How Mailbox Manager processes recipients

Here is a good post from Mike Lagase on Mailbox Manager details...

This is a part 2 of my 3 part series on Mailbox Manager, please go here to read the part 1!

There is a task (CMBCleanTask) within MAD.EXE that runs every 15 minutes and figures out if the schedule information says it is now time to run. The schedule is controlled by the attributes msExchMailboxManagerActivationStyle and msExchMailboxManagerActivationSchedule on the server object in the DS.

The values for 'style' are:

         0 = Never
         1 = Schedule
         2 = Always
         3 = Custom

If we determine that we need to run, MAD starts the Clean Mailbox function to do the actual work. When this function is called, we first look in each of the databases on the server for mailboxes.  Based on the mailboxes this process found, it then queries Active Directory to see what user has a Mailbox Manager Policy applied to them. Once the user's policies have been identified, we then, based on how that policy is configured, go in to each mailbox and clean them accordingly. Once a mailbox is processed, an email notification is sent to the end user, if configured. At the end of the process, we send the administrator report, whether it is a detailed or a summary report. This report beginning with Exchange 2000 SP3 and later is sent via an authenticated MAPI logon using LocalSystem. Versions prior to Exchange 2000 SP3 used CDO for sending this report and needed anonymous authentication on the SMTP Virtual Server to relay properly.

How do we calculate if we process a message?

This calculation is determined by the following three MAPI properties on a message. If any one of these properties is less than the limit set by the Mailbox Manager rules, then we will skip that message.

- PR_MESSAGE_DELIVERY_TIME
- PR_CLIENT_SUBMIT_TIME
- PR_LAST_MODIFICATION_TIME

For a message to be moved or deleted by Mailbox Manager, all three of the above properties need to exceed the limit that has been set on the policy. So if you have a policy that states that any message in your Inbox older than 30 days needs to get cleaned by the Mailbox Manager process, we check the above properties and if all are greater than 30 days, we go ahead and clean that message. For other message classes such as Appointments, Task, Journal items, etc., we perform additional checks and look at different MAPI properties during this cleaning process. More information regarding those other checks can be found at http://support.microsoft.com/?id=302804

When Mailbox Manager first came out back in Exchange 5.5, we based the above calculation different than what we do in Exchange 2000 or Exchange 2003. We used to base this on the PR_MESSAGE_DELIVERY_TIME of a message only. There are some instances where you would like to base the cleaning on this property alone. This can be modified by changing the value for msExchMailboxManagerAgeLimit on the Mailbox Manager policy to a value of 3. All possible modifications to this value can be found here.

Below is a listing of attributes associated with Mailbox Manager Policies:

Policy Attributes
msExchMailboxManagerAgeLimit
msExchMailboxManagerCustomMessage
msExchMailboxManagerFolderSettings
msExchMailboxManagerKeepMessageClasses
msExchMailboxManagerMode
msExchMailboxManagerSendUserNotificationMail
msExchMailboxManagerSizeLimit
msExchMailboxManagerSizeLimitEnabled
msExchMailboxManagerUserMessageBody
msExchMailboxManagerUserMessageFooter
msExchMailboxManagerUserMessageHeader

Server Attributes
msExchMailboxManagerActivationStyle
msExchMailboxManagerActivationSchedule
msExchMailboxManagerMode
msExchMailboxManagerReportRecipient

MS05-021: Vulnerability in Exchange Server Could Allow Remote Code Execution (894549)

This update resolves a newly-discovered, privately-reported vulnerability in Microsoft Exchange Server that could allow an attacker to run arbitrary code on the system. The vulnerability is documented in the "Vulnerability Details" section of this bulletin. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
[Microsoft Security Bulletins]

The new Windows Server 2003 TechCenter

New: Windows Server 2003 TechCenter The Windows Server 2003 TechCenter offers a key step toward improving the documentation experience by enabling authors to update content based on customer feedback. It presents views into documentation by language, technology, task (or documentation category), and documentation set. The TechCenter hosts Microsoft Windows Server 2003 technical documentation and updates (including the new Service Pack 1).

Exchange User Monitor (Exmon) released

Introducing the Microsft Exchange User Monitor (Exmon) tool

Chris Mitchell has announced that this month's Exchange Web release contains a tool that the Exchange performance, development, and operations teams at Microsoft have used for quite some time called Exchange User Monitor (Exmon) and can be downloaded here.  Exmon for the first time allows an Exchange administrator the ability to see in amazing detail the performance of an Exchange server.  Shown on a user by user basis, Exmon allows you to see how much CPU, latency, network traffic, and disk each user on an Exchange server consumes.  It can be run in almost realtime (minute by minute analysis) or over longer (multiple-hour) capture periods.  Exmon also 'bubbles' up data sent back to the Exchange server from Outlook 2003 and higher about the user's actual experience, showing the actual RPC (network+server) latency and even the name of the process talking to the Exchange server (so you can see ActiveSync usage and other 3rd party MAPI applications).  The data Exmon exposes is the 'raw' data that many of the Exchange Performance counters use in calculating the running averages. 

Internally, this tool was used to help understand the performance of Outlook 2003 and other MAPI applications during the development of Exchange Server 2003.  We use it to understand the broad impact of performance across a server, but also to troubleshoot specific performance problems with individual users.  The impact to the server being 'traced' is minimal, allowing it to be run on very large servers. 

On a personal note, I recommend looking at a number of traces to 'aquaint' yourself with what's normal.  Exmon data can be highly dynamic in range.  It's best to use longer traces rather than smaller ones, because MAPI traffic can be very bursty, unless you're trying to look at a very microscopic level.

 

Network Monitor 3.0 beta soon

According to Neil Leslie, general manager of Microsoft Corp.'s customer service and support group, the company within six months will release a beta version of Network Monitor 3.0, an upgrade of a tool that has shipped as part of its Systems Management Server (SMS) software. What will be different in the next SMS release, Leslie says, is that Netmon won't have a "90-day time bomb" that turns off the tool unless you buy it. In other words, if you get SMS, you'll get Netmon 3.0. Free. Netmon captures and stores network packets for analysis. It can filter packets by protocol type and let you find devices on your network and track their packet-broadcasting rates. The 3.0 release adds a Visual Basic-like scripting language so you can easily customize it, says Leslie. Today, he notes, you need C and assembler language skills to do so.

