MS Exchange Server 2007 ( 70-236 )
Table of Contents.
Introduction to Exchange Server 2007
Installation and Configuration
Storage Management
Recipients
Client Access
Public Folders
Message Flow
Availability & Recovery
Monitering & Reporting
Administrative Permissions
Chapter # 01
Introduction to Exchange Server 2007
Server-based Messaging
As you study this section, answer the following questions:
- How does file-based messaging message storage differ from client/server
messaging message storage?
- How does new message notification differ between file-based messaging and
client/server messaging?
- How does client/server messaging reduce network traffic?
- Where are messages written in file-based messaging?
Server-based Messaging Facts
There are two messaging methods that have been used to deliver e-mail
messages in Exchange environments:
| File-based messaging |
At a basic level, file-based messaging maintains a text file for each user.
Every new message for a user is appended to the bottom of the user's text file.
It is the user's responsibility to poll the server to see if any new messages
had been sent. When a new message arrives, the user downloads it to the local
machine, generally deleting the message from the server. Where the client/server
system maintains a mailbox store that holds the user's messages on the server,
file-based messaging is not intended to maintain messages on the server.
To send or receive messages, the file-based system uses the following
process:
- The sender creates an e-mail message.
- The message is sent to the server.
- The server receives the message and holds it, acting as a file-share.
- The recipient polls the server to see if any messages have been sent.
- The recipient retrieves the message from the server.
|
| Client/server messaging |
A client/server messaging system distributes the processing of information
between the user's machines (clients) and the central computer (server) that
hosts the user's mailboxes. The process includes the following steps:
- A user initiates a connection to the server and creates an e-mail.
- The e-mail message is sent to the server.
- The server receives the message.
- The server notifies the recipient that they have received a message and
places it in the recipient's mailbox.
The client/server messaging system is implemented in Exchange 2007 because it
provides the following advantages:
- Provides more security than file-based systems because the server is
responsible for delivering messages, instead of allowing the user to access the
user's mailbox to send a message. In file-based messaging the local machine must
act as the mail transfer agent (MTA). In client/server messaging, the server
takes that role.
- Reduces the amount of network traffic by eliminating the need to poll the
server repeatedly to check for new messages.
- Increased scalability that allows thousands of users to be located on a
single Mailbox server.
- Increased stability due to the added capacity of the network.
The main disadvantage of using a server-based messaging system is the cost of
the high-capacity servers that are required to support the
workload. |
Previous Version Facts
Exchange 2007 has made many advancements and improvements to the
previously-released versions of Exchange. The previous versions of Microsoft
Exchange Server are described in the following table:
| Microsoft Exchange Server 5.5 |
Microsoft Exchange Server 5.5:
- Ran on the Windows NT4 platform which stored all of the user accounts and
provided authentication.
- Used its own directory service.
- Hosted a mailbox database (priv.edb) and a public folder database (pub.edb).
The server could only host one database of each type.
|
| Microsoft Exchange Server 2000 |
Microsoft Exchange Server 2000 (version 6.0) ran on the Windows 2000 platform
instead of the NT4 platform and includes some integration with Active Directory.
It provided the following improvements from Exchange 5.5:
- Raised the maximum sizes of databases and increased the number of servers in
a cluster from two to four.
- Allowed multiple mailbox databases on a single server.
- Introduced Outlook Web Access (OWA).
- Used front-end servers for SSL and authentication traffic.
- Used back-end servers for databases and MAPI.
|
| Microsoft Exchange Server 2003 |
Exchange 2003 included multiple compatibility modes to allow an easier
transition for upgrading from Exchange 2000. Exchange 2003 upgraded the
following components:
- Added usability features for OWA.
- Enhanced disaster recovery.
- Added Outlook Mobile Access and server-side ActiveSync.
- Enhanced antivirus and antispam protection.
- Improved management tools for mailbox and messaging.
|
Exchange 2007 Features
The primary goals of Exchange 2007 are:
- Increased security
- Easier setup and deployment
- Higher availability
The following features were implemented to achieve these goals:
| Role-based setup |
A server role is a unit that logically groups required components and
features that are needed to perform functions within a messaging environment.
