Blog'in I.T

Office 365 Exam Revision Notes

2012-01-26T13:02:00.001Z

I recently took both Office 365 beta exams (70-321 & 70-323) and along the way made many revision notes relating to key points particular around Exchange & Lync Online. There’s some reference to SharePoint to but I’m noticing more & more notes are becoming available in this area, especially with the recent service updates applied to Office 365.

The notes were derived from a culmination of the following sources: -

1. Personal experience

2. Office 365 Deployment Guide

3. Office 365 virtual labs (although at the time of writing these haven’t been updated to take advantage of Exchange 2010’s hybrid deployment functionality in service pack 2.

I hope these notes are of as use to the community as they were to me.

Note: These are not ‘brain dumps’ of contents from the exams I took, they are my personal notes taken to remind me of key points…and I’m happy to share this with everyone.

Key Points

Service

· RPO: described as ‘near instantaneous’

· RTO: 1 hour

Support

· Hybrid deployments only support coexistence within a single AD forest

· Use Exchange Deployment Assistant for configuring hybrid deployments

· Support exception required for DirSync replicating more than 20,000 objects

· High latency (bad), low latency (good)

Deployment Overview

· 3 x phases – Plan, Prepare & Migrate

· Plan & Prepare will overlap

· DirSync (Microsoft Online Services Directory Synchronization Tool) must be used to sync on-premise AD with O365

· To enable single sign-on, ADFS 2.0 federation & proxy servers must be used

· All ADFS (inc proxies) can be made HA

· For hybrid deployments, an Exchange 2010 hybrid server must be deployed on-premise

· Virtualisation support – federation & proxy servers supported, recommended on seperate physical hosts. Exchange 2010 hybrid supported

· No support for single label domains

· SSL requirements complex!

· Multiple forest deployment considerations: -

· ADFS allows only one namespace per farm/instance, i.e if busitc.com & busitc.co.uk are required then two ADFS farms are required to provide authentication for each namespace (subdomains, i.e. sales.busitc.co.uk don’t require a separate ADFS farm)

· Only internet routable domain names supported with ADFS, i.e. .co.uk, .com. .local, .internal etc aren’t (for AD’s that use non-routable domain names a UPN suffix needs to be added into ADF&T’s and then each user’s ‘UserPrincipleName’ suffix needs to be modified to routable domain

Distinct Functionality differences between Exchange 2010 SP1 & Office 365

· Max message size: 25MB

· Max 1500 recipients/day

· Max 30 messages/minute

· Deleted item retention: 14 days

· Deleted mailbox retention: 30 days

· No Outlook 2003 support

· No OWA public/private log-in

· Vanity OWA etc URL can be set-up through redirect

· OWA default time-out: 6 hours (configurable up to 24 hours)

· Minimum Windows Mobile 6.0

· No certificate based authentication for EAS

· BES support later in year

· No catch-all mailbox

· No custom address lists

· No GAL segmentation

· UM interoperability with on-premise Voicemail via SMTP or EWS only

· No OWA support for S/MIME

· Outlook S/MIME support limited

· No app connectivity through Exchange MAPI/CDO API

· No public folders

Exchange 2010 SP1 & Exchange Online (Office 365) Feature Comparison

Administration

· Partners can be authorised as a ‘delegate administrator’

· EWS only supported. CDO, WebDAV and any customer code requiring changes to Exchange Online not supported

· Standard identity – term refers to requirement for separate identity required for on-premise AD and O365

· SSO – also called identity federation – users use corporate AD credentials for both on-premise AD and O365

· User creation and provisioning options

· ‘Microsoft Online Services Module for Windows PowerShell’ enables single sign-on

· Microsoft Online Services Portal; used for: -

Add users, add domains, manage licenses, create groups.

· ECP allows Admins to manage individual mailboxes or entire Org (www.outlook.com/ecp/busitc)

· Remote PowerShell cmdlets: http://technet.microsoft.com/en-us/library/dd575549(EXCHSRVCS.149).aspx

· RBAC – following groups available by default in Exchange Online: -

Organization Management

View-Only Organization Management

Recipient Management

Unified Messaging Management

Help Desk

Records Management

Discovery Management

· Message Tracking – use ECP

· Remote PowerShell for usage reporting

· Auditing. O365 provides two types:

Admin Audit Logging – tracks changes made by Admins (on by default)

Mailbox Audit Logging – tracks access to mailboxes by users other than owners (off by default) (http://help.outlook.com/en-us/140/ff628722.aspx)

Archiving & Compliance

· Disclaimers supported – can be applied to different groups and control whether applied to internal messages, outbound or both (http://help.outlook.com/en-us/140/ff852816.aspx)

· Full transport rule support of all functionality in Exchange 2010 SP1 – managed using ECP or Remote PowerShell

· Using transport rules to copy all mail to an O365 mailbox for the purposes of archiving is not permitted.

· Personal archives – only fully supported with Outlook 2010 & Outlook Web App. Outlook 2007 provides basic support for personal archive. Outlook 2007 cannot apply retention or archive policies to items in mailboxes; instead must rely on Administrator-provisioned policies

· Enable archiving using remote PowerShell (http://help.outlook.com/en-us/140/ff628726.aspx)

· Outlook 2007 needs SP2 & cumulative update for Feb 2011 to access the personal archive

· O365 P1 plan includes 25GB storage for both primary & archive mailboxes

· O365 P2 plan includes 25GB storage for primary & unlimited storage in archive mailbox

· Default quota for O365 archive is 100GB. If more is needed a call needs to be raised with O365 support, this can be raised up or down

· Users can import data into archive by: -

Importing directly into archive mailbox in Outlook

Move messages from primary to archive

Let retention policies automatically move based on age

Note: New-MailboxImportRequest cmdlet is not available in Exchange Online!

· http://help.outlook.com/en-us/140/ff628726.aspx

· Deleted item retention – 14 days

Journaling

· Only journaling to any external location that can receive SMTP is supported, i.e on-premises to Exchange hosted archive,or third-party solution supported

· Journaling destination cannot be an O365 mailbox

· Journal managed by ECP or RPS

· Journaling configured on a per-user or per-distribution list basis

· Scoped for internal and/or external recipients

· Journaled messages include original message, sender, recipients, coped recipients including BCC!