Leslie says Microsoft will also make available later this year D-Code, its database of the various service and support tools that the company uses internally. The database not only lists what's what, but it also rates the effectiveness of what's what. Leslie says he wants other companies to rate their troubleshooting and analysis tools inside D-Code so the info can be shared broadly.

Exchange Server due out in 2006

"Andy Lees, corporate vice president of marketing for Microsoft's server and tools business, revealed the ship date Tuesday."

This suggests that Exchange 12 will arrive sooner versus later.  It was previous suggested the release date might not be until early 2007.

Lees also indicated that Exchange 12 will support "both the 64-bit extensions and the dual-core technology."  I don't think that includes Itanium.

Exchange 2003/Windows 2003 sp1 Cluster Patch

This update only applies to Exchange Server 2003 clusters running on Windows Server 2003 with the recently released Windows 2003 sp1.  MS KB 841561 fixes "'500 - Internal server error' error message when a user tries to access a clustered Exchange Server 2003 back-end server by using Outlook Web Access."

SYMPTOMS

You install Microsoft Windows Server 2003 Service Pack 1 (SP1) on a server cluster. The server cluster is running a clustered Microsoft Exchange Server 2003 back-end server. You experience the following symptoms:

•	If a user tries to access a mailbox by using Microsoft Outlook Web Access, that user receives the following error message: 500 - Internal server error
•	If you log on to a client computer by using administrator rights and then try to access a mailbox by using Outlook Web Access, you are successful.

 

CAUSE

This problem is caused by some of the security enhancements that are included with Windows Server 2003 SP1.

In this scenario, when a user tries to access a mailbox by using Outlook Web Access, HTTP requests into the clustering API by impersonating the logged-on user. However, there have been security changes in Windows Server 2003 SP1. The security restrictions for the APIs that perform remote registry access have been changed. Therefore, the logon attempt is not successful.

Windows 2003 SP1 Security Configuration Wizard and Exchange servers

Nino Bilic has posted this more detailed information on the SCW and E2K3... 

Now that Windows 2003 SP1 is out, I wanted to mention a tool that has shipped as part of Windows 2003 SP1. While the tool itself is not installed by SP1, the shortcut to the Help file is placed on the server desktop when SP1 is installed.

What does that have to do with Exchange? About the tool:

Security Configuration Wizard (SCW) is an attack surface reduction tool that is part of Windows Server 2003 SP1.  SCW uses a roles-based metaphor (e.g. "File Server", "Web Server", "Domain Controller", etc.) to determine the desired functionality of a particular type of server, then disables functionality that is not required for the role(s) the server needs to perform.  Specifically, SCW:

    - Disables unneeded services
    - Blocks unused ports
    - Allows further (address or security) restrictions for ports that are left open
    - Prohibits unnecessary web extensions (if running IIS)
    - Reduces Protocol Exposure (SMB, LanMan, LDAP)
    - Defines an Audit Policy

SCW guides you through the process of creating, editing, applying, or rolling back a security policy based on the selected roles of the server. The security policies that are created with SCW are XML files that, when applied, configure services, network security, specific registry values, audit policy, and if applicable, Internet Information Services (IIS).

So - really, what does all this have to do with Exchange, you ask?

There is a known issue with Exchange server installed into a non-default path (something other than %ProgramFiles%\Exchsrvr) where SCW is run and application of resultant policy might cause Exchange Server not to be accessible by clients anymore. The possible gotcha is in the "Network Security" portion of SCW which configures the Windows Firewall. This portion of SCW is used to turn on and add exceptions to the Windows Firewall. Exceptions are added by pointing the Windows Firewall to the EXE file to the application that is exempt from firewall blocking. SCW however expects those applications (in our case - services) to be in their default installation paths.

Now, before we start to get nervous, we should understand that the SCW will indicate to the Administrator if it runs into this problem. In other words - the UI will indicate there are issues with services that were "not found", and the Admin will have a chance to correct this before any changes are made to server configuration.

Once you get to the SCW part that configures Network Security, and if you are running SCW on the server that is not installed into the default installation path, you will see this:

 
In above example - the MTA Stacks, System Attendant and Store are the services that SCW expects to find in one location, but the actual EXE files are not physically there. If we continued to run SCW here and said YES to the popup that will warn you that some services were not found - after the server reboot, those services would not be accessible by their clients, as Windows Firewall would block their ports.

Please see the following article for information how to configure SCW to point to valid file locations, as well as how to recover if the server is already in the situation where services are blocked by Windows Firewall after SCW policy was applied:

896742 After you run the Security Configuration Wizard in Windows Server 2003
http://support.microsoft.com/?id=896742

There are few extra things I wanted to mention on this:

At the end of the SCW run, you will save the policy under a name you can choose. SCW lets you then take this policy and apply it to other servers in your Organization.

The possible problem here is - if the policy was created on the "default installation path" Exchange server, it will cause problems after import on the "non-default installation path" Exchange server, and vice versa. The above warnings (and a chance to correct them before policy application) are seen only during the policy creation not during the policy import.

Additionally - assuming that Windows Firewall was activated on the server and exceptions were added to the firewall policy, if administrator then adds a component or a service to the server (for example, POP3, IMAP4 or SRS are enabled) - the service will effectively be blocked from it's clients until the SCW is re-run, the added service is approved through it and policy is reapplied. Alternatively, you can manually add the service into exceptions of Windows Firewall.

I personally love the tool, but - we just have to be careful when using it!

- Nino Bilic

[You Had Me At EHLO...]

E2K3 and the Security Configuration Wizard in Windows Server 2003 SP1

A new KB article has been published for Exchange 2003 when applying Windows Server 2003 Service Pack 1.  It involves servers that the install path for the Excahnge bits were changed from the default.

