory.

This means that a thousand cached mode users will require about 20 megabytes of paged pool memory to support their connections. On a correctly tuned Exchange server with the /3GB switch set, there is a maximum of about 250 megabytes of paged pool memory available to all applications on the server.

NOTE: Please refer back to the first flash in this series for more information about the trade-offs involved in setting the /3GB switch. You can follow this link to read that flash on the Microsoft Exchange Team blog:

http://blogs.technet.com/exchange/archive/2005/12/07/415733.aspx

If additional security groups push the token size above 4K, then the amount of kernel memory used for tokens will suddenly be 40 megabytes instead of 20 megabytes. If each user starts using Microsoft Communicator and MSN Desktop Search, there can be additional connections made to the Exchange server. If these additional clients add a single connection each, they increase paged pool demand by another 40%.

There may also be clients on your network who have Outlook add-ons that make additional connections, clients who connect to the server from multiple computers at once, and delegates who open multiple calendars or mailboxes simultaneously. Each of these puts additional pressure on paged pool memory by making additional connections.

What happens if I run out of paged pool memory?

The server will become slow or refuse additional requests and connections. Applications may fail suddenly. In extreme cases, the server can even "blue screen" and stop entirely.

If the paged pool shortage is transient, the server will likely recover. Applications can be somewhat resilient to temporary shortages of memory, but no application can run forever if critical resource requests are not satisfied. If the paged pool shortage lasts very long, it is likely to trigger cascading bottlenecks. In such a case, the server will probably have to be rebooted to make it functional again.

How much paged pool memory should be free in order for me to feel safe?

Under peak load, there should be approximately 50 megabytes of available paged pool. If you have less than 30 megabytes free, you should take immediate steps to reduce load on the server.

Paged pool is allocated statically at Windows boot time. The pool cannot be increased without reconfiguring and rebooting the server. The amount of paged pool memory available depends on a number of factors, including boot switches (such as /USERVA and /3GB), registry settings and physical RAM.

You can use a kernel debugger to view the size of initial paged pool and other kernel memory allocations. Setting up a traditional kernel debugging session can be a daunting task, typically requiring an extra computer, specialized cabling and a server reboot. Alternately, the LiveKD utility from Sysinternals can be used to start a kernel debugging session from the server console. LiveKD does not require you to reboot the server. For more information, please see this article in the Microsoft Knowledge Base:

The Performance tool does not accurately show the available Free System Page Table entries in Windows Server 2003

http://support.microsoft.com/kb/894067

IMPORTANT NOTE: Commands that can be used during a kernel debugging session can cause the system to become unstable or to stop. Microsoft recommends that you stop all Exchange services before initiating a kernel debugging session, and that you reboot the server after the session.

Without running a kernel debugger, you can still estimate how much paged pool is available on your server. A typical Exchange mailbox server with 1 gigabyte or more of RAM should have an initial paged pool allocation of slightly under 250 megabytes. (This assumes that the server has been configured with the /3GB switch and other recommended optimizations. Without the /3GB switch, initial paged pool on the same server would be about 350 megabytes.)

It is easy to check how much paged pool is currently in use. Windows Task Manager displays paged pool usage on the Performance page under Kernel Memory\Paged. You can also monitor paged pool usage over time with Windows System Monitor through the Memory\Pool Paged Bytes counter.

As a general rule then, paged pool usage in excess of 200 megabytes is cause for concern, and paged pool usage in excess of 220 megabytes requires immediate attention. If you are within these limits, and the server is still running out of paged pool, then the problem is likely that the initial paged pool allocation is insufficient. You can use a kernel debugger to verify whether this is the problem.

How can I find out how much of a server's pool usage is for user tokens?

You can find out how much kernel memory is being used for tokens at any given moment by using the Poolmon or Memsnap utilities. These utilities can be run without interrupting the server. They are available with the Support Tools for Windows 2000 and 2003.

Both utilities rely on the fact that each allocation of pool memory has a tag associated with it. The tag for tokens is called TOKE. Therefore, you can look through the output of either utility and find the TOKE line to see how much paged pool memory is in use at the moment for tokens.

NOTE: For Windows 2000, display of the pool tags is not enabled by default. You must enable tag display with the Gflags utility and then reboot the server before you can use Poolmon or Memsnap.

More information about monitoring and tuning kernel memory for Exchange is available here:

How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Memory Leaks

http://support.microsoft.com/kb/177415

The "Ruling Out Memory-Bound Problems" section of the Troubleshooting Exchange Server 2003 Performance white paper

http://www.microsoft.com/technet/prodtechnol/exchange/2003/library/e2k3perf.mspx

How to optimize memory usage in Exchange Server 2003

http://support.microsoft.com/kb/815372

What can I do to reduce the size of user tokens?