The implementation of server roles simplifies installation and management by
grouping necessary features according to the role the server plays within the
organization. With the role-based setup:
- Multiple roles or a single role can be installed on a server (with exception
of the Edge Transport server).
- Installation only requires the components needed for each particular role
that is installed.
- Maintenance needs to be performed only on the server hosting a specific
role.
|
| New administration model |
Exchange 2007 uses a simplified administration management console which
includes:
- Exchange Management Shell (Windows PowerShell) is a command line environment
designed for automating administration and maintenance. The Exchange Management
Shell is the primary management interface of Exchange 2007.
- The Exchange Management Console is the graphical administration tool. It is
comprised of a three-paned view that includes a tree view, results, and an
actions pane. It cannot perform many of the administrative tasks that can be
performed in the Exchange Management Shell.
|
| Additional compliance features |
Compliance and journaling focuses on the requirements that many
organizations now face for messaging, archiving, and controlling the flow of
messages within the environment. Compliance and journaling allows you to:
- Set up an ethical wall that can prevent certain members of your organization
from e-mailing one another.
- Restrict communication and messaging or cause all messages to be archived
and maintained between certain members or groups of the organization.
|
| High availability |
Improved availability in Exchange 2007 is made possible by features such
as:
- Local Continuous Replication (LCR) maintains a copy of the production
storage group on a second set of disks that are connected to the same server
using built-in asynchronous log shipping and log replay technology.
- Cluster Continuous Replication (CCR) provides a new, simplified type of
cluster implementation that utilizes passive nodes as backups for the
information being used on the active node. The databases on the active node are
copied to the passive node using file sharing. This allows the passive node to
maintain the Exchange services and availability for all users in the event of
primary Exchange server failure.
|
| 64-bit environment |
Exchange 2007 employs a 64-bit environment. The additional memory in the
64-bit architecture reduces I/O operations by nearly 80% and increases the
amount of RAM that the system can use. |
| Messaging |
Unified Messaging improves a mobile user's ability to stay connected by
combining e-mail, voicemail, calendar, and fax communications into a single
store which is available from a telephone or computer.
|
The following features are no longer supported in Exchange 2007:
- Exchange 5.5 support.
- Connector types. You need to maintain an Exchange 2003 server within your
environment if you wish to continue using applications, such as X400, GroupWise,
or Lotus Notes.
- Admin and routing groups.
- Outlook Mobile Access has been replaced by ActiveSync.
- Active/Active clustering. Exchange 2007 supports Active/Passive clustering
exclusively.
Exchange 2007 comes in two different versions: Standard Edition and
Enterprise Edition.
| Standard Edition |
The Standard Edition has:
- Up to 5 storage groups
- Up to 5 databases
- 16 TB per database
The Standard Edition supports Local Continuous Replication. |
| Enterprise Edition |
The Enterprise Edition has:
- Up to 50 storage groups
- Up to 50 databases
- 16 TB per database
The Enterprise Edition supports:
- Local Continuous Replication
- Single Copy Clusters
- Cluster Continuous Replication
|
Server Role Facts
A server role is a unit that logically groups required components and
features that are needed to perform functions within a messaging environment.
During installation, you choose the role(s) that the server will play within the
organization. The following table describes the different types of roles in an
Exchange 2007 environment:
| Mailbox server |
The Mailbox server role in Exchange 2007 contains the mailbox and public
folder databases. Mailbox servers provide services such as:
- Calculating e-mail address policies and address lists for recipients
- Enforcing managed folders.
The Mailbox server interacts directly with the following:
- Active Directory directory service server
- Client Access server
- Hub Transport server
- Microsoft Outlook clients
- Unified Messaging (UM) server
|
| Client Access server |
The Client Access server role allows a variety of different clients to
communicate with the Exchange server. The Client Access server role hosts the
following client applications and protocols:
- Outlook Web Access
- Exchange ActiveSync
- Post Office Protocol version 3 (POP3)
- Internet Message Access Protocol version 4rev1 (IMAP4)
You should know the following about Exchange protocols in relation to Client
Access servers:
- In previous versions of Exchange, the back-end server could be accessed
using MAPI or any Internet protocol (POP3, HTTP, IMAP4). The only protocol used
to communicate to a Mailbox server in Exchange 2007 is the MAPI RPC protocol.