 

896742 After you run the Security Configuration Wizard in Windows Server 2003 SP1, Outlook users may not be able to connect to their accounts

Interesting Exchange KB articles

Here are a couple of interesting KBs that have come out or been updated recently:

KB.884863 (http://support.microsoft.com/kb/884863) – “Update to Exchange 2000 Server adds application event logging for deletion of public folders”

An additional feature that is related to public folder diagnostics logging is now available for Microsoft Exchange 2000 Server. When you use this new functionality, an event is generated in the Event Viewer Application log when a user deletes an Exchange 2000 public folder. If the Public Folders General category is set to Medium logging or higher, an event that similar to the following will be logged when a user deletes a public folder in Microsoft Exchange 2000 Server:

Event Type: Information
Event Source: MSExchangeIS Public Store
Event Category: General
Event ID: 9682
Description: Folder /Name_of_Public_Folder with folder ID 9-9999B was deleted by /o=Exchange_Organization_Name/ou=Exchange_Site_Name/cn=Recipients_Container/cn=User, user account Domain\NTAccount_Name.

 

Note, you can also get this hotfix for Exchange 2003 Post-SP1 by referencing KB.891968 with PSS.

 

 

KB.895847 (http://support.microsoft.com/kb/895847) – “Multi-site data replication support for Exchange 2003 and Exchange 2000”

 

You can use replication technology to help provide high availability for Microsoft Exchange Server 2003 or Microsoft Exchange 2000 Server data. Exchange 2003 and Exchange 2000 replication solutions are provided by third-party program vendors. This article describes our support policies for Exchange when Exchange is used together with a third-party replication solution.

 

(Translation: this is the definitive “Exchange on replicated storage” KB article. It covers synchronous replication, asynchronous replication, software replication, Geo-clusters, you name it!)

 

 

KB.175481 (http://support.microsoft.com/kb/175481) – “Exchange single-instance storage and its effect on stores when moving mailboxes”

 

This KB article about single-instance storage behavior during mailbox moves (ie – that we keep it if you use the built-in move process) has been updated to include the cross-site mixed-mode Exchange 2003 SP1 feature. The article clarifies that these cross-site moves also retain SIS, unlike the old “Exmerge” method of moving mailboxes cross-site.

Interesting Exchange KB articles

Here are a couple of interesting KBs that have come out or been updated recently:

KB.884863 (http://support.microsoft.com/kb/884863) – “Update to Exchange 2000 Server adds application event logging for deletion of public folders”

An additional feature that is related to public folder diagnostics logging is now available for Microsoft Exchange 2000 Server. When you use this new functionality, an event is generated in the Event Viewer Application log when a user deletes an Exchange 2000 public folder. If the Public Folders General category is set to Medium logging or higher, an event that similar to the following will be logged when a user deletes a public folder in Microsoft Exchange 2000 Server:

Event Type: Information
Event Source: MSExchangeIS Public Store
Event Category: General
Event ID: 9682
Description: Folder /Name_of_Public_Folder with folder ID 9-9999B was deleted by /o=Exchange_Organization_Name/ou=Exchange_Site_Name/cn=Recipients_Container/cn=User, user account Domain\NTAccount_Name.

 

Note, you can also get this hotfix for Exchange 2003 Post-SP1 by referencing KB.891968 with PSS.

 

 

KB.895847 (http://support.microsoft.com/kb/895847) – “Multi-site data replication support for Exchange 2003 and Exchange 2000”

 

You can use replication technology to help provide high availability for Microsoft Exchange Server 2003 or Microsoft Exchange 2000 Server data. Exchange 2003 and Exchange 2000 replication solutions are provided by third-party program vendors. This article describes our support policies for Exchange when Exchange is used together with a third-party replication solution.

 

(Translation: this is the definitive “Exchange on replicated storage” KB article. It covers synchronous replication, asynchronous replication, software replication, Geo-clusters, you name it!)

 

 

KB.175481 (http://support.microsoft.com/kb/175481) – “Exchange single-instance storage and its effect on stores when moving mailboxes”

 

This KB article about single-instance storage behavior during mailbox moves (ie – that we keep it if you use the built-in move process) has been updated to include the cross-site mixed-mode Exchange 2003 SP1 feature. The article clarifies that these cross-site moves also retain SIS, unlike the old “Exmerge” method of moving mailboxes cross-site.

Antivirus getting in the way of IsAlive checks

 

Evan Dodds wrote a long time ago about the IsAlive behavior in Exchange 200x clusters, but one interesting scenario was brought to his attention recently.

Remember that the IsAlive check for the SMTP resource requires the cluster node actively running the SMTP resource to be able to connect into port 25 on the virtual IP address bound to the particular SMTP virtual server. So, if anything prevents the cluster service from making this connection, the IsAlive is surely bound to fail!

With that background, know that some antivirus vendors have added an option to prevent “mass mailing worms from sending mail” (ie – they actively block access to port 25). This will prevent mail delivery to the server where this feature is enabled, whether it’s a cluster or not. Clearly it shouldn’t be enabled on an Exchange server.

But, as I mention above, if you have this option set on an Exchange 200x cluster you are going to have problems getting the SMTP resource online (and keeping it online) above and beyond any mail delivery issues you might encounter!

A Brief History of Exchange Server

 

A brief history lesson, for those of us that have lived through this, it is great to see where we have been.

Microsoft Exchange Server started its life as Exchange Server 4.0, shortly after Microsoft discovered the Internet.  Prior to Exchange, Microsoft had another email product called Microsoft Mail. The last version of MS-Mail was 3.5 and it was released in September of 1995. Microsoft hoped that by numbering the first version of Exchange as 4.0, it would convince users to migrate quickly.

Regardless of the version number, Exchange 4.0 was a version 1.0 product and it was not an upgrade to MS-Mail 3.5. To get from MS-Mail 3.5 to Exchange Server 4.0 was a full-scale migration. Exchange 4.0 also had a number of severe limitations and somewhat limited functionality (especially when compared to the products available today). However, it introduced many capabilities that are absolutely recognizable even in today’s much more mature product. Exchange Server 4.0 was followed by Exchange Server 5.0 and then by Exchange Server 5.5.

Exchange Server 5.5 was the first version of the Exchange product line to really take off. Exchange Server 5.5, especially by service pack 3, was a very usable product. It is estimated that, at this writing (very early 2005) that over 25% of Exchange customers are still using Exchange Server 5.5; even despite the fact that two major versions of Exchange have been released since the release of Exchange Server 5.5. It was, and still is, a very stable product.