· http://help.outlook.com/en-us/140/ff633680.aspx

Retention Policies

· Managed using RPS

· Two types of policies: -

Archive Policies

Delete Policies

· Users can, for example, tag a message so it’s auto moved to archive and deleted after another span of days

· Capabilities same as offered in Exchange 2010 SP1

· http://help.outlook.com/en-us/140/gg271153.aspx

Legal Hold

· Preserves users deleted and edited mailbox items for both primary & archive mailboxes

· Use ECP or RPS to set legal hold on individual mailbox or entire Org

· Includes ability to send users notification of hold

· http://help.outlook.com/en-us/140/ff628734.aspx

Multi Mailbox Search/Cross Premises

· Use ECP

· Emails, attachments, appointments & contacts supported

· Searches simultaneously across primary & archive mailboxes

· Items can be copied/moved to a designated mailbox for further investigation

· Administrators can connect Outlook to this mailbox and export search results to PST

Note: Admins can’t directly export mailbox search results to PST in O365

AD Synchronization

· Supports only 1 x AD forest

· DirSync requires Enterprise Admins access

· Exchange Hybrid deployments (2010 CAS & HT on-site) requires on-premise AD schema update

· Exchange 2010 hybrid deployments can be made HA by implementing 2 or more

· Domain Controller requirements for on-premise that communicate with O365

· AD on-premise clean-up

· DirSync sends status emails of objects that require sync attention

· AD Auditing – enabling SSO will capture directory services logs on DC’s

Single Sign-On

· SSO aka identify federation

· Allows for users to enter their corporate AD credentials to gain access to O365

· SSO used ADFS

· Must be ADFS 2.0

· Recommended ADFS is installed in ‘farm mode’. This allows flexibility if further ADFS servers later (maximum 5).

· When ADFS is installed in ‘farm mode’, first fed server acts as primary authentication liaison. All additional ADFS roles are deployed in ‘read-only’ mode

· Recommended 2 x ADFS fed servers & 2 x ADFS proxy severs are deployed for resilience

· Should be deployed at location nearest to majority of end users

· ADFS proxy servers should be deployed in DMZ

· Proxy to federation communications is port 443.

· Best practice to deploy hardware load balancer in front of ADFS proxies to balance authentication requests, although Windows NLB supported

· HLB/NLB can also be used for ADFS fed roles

· DirSync must be deployed first

· Plan for and deployed AD FS 2.0 for use with single sign-on (http://onlinehelp.microsoft.com/en-us/O365-enterprises/ff652539.aspx)

· End user experience: -

· No SSO means separate log-in’s for both AD on-premises & O365

· Main benefit of SSO means on-premises AD password policies & account restrictions can be enforced

· SSO supports 2-factor authentication. This is only available using Office Web Clients

· User experience varies dependent on location: -

Corporate network: enables access to O365 resources without signing in again

Roaming on domain-joined PC: enables access to O365 resources without signing in again

Home or public PC: user needs to sign-in to O365 and ADFS proxy servers are required

· ADFS requirements: -

Single AD Forest

AD FS 2.0

Windows 2008 or Windows 2008 R2

Clients: Windows 7, Windows Vista SP2, Windows XP SP3

SSL certificates required for AD federation & proxy servers

Windows PowerShell 2.0 & Microsoft Online Services Module for Windows PowerShell (http://onlinehelp.microsoft.com/en-us/O365-enterprises/ff652560.aspx)

· Relying Party trust relationship required between federation server farm & O365. Relying party acts as a secure channel where authentication tokens can pass between on-premise & O365: -

· ADFS Pre-Installation Requirements: -

.Net framework 3.5 SP1

ADFS hotfixes (http://office.microsoft.com/en-us/outlook/top-10-reasons-to-try-outlook-2010-HA101631728.aspx)

· To check UPN suffixes using PowerShell

o Import-Module ActiveDirectory

o CD AD

DirSync

· REQUIRES X86 PLATFORM!

· Hardware specs: -

· Syncs mail-enabled users, mail-enabled groups, security-enabled groups (for SharePoint Online) & mail-enabled contacts from on-premise AD to O365

· Requires install on dedicated domain member server

· Set-up installs SQL Server Express edition which has maximum file size limitation 10GB (sufficient for about 50,000 objects)

· More than 50,000 objects to sync, full version of SQL Server 2008 required

· Deploying full SQL is best practice

· Enterprise Admin rights required at time of install. Post-install a non-priviledged AD account required and done automatically at DirSync install

· Required if Exchange hybrid deployment model needed with O365

· Can also provide GAL sync between on-premise & O365

· First-time sync results in all replicated objects being marked as ‘non-activated’, this means they can’t send or receive email and do not use any subscription licenses. Sync’d users are activated by being assigned appropriate license

· DirSync enables the following: -

SSO

Lync Online coexistence

Hybid deployment using: -

Fully shared GAL between on-premises & O365

Ability to ‘onboard’ & offboard’ users between on-premises & O365, i.e move users back to on-premises if needed

Allow mailboxes to be on-premises and at O365

Safe & blocked senders are replicated to O365

Sync of photos, thumbnails & conf rooms

· If DirSync needs to replicate more than 10,000 objects a support request needs to be logged with O365 support and number of objects roughly to be replicated needs to be given

· First sync network heavy, proceeding sync’s incremental

· 2-way sync option is known as ‘write-back’

· 2-way sync option takes advantage of O365 archiving, safe & blocked sender config, voicemail

· 2-way sync necessary for copying changes at O365 AD back to on-premise AD

· Features enabled by 2-way dirsync and write-back attributes necessary: -

Capacity Planning

· Recommended hardware based on user numbers: -

Exchange Online Planning

· Two types of coexistence with O365 - Hybrid Deployment & Simple Coexistence

· Hybrid deployment – requires Exchange 2010 hybrid role on-premise, dirsync & ADFS

· Simple Coexistence – No SSO, users maintain separate authentication credentials for O365 & on-premise

· Hybrid deployment can: -

Share free/busy calendar data

EMC can be used to manage both O365 & on-premises environments

Outlook profiles are automatically updated, as in intra-org transition (requires appropriate hybrid server & autodiscover configuration)

No resync of OST

OWA redirection allows for redirection from on-premise OWA to O365 OWA

MailTips, OOO etc continue to work as all part of same topology

Delivery reports & multi-mailbox search work with users in both O365 & on-premises

Authentication headers are preserved during O365 & on-premises mail flow, so all mail feels and looks internal to company

