MAPI tool

http://mfcmapi.codeplex.com

https://support.microsoft.com/kb/2679568

Using Auth Login to Troubleshoot Exchange

http://www.tomsitpro.com/articles/exchange_server-smpt-telnet,2-134-3.html

searching message tracking logs in exchange

Searching message tracking logs

Get-MessageTrackingLog -Recipients clowe@davies.com.au -Start 08/12/2014 | ft MessageSubject,MessageID

Get-MessageTrackingLog -MessageID XXXXXXX.domain.com | fl

granting send on behalf of permissions in exchange management shell

Set full access permissions
Add-MailboxPermission mymailbox@server.com -User grantmerights@server.com -AccessRights FullAccess -InheritanceType All

Send on behalf of permission (give dlopez send of behalf of for rclark)
Set-Mailbox mymailbox@server.com -GrantSendOnBehalfTo grantmerights@server.com


check settings
Get-MailboxPermission -Identity mymailbox@server.com -User grantmerights@server.com
get-mailbox -Identity mymailbox@server.com | fl *grantsendonbehalfto

microsoft exchange attachment size limit

You'll want to connect to your hub transport server.
Start the Exchange Management Console.
Under Organization Configuration, click Hub Transport.
On the Global Settings tab, click Transport Settings.
Limit is set in kb

Email Header Analyzer

http://www.mxtoolbox.com

Great website for testing email stuff

verify edgesync synchronization results for a specific recipient using ldp.exe

If you want to verify the EdgeSync synchronization results for a specific recipient, you can use Ldp.exe to view the recipient properties that are stored in ADAM. You must locate the recipient by its Active Directory GUID and, because the data is sent hashed, you must also be able to interpret the information that is returned when you view the recipient details.

To verify the EdgeSync synchronization results for a recipient, follow these steps:
1.Determine the user name of the recipient for which you want to verify EdgeSync synchronization results.
2.Determine the GUID that is associated with the recipient in Active Directory. This GUID is represented as the recipient's canonical name (CN) in ADAM.
3.Determine the Active Directory value of the attributes that you want to verify for that recipient.
4.Use Ldp.exe on the Edge Transport server to retrieve information about that recipient from ADAM.
5.Use the Windows Calculator to translate the retrieved decimal attribute values to hexadecimal and determine the significant byte.
6.Compare the Active Directory attribute values and the ADAM attribute values, and verify that they match.

1.Start Ldp.exe on the Edge Transport server. By default, this tool is located at <System drive>\WINDOWS\ADAM\ldp.exe.
2.Click Connection on the menu bar, and then click Connect
3.In the Connect dialog box, type the name of the Edge Transport server in the Server field. In the Port field, type the ADAM LDAP port. By default, this port number is 50389. Do not select the Connectionless or SSL check boxes. Click OK.
4.Click Connection on the menu bar, and then click Bind.
5.If you are logged on as a local administrator, in the Bind dialog box, select Bind as currently logged on user. To enter administrator credentials, select Bind with credentials, and then enter a user name and password. Click OK.
6.Click View on the menu bar, and then click Tree.
7.In the Tree View dialog box, clear any entry in the BaseDN field. Click OK. You are now connected to the root of the ADAM directory.
8.Click Browse on the menu bar, and then click Search.
9.In the Search dialog box, use the drop-down box for the BaseDN field to select OU=MsExchangeGateway.
10.In the Filter field, enter search criteria that will find the recipient whose CN is equal to the GUID that you obtained from Active Directory. For example, if the GUID starts with 21664853, enter (cn=21664853*). Notice that you do not have to type the complete GUID. You can type the first several characters and then use the * wildcard character to search for all GUIDs that begin with those characters.
11.Select Subtree as the Scope. Click Run. The search results appear in the right pane of Ldp.exe.
12.You can change the list of attributes that are included in the search results. To do this, click Browse on the menu bar, and then click Search. Enter the BaseDN, Filter, and Scope options as instructed in the previous steps. Click Options.
13.In the Attributes field, enter a list of attributes to display. Separate each attribute by using a semicolon. For example, to list the SCL delete threshold and the SCL reject threshold, enter the following text:
MsExchMessageHygieneSCLDeleteThreshold;MsExchMessageHygieneSCLRejectThreshold
14.Click OK, and then click Run in the Search dialog box. The search results appear in the right pane of Ldp.exe. Attributes that have a null value do not appear.

miscrosoft exchange server studies

I've been reluctantly learning about exchange, this is where I will post some info.