Exchange Server 5.5 was the first version of Exchange to truly support “the Internet” with an Internet Mail Connector (IMC). Therefore, if companies are still using older versions of Exchange Server, then they are probably not connected to the Internet, at least for email! I doubt that very many copies of Exchange Server prior to version 5.5 are still in operation.

The releases of Exchange Server up to and including Exchange Server 5.5 all shared a common feature – a directory which was maintained by the Exchange Server itself. For the purposes of this discussion, a directory is a list of items (such as subscribers, distribution lists, contacts, public folders, routing tables, etc.) and all of the attributes (information and data) about each of those items. All of the items and their attributes were stored in a database maintained by Exchange – and this database was not part of the operating system.

In a revolutionary change, Exchange 2000 Server moved the directory into the brand new Active Directory. Starting with Exchange 2000 Server, Exchange requires Active Directory and heavily uses some of the features and functionality of Active Directory.

Since the Active Directory database was originally based on the Exchange database technology, it was a natural step.

There were other revolutionary changes in Exchange 2000 Server – among them the inclusion of a Conferencing Server (which provided additional collaboration capabilities to Exchange) as well as Instant Messaging capabilities. These changes were moved back out of Exchange Server and into a separate product (Microsoft Live Communications Server) as of Exchange Server 2003.

As a minor aside, the change in name between all prior versions of Exchange Server Version and Exchange 2000 Server was another modification that lasted for only a single product release.

The movement to Active Directory with Exchange 2000 Server also significantly changed the administrative model for Exchange. Historically, an Exchange administrator could control everything about an Exchange site – the subscribers, the mailboxes, the distribution lists, server configuration, etc. With the integration to Active Directory, however, that is no longer always the case. Exchange management is now separate from user and group management (groups include distribution groups, which were known as distribution lists in Exchange 5.5 and before).

In larger companies, this administrative split makes very good sense, as messaging and collaboration are just applications. Being an administrator of the messaging system shouldn’t provide application level administrators the full administrative control of the computer network too. For many (if not most) smaller companies, the distinction is meaningless and it often doesn’t seem to make any sense – why it is now necessary to use two programs for administration, whereas in Exchange 5.5 and earlier, everything could be done in a single program.

Thankfully, for these smaller environments the multiple administrative consoles may be merged into a single custom console providing the single point of administration that these companies are used to.

Exchange 2000 Server represented a major change to the core architecture of the Exchange product, and in some ways the integration with Active Directory again made it a version 1.0 product. Even so, Exchange 2000 was a significant improvement over Exchange 5.5. Many of the Exchange 2000 deficiencies were corrected in Exchange 2003. Exchange 2003 has proven itself to be an extremely stable and feature rich platform.

Table 1-1. Versions of Exchange Server and related products

Product Name	Release Date
Microsoft Mail 3.5	September 12, 1995
Exchange Server 4.0	June 11, 1996
Exchange Server 5.0	May 23, 1997
Exchange Server 5.5	February 3, 1998
Exchange 2000 Server	November 29, 2000
Exchange Server 2003	September 28, 2003

 

The release of Exchange Server 2003 also integrated a significant new feature set into Exchange – Mobility. Mobility provides access to Exchange features and functionality from non-traditional clients – such as Windows Mobile Clients (Pocket PC 2002 and Pocket PC 2003 with Microsoft ActiveSync) as well as any PDA client which supports cHTML (via Outlook Mobile Access or OMA).

Prior to Exchange Server 2003, the available mobility functionality was present in another server product – Microsoft Mobile Information Server (MMIS). Its functionality was somewhat less than what is present in the current version of Exchange. The releases of MMIS were as shown below.

Table 1-2. Versions of Microsoft Mobile Information Server

Product Name	Release Date
Mobile Information Server 2001	September 16, 2001
Mobile Information Server 2002	May 21, 2002

 

As of this writing (very early 2005), Exchange Server 2003 has had one service pack released, with a second service pack expected in the second quarter of this year. There have also been several “add on” feature packs released to add functionality to Exchange Server 2003 (IMF – Internet Message Filter being the chief one among them).

The next version of Exchange Server, codenamed E12, is expected in the second half of 2006.

Windows Server 2003 SP1 Is Coming. Before You Install It On Exchange Server 2003…

If you are looking to roll out Windows Server 2003 SP1 on your Exchange servers and you are doing clustering on back-end servers, we have a hotfix that you will need to install.
From: 841561 "500 - Internal server error" error message when a user tries to access a clustered Exchange Server 2003 back-end server by using Outlook Web Access
“This problem is caused by some of the security enhancements that are included with Windows Server 2003 SP1. In this scenario, when a user tries to access a mailbox by using Outlook Web Access, HTTP requests into the clustering API by impersonating the logged-on user. However, there have been security changes in Windows Server 2003 SP1. The security restrictions for the APIs that perform remote registry access have been changed. Therefore, the logon attempt is not successful.”
Right now, this is a hotfix that you need to call in to get. If it becomes available for public download the link will be in the above article. This hotfix requires that you have Exchange Server 2003 SP1. Another article will be available to address the issue if you do not have Exchange Server 2003 SP1 installed.As always… please test the hotfixes in your test lab before deploying to production servers.
posted on Tuesday, March 29, 2005 8:36 AM by Gerod Serafin

HP Enhances E-Mail Archiving Storage Array

Bolstering its information life-cycle management lineup, Hewlett-Packard on Tuesday made hardware and software enhancements to the HP StorageWorks Reference Information Storage System (RISS), an application-aware, content-based archiving array.

RISS, which shipped last May, is an integrated storage, search and retrieval appliance that originally was aimed at e-mail archiving, said Paul O'Brien, director of ILM for HP's StorageWorks Division. It uses what HP calls Smart Cells, which are connected on a storage grid and consist of a processor, storage and software. As pockets of data tied to an application, the Smart Cells can be physical or logical devices, and they can be assigned to specific users for read-and-write authorization, he said.

With the enhancements, Smart Cell capacity is now 850 Gbytes, up from the previous 400-Gbyte maximum, O'Brien said. As a result, the base capacity of a RISS increases to 1.8 Tbytes, from 1 Tbyte before. The list price for a RISS starts at $112,500, with extra 850-Gbyte mirrored Smart Cells available for $52,000.