Mailbox moves can go from O365 to on-premises if required, as well as vice-versa

· Hybrid Coexistence vs Simple Coexistence: -

· Hybrid Deployment considerations: -

Delegate permissions (inc delegate access,l folder permissions and “send on behalf of”) are migrated but not available until ALL PARTIES are moved at same time, e.g. if an executive in your organization is migrated to Exchange Online then his or her administrative assistant will need to be migrated at the same time in order to maintain delegate access

On-premises mailbox permissions such as Send As, Receive As and Full Access that are explicitly applied on the mailbox are migrated. However, inherited (non-explicit) mailbox permissions as well as any permissions on non-mailbox objects—such as distribution lists or a mail-enabled user—are not migrated. Therefore, you will need to plan for configuring these permissions in Exchange Online if applicable for your organization. For example, you can use the Add-RecipientPermission and Add-MailboxPermission Windows PowerShell cmdlets to set the permissions in O365

Multi-forest AD environments implementing multiple forests for logon or resource segmentation do not support a hybrid deployment.

· Hybrid Deployment Requirements

Exchange 2010 Hybrid must be running SP1

Exchange 2010 Client Access server role on the hybrid server acts a proxy between older Exchange environments and Exchange Online without the need to migrate on-premises Exchange mailboxes to Exchange 2010

DirSync write-back is recommended to enable smooth offboarding of users

Microsoft Federation Gateway is free online service offered by Microsoft that acts as the trust broker between your on-premises Exchange organization and your Exchange Online service. Organizations implementing a hybrid Exchange deployment must create a federation trust with the Microsoft Federation Gateway

· Use Exchange Server Deployment Assistant for detailed deployment configuration

· Hybrid role requirements: -

· Topology where no coexistence established: -

· Topology with coexistence established: -

· Changes after hybrid coexistence complete

Migration

· O365 supports 5 types of mailbox migrations

Exchange Server mailbox

Hosted Exchange mailbox

IMAP4 mailbox

Lotus Notes

GroupWise

· Types of Exchange migrations: -

· Supports migration of ‘delegates’

· Mailbox migration of ‘delegates’ and their ‘managers’ should occur at the same time

IMAP Migration

· Suitable for small org’s, quick cut-over, no coexistence

· User ID’s are automatically provisioned with the IMAP migration tool within ECP (Mailboxes will need to be created before use of IMAP migration tool)

· ADFS can be deployed after

· Supported IMAP servers: -

Courier-IMAP

Cyrus

Dovecot

UW-IMAP

Exchange 2010, 2007 & 2003

· Recommended max 10 connections to IMAP server to avoid IMAP resources/bandwidth overload

Notes/GroupWise Migrations

· MS recommend third-party tool involvement; Quest/Binary Tree etc

Mailbox Migrations

· Common practice to reduce mailbox sizes is to move mail to archive either manually or with auto-archive. This is discouraged as when user moves PST export back in to mailbox, the Exchange online mailbox wil not allow user to reply to mail.

· To reduce mailbox size consider following: -

Delete or archive mail in sent items

Delete or archive calendar attachments

Delete or archive attachents over 5MB

Disable Outlook journaling

Empty deleted items

Run mailbox cleanup wizard from Tools menu in Outlook

Bandwidth

· Not just Exchange mailbox moves, but also impact of Lync & SharePoint use

· Determine average mailbox size for mailboxes to be moved to O365

· Determine average connection & throughput speed from O365 to on-premise

· Calculate average expected transfer speed and plan mailbox moves based on these

Certificates

· For hybrid deployment MS recommend: -

Dedicated third-party certificate for ADFS

Dedicated third-party certificate for Exchange services on Hybrid Server

Self-signed for federated delegation on Hybrid Server

As at http://technet.microsoft.com/en-gb/library/gg476123.aspx

Public Folders

· Not supported in O365

· Mailboxes moved to O365 won’t have access to public folder data in on-premise Org

· Existing on-premise public folder config won’t be changed during hybrid deployment

· Microsoft recommends moving PF-located calendars, tasks & contact lists to SharePoint

· Alternative is to use ‘shared’ mailbox in O365

Client

· Defined as ‘rich’ experience or ‘web’ experience

· Rich experience is native Outlook client

· Web experience is browser-based

· Port exhaustion must be considered. A public IP for every 2000 user due to connection persistency requirements

· Recommended clients are: -

Outlook 2010

Outlook 2007 with SP2

Outlook Web App

Outlook for Mac 2011

Entourage 2008 Web Services Edition

· Outlook 2003 not supported

· All client connections support encryption: -

Outlook, OWA, EAS & EWS use SSL over 443

IMAP uses SSL over 995

O365 supports transport and storing of messges encrypted using client-side, third-party encryption, i.e. PGP. O365 does not host public keys, key management or key directory services

· ActiveSync supported against Hybrid server

· Minimum Windows Mobile version is 6.0

· Nokia E & N Series, Android, iOS & BlackBerry supported during coexistence

· RIM will introduce a new hosted BES service for Exchange Online customers later in year. RIM will host, license & support the service (http://community.O365.com/en-us/b/microsoft_office_365_blog/archive/2011/03/16/office-365-and-blackberry.aspx)

· Thresholds for mail items in folders (set deliberately by MS for O365 to mitigate service performance issues (http://technet.microsoft.com/en-us/library/cc535025(EXCHG.80).aspx) : -

Inbox: 20,000 items

Sent Items: 20,000 items

Deleted Items: 20,000 items

Calendar: 5000 items

Contacts: 5000 items

Contacts & Distribution Groups

· Created in ECP or sync’d from AD on-premise

· Supports restricted, dynamic, moderated & self-service DG’s

Address Lists

· Hierarchical, GAL segmentation & custom GAL views not supported in O365

· Photos can be provisioned on-premise and will be sync’d to O365, users can also upload their own photo in MOS portal

Calendar Sharing

· Free/Busy easily shared with anyone else on O365, trust is pre-config’d for all customers on O365

· O365 supports federated sharing with Exchange Org’s outside of O365

· http://technet.microsoft.com/en-us/library/dd638083.aspx

Conference Rooms & Resource Mailboxes

· Created in ECP or RPS

· DirSync will sync existing on-premise to O365

· Mailbox quota for conference rooms is 250MB

· Conference Rooms do not require a user subscription license (http://help.outlook.com/en-us/140/Ff628697.aspx)