There are three strategies you can follow:

Reduce the number of security groups to which each user belongs.

Nesting security groups will not help in doing this. The SID of each nested group is stored in the user token. In fact, if you are puzzled by what appears to be a discrepancy in the number of groups to which users belong and the size of their tokens, nested security groups may be the explanation. You can simplify group administration by following the best practice of not nesting groups beyond two levels.

If you are migrating user accounts from Windows NT 4 domains or between Active Directory domains, users may have sIDHistory entries for previous domains. If users belong to a large number of groups in that domain, this can greatly increase the token size. Completing the migration and decommissioning the previous domains may therefore reduce token size.

Host Exchange servers in a different domain than the users who connect to them.

This can reduce the size of user tokens by stripping domain local groups for the user account domain from the token presented to the Exchange server. This works because domain local groups from one domain are not kept in the token generated on a server in a different domain.

Where possible, convert security groups to distribution groups.

Token size is increased by membership in security groups, not distribution groups. Users can belong to thousands of distribution groups with no effect on token size. If a group is not actually being used to deny or grant access to resources, it should be a distribution group, not a security group.

What else can I do to reduce the total TOKE size on my server?

Once you have reduced the typical token size to the practical minimum, the next step is to manage the number of simultaneous connections made to the server. As mentioned above, each client may make multiple connections to the server, and different clients make different numbers of connections based on a wide variety of factors. You may not even have a full list of all the clients that connect to your server.

Users may install Outlook add-ons that make additional connections. Developers may run applications that make large numbers of connections or that don't shut down connections when they are done. Therefore, the first thing to do is to analyze what kind of clients connect to your server.

Exchange System Manager (ESM) will help you do this analysis. Each database displayed in ESM has a Logons page that lists the number of connections per logon, along with much other useful information.

You can get even more detailed information, including the name of each client process, by running the Exchange Server User Monitor (EXMon), which can be downloaded here:

http://www.microsoft.com/technet/prodtechnol/exchange/downloads/2003/tools.mspx

After you have inventoried the connections being made, you are ready to consider the following actions to reduce the number of connections:

Restrict unauthorized clients and applications.
Remove the Public Information Store from the server and direct clients to public folders on a different server. This eliminates public folder connections made by clients.

Remove specific public folders that account for large numbers of client connections. Good candidates here are the Schedule+ Free/Busy folder and the Offline Address Book. Clients must make additional connections to these folders when scheduling appointments or downloading the address book.

Add replicas of heavily accessed public folders to distribute the number of clients who connect to them between multiple servers.

Install dedicated public folder servers to eliminate all public folder connections from mailbox servers.

Distribute heavy connection users evenly across multiple servers. Heavy connection users are likely to be those with multiple computers or devices and field and mobile users.

Distribute users with large security tokens across multiple servers.

What is Microsoft doing to help with this problem?

Microsoft has made several tools and scripts available to help administrators manage and monitor kernel memory usage. A new sample script will soon be available that can scan Active Directory user objects and report how many groups each user account belongs to. When published, this script will be available in the following Microsoft Knowledge Base article. We will also publish the script on this blog site within next few days.

http://support.microsoft.com/kb/912376

By knowing the number of groups each user belongs to, you can estimate how large user tokens are likely to be, and judge how close you are to a line where token size will suddenly jump by another 4K.

The configuration file for the Exchange Best Practices Analyzer (ExBPA) has been updated recently and now detects many problematic hardware configurations. You can download ExBPA here.

http://www.microsoft.com/technet/prodtechnol/exchange/downloads/2003/analyzers/default.mspx

ExBPA is updated frequently to detect new issues and environments and to make recommendations to Exchange administrators for dealing with them. Each time you run ExBPA, it can check for new configurations and versions, and automatically update itself. Running ExBPA on a regular schedule gives you immediate and automatic access to the latest best practices for Exchange configuration.

The ultimate solution for these issues is to move to a 64-bit platform. The situation is similar to that which existed when the 16-bit DOS operating system was nearing the end of its life. Making even marginal improvements in memory management became important. While careful memory optimization on the 32-bit platform can improve scalability significantly, it cannot entirely overcome the fundamental problem of the 32-bit limit.

The next version of Exchange will be 64-bit. Until that version is available, Microsoft will continue to provide guidance and optimizations for maximizing the scalability of Exchange running in a 32-bit memory space.