- In Exchange 2007, the Client Access server is responsible for all MAPI
access. If a user wishes to use Outlook Web Access then they will use RPC/HTTP
(Outlook Anywhere). If a user wishes to use POP3 or IMAP4, they will need to
contact the Client Access server.
At least one Client Access server is required in every Exchange 2007
organization. In addition, each site that has a Mailbox server also requires a
Client Access server. |
| Edge Transport server |
The Edge Transport server handles all Internet-facing ingoing and outgoing
mail flow and provides Simple Mail Transfer Protocol (SMTP) relay and smart host
services for the Exchange 2007 organization. You should know the following about
Edge Transport servers:
- In past versions of Exchange, the Exchange server was a domain member but
could still be face-to-face with the Internet. If the Exchange server were
compromised, the entire domain could be compromised as well. For this reason,
the Edge Transport server in Exchange 2007 does not require domain membership,
but is designed to be deployed within a perimeter network.
- The Edge Transport server does not have access to the Active Directory
service, but instead runs a service called the Active Directory Application Mode
(ADAM) which is a scaled-down, read-only version of Active Directory that can be
deployed on a single machine, but does not require the DNS services and the
supporting infrastructure that a full Active Directory implementation requires.
The Edge Transport server stores all of its configuration in a local database.
- Agents run on the Edge Transport server which provide protection against
spam and viruses and apply rules to overall mail flow control.
- It is possible to install more than one Edge Transport server in a perimeter
network to provide redundancy in case of server failure.
The Edge Sync service makes it possible to set up Active Directory data
synchronization between the Hub Transport server and the Edge Transport server.
This allows the Hub Transport server to actually contact the Active Directory
domain controller and global catalog server to retrieve information such as the
recipients for the organization and the accepted domains and connectors, then it
populates the information out to the ADAM instance on the Edge Transport
server. |
| Hub Transport server |
The Hub Transport server role is responsible for processing and delivering
all messages within the Exchange Organization. The Hub Transport server role:
- Is deployed inside the Active Directory service.
- Is responsible for applying organizational policies.
- Uses the store driver to:
- Deliver mail to recipient's mailboxes within the organization.
- Retrieve messages from a user's mailbox and place them in the Submission
queue.
- Determines the routing path for all messages in the organization and routes
messages to recipient's mailboxes who reside outside of the organization.
- Uses the categorizer feature to perform recipient resolution, content
conversion, and routing resolution for all messages within the organization.
|
| Unified Messaging server |
Unified Messaging allows users to access e-mail, voicemail, calendar
information, and fax communications using an e-mail client such as Microsoft
Outlook, Outlook Web Access, or a mobile device that has Microsoft Exchange
ActiveSync. The Unified Messaging server allows the Exchange organization to
connect to a Private Branch eXchange (PBX) system.
Unified Messaging integrates voicemail, faxes, and calendars in the following
ways:
- All e-mail, voicemail, calendar, and fax communications are combined into a
single store which is available from a telephone or computer.
- All voicemails are converted to Windows Media audio files which are sent to
the user's Mailbox server and stored as attachments in an e-mail.
- When a fax is received, the fax can be converted into a .tif file which is
saved as an attachment in a user's mailbox.
Users are provided with voice-based access to their mailbox through
voice-prompts and queries. This allows users to perform the following tasks over
the phone:
- Access voicemail.
- Listen to calendar information.
- Listen, reply, or forward e-mail messages.
- Access or dial contacts stored in the global address list or their personal
contact list.
- Accept or cancel meeting requests.
- Set a voicemail out-of-office message.
- Set personal options and security preferences.
The auto attendant feature allows external users to use the telephone keypad
or speech inputs to navigate the Unified Messaging System to locate and/or call
a user. It also allows the administrator to perform the following tasks:
- Create a set of menus that can be customized for external users.
- Define schedules for holidays.
- Explain how to search the organization's directory to connect either
directly or by using their extension.