IMF Enhancements via NEMX

SecurExchange IMF edition extends the IMF by:

• Allowing any number of thresholds to be defined with different actions for each threshold range. For instance, a SCL rating of 4-6 can be assigned "Quarantine", while a SCL rating of 7-9 could be assigned "Delete"
• Providing additional actions available to a triggered message.
• Additional actions like "reroute", "move to any sub folder", "copy to user", "send a message", and others may be assigned. Moving a message to any subfolder does not require Outlook 2003.
• Allowing different thresholds and corresponding actions amongst different user groups.
• For instance in a school environment, the "staff" group may have messages quarantined for a SCL range, while the "students" group would have those messages deleted.
• Automatically or manually allow business partner's messages to bypass Exchange's IMF through SecurExchange's Friendly Domain capability, minimizing false positives generated by the IMF
• Creating Safe Sender's lists to prevent Exchange's IMF from archiving or deleting messages on the SMTP gateway / frontend server that exceed the gateway 's IMF threshold.

Phishing And Complexities Of E-Mail Security Top List Of IT Pros' Concerns

http://www.messagingpipeline.com/159904303 Business-technology professionals want simple, fast ways to manage E-mail security, with many aiming to consolidate with one vendor.

Symbian To License Microsoft E-Mail Technology

http://www.messagingpipeline.com/159904213 Unexpected deal with rival may bolster Microsoft's bid to extend its dominance to mobile devices.

IBM Enters Anti-Spam Waters

http://www.messagingpipeline.com/159904164 New technology checks e-mail sender validity without resorting to special additions to MX or DNS records.

OAB sort orders and character handling

Borrowed from Neil Shipps Blog...

In Exchange 2000 and earlier, 10% of Exchange users used the Offline Address Book was the statistic that was most often repeated to me. But with Exchange 2003 and Office 2003, that number has gone way up due to Outlook's usage of Cached Mode Exchange. This means that everyone that uses Outlook in cached mode now downloads the Offline Address Book or OAB, and they may get a slightly different experience than they were used to.

Before Cached Mode Exchange, clients would get their address books directly from the Active Directory. As long as the global catalogs they were using had the client language installed (see KB http://support.microsoft.com/default.aspx?scid=kb;en-us;301314), the Active Directory would sort the GAL for browsing using the correct sorting locale and return it to the client rendered in the right code page. When the client actively searched for entries, again, the AD would use the sort locale of the client to compute the result. When the OAB server generates the OAB files, it reads the entries from the AD sorted in the default sort order of the OAB server and builds the OAB search files using that same sort order. Now in cached mode, since the OAB is sorted according to OAB server and not the client, it may not match the clients language locale. This means that users may not be able to find entries in the GAL as easily because they're not sorted in the way the user expects.

By default, Exchange Server creates a single default OAB with the Global Address List on the first server installed in the organization. This works well if your users all have the same language set as default on their client computers. But for those organizations who must support different client languages it now gets complex. The OAB generation process in Exchange Server 2003 can build two different versions of the OAB: a Unicode version and an ANSI version. The Unicode version reads the Active Directory recipients in Unicode and keeps the data as Unicode when stored on the client. It's up to the client to render the characters in the right code page. However for the ANSI files, the OAB server renders the Unicode AD characters using the default code page of the server. So if your OAB server is running on a US English Windows server and you have some Active Directory recipients with non-western characters in their properties, you're going to get question marks for those characters in the OAB data for the ANSI version of the OAB.

For the display names that can't be rendered in ANSI there is a work around. If the AD or the OAB finds that characters in the displayname can't be rendered correctly in the current code page, they will then substitute the "simple display name" attribute for the display name. If you have filled out this attribute then that text will show up instead of the original display name in the address book and on the property pages. If it hasn't been set, the alias name will be used. However, the records will not be resorted. The simple display name will show up where the display name would have sorted to. Since the display display name or alias may not have any relation to the display name, then the address book may not appear to be in the correct order for those entries.

This leads us into sort order problems. Alphabetical English is not the only way that words are sorted. Many languages use different sorting rules. The far-east languages are the most removed from English, but even western European languages use slightly different sorting rules. Letters with diacritical marks may sort differently: 'A' with an umlaut may come after 'Z', double 'ss' may sort the same as a single 's', or 'ch' is considered a different letter that comes in-between 'c' and 'd'.

When you have users who are geographically diverse, they may require that the OAB files they use be sorted differently. Address Name Resolution may not be able to find entries and type-down in the Address Book pane may not work. This is because the user's client is using one set of rules to search a list of words sorted using an entirely different set of rules. The user could enter 'A' with an umlaut and they may be taken to the end of the address book when the entries they wanted are at the beginning. Or when entering a display name in Outlook and trying to resolve the name comes up with no matches found because the OAB was sorted with a different sort order. To improve this situation, in Exchange Server 2003 the OAB server stamps the OAB with the sort order that was used to create the files so the client knows what search rules to use when searching the OAB. However this only works for Outlook 2003. Older clients may still use different search rules.

To completely solve this issue you have one option: install a different Exchange OAB server with its own OAB for each client locale you want to support. Each server would have the system locale set to the locale of the client language you want to support. Once you've done this you now need to change the OAB settings for each user who requires a different sort locale. If you can move all your users who require a specific language to one Mailbox Store, you can change the default OAB setting for the Mailbox Store to the OAB that is sorted in the correct locale. If you can't put all the users who require the same sort order on the same Mailbox Store, you can set the user's OAB on the user object itself. See KB http://support.microsoft.com/default.aspx?scid=kb;en-us;275203

Since the OAB is now used by a larger part of the customer base, Microsoft is putting more resources on documenting the OAB. Microsoft has a good whitepaper on Offline Address Book best practices which covers OAB issues including sort orders. It can be found here: http://www.microsoft.com/technet/prodtechnol/Exchange/guides/OffLineAddressGuide

ExBPA v2.0 Is Here

ExBPA v2.0 has been released and you can grab it here. This version has support for MOM 2005 which I wrote about yesterday.
There are many improvements, such as the support for MOM 2005, multiple language suppport, DNS collector, scheduling capabilities, a new 'best practice' category, an improved scanning scope, etc, etc.
You can find out about all the new features of this version via the readme.