Mail-Enabled Apps

· User the Exchange Legacy API Scanner to analyse mail-enabled applications with legacy API’s (http://exapiscanner.codeplex.com/)

· Mail-enabled apps may require Exchange HT on premise if it doesn’t support EWS

· Forefront Online white list, block list & policy filtering modification may be required in order to allow potentially blocked emails generated by mail-enabled apps

· O365 can be used as an SMTP delivery service to relay messages from fax, network appliances or any custom/bespoke app

· Must authenticate to an O365 mailbox, connect over TCP 587 and use TLS

· Same message size limits apply

· http://blogs.technet.com/b/msonline/archive/2009/09/02/using-smtp-relay-with-exchange-online.aspx

· http://help.outlook.com/en-us/140/cc835669.aspx?sl=1#FindTheServerSettings

· Outlook Web App parts supported http://technet.microsoft.com/en-gb/library/bb232199.aspx

· Exchange MAPI & CDO not supported as these need to be on same local network as Exchange and will not connect over internet, which is required

· Lync Online can be federated with Lync/OCS on-premise as long as using different SIP domains

· No support for WebDav

Archiving, Retention & Compliance

On Office 365, Ankur noted that Single Item Recovery (SIR) is enabled by default for all mailboxes. SIR means that all changes to deleted items in a mailbox such as attempts to purge the items or to edit their contents will be tracked by Exchange for the retention period that’s specified. In this case, Office 365 uses a retention period is 14 days. On-premises Exchange 2010 mailboxes are not enabled for SIR by default. You have to enable mailboxes explicitly by running the Set-Mailbox cmdlet. For example:

Set-Mailbox -Identity Tony -SingleItemRecoveryEnabled $True

The retention window is configured per-mailbox or per-database. For example, if I wanted to set a retention period of 365 days for a mailbox, I’d run a command like:

Set-Mailbox -Identity Tony -RetainDeletedItemsFor 365

Whereas for a mailbox database I’d use a command like:

Set-MailboxDatabase -Identity DB2 -DeletedItemRetention 365

Of course, expanding the deleted item retention period (for a database in particular) increases the storage requirement for a database and shouldn’t be altered unless necessary. It’s also worth noting that calendar items are retained for 120 days at least even if a smaller retention period is specified.

The next factoid that I learned is that Office 365 uses a Managed Folder Assistant (MFA) workcycle of seven days. By comparison, the on-premises Exchange 2010 MFA uses a one-day workcycle. The workcycle sets a goal for the MFA in terms of how often it should process a mailbox to clear out deleted items, stamp items with retention tags, and action items whose retention period has expired. I guess it’s logical that Office 365 would want to minimize the amount of processing load that MFA imposes on mailbox servers but a 7-day workcycle does mean that items in mailboxes might not be processed as quickly as you’d expect. For example, an item that you’d expect to move to the archive after 30 days might linger in the mailbox and only move after 36 days. A small point to keep in mind.

It’s logical but might escape some that retention policies have to be maintained in two places if you operate a hybrid on-premises/cloud environment. For on-premises Exchange 2010, retention policies and tags are maintained in the Exchange configuration data in Active Directory and are not shared with the cloud. Therefore, if you’ve created a set of retention policies and tags to enforce compliance, you have to duplicate them in both places.

Some scripts are provided on the Exchange 2010 kit that can help, even if the ongoing synchronization will be a manual process. Details of the scripts can be found in the deck referred to above. As per this TechNet article, the magic that assures that both policies are deemed to match is having a similar RetentionId property. Having the same policy and tag occurs automatically in at least one instance. If you enable an archive mailbox for an on-premises user, their mailbox is assigned the “Default Archive and Retention Policy”. This policy is the same on both sides of the cloud divide so it follows that the policy can be implemented consistently. Before you rush to implement archive mailboxes and their associated retention policy, you might like to read this post.

If policies are not identical on both sides, mailboxes that are moved to Office 365 cannot maintain the tags that the on-premises MFA stamped on them. The tags are removed by MFA when it processes the Office 365 mailbox for the first time because MFA cannot resolve the tags (this is the same behavior that exists when you delete a retention tag from on-premises Exchange). All of this means that it’s important the same policies and tags are available on both sides else the Office 365 MFA cannot apply them to the newly arrived mailbox.

Ankur was asked whether it’s possible to apply a retention tag with a transport rule to an outgoing message as it passes through the transport system en route to another domain. The answer is “no” and again it’s pretty logical as Exchange has no knowledge of what kind of target domain you’re sending to and anyway, it’s only Exchange 2010 that would have any chance of understanding and applying the retention tag on arriving items. Also, would you like if an external organization had the chance to apply retention policies to items under your control? The real answer here is that if you want control over outgoing items you’ll have to use Active Directory Rights Management Services to apply templates and then hope that the receiving servers can understand and respect the restrictions.

The question was posed whether Exchange 2010 discovery searches can generate a manifest (perhaps in XML format) of all items discovered by the search so that this can be included in a PST (generated by the New-MailboxExportRequest cmdlet) and provided to a legal investigator. Again the answer is no. Exchange captures items that satisfy search criteria in the target discovery search mailbox and it’s up to you to decide how to process them from there on. I’m sure that someone clever could use Exchange Web Services to scan the discovery search mailbox and enumerate the items retrieved by a search to create a manifest – maybe this has already been done elsewhere or perhaps it’s a feature of one of the third-party compliance products that now compete with Exchange.

Ankur was asked how to migrate items from a third-party archive to Exchange 2010. The answer was that some products include the ability to restore items from their archive into user mailboxes. If this is possible, then the user can move the recovered items into the archive or let Exchange do this automatically through archive tags in a retention policy. The alternative is to use products such as those available from Transvault to move data directly from the archiving solution to Exchange 2010.

An interesting question was how best to export data from a discovery search mailbox on Office 365? The problem here is that the New-MailboxExportRequest cmdlet is not available to Office 365 administrators, probably because the cmdlet depends on the ability to access a network file share where it will create the PST to hold the exported data. Of course, Office 365 doesn’t have access to network file shares in your environment so it can’t write out the data. So you have to revert to the age-old answer of using Outlook as an intermediary. Connect Outlook (2007 or 2010 – 2003 can’t connect to Office 365) to the discovery search mailbox where the data is located and drag and drop to a local PST and then provide that PST to whoever needs it. A kludge, but it works.