Hub Server

• Most of the items we are interested are under organization conf, hub transport)
• Send connectors , none by default on a hub
• Recieve connectors (under server conf) defaults are "client" and "default" recieve connectors
• Anti-spam settings are not enabled by default on a hub, can be turned on
• Transport rules are enabled but none configured by default, can be configured
• Journal rules are there, nothing configured
• Edge subscriptions are there, nothing configured

Edge server

• Edge servers are not part of the domain by design
• Edge server should be in DMZ, hub server should be in internal network
• The edge server's console only has the one edge transport role
• It has the following:
• Anti-Spam is enabled
• Send connectors (nothing configured)
• Receive connectors (default internal receive connector is there by default)
• Transport rules (nothing configured)
• Accepted domains (nothing configured)

The edge server is supposed to sit in the DMZ and defend your organization from spam, virus and DDOS attacks. The hub handles all of the mail flow within the organization. Applies transport rules, journalling policies, delivers messages to mailboxes, if there is no edge it can send/receive emails to/from the internet.You can have multiple hub and edge servers. Hub servers sync settings with each other, edge servers do not but you can export/import settings.

Edge servers are not required, but it is best practice from Microsoft and anyone with experience  If you choose not to use one, you should use an antispam/virus checking service like mxsweep. You can enable antispam, configure transport rules and uses a 3rd party solution on the hub server.

Mail flow
Mail will flow in/out of hub and edge transport servers.

Edge transport servers will never see emails that goes between internal users.

To connect the hub and edge you need to create an edge sync subscription
The edge transport role is designed to protect, its not part of the domain,

it can cut down the spam at the front door

A 3rd party solution can be just as good or better than the edge server.

A combination of forefront, ISA server and edge transport server can offer pretty good protection.

Send/Receive connectors

Connectors are like train tracks one going in and one going out.

You can have more than one outgoing or incoming tracks.

When you have 2 hub servers, there are invisible send connectors between the hub servers.
The edge transport role is configured automatically to receive email from the internet.

The hub transport server must be configured to do this.

Anti-Spam/Virus

The edge server has it turned on by default

The hub server you need to turn it on

Should use AV internally (Forefront / modusGate from Vircom / other 3rd party hosted)

Transport rules

You can make rules that applies to incoming/outgoing mail while in transit

The differences between the hub and egde transport rules

The edge (edge rules agent) is more for message hygiene, stops virus attack, DDOS etc

The hub (transport rules agent) is more for message compliance and policy enforcement, message classifications, disclaimers etc

you can make a transport rule to attach a disclaimer to emails that go out of your organization but internal emails will not have it attached.

Transport rules are built upon three components:

Conditions , exceptions and actions

Edge Sync subscription

Install hub and edge servers.

Make sure to set the DNS suffix correctly on the edge server during installation.

For the hub this is done automatically because it is part of the domain.

The edge should be in the DMZ, so it wont be in DNS automatically.

You may have have an internal network card on the edge server also.

Configure a host/A record on the DNS server that the edge server uses to point to the hub server

Configure a host/A record on the DNS server that the hub server uses to point to the edge server

Alternatively you can edit the hosts file (C:\windows\system32\drivers\etc\hosts) on each server

• 192.168.1.10 edge.domain.com
• 192.168.1.35 hub.domain.com

Ensure hub and edge can take to each other through DNS name resolution

From hub server

• ping edge.domain.com

From edge server

• ping hub.domain.com

Port LDAP TCP:50389 Secure LDAP TCP:50636 must be open between the two servers(best practice to have a firewall between them).

• telnet edge.domain.com 50389
• telnet edge.domain.com 50636
• telnet hub.domain.com 50389
• telnet hub.domain.com 50636 

On edge, create the subscription file (in the EMS run New-EdgeSubscription –file “C:\edgesub.xml")

Copy the xml file to hub and import it (in the EMC, Organization Configuration > Hub Transport> Create New Edge Subscription)

It can be difficult to get the subscription file off the edge if the network is locked down. You may have to get the restrictions lifted temporarily

or get the file off with a USB.