Exchange Web Releases due this week

From my buddy Joe!...
Just thought you may like to know what is coming this week:

Exchange Web Release 1.2 Scheduled to RTW March 15, 2005!
WR 1.2 Updates
Web Release 1.2 is scheduled to RTW March 15th, 2005. This message contains information on what is new and updated.
Overview of changes in WR 1.2:
WR 1.2 Updates. 1
Overview of changes in WR 1.2: 1
Summary: 1
New Tools: 1
ExMon. 1
New versions: 2
ExBPA v2. 2
Doc and tools changes: 2
LoadSim.. 2
Doc changes only: 2
UTD Notifications Binding Cleanup. 3
JetstressUI 3
MSSearch. 3
Exchange Profile Update. 3
Exchange Domain Rename Fix-Up. 3
ExMerge. 4


Summary:
New Tools:
ExMon
Description
Exchange User Monitor (ExMon) for Microsoft® Exchange Server enables administrators to view an individual user's usage and user experience with Exchange Server 2003. With this tool, you can gather real-time data for operating servers, to attain a better understanding of usage patterns of clients, and for future planning.
Additional Information
Please see the following documents for more information about ExMon:
Using_ExMon2.doc
Using_ExMonInternal.doc


New versions:
ExBPA v2
Description
The newest version of ExBPA includes numerous database updates as well as some very impressive enhancements including:
MOM 2005 support
Localized into all server languages
Scheduling capabilities
Additional Information
There are many more enhancements to this very useful tool. For more information, please see the previous messages sent by Paul Bowden and Shawn McGrath.

Doc and tools changes:
LoadSim
Description
Documentation changes:
Expected database size after default installation for 500 users.
Screenshot updated to show LoadSim 2003 values instead of LoadSim 2000 values.
Elaboration on what the generated score means.
Elaboration for remote configuration.
Running LoadSim 2003 with any version of outlook other than Outlook 2003 or Outlook 2000 is not supported.
Removed lsperf.reg import section from the LoadSim docs. The registration of performance counters is handled within the MSI setup, and we don't drop the lsperf.reg file anymore.

Application Change:
Invalid Delivery Time Warming changed to “debug” level because of erroneous messages as a result of initialization.
Bug Numbers
253112 DCR: Expected Database size needs to be documented or have LoadSim estimate it.
253113 Loadsim2003 doc still shows Loadsim2000 values and needs to get updated
253139 document why loadsim2003 does not work with any other versions of Outlook besides Outlook 2003
251951 LoadSim 2003 new warning to be documented
253188 Need to remove lsperf.reg import section from the LoadSim docs



Doc changes only:
UTD Notifications Binding Cleanup
Description
Updated documentation to remove references to “Select All” as a result of a UI change.
Bug Number
230515 Up-to-Date Notifications Binding Cleanup Tool: Documentation Update Required


JetstressUI
Description
Documentation modified to give guidance on configuring JetstressUI.
Bug Number
252357 JestressUI: documentation is not clear how the input parameters relate to the end database sizes
252792 JetstressUI: documentation needs to be updated to call out reasoning for 6 databases and how it doesn't have to match production


MSSearch
Description
Documentation modified to describe using “cscript.exe /h:cscript” or “wscript.exe /h:cscript” so that the usage is displayed on the command prompt instead of in dialog boxes.
Bug Number
252870 MSSearch_Admin tool - suggestions


Exchange Profile Update
Description
Documentation modified to state that you can not run Exchange Profile Update on a Terminal Server. There were also some link and heading fixes.
Bug Numbers
253024 ExProfRE is not supported on Terminal Server.
254340 Exchange Profile Update Tool doc: fix broken link reference

Exchange Domain Rename Fix-Up
Description
Documentation changes to reflect that
The Exchange Domain Rename Fix-Up Tool was first supported in Exchange 2003 SP1, NOT the RTM version.
The Exchange Domain Rename Fix-Up Tool will verify servers whose DNS name is part of the domain. If you have static names that do not contain the domain name, then they will NOT be reported with /verify. Customers should manually ensure that they do not have these or that they handle these manually.
Applying the restore.ldf file will undo the changes to the AD caused by applying the changes.ldf file.
Bug Numbers
235167 Domain Rename: "Exchange Domain Rename Fix-up.doc" should also state that E2K3 (Ti RTM) is supported with Domain Rename.
241567 Domain rename: after the second rename XDR-fixup /Verify does not report verification status of exchange server with statically assigned DNS name.
250213 XDR-Fixup doc needs to mention use of restore.ldf for reverting changes.ldf,

ExMerge
Description
Numerous small documentation bugs fixed
Bug Number
254939 ExMerge Tools Doc: Updates for WR1.2. This is a tracking bug for the numerous changes.

ExBPA Management Pack for MOM 2005

Microsoft has released the Exchange Best Practices Analyzer Management Pack for MOM 2005.
Overview:
The Microsoft Exchange Server Best Practices Analyzer (ExBPA) Management Pack can be used to deploy the ExBPA tool on computers running Microsoft Exchange Server 5.5, Exchange 2000 Server and Exchange Server 2003. Using a timed event, the tool will run automatically on each server and write any identified performance, scalability and availability issues to the Windows NT Event Log.

The ExBPA Management Pack will interpret these events and generate the appropriate alerts on the MOM Management Console.The ExBPA Management Pack works in tandem with the ExBPA tool:

• Identification of Exchange server configuration issues which could result in poor performance, scalability and unplanned downtime
• Automated analysis and root cause identification
• Support for third-party software and hardware
• Self-updating database and help content
• Links to over 500 articles on the Web
• Works with Exchange Server 2003, Exchange 2000 Server and Exchange Server 5.5 (in mixed mode topologies

Microsoft Renames 'Istanbul'

Microsoft has rechristened its "Istanbul' corporate instant-messaging client "Office Communicator 2005." The new client requires Service Pack 1 for Live Communications Server 2005 in order to provide the enterprise messaging, VOIP and web-conferencing functionality that Microsoft rolled out last fall. Microsoft also unveiled on Tuesday an upgrade to its Live Meeting web-conferencing service, dubbed Live Meeting 2005.

Exchange Tidbits

Evan Dodds posted recently a few answers to common questions.  Here are a few of them:

Couple of Exchange tidbits I’ve been saving up for a while. None of them are on my usual topics (Exchange clustering, site consolidations, etc) and they are not large enough individually to warrant their own post, but hopefully they’ll help you out.