- Allow external users to call the operator.
|
Exchange Concepts
The following table lists some of the basic components that are used to
organize and administer Exchange. You will learn more details about each
throughout this course.
| Organization |
The organization is the top Exchange infrastructure object. The
organization defines your messaging environment. It includes the following:
- Exchange server
- Domain controllers
- Global catalog server
- Users
|
| Server role |
A server role is a logical set of features and services that allow
users to perform specific tasks. Exchange 2007 offers the following five server
roles:
- Client Access
- Mailbox
- Unified Messaging
- Hub Transport
- Edge Transport
|
| Mailbox |
A mailbox is a logical storage location associated with a recipient.
The mailbox is where all e-mail messages are stored. The inbox and all other
associated folders make up the mailbox. |
| Recipient |
A recipient is a mail-enabled Active Directory object to which
Exchange can send messages. A recipient has Exchange attributes, but it does not
have to have a mailbox. Examples of recipients include the following:
- Mailbox users
- Mail users
- Resource mailboxes
- Mail contacts
- Distribution groups
- Dynamic distribution groups
|
| Store |
A store is a database of Exchange information. The store contains
individual recipient mailboxes. All mailboxes in the store share common
configuration settings. |
| Domain controller |
The domain controller is the server within the Windows server domain
that responds to authentication requests such as logging in and permissions
assignment. The domain controller is effectively a database server. It contains
a file called NTDS.dit which contains:
- The NT Directory service
- The directory information tree which is part of the X500 directory naming
standard.
|
| Storage group |
A storage group is a collection of stores. All stores in the storage
group are held on the same physical server. |
| Queue |
A queue is a temporary holding space for messages waiting to enter
the next stage of processing. Each queue is a logical set of messages that an
Exchange transport server handles in a specific order. Queues only exist on
machines that have the Edge Transport or Hub Transport server roles
installed. |
| Address lists |
An address list is a list of recipients. The global address list is
an address list that is automatically generated by Exchange and which includes
all recipients in the Exchange organization. In addition, you can define custom
address lists. |
| Outlook |
Microsoft Outlook is the premier messaging and collaboration client for the
Internet and Microsoft Exchange Server. Outlook:
- Helps users communicate with others through e-mail, telephone, group
scheduling, and real-time Microsoft NetMeeting conferencing software.
- Allows users to share information with others via Internet connectivity,
Microsoft Exchange Server, and electronic forms, and as a component of
customized collaborative solutions.
- Integrates and organizes communications and shared information in one
application.
|
| Outlook Web Access |
Outlook Web Access (OWA) allows clients to access e-mail, calendars,
contacts, tasks, and other mailbox contents when access to the Microsoft Outlook
desktop application is unavailable. OWA:
- Offers read-only access to documents stored in Microsoft SharePoint sites
and network (UNC) shares.
- Is provided as part of Exchange Server 2007 to allow users to connect
remotely via a Web browser.
- Can perform many of the functions of Outlook.
- Requires a network connection to function.
|
| Public folder |
A public folder is a repository for data that can be accessed by
multiple users.
- A public folder is a recipient that can have an associated e-mail address.
- Users can e-mail or post content into the public folder.
- Content in the public folder is accessible through the Outlook clients.
|
Exchange 2007 uses the following protocols:
| Simple Mail Transfer Protocol (SMTP) |
SMTP is the Internet standard protocol for transferring e-mail messages
between hosts. SMTP assumes that both host and client are constantly connected,
but you can use both permanent and dial-up connections to an SMTP
host. |
| Messaging Application Programming Interface (MAPI) |
MAPI is a set of standard commands developed by Microsoft. Messaging
services use these commands to communicate with other MAPI-compliant
applications. In Exchange 2007, the Client Access Server is responsible for all
MAPI access. The only protocol used to communicate to a Mailbox server in
Exchange 2007 is the MAPI RPC protocol. |
| Post Office Protocol version 3 (POP3) |
POP3 is a mail-drop protocol designed to work with clients that are not
always connected to the network. It allows a mail server to receive mail
messages and store them on a server until the client comes back online and
requests them. |
| Remote Procedure Call (RPC) |
Remote Procedure Calls are based on a client/server model in which one
server runs processes on another server. Both servers assume the calls are
local, when in reality they run over LAN connections and through software
libraries on both servers. |
| Internet Message Access Protocol version 4 (IMAP4) |
Like POP3, IMAP4 is a protocol that allows a client to download
messages from a server. (It does not allow you to send messages.) IMAP4 is much
more powerful than POP3. For example, with IMAP4, you can open all folders in
your mailbox, not just the Inbox, as well as public folders on the server.