The application log should not show any errors, it should say it completed successfully

Two default send connectors will be created on the hub server

Start the EMS on hub, run

Start-EdgeSynchronization

Test-EdgeSynchronization (we should see sync status normal)

Test-EdgeSynchronization -VerifyRecipient user.name@domain.com (RecipientStatus)

On Edge we should see the two send connectors were created in the EMC
Test mailflow by sending and reciving email to/from an external email address, from a client inside your network.

Transport Layer Security (TLS)

Exchange 2010 by default uses self signed certs for all internal message transfers (also called direct trusts).

Exchange 2010 it will try to use TLS with a remote server, if it doesn't work it will use SMTP.
You can configure Mutual TLS between external organizations. You need to purchase a public cert for this.

Remember TLS only protects data in transit.

You can only ensure one hope is encrypted, but not the next hop.

You may need to speak with your third party vendors to see if they support TLS.

The exchange toolbox

In the EMC there are a lot of tools there by default that can help troubleshooting

You can add extra useful tools (Jetstress / Load Generator)

One of the most important tools to run is the best practices analyser.

You should run it after install, after any upgrades, and perhaps schedule it at least once a year.

Mail flow trouble shooting tool is also very good.

Details templates editor - will probably never be used

Remote connectivity analyser (should be run on edge if you are using one)

Monitoring tools in the exchange management shell

You can do more with the shell than you can with the GUI

Get-Command Test* (show all the test commands)

Test-Mailflow

Test-ServiceHealth

Test-MapiConnectivity

don't forget get-help [command]

Get-MailboxStatistics (-server -identity -FolderScope)

Get-MailboxFolderStatistics

Get-MailboxDatabase

Get-TransportPipeline (needs to be run on the hub server)

PowerGUI has an exchange 2010 powerpack that you can download and add to powergui.

Remember to test send/receiving email from outlook, owa etc.
After a system outage exchange should be the last server to start up.
Generally we  want to start DCs, SQL servers and then exchange. Exchange services take some times to start up.


RAID
You should use RAID 10 on the disk groups that you store databases on for optimal performance.

Perfmon
You can use start -> perfmon to monitor performance aspects of Exchange.
First see if you can match spike in average disk queue length for all disks (under physical disk) to a single disk. Then for that disk monitor the average reads/writes per second. The values should be below 20ms most of the time with spikes to 50ms.

Some good articles on using perfmon are here
http://www.computerperformance.co.uk/HealthCheck/Disk_Health.htm
http://www.windowsnetworking.com/articles_tutorials/Windows-Server-2003-Performance-Tuning.html

Get largest mailboxes
Get-MailboxStatistics | Sort-Object TotalItemSize -Descending | ft DisplayName,@{label="TotalItemSize(MB)";expression={$_.TotalItemSize.Value.ToMB()}},ItemCount

Creating a new self signed certificate

New-ExchangeCertificate -DomainName servername,sername.domain.local, mail.domain.ie,owa.domain.ie -lPrivateKeyExportable:$true
enable-ExchangeCertificate -Thumbprint [copy from output above] -services "SMTP,POP,IIS,IMAP"
On edge server
enable-ExchangeCertificate -Thumbprint [copy from output above] -services SMTP

Remember you can't use the same certificate on the hub and the edge server, the same goes for third party certs.

Exporting a cert

• From the certificates snapin
• personal -> certificates
• right click all tasks - > export
• tick export the private key
• Personal Information exchnage
• tick include all certificates in the
• tick export all extended properties
• type a password
• browse for where you want to save the file

Importing a cert

• Export the cert on hub server as detailed above
• Copy the cert to edge
• Import-ExchangeCertificate -Path c:\certificates\ExportedCert.pfx -Password:(Get-Credential).password
• type anyusername
• type the password that was used to export the cert
• enable-exchcertificate -services SMTP

 restart topology service on hub server.

Databases and transaction logs

Emails come in over the network, first they enter RAM on the server, then they are moved into the transaction logs. The transactions logs are written into the database. Checkpoint files (.chk) are used to keep track of which transaction logs have been written into the database and which have not. Transactions logs are 1MB in size and more and more are created as more emails come in. You should be able to tell from the checkpoint files which emails have been written to the database. JRS files are reserved transaction log files (only used when the disk runs out of space, but they are only 1MB in size so they are useless these days).