Message Hygeine

· O365 uses Microsoft Forefront Online Protection for Exchange (FOPE)

· Protects incoming, outgoing & internal message flow

· Uses proprietary anti-spam technology and multiple anti-virus engines

· Admins can manage advanced settings specific to environments using FOPE Admin Centre

· Users manage safe & blocked senders within Inboxes in Outlook or OWA

· Admins can manage org-wide safe & blocked senders via FOPE Admin Centre (IP’s, domains & email addresses can be allowed or restricted)

· SCL processing: -

High SCL’s are deleted at perimeter

Low SCL’s delivered to Inboxes

Borderline SCL’s are placed in Junk folder and automatically removed after 30 days

· By default, no emails are kept in FOPE spam quarantine; eliminates need for managing separate quarantine

· Clients can choose to use FOPE’s spam quarantine rather than integrated junk mail filter in Outlook/OWA

· Admins can change spam action settings in FOPE Admin Centre (http://technet.microsoft.com/en-us/library/ff715240.aspx)

Message Routing

· On premises appliance or another hosted service can be used to filter email before it reaches O365. In this scenario, the email domain’s MX record is pointed to the appliance or service which then passes to O365. This config can also be used in coexistence

· O365 supports ability to route outbound mail through on-premises server or hosted service. This allows custom post processing of outbound email and another option of delivering mail to business partners via private networks

· Custom routing configured within FOPE

· Address re-writing not supported by O365 however messages can be routed via on premises server for this functionality

· O365 supports opportunistic & forced TLS encryption

Unified Messaging

· Allows a business to connect its on-premise phone system to voicemail services provided by O365

· Speech access to directory not supported (http://help.outlook.com/en-us/140/gg299309.aspx)

· On-premises PBX can be connected to O365 using VOIP media gateways or an IP-based PBX directly to O365 UM through session border control.

· Interoperability with Lync 2010 on-premise for full voice support is supported in O365

· Voicemails are recorded and stored in O365 mailboxes

· Hosted UM services supported include call answering (VM), dial-in to Exchange (OVA) and automated attendant

· UM migration supported only from on-premise Exchange 2007 & 2010

· http://help.outlook.com/en-us/140/ff628732.aspx

· http://technet.microsoft.com/en-us/exchangelabshelp/gg702674

· O365 does not provide outbound fax services

· Inbound fax solutions can interoperate with O365

Monitoring

· If federation servers &/or proxies are unavailable , single sign-on users who attempt to access any O365 service will be unable to authenticate and therefore access services

· SCOM management pack available for ADFS

· SCOM allows for ‘synthetic’ log-ins to ADFS

Backup & Restore

· The ‘Update-MSOLFederationDomain’ PowerShell cmdlet in the MS Online Services module for Windows PowerShell needs to be run to restore ADFS configuration

Known Issues

Other

· Administrators can reduce maximum mailbox sizes via Remote PowerShell

SharePoint

Lync 2010

· Lync Online provides: -

Presence

A/V communication

Online Meetings

Application & Desktop Sharing

Lync Domain Federation

Lync Client

Lync Web Application

· Lync Online is not a PBX replacement/integration

· When deploying with Lync on-premise, SMTP address & SIP URI must be the same

· OCS 2007/R2 client cannot be used with Lync Online

· Lync client uses ports TCP 5061 & 443

Prepare

· High-level sequence of tasks: -

· Key Activities Summary

Microsoft Office 365 Federation Setting for Microsoft Lync

2011-09-25T19:36:00.001+01:00

I was recently trying to add users to my Lync 2010 contacts who are outside of my subscription list (my Exchange/IM/SharePoint is hosted on the Microsoft Office 365 platform) and after much searching discovered the namespace you’ll need to give to the target Lync/OCS Administrator in order to establish federation. The setting that worked for me was: -

“sipfed.online.lync.com”

To check your setting is the same: -

1. Log-in to your Office 365 administration page

2. Select ‘Domains’

3. Select the domain namespace you use for your Lync 2010 clients within Office 365

4. Select ‘View Properties’

5. Select ‘DNS Manager’ and examine the value for the SRV record type “_sipfederationtls'” type (shown below)

Once my Client had added this value to their list of domains allowed to federate with theirs I could simply add users in my Client’s namespace, and vice-versa.

Hope this helps anyone who’s looking.

Live on Office365….25GB storage on Exchange 2010, SharePoint 2010 & Lync 2010 for the price of a cup of coffee!

2011-06-29T14:23:00.001+01:00

I’ve been running my production mail on Office365’s P1 plan since the first beta invites went out and have today subscribed after the service went live yesterday. The one thing that has shocked me, other than the impressive array of functionality, is the price for the P1 plan…only £4 per month!

I appreciate this is only the entry level subscription plan but for just me it’s perfect! I get a 25GB mailbox with 25MB attachment sending, a SharePoint workspace for document collaboration & reviewing with my Clients & Colleagues, Lync 2010 functionality with federated access to others I know using Office365….and all this accessible from anywhere!

The integration of Lync presence and the ability to communicate with contents via Outlook Web App (OWA) is also superb meaning wherever I am, I can still IM through my browser.

My previous Exchange hosting provider used to provide a 1GB mailbox for £7 per month….and no other features! Contact terminated!

Great value service, rich in functionality and aimed from 1 user to the enterprise. I’d have paid nearer £20 per month for all this! Brilliant stuff Microsoft.

Using Windows PowerShell to connect to and administer Office365

2011-05-02T15:08:00.001+01:00

If you’re using Office365 as your messaging and collaboration platform, did you know you can use Windows PowerShell to administer your Exchange resources, in the same way you can use the Exchange Management Shell for an on-premises solution.

Simply run the following lines within Windows PowerShell: -

#Set the PowerShell execution policy on each Exchange 2010 Server to unrestricted

Set-ExecutionPolicy Unrestricted

#Enter your Office365 administration authentication credentials

$LiveCred = Get-Credential (the below windows will appear)

#Allow redirection of your PowerShell session to your Office365 portal using credentials supplied above

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic –AllowRedirection

#Supported Exchange Shell Management commands are imported into your session

Import-PSSession $Session

You now have exposed supported Exchange Management Shell commands for your Office365 platform at your fingertips. For a full list of supported commands see: -

http://technet.microsoft.com/en-us/library/dd575549(EXCHSRVCS.149).aspx

For example, to retrieve mailbox statistics on an Office365-located mailbox you’d run the following supported cloud command just as you would on an on-premises solution.