|
Exchange Administrator Roles
It is possible to have more than one Exchange administrator in your Exchange
2007 organization. To better facilitate the implementation of multiple
administrators, Exchange 2007 provides predefined administrator roles that
minimize manual permission configuration. The following table describes the
predefined roles offered in Exchange 2007 to manage configuration data:
| Exchange Organization Administrator |
Users who are an Exchange Organization Administrators have the highest level
of permissions within the Exchange organization, having full access to modify
all Exchange properties and objects in the Exchange organization, including:
- Full control as owner over the Exchange organization data in the
configuration container in Active Directory and the local Exchange server
Administrator group.
- Full control as owner over the local Exchange server configuration data.
- Read access to all Active Directory domain users.
- Write access to all Exchange-specific attributes in all Active Directory
domain user containers.
You must be assigned as the Exchange Organization Administrator role to
perform any task that will affect the entire organization, including:
- Creating the Exchange organization and installing the first Exchange server
- Changing any global configuration settings
- Deleting connectors
- Changing server policies
You should know the following about the Exchange Organization Administrators
role:
- Setup will add the Exchange Organization Administrators role as a member of
the local Administrators group on the computer on which you are installing
Exchange.
- If you install Exchange 2007 on a domain controller, the users in the
Exchange Organization Administrators role will have additional Windows
permissions that they do not have if you install Exchange 2007 on a computer
that is not a domain controller.
|
| Exchange View-Only Administrator |
Users who are an Exchange View-Only Administrator have read-only access to:
- The whole Exchange organization tree in the Active Directory configuration
container.
- All the Windows domain containers that have Exchange recipients.
|
| Exchange Recipient Administrator |
Users who are an Exchange Recipient Administrator can perform the following
functions:
- Modify any Exchange property on an Active Directory object, including:
- Users
- Contacts
- Groups
- Dynamic distribution lists
- Public folder objects
- Manage Unified Messaging mailbox settings and Client Access mailbox
settings.
Additionally, Exchange Recipient Administrator role gives the following
permissions:
- Membership in the Exchange View-Only Administrator role.
- Read access to all the Active Directory Domain User containers that have
been prepared for Exchange 2007.
- Write access to all the Exchange specific attributes on the Domain User
containers in Active Directory domains that have been prepared for Exchange
2007.
|
| Exchange Server Administrator |
Users who are an Exchange Server Administrator have permissions to server
Exchange configuration data stored on the local server and in Active Directory.
Members have the following permissions:
- Members of the Exchange View-Only Administrators role.
- Full control as owner over the local server configuration data.
- Local administrator on the computer on which Exchange is installed.
When you assign this role, you designate the Exchange server(s) that
the administrator is allowed to manage. |
| Exchange Public Folder Administrator |
Users who are an Exchange Public Folder Administrator have administrative
permissions to perform the following tasks related to public folders:
- Create and delete public folders
- Mail-enable public folders
- Manage public folder settings, such as:
- Replicas
- Quotas
- Age limits
- Administrative permissions
- Client permissions
Note: Users who are an Exchange Public Folder Administrator cannot
modify mail recipient-related properties on public folders, such as proxy
addresses. |
These Exchange Administrator roles (with exception of Exchange Server
Administrators) are created in a new Microsoft Exchange security
group Organizational Unit (OU).
Exchange Management Console Facts
The Exchange 2007 Management Console is a graphic interface used to manage an
Exchange environment. It has been simplified from previous versions of Exchange
so it now focuses only on the most commonly executed tasks. Additional tasks
that could traditionally only be performed in REGEDIT or ADSIEDIT were also
added to the Exchange Management Console to improve ease of use. You should know
the following about the Exchange Management Console:
- In Exchange 2003, the information shown in the tree-pane was dependent on
the configuration of your Exchange Server. This pane is now static in the
Exchange 2007 Management Console so no matter how many servers you have, what
options have been chosen, or what has been installed, the tree-pane will always
be the same.