If the disk a database is on runs out of space that's bad. It can't be mounted/debugged. When the disk gets to 1 GB of space left it will stop the transport service to that database. E00 is the current log, when it fills up it will be renamed and a new log is started. Circular logging can be turned on which writes over the transaction logs once they have been written into the database. Also many backup solutions delete the transaction logs after a full backup completed successfully.

DB files should be kept on separate disks from transaction logs. They should also be kept separate from the system partition and where exchange is installed. Take for example, you have the OS, exchange install, the DB and the transaction logs all on a single non-redundant physical disk. If that disk fails we have lost everything. Even with a full backup from the night before we will miss out on all the mails in between. This is why we want to use redundant disks or a SAN for storage. Lets say we set up 3 redundant disks, the OS and exchange are installed on disk1, the DB is on disk2, the transaction logs are on disk3. This way if we lose a disk, we just replace it without any interruption. If some how we actually lose one, we just need to restore that disk from back up everything else is in place.

Transactions logs should be on a mirrored volume RAID 1 at least (depending on what you can afford) Database files should be on RAID5 or RAID10 (depending on what you can afford)
Think about if you are using physical disks in the server or are you using virtual disks on a SAN ?

The MS exchange team have created an "Exchange 2010 Mailbox Server Role Requirements Calculator" its a spreadsheet that can help you calculate how much disk space you need. What ever answer you get always add some more, no doubt you'll need it some day.

Exchange standard supports 5 databases. (small medium businesses)
Enterprise supports 100 databases. (enterprise)

some exchange power shell commands

To test if your edge sync is working
test-edgesynchronization

Start edge sync
start-edgesynchronization

Display useful information on exchange server, useful for getting versions
get-exchangeserver | fl

Get a list of the certs on the server
get-exchangecertificate

telnet to exchange server displays error message 220 *****

When telneting to an exchange server you get the following errorr:
220 *******************
When you run EHLO you get the following error
500 5.3.3 Unrecognized command

This can happen when a cisco device is using
"fixup protocol smtp 25"
or
"inspect esmtp"

Also AV's have been known to cause these issues.

See this page for more detail:
http://www.binarywar.com/2009/11/cisco-pixasa-causes-smtp-banner-corruption/

re-creating the edge sync subscription exchange 2007

symptoms:
new users can't recieve external emails

When you attempt to telnet to the edge server and send an email to a new user the server will respond that it doesn't know who that user is or something similar

causes:
the edge sync subscription has stopped working
this can be due to different patch levels or update rollups on the hub and edge servers
you need to have your exchange servers on the same patch levels

How to confirm:
1. Run Adsiedit.msc
2. Navigate to Configuration->Services->Microsoft Exchange->Organization Name->Administrative Group->Exchange Administrative Groups->Servers->Edge Server Name
3. Right click the Edge Server and click Properties
4. Locate the msExchEdgeSyncCredential property. Does this have a value set? It will probably show as not set.

solution:
re-create the edge sync subscription

preperation:
Do a full backup on all exch servers if you can.
You must backup all exch databases
You must backup system state on all servers
You must back up how your send connectors are configured (screenshots)

implementation:
On the EdgeServer start up the Exchange Management Shell and type:
New-EdgeSubscription -file “c:\subscription.xml”
Browse to the root of C:\ and copy the subscription.xml file to your hub server. This can be tricky sometimes due to the Edge being located on a DMZ or inaccessible network. I used a USB key to move it between both servers.

On your Hub server open up Exchange System Manager and add the new subscription:
Organization Configuration> Hub Transport> Create New Edge Subscription.
Browse to your subscription.xml file and then click New.  Make sure that your subscription is set to the correct site. It will choose Default site as default, so don’t just click next, double check that it is being subscribed to the same site as your Hub server.

NOTE - You do not need to remove the existing Edge Subscription. The new subscription will simply overwrite the existing one as it is for the same servers.  

We now need to replicate Active Directory information and synchronize the Edge and the Hub server.
In Exchange Management Shell on your Hub servers and run the following command:
Start-EdgeSynchronization

Hopefully this completes successfully and you should now have a working Edge Sync.