1) You can force the Exchange 2003 SP1 RUS to stamp secondary email proxy addresses onto an existing user account without having to do “apply now” on the recipient policy. This is principally for cross-forest migrations, but may also work for users who haven’t been moved cross forest. KB.820381 covers the cross-forest scenario, but you can also set the GUID manually on the user’s msExchPoliciesIncluded attribute: {23668AD4-4FA1-4EE8-B2BB-F94640E8FBA0}.

2) NTDSNoMatch doesn’t have to be set on Custom-Attribute-10. Everyone refers to extensionAttribute10 when discussing NTDSNoMatch (see KB.274173, for instance). Little-known fact is that it doesn’t have to be attribute #10. If you’re using attribute #10 for something else, just put the “NTDSNoMatch” value into any of the 15 extensionAttributes and the ADC will pick this up transparently. Thanks to Alex Seigler for this find.

3) LegacyExchangeDN may add a random 8 digit number to ensure uniqueness. You may notice that sometimes the LegacyExchangeDN value associated with a user is of the format /o=org/ou=site/cn=recipients/cn=username######## rather than the expected /o=org/ou=site/cn=recipients/cn=username. This happens because the LegacyExchangeDN serves as the unique X500 identifier in the Exchange 5.5 directory, and as such, has to be unique. If there is any collision of LegacyExchangeDN values when the user is being mailbox enabled, eight random numeric digits are appended to the proposed LegacyExchangeDN and it’s checked again for uniqueness. Note that it really doesn’t matter what your LegacyExchangeDN is, so long as it’s properly associated with the user and is unique (ie - don’t bother trying to go back and “change” these unique-ified values)

Update for Outlook 2003 Junk Email Filter (KB892236)

Microsoft has posted another Junk E-mail Filter update for Microsoft Office Outlook 2003 with a more current definition of which e-mail messages should be considered junk e-mail. This update was released in March 2005.

You can get specific information about this update in the Microsoft Knowledge Base article Description of the Update for Outlook 2003 Junk Email Filter (KB892236).

Sender ID ready

SenderID is now ready for deployment.  Now lets convince the rest of the world to start using it.


see:

Implementation Tips for the Sender ID Framework—Creating Your SPF Record

Sender ID: Sender ID Overview

Sender ID Framework SPF Record Wizard

Microsoft Unveils Next-Generation Real-Time Collaboration Client

Real-Time Collaboration Client Will Strengthen Connection Between Customers And Their Telephony, Line-of-Business and Productivity Applications; Beta Program Open for Nominations

Today in his keynote address at the Fall 2004 VON Conference & Expo, Anoop Gupta, corporate vice president of the Real-Time Collaboration (RTC) Business Group at Microsoft Corp., outlined Microsoft's real-time collaboration vision and strategy for integrated communications, and announced plans for a next-generation client. Building on the recent success and rapid adoption of Microsoft® Office Live Communications Server and Microsoft Office Live Meeting, Gupta introduced the newest member of the Microsoft Office System, code-named "Istanbul," that will provide integrated communications capabilities including instant messaging, extensible presence, PC-based voice and video, and telephony integration.

"Customers depend on real-time communications to make more informed, timely decisions, and to stay better connected with their customers and grow their business," Gupta said. "With 'Istanbul,' Live Communications Server and Live Meeting, we are providing pervasive real-time collaboration capabilities and empowering our customers to work together more effectively. 'Istanbul' represents a milestone by integrating various modes of communications in one unified desktop experience."

......
The "Istanbul" beta program is open for nominations. Those interested in participating should contact their Microsoft account manager or sales representative for instructions on how to nominate their organization. "Istanbul" is scheduled for release in the first half of 2005. Full Story At Source

Exchange Server 2003 Security Hardening Guide (updated)

Updated February 2005. The download package for this guide includes important security templates. These templates were updated November 2004. This guide walks you through the process of hardening your Exchange 2003 environment, including configuration recommendations and strategies for combating external threats.

Read the entire Exchange Server 2003 Security Hardening Guide online or download the Exchange Server 2003 Security Hardening Guide . This guide is designed to provide you with essential information about how to harden your Exchange Server 2003 environment. In addition to practical, hands-on configuration recommendations, this guide includes strategies for combating spam, viruses, and other external threats to your Exchange 2003 messaging system. Important: Since the previous version of this guide was released, the following new topics have been added and are available only online:
• Running Exchange Server 2003 Clusters in a Security-Hardened Environment
• How to Run Exchange Server 2003 Clusters in a Security-Hardened Environment Download At Source

Live Meeting 2005 for Intranet deployment

Live Meeting 2005 Add-in: Microsoft Office Live Meeting Intranet Portal

The Microsoft Office Live Meeting Intranet Portal makes it easier to deploy and manage Live Meeting.

 

Live Meeting 2005 Intranet Portal Administrator’s and Programmer’s Guide

The Live Meeting 2005 Intranet Portal Administrator’s and Programmer’s Guide provides information to help administrators and developers to deploy, use, and customize the Live Meeting Intranet Portal.

Live Meeting 2005 Document: Live Meeting 2005 Deployment Guide

This guide provides the information you need to plan, understand, and perform a deployment of the Microsoft Office Live Meeting 2005 console in your environment.

And here are some Exchange 12 answers!

In a post from KC Lemson:

A few weeks ago, we asked you for your list of questions about E12 and said we'd pick a few and post answers on the one year anniversary of this blog, February 9th. Well as you can see, I totally missed that date :-) Very sorry about that and I'd be happy to list off my excuses, but let's get on to the good news instead: for the foreseeable future, we are going to have a monthly post about E12, the content will usually be based on the questions we get from you. So without further ado, here are answers to the first set of questions. Please add any additional questions as comments on the E12-focused posts and they'll be added to the list for consideration for answering the next time around. We won't be able to answer everything, depending on the state of the feature in question, as we only want to talk to you about features that are very baked. Without further ado:
 
Question #1: Lots of people asked about the 32k rules limitation:  "As someone else mentioned how about improvements to server side rules (32k limit)", "Since I ask this every time I talk to Microsoft developers :), any news on when will the 32k server side rule limitation be resolved".
 