- Many tasks can't be performed through the Exchange Management Console, only
through the Exchange Management Shell.
- The Exchange Management Console can filter views.
The console tree is organized into nodes and sub-nodes which can be expanded
up to eight or more levels. The nodes in the console are as follows:
| Microsoft Exchange node |
The Microsoft Exchange node allows you to view the Finalize
Deployment and End-to-End Scenarios tabs. These tabs help you to
complete the required and optional configuration tasks for the server roles you
deployed. |
| Organization Configuration node |
The Organization Configuration node configures global and system-wide data
for all servers and users in the Exchange 2007 organization. |
| Server Configuration node |
The Server Configuration node configures the Exchange 2007 servers and their
components such as protocols, databases, and messaging records
management. |
| Recipient Configuration node |
The Recipient Configuration node manages the recipients in the
Exchange 2007 organization. |
| Edge Transport node |
The Edge Transport node is visible only from a computer that has the Edge
Transport server role installed and is used to manage your organization's
perimeter network. |
| Toolbox node |
The Toolbox node contains the following tools:
- Queue Viewer
- Exchange Server Best Practices Analyzer
- Database Recovery Management
- Database Troubleshooter
- Performance Monitor
- Performance Troubleshooter
- Mail Flow Troubleshooter
- Message Tracking
|
Exchange Management Shell Facts
The Exchange Management Shell (also referred to as the Exchange
PowerShell) is the primary platform for all administration (the graphical
interface is simply running atop of the command shell). You should know the
following about the Exchange Management Shell:
- The PowerShell must be installed before Exchange 2007 is fully installed,
then extensions are installed to the PowerShell during the Exchange 2007
installation to create the Exchange 2007 PowerShell environment.
- To manage your Exchange organization, make sure you load the Exchange
Management Shell, not Microsoft Window's PowerShell.
- The Exchange.ps1 file includes setup for the PowerShell.
Management using the shell is done by typing cmdlets.
- Cmdlets use a verb + noun-based syntax, for example:
Get-AcceptedDomain.
- Commands are followed by one or more options. Options are identified by a
hyphen and are typically followed by data. For example, Get-Mailbox -Server
Server1 returns a list of mailboxes on Server1.
- To see the options available with a command, type help followed by
the command.
- To get help within an environment, type get-help. Use the
-detailed option with this command to get even more information.
- The tab completion feature automatically points you to the most likely
command if you only enter part of a command then press tab. If you're not sure
what the command is, or only know part of it, use tab completion to see options
starting with the letters you have typed.
The following table lists the basic set of Management Shell commands:
| Set |
Set modifies the properties of an existing Exchange 2007
object. |
| Get |
Get retrieves information about a particular Exchange 2007 object.
Pipe the command to the Format-List cmdlet to tell it to return verbose
information when you run a command. |
| New |
New creates a new Exchange 2007 object. |
| Excommand |
Excommand lists all available commands that relate to Exchange Server
2007. |
| Move |
Move relocates the specified Exchange 2007 object from one container
or server to another. |
| Disable |
Disable sets the Enabled status of the specified Exchange 2007 object
to $False, which prevents the object from processing data even though the
object exists. |
| Enable |
Enable sets the Enabled status of the specified Exchange 2007 object
to $True, which enables the object to process data. |
| Install |
Install installs a new object or feature on an Exchange 2007
server. |
| Uninstall |
Uninstall removes an object or feature from an Exchange 2007
server. |
| Remove |
Remove deletes the specified Exchange 2007 object. |
| Test |
Test tests specific Exchange 2007 components and provides log files
that you can examine. |
Use
pipelining (also called
piping) to string together the
actions of two or more cmdlets. Output from the first cmdlet is fed into the
second cmdlet (and so on). For example, the following cmdlet gets a list of
mailboxes on a server, then moves all mailboxes to a new server:
Get-Mailbox -Server Mail1 | Move-Mailbox -TargetDatabase
Mail2\Executives
When you execute a
Get command, a default set of values is returned
and the content is displayed in a specific order. Use the following cmdlets in
combination with the Get command to format the output:
- Use Format-List (fl) to take input from the pipeline and
output a vertical columned list of all the specified properties of each
object. This option is similar to the verbose option for command prompt
commands. You can also follow fl with a list of properties to show only
the desired properties.