To verify that it is all working as it should, run on your Hub server:
Test-EdgeSynchronization and you should receive a status of succeeded:

Some people have found that re-creating the EdgeSubscription resets your send connectors, but I have not come across this. The settings within the Send Connector and SPAM setting etc, will stay the same as we have not removed the existing Edge Subscription, we have just overwritten attributes within it. Just in case though, verify your Send Connectors with the settings you recorded at the start of the EdgeSubscription process.

how to check the mx record with nslookup

Open a Command Prompt
nslookup
Server (The DNS server that you want to use. This is optional.)
Set q=mx (This sets the query type to "MX" {Mail Exchanger}.)
domain.com (The domain name you want to lookup the mail exchanger to.)
This operation can be done on Windows XP, Windows Server 2003, and Windows Vista. There are similar options if you are doing this from Linux.
Open up a terminal
nslookup
Set type=mx (This sets the query type to "MX" {Mail Exchanger}.)
domain.com (The domain name you want to lookup the mail exchanger to.)

view email headers in outlook 2010

Double click to open the email, click file -> info -> Properties
Copy the header and paste into www.mxtoolbox.com

testing email with telnet and exchange 2007

Telnet can be useful for testing email. If you get Queued mail for delivery at the end everything looks good. You may get another error which you can use to troubleshoot. Commands I typed are in bold

telnet 11.222.333.444 25 Trying 11.222.333.444...
Connected to 11.222.333.444.
Escape character is '^]'.
220 exch-server-edge.domain.local Microsoft ESMTP MAIL Service ready at Mon, 20 Aug 2012            11:19:32 +0100
EHLO mydomain.com 250-exch-server-edge.domain.local Hello [11.22.33.44] (my ip)
250-SIZE 10485760
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-X-ANONYMOUSTLS
250-AUTH
250-X-EXPS NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250 XEXCH50
MAIL FROM:myemail@mydomain.com 250 2.1.0 Sender OK
RCPT TO:useryouwant2test@theirdomain.com 250 2.1.5 Recipient OK
DATA
354 Start mail input; end with <CRLF>.<CRLF>
SUBJECT: test email
test email please ignore
.
250 2.6.0 <6619443d-79a6-423b-8a27-76d5e2f3d916@exch-server-edge.domain.local l> Queued mail for delivery

Use openssl to test with STARTTLS, you will need a valid username and password

exporting messages from exchange 2007 to a pst file

Make sure you have an exchange admin account, grant it rights on the mailbox you want to export
Add-MailboxPermission -Identity MailBoxToExport -User MyAdminAccount -AccessRights FullAccess

Make sure you have enough disk space to extract the data to
Export-Mailbox -Identity MailBoxToExport -IncludeFolders '\Folder to Export'  -PSTFolderPath C:\Users\jack.oregan\extracted-pst\extracted.pst

get information on a mailbox in exchange 2007

start the exchange powershell console

Get-Mailbox mailboxname | Select-Object name,primarysmtpaddress, DisplayName,Database,@{n="Size(MB)";e = {$MBXstat = Get-MailboxStatistics $_.name; $MBXstat.totalItemsize.value.toMB()}},@{n="Items"; e = {$MBXstat = Get-MailboxStatistics $_.name ; $MBXstat.itemcount}}

how to extract emails from the message queue in exchange 2007

Start the exchange management console
Mark the message as suspended in the queue
Collect the message properties so you have the queue and message ID
Start the exchange management shell

Export-Message -Identity EXCHSRV\5000\10000 -Path "C:\export\exported-email.eml"

5000 is the queue ID
10000 is the message ID

Export the entire queue (I have not tested this)
http://technet.microsoft.com/en-us/library/bb125215%28v=exchg.80%29

Exchange cached mode and ost files

Turning cached mode on is intended for laptop users so they have access to read emails when offline. Usually we turn off cached mode when we have constant connectivity to the exchange server like on a desktop on the LAN.

Often users will find OST files taking up GB's worth of space for no good reason.
Disable cached mode in outlook, close outlook and delete the ost file.

Also OST files cannot be migrated you need to delete them and let outlook create a new one. If you are running a migration from office2007 to 2010 make sure to exclude ost files.