Answer #1: I'm happy that I get to be the one to tell you that the 32k rules limit is gone... It's now 64k! Just kidding!! We are still determining what the default will be (there's a tradeoff in performance of course, the more processing you ask the server to do on inbound mail, so we want to choose a smart default), but the administrator will be able to change the limit.
 
Question #2: I'd like to see a unified messaging function in E12 (facsimile, voice,...).
 
Answer #2: UM is absolutely an area we are investing in, as you can see from some of the articles about it, such as this one from eWeek. If you call me at Microsoft today and leave me a voicemail, it gets routed to my inbox using only Microsoft technology.
 
That's it for right now, and look for a post next month with some more questions and answers about E12.

Exchange 12 To Ride a Faster JET

From an article in RedmondMag.com:

Exchange 12 To Ride a Faster JET
Microsoft is finally providing specifics on the next version of Exchange.

March 2005 • by Scott Bekker

Microsoft's long silence on Exchange is over.

In January, Microsoft publicly laid out plans for the next release of Exchange. Microsoft is calling the next version "Exchange 12" or "E12." The code-names emphasize the close ties to the next version of Office, code-named "Office 12."

Usually Microsoft starts talking about the next version of a product as soon as, or even before, the latest version ships. But since Exchange Server 2003 went gold in June 2003, Microsoft hasn’t said much on the record about its successor.

The big problem is that Microsoft had to figure out what to do next with Exchange. Exchange 2003 was an incremental release, essentially upgrading Exchange 2000 Server to take advantage of some useful plumbing changes in Windows Server 2003. They included security improvements, eight-node failover clustering and Volume Shadow Copy services.

For years the company has been toying with the idea of taking the data store from SQL Server and porting it to Exchange, replacing the JET storage engine that the messaging server currently uses. The effort was code-named "Kodiak," a vaguely defined future version of Exchange that would use the new data store. The design goal reflected a wider, long-standing effort within Microsoft to standardize the data store across major products. Microsoft had ambitious plans to use the SQL Server storage engine in the next version of Windows, code-named “Longhorn,” and Exchange. Cracks in that plan emerged in June, when Microsoft said Kodiak was off the table. A few months later, unified storage, known as WinFS, was pulled from Longhorn, too.

The JET storage engine will power Exchange 12 just as it did Exchange 2000 and Exchange Server 2003. A Microsoft spokesperson downplayed the technological role in JET's survival. "The decision to ship the next version of Exchange with JET was based on many factors, but the primary reason was customers. Staying with JET will mean customers will not be faced with the migration work associated with moving to a new store."

Customers have been unhappy with JET in scalability, high availability and developer hooks. JET is also old: Related to the JET engine used in the Microsoft Access database, it's a generation behind the SQL Server engine. To address these issues, JET is getting a serious overhaul for Exchange 12.

First, JET is getting x64 support (AMD64 and Intel EM64T), to allow greater scalability. No word as yet on Itanium support, but unlike SQL Server, Exchange would probably get as much scalability benefit as it could use from the 64-bit extensions. Microsoft is leaning more and more heavily toward supporting x64 in many products, and company officials predict most new server chips will ship with 64-bit extensions within the next year.

Exchange Web Releases

Microsoft won't have a new version of Exhange this year, but the company plans to push out several new technologies in a service pack and in Web releases: A storage sizing assistant An SMTP configuration diagnosis tool Public folder usage and analysis tools Integration of the Exchange Best Practices Analyzer with MOM 2005 Integration of the Sender ID Framework with SP2 — Scott Bekker

To address high-availability requirements, JET will support log shipping, a feature Microsoft built into SQL Server 2000. The technology allows Exchange to send its log of changes to another server, off-site if necessary, at set intervals. The process is the poor man’s server’s clustering—more likely to miss the most recent transactions but less expensive. The nod to developers comes with adding Web services to reduce the complexity associated with writing to multiple application programming interfaces.

Above the data level, broad themes of the next release are improved end-user productivity, total cost of ownership, manageability and secure messaging. The planned end-user productivity boost comes in part from an investment in unified messaging. Exchange 12 is slated to have an architecture within Exchange for e-mail, voice mail and fax.

Any new version of Exchange would come after Microsoft ships the "Istanbul" client for Live Communications Server 2005. That client integrates telephone with a Windows Messenger interface and the technology could provide a bridge to unified messaging in Exchange (see December 2004’s Redmond Roadmap, “The Road to Istanbul”).

Other ways Microsoft plans to improve user productivity for Exchange 12 include investments in the mobile device experience, Outlook Web Access and efficient and reliable meeting scheduling. Microsoft is working to reduce total cost of ownership and manageability for Exchange Server with scripting, the Web services APIs and improved search functionality.

Exchange Joins Microsoft’s Billion-Dollar Club

While Microsoft has begun talking about new versions of Exchange, the company is raking in cash from the old versions. Microsoft's Exchange Server business crossed the $1 billion revenue threshold in fiscal 2004 (July 1, 2003-June 30, 2004), the company disclosed recently. That fiscal year coincided almost perfectly with the launch and first 12 months of availability for Exchange Server 2003. Other Microsoft products that are good for a billion dollars or more in revenues each year are the Windows client operating system, Microsoft Office, the Windows server operating system and SQL Server. Microsoft’s total revenues for fiscal 2004 reached $36.8 billion. — Scott Bekker

Security is a huge messaging issue that Microsoft could address in a number of ways. For now, Microsoft officials say they are channeling resources into message "hygiene" at the perimeter and creating a privacy compliance infrastructure. The message hygiene technology is a remnant of the Exchange Edge Services 2005 project, which was broken up into components that will ship with Exchange Server 2003 Service Pack 2 and Exchange 12.

Dave Thompson, corporate vice president in charge of Microsoft's Exchange Server Product Group, says the release of Exchange 12 will be loosely tied to Office 12, but won't ship at the same time. Office 12 is unofficially scheduled for 2006. Exchange 12 may come in 2006 or 2007.

For now, the Exchange team is faced with a situation similar to the SQL Server team—a long time between releases. While the Exchange team may not be borrowing the SQL Server engine, it is borrowing a page from the SQL team's playbook in dribbling out new features and tools in service packs and Web releases (see "Exchange Web Releases," above ).