- Use Format-Table to display items in a table format with label
headers and columns of property data.
- Use GroupBy to group output by a specified property.
- Use Property to specify which properties you wish to be displayed.
- Use Sort-Object to sort information using a specific order.
Chapter # 02
Installation & Configuration of Exchange 2007
Infrastructure Preparation
As you study this section, answer the following questions:
- How does Exchange 2007 modify the Active Directory schema?
- What functions are performed by Setup /PrepareAD?
- What permissions are required to run Setup /PrepareDomain?
- What is the difference between Setup /pd and Setup /pad?
- Which other commands' tasks are accomplished when you run Setup
/PrepareAD?
- Assuming you have all permissions to Active Directory and Exchange, what is
the most efficient way to prepare Active Directory for Exchange installation?
This section covers the following exam objectives:
- 101. Prepare the infrastructure for Exchange installation.
Infrastructure Preparation Facts
Exchange 2007 uses Active Directory for authentication, storing configuration
data, recipient addressing, and message routing. Active Directory has three
partitions (also referred to as
naming contexts). Each partition holds
different kinds of Exchange data.
| Schema |
The schema defines the rules for how objects are created (classes)
and the properties and bounds for object properties (attributes). Installing
Exchange 2007 extends (modifies) the Active Directory schema by adding the
following:
- Classes to create Exchange-specific objects, such as agents and connectors.
- Attributes to configure the Exchange-specific objects as well as additional
attributes for existing objects such as users and groups.
Each domain controller and global catalog server in the forest holds a
replica of the schema. |
| Configuration partition |
The configuration partition stores data that includes information that
includes AD site configuration, Exchange global settings, transport settings,
and mailbox policies. Configuration information specific to Exchange is stored
in a subfolder under the configuration partition's Services container. It
includes the following:
- Address lists
- Address and display templates
- Client access settings
- Connectors
- Global settings
- E-mail address policies
- System policies
- Transport settings
Each domain controller and global catalog server in the forest holds a
replica of the configuration partition. |
| Domain partition |
The domain partition holds all data for individual users, contacts, and
mailboxes. As Exchange runs, it stores and modifies data in the domain. The
domain partition stores the largest amount of information in a typical
deployment.
Each domain controller holds a replica of the domain partition for the domain
for which it is authoritative while each global catalog server in the forest
holds a subset of the information in every domain partition in the
forest. |
Before installing Exchange, make sure your Active Directory structure meets
the following requirements:
- The domain controller that is the Schema Master must be running Windows
Server 2003 SP1 (or later).
- In each site where Exchange Server 2007 will be installed, there must be at
least one global catalog server running Windows Server 2003 SP1 (or later).
- In each domain where Exchange Server 2007 will be installed, there must be
at least one domain controller that is running Windows Server 2003 SP1 (or
later).
- For all domains in the Active Directory forest where Exchange 2007 is
installed or where Exchange 2007 recipients exist, Active Directory must be in
Windows 2000 native mode or higher. To place the domain in Windows native mode,
you must remove any NT4 domain controllers.
- If the organization includes a previous version of Exchange, you cannot have
any Exchange 5.5 servers, and the organization must be running in native mode.
Preparing and installing Exchange makes the following changes in Active
Directory:
- Modifies permissions of existing Exchange 2000 or Exchange 2003
environments.
- Extends the schema to add Exchange classes and attributes.
- Creates the Exchange organization.
- Creates Exchange-specific objects and groups.
- Assigns permissions to groups used by Exchange.
Running the Setup wizard during the Exchange server installation makes all of
the necessary Active Directory modifications as long as the account you use has
the proper permissions. However, in large organizations, administrators with
permissions to install Exchange servers typically do not have the permissions
necessary to modify the schema or domain configuration. For the most granular
control over the Active Directory preparation process, and to delegate these
tasks to other administrators, run the Exchange server
Setup.com program
(with specific switches) in the following order, waiting for the changes to be
propagated through Active Directory before proceeding to the next step:
- If you have an existing Exchange 2000 or 2003 configuration, run Setup
/PrepareLegacyExchangePermissions (or Setup /pl) to modify the
existing Exchange 2000 or Exchange 2003 permissions.