Enjoy.

Exchange 2010 Client Access (CAS) Load-Balancing Best Practices/Recommendations

2010-12-13T13:10:00.001Z

Designing highly-available Client Access role deployment for Exchange 2010 has never been simple, software or hardware network load balancing solutions?

Generally, recommendations from Microsoft have always been that Windows NLB scaled fine up to 8-nodes, anything above that and a hardware based solution is recommended.

The problem is, most Clients I work for utilise 2-4 CAS roles within a single Active Directory Site making Windows NLB a viable solution. Due to the cost of hardware load balancers this solution is not viable and Windows NLB is sufficient However, there are additional problems I’ve seen with Windows NLB: -

Quote from MSExchange Team

“1. It only provides the ability to do IP-based affinity. So we don't get the persistent capabilities that we need.

2. It doesn't provide service awareness… it's "server-aware". If the web service fails, Windows Network Load Balancing has no concept of that. It just continues to route requests to that and then the user has a broken experience.

3. It doesn't scale well. When we talk about Outlook connectivity, and Outlook going to this load balancing solution, you know, if it's just direct Outlook connectivity, at a minimum we're doing 4 TCP sessions - plus one or two HTTP sessions, for that connectivity. So - 4 MAPI sessions, 2 HTTP sessions. So that's 6 sessions that you have to deal with, per Outlook client at a minimum. And then, you look at the perspective that you might have 50,000 of those clients, or a 100,000 of those clients, all connecting to this array. That's just a scale that Windows Network Load Balancing does not deal with.

So anything over 8 nodes - we don't recommend that you use Windows Network Load Balancing. “

In my opinion, if you can afford it, go for a hardware load balancing option as you can combine this kit with other applications you may be deploying in conjunction with Exchange, i.e. Office Communications Server 2007 R2/Lync 2010. You’re also then able to maybe consolidate Exchange roles by combining the CAS with Mailbox (CAS using Windows NLB is not supported with Exchange 2010 DAG members due to clustering reuqi

Exchange 2010 Service Pack 1 SP1 Pre-Requisite Installs

2010-12-08T11:10:00.001Z

Have you come across the pain that is implementing pre-requisites for Service Pack 1, Exchange 2010 and being presented with the below window: -

Well once you’ve downloaded the hotfixes you have to perform multiple restarts. to get around this, paste the following into a batch file in the order shown and you’ll only have to restart once.

Enjoy!

#Exchange 2010 SP1 Pre-Req Install Routine
FilterPack64bit.exe /quiet /norestart
Windows6.1-KB977020-v2-x64.msu /quiet /norestart
Windows6.1-KB979744-x64.msu /quiet /norestart
Windows6.1-KB982867-v2-x64.msu /quiet /norestart
Windows6.1-KB983440-x64.msu /quiet /forcerestart

Exchange Management Shell

2010-12-06T14:58:00.001Z

OK, so it’s been a while since I’ve blogged but I’ve had my head buried very deep in various Exchange 2010 deployments, even more so now SP1 has been released and many features not deemed ready for RTM are now available.

In the last year I’ve really delved deep into PowerShell and have seen the benefit in using this interface to deploy and manage Exchange….I intend to post exerts from my compiled deployment PowerShell scripts to my blog regularly to help anyone out there interested.

To get it started here’s one of my favourites

#OUTPUT EVERYTHING YOU SEE IN THE EXCHANGE MANAGEMENT SHELL WINDOW TO A TEXT FILE FOR REVIEW LATER ON

Start-Transcript c:\EMSLog.txt –Append

Stop-Transcript

Note: I use the ‘-Append’ switch to update the existing log file

Microsoft Exchange Deployment Planning Services

2009-11-25T08:15:00.001Z

I was recently pointed to this URL by a very kind Microsoft Partner resource, a Microsoft partner site for those engaging with Microsoft to deliver Exchange 2010/2007 solutions.

The site includes fantastic delivery templates for use with your Clients, Office Communications Server 2007 R2 material is included to.

Extremely useful . . .

Linkedin Recommendations – A great online accompaniment to the CV (especially if you’re a Contractor)

2009-11-24T15:42:00.001Z

I use Linkedin religiously, not just to keep in touch with colleagues past and present but also to display references (or, in Linkedin speak; recommendations). As a contractor I work for different Clients and it’s great to have a reference from each of them all in one place ready for prospective Clients to reference and align to my CV history/employment dates.

What are you experiences of Linkedin? My only annoyance is that recommendations given to you are only displayed to your connections on Linkedin, not to the rest of the world on your public profile :-( . Therefore anybody requiring access to your references will need to become a connection first.

Click on the Linkedin icon above to visit my profile and add me as a connection if you want to view my references.

Exchange 2010 Hub Transport Server Role Architecture Poster PDF Download

2009-11-24T14:42:00.001Z

Microsoft have recently released a great new PDF detailing the Exchange 2010 Hub Transport role architecture. Apparently other PDF’s detailing Exchange 2010 architecture including roles are on the way.

Download the above poster here:

Shouting in the Data Centre

2009-11-24T14:32:00.001Z

A tutor on a recent training course gave me this link! The motto of the story… whispering only whilst in the data centre please!

Windows 7 – Trial it for 120 days instead of 30!

2009-11-24T13:10:00.001Z

As long as you’re using an RTM version of Windows 7 (any version) it’s possible (legitimately of course) to extend the 30-day trial to 120 days. However, you have to make sure you perform it at the right time during the trial.

This process assumes you haven’t entered a product key during the installation procedure

When you get to the end of the 30-day trial you’ll need to reset the ‘timer’ for the evaluation period. To do this: -

1. Launch a command prompt (make sure you do this with Administrator privileges (right-click > run as administrator) ).

2. Enter ‘SLMGR –REARM’ and press enter.

3. Restart Windows 7

SLMGR is a VBS script within Windows that performs Windows 7’s licensing management. The ‘-REARM’ switch resets the trial period for another 30 days (you can perform this 3 times) on top of the initial 30-day trial to give you 120 days.

Additional options as follows: -

Exchange 2010 Pre-Requisites

2009-10-23T22:30:00.001+01:00

I’ve been working on Exchange 2010 Beta & RTM a lot lately and have found configuration of pre-requisites for the various single/combination of Exchange 2010 roles a breeze when running on Windows 2008 R2.

Instead of using the ‘ServerManagerCMD'’ routine in Windows 2008 (non-R2), the default Powershell ‘cmdlet’ ‘add-windowsfeature’ makes it very simple by adding all pre-req’s in a single line. Here’s what you need to run for the various roles: -

Roles

CAS = Client Access Server, HT = Hub Transport, MBX = Mailbox, UM = Unified Messaging, ET - Edge Transport

CAS/HT/MBX
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

CAS/HT/MBX & UM
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy,Desktop-Experience
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

CAS/HT
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

HUB/MBX
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

CAS/MBX
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

CAS
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest-Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

HT
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

MBX
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

UM
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic-Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt-Console,WAS-Process-Model,RSAT-Web-Server,Desktop-Experience
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

ET
1. Import-Module ServerManager
2. Add-WindowsFeature NET-Framework,RSAT-ADDS,ADLDS
Restart when 2. is complete
3. Set-Service NetTcpPortSharing -StartupType Automatic

Free Anti-Virus Software . . . from Microsoft. Welcome Microsoft Security Essentials

2009-10-08T10:52:00.001+01:00

I’ve been a big fan of Microsoft’s Windows Live OneCare for years, subscribing annually to protect the multiple PC’s I run. It’s light system footprint, unobtrusive workings and tight integration with all recent versions of Windows to provide excellent protection made it a must for me.

However, over the last few months a statement appeared on the Microsoft website saying the product was to be discontinued . . .

Microsoft Security Essentials would be its replacement (as stated in the paragraph immediately above).

You can download it here or here: www.microsoft.com/securityessentials

And here’s some screenshots of it running on my Windows 7 notebook:

Exchange 2007 SP2 running on Windows 2008 R2 Member Servers

2009-10-07T17:48:00.001+01:00

There’s been a lot of talk about the lack of support for Exchange 2007 role installations running on Windows 2008 R2 domain member servers. Below is the official support statement published by the Microsoft Exchange Team.

Note: Windows 2008 R2 domain controllers are supported in an Exchange 2007 Organisation.

Free Exchange 2010 Online Training

2009-10-07T15:50:00.001+01:00

A 2-hour collection of Microsoft Learning ‘Clinics’ exploring the features of Exchange 2010 available here.

Windows 2008 R2 Functional Level…..a great new feature when you raise your forest level to it.

2009-10-07T14:51:00.001+01:00

I recently raised a Client’s Active Directory forest functional level to ‘Windows Server 2008 R2’ as we’d upgraded all of their DC’s to the R2 version. This feature doesn’t appear to be widely publicised but provides useful functionality.

You can read more here.

Exchange 2007, OCS 2007 & Outlook 2007 - all working together nicely

2008-09-18T15:07:00.001+01:00

I was recently priviledged to be involved in a deployment where OCS 2007 was integrated with Exchange 2007 enabling users to access voicemail and manage their mailbox not only from desk phones but also their OCS Clients.

4 weeks after deployment, feedback from my Client is they're impressed . . .very impressed, particularly with how users are informed on missed events through the integration of Outlook 2007 with Exchange 2007 UM, and Exchange 2007 UM with SP1 with OCS 2007.

The screen shot below of my mailbox shows just how integrated OCS 2007 and Exchange 2007 SP1 are . . .

Somebody . . .

1. calls me via my OCS Client and I miss the call

2. IM's me and I'm offline or away

3. leaves me a voicemail,

. . . I get an email to let me know.

I know Exchange 2007 UM has been here for a while and missed call and voice mail notifications are not new, but the way OCS now integrates with Exchange 2007 UM (SP1 deployments only) and Windows Mobile, OWA and Outlook Anywhere you're never out of touch from what's going on with your internal communication systems.

Thanks to Harold Wong of Microsoft

2008-09-18T10:36:00.001+01:00

I've recently been in touch with Harold Wong (Microsoft employee and self-confessed Geek!) with regards to feedback on Hyper-V and associated virtual machine deployment experience. After numerous technical email exchanges Harold has published links to 2 articles on my blog (here and here) referencing a Hyper-V environment I use for functionality testing, training and problem mirroring.

Click here to see Harold's Blog and here to view his blog post.

Thanks again Harold. Next time you're in the UK the Sushi and Starbucks are on me!

My Virtual Environment (Part 2). Configuration - Hyper about Hyper-V

2008-08-18T20:17:00.001+01:00

In my last post I gave an overview of how I use a data-centre hosted solution to provide demonstrations of enterprise-class software functionality.

Well it's probably no surprise that the solution is based on a Virtualisation platform, Windows Server 2008's Hyper-V to be exact!

3 x Sun SunFire Virtual Machine 'Hosts' (specification detailed in previous posts) each run Windows 2008 64-Bit Server Operating Systems with the Hyper-V role enabled. Prior to this I ran Virtual Server 2005/SP1 for years and the reliability was perfect. Only since Hyper-V RTM'd did I make the jump to Microsoft's current Virtualisation platform . . . and I have not looked back!

Each of the 3 hosts will run between 4 and 6 virtual machines depending on physical host memory and disk allocation (as you can see immediately below). . .

Each VM runs a Windows Server 2003 64-Bit OS (I'm currently in the process of testing and ensuring all VM guests will run applications successfully with Windows Server 2008)

Generally each VM is allocated two VHD's, one for the OS and the remainder for application data.

Services I demonstrate are: -

Active Directory (DC01, DC02 & Dc03)
Exchange 2007 (Client Access Role) (EXCAS01 & EXCAS02)
Exchange 2007 (Hub Transport Role) (EXHT01 &EXHT02)
Exchange 2007 (Unified Messaging Role) (EXUM01 & EXUM02)
Exchange 2007 (CCR Mailbox Role) (EXMLB01 & EXMLB02)
Windows Server Update Services (WSUS01)
Office Communications Server 2007 (Unified Messaging integration with Exchange Unified Messaging Services) (OCS01)

There are 2 of each Exchange and 3 AD DC roles to demonstrate high-availability in the event of a loss of a service failure, single VM or Hyper-V/OS/hardware.

WSUS keeps patching of OS's and supported Applications current.

Office Communication Server provides UM integration functionality demonstrations.

I use virtual network for network load balancing functionality with the CAS and Edge Exchange 2007 roles. I also have a dedicated DMZ network for the Edge roles. A dedicated virtual network also exists for the Exchange 2007 CCR VM's.

The 3 VM hosts are all in a workgroup and are security hardened for the Hyper-V role. They've been running for nearly 2 months now with zero issues or downtime.

I'm seriously impressed with Hyper-V. I'm not using shared storage so I've no clustering capabilities for Hyper-V itself.

It's support for 64-Bit Guest OS's, speed, ease of configuration etc are fantastic. Yes I know VMWare and other open-source solutions do all this as well. . . but I specialise in Microsoft Server Technologies so it's Hyper-V for me :-)

My Virtual Environment

2008-08-18T19:51:00.001+01:00

I frequently demonstrate product functionality to Clients using a remote virtualised environment. 'Remote' is the key word here meaning it's hosted. Gone are the days for me of attempting to boot VM's on my laptop, no way!

Delivering product demonstrations is something I do fairly frequently these days, whether it's high availability scenarios in Exchange 2007 or Office Communications Server 2007 & Unified Messaging integration the resource requirements are high. Back in the VMWare GSX and Windows NT days a decent spec'd desktop would have sufficed. Demonstrating today's enterprise-aimed software is, I find, a whole different story.

So why am I blogging about this?

Probably the most common query I got after doing a demo is 'What/where/how is the solution you use to demo?' Well I have a data-centre hosted solution in the UK comprising of 3 x Sun SunFire X4200 servers, each loaded with 4 x AMD Opteron cores, 16GB RAM, multiple NIC's for segregated network access etc and a terabyte of direct attached storage attached to each machine

So why do I pay for a hosted solution? I'll give you many reasons . . .

I'm a Consultant. A demo has to look for professional. I need enterprise class hardware to demo.
Home routers just don't cut a solution when you need a DMZ with multiple hosts or you have multiple networks
I don't have to worry about power, cooling, space, racks and anything else associated with running your own hardware.
I can reach the solution from any device with an Internet connection
I want my laptop's space for data, not VM disks!
It's fantastic for training myself and others. . . I can stay ahead of the game
I can emulate configurations for testing.
I can baseline my environment using snapshots and easily go back after changes.

So how is all this horsepower configured? I'll blog about it in my next post but until then, here's a hint . . . ;-)

Configuring Exchange 2007 Unified Messaging Server Roles for integration with Office Communications Server 2007

2008-08-14T13:40:00.001+01:00

Oh the joys of Powershell . . .

So today I'm tasked with preparing and configuring an Exchange 2007 Organisation for integration with Microsoft's Office Communications Server 2007 solution.

Part of the requirement is to run a Powershell script installed when you apply SP1 for Exchange 2007 'EXCHUCUTIL.PS1' from within the Exchange Management Shell. However, it fails with the below error . . .

? ? ? I think. I know I've set the correct permissions for OCS and Exchange, and I'm using an account with permissions to modify both?

It turns out the answer is, for once, in the error! The call to the script 'get-ucpool.ps1' does not work when you run powershell from it's default location, it needs to run directly from the 'Program files\Microsoft\Exchange Server\Scripts' folder.

The solution is to modify the properties of the Start Menu shortcut for the Exchange Management Shell so it launches directly from the 'Scripts' folder rather than the desktop for the logged-on user

Clicking OK and running the script again produces the following result . . .

Note the 'skipping' output within certain routines of the script. It's because the script is attempting to create/amend resources it had previously done so in another run. I've run it again as my screen shot grabbing tool failed to work the first time!

Thank you again Microsoft forums . . phew!

Forefront Security for Exchange Server 2007 - License Activation

2008-08-13T13:32:00.001+01:00

Having recently deployed and configured the Forefront Security for Exchange 2007 product for a Client, I noticed a routine for the licensing activation routine which I've not seen in other Microsoft product's before. Here's how it went . . .

My Client gave me their Volume License product key which I duly entered on the below screen . . .

Upon successfully entering the product key (which obviously isn't displayed in the above screen shot!) I received the below window . . .

Not what I expected? Infact I've never seen this product activation routine when activating other Microsoft Product's. The License Agreement Number was retrieved from the 'Subscriber Downloads' area of the MSDN Downloads Site

If anyone else has seen this activation routine in other Microsoft products feel free to let me know.

Exchange 2007 Spam Confidence Level Thresholds

2008-08-12T16:06:00.001+01:00

I was contacted this morning by a Client of mine who had recently migrated from Exchange 2003 to Exchange 2007. They wanted to know where the 'Spam Confidence Level' settings could be amended within the Exchange 2007 Management Console?

In Exchange 2003 System Manager, the SCL settings were configured within the 'Global Settings' > 'Message Delivery' properties > 'Intelligent Message Filtering' tab....

However, in Exchange 2007, Global Exchange Organisation parameters are configured within the Exchange Management Shell' and not via the Management Console (at least with the version I use which is SP1 with Update Rollup 3 applied.

Running 'Get-OrganizationConfig' displays the following output. The line 'SCLJunkThreshold' indicates that messages with an SCL rating of '4' are currently blocked

Running the following command lowers the SCL Junk Threshold to '2'

set-organizationconfig -SCLJunkThreshold '2'

When 'get-organizationconfig' is run again notice the 'SCLJunkThreshold' value is now set to '2'

I wonder if the capability to amend parameters like these via the Exchange Management Console will be added in a future service pack?

So why blog?

2008-08-12T14:38:00.001+01:00

'Do you maintain a blog'? It's a question I hear regularly from Colleagues. I've subscribed to I.T-related blogs for years now but only since the release of Outlook 2007 with its' integrated RSS feed do I now regularly view the content, so much so that I now move the downloaded content to my Inbox for viewing every day.

With blogging now so commonplace within the I.T industry, and having myself learned so much from subscribed content, I thought it's time I gave 'something back'. Therefore I plan to publish technical articles, notifications, fixes, amusing experiences and anything else I think relevant to my blog's purpose.

So thank you to those blog sources who have provided me with such inspiration to start my own. There are too many to list but those published by Microsoft internals (Eileen Brown, Jason Langridge, Harold Wong and the Exchange Team amongst others) provide top quality content and most importantly informative content.

Now onto my first technical post........