- If you are a member of the Enterprise Admins group, all domains will be
modified.
- To run this command for a single domain, include the domain name in the
command. You must be delegated the Exchange Full Administrator role and you must
be a member of the Domain Admins group.
- Run the command on a Windows Server 2003 SP1 (or higher) server that can
contact all other domains in the forest.
- Run Setup /PrepareSchema (or Setup /ps) to extend the schema.
- You must be a member of the Schema Admins and Enterprise Admins group to
perform this step.
- Run the command on a computer in the same site as the Schema Master.
- Run Setup /PrepareAD /OrganizationName: Name (or Setup /p
/on: Name) to create the organization, create global Exchange
objects, and prepare the local domain. If the Exchange organization already
exists, omit the /on switch.
- You must be a member of the Enterprise Admins group to perform this step.
- Run the command on a computer in the same domain and site as the Schema
Master and that can contact all domains in the forest over port 389.
- Prepare each additional domain where you will have Exchange 2007 servers or
recipients. Use one of the following methods to prepare additional domains:
- Run Setup /PrepareDomain (or Setup /pd) on each additional
domain. You do not need to run this on the domain where you ran
/PrepareAD.
- You must be a member of the Domain Admins group in the domain to perform
this command if the domain that you are preparing existed before you ran
Setup /PrepareAD.
- You must be a member of the Exchange Organization Administrators group and
the Domain Admins group in the domain if it was created after you ran Setup
/PrepareAD.
- Run Setup /PrepareAllDomains (or Setup /pad) to prepare every
domain in the forest. You must be a member of the Enterprise Admins group to run
this command.
Note: The computer that is used to run
Setup must have the
Microsoft .NET, Framework 2.0, and the Microsoft Command Shell installed.
Perhaps the biggest consideration in deciding how to prepare Active Directory
is the permissions required to perform each specific task. The following table
summarizes the permissions required for each:
| /PrepareLegacyExchangePermissions |
- Enterprise Admins group membership to modify all domains.
- Delegated the Exchange Full Administrator role and Domain Admins group
membership to modify a single domain.
|
| /PrepareSchema |
Schema Admins and Enterprise Admins group memberships. |
| /PrepareAD |
- Enterprise Admins group membership if the schema is already prepared.
- Schema Admins and Enterprise Admins group membership if the schema has not
yet been prepared.
- In addition, you must be an Exchange Full Administrator if there are
existing Exchange 2003 servers.
|
| /PrepareDomain |
- Domain Admins group membership if the domain existed before you ran
/PrepareAD.
- Exchange Organization Administrators group membership and Domain Admins
group membership if the domain was created after you ran /PrepareAD.
|
| /PrepareAllDomains |
Enterprise Admins group membership. |
When you use
Setup to prepare Active Directory for Exchange server
installation, be aware of the following special cases:
- If you run the Setup wizard with appropriate permissions, the following
actions are performed: legacy permissions are modified, the schema is extended,
the organization is created, and the local domain is prepared. This is the most
efficient way to do the preparation and the installation if you have all of the
necessary permissions.
- Running /PrepareAD modifies legacy permissions and extends the schema
if those steps have not yet been performed (as long as you are a member of the
Schema Admins and Enterprise Admins groups).
- Running /PrepareSchema modifies legacy permissions if that step has
not yet been performed.
- Running /PrepareAllDomains is the most efficient way to prepare
domains for Exchange installation, but requires membership in the Enterprise
Admins group.
- Because you can only create a single organization in a forest, you must
create a second forest to accommodate two organizations. Run Setup /PrepareAD
/on in each domain to create the organizations.
- All domains with Exchange 2007 servers or recipients must be prepared.
Domains are prepared for Exchange if you have run /PrepareAD or
/PrepareDomain in the domain, or if you run /PrepareAllDomains.
In addition to preparing Active Directory, you must have a good DNS
infrastructure prior to Exchange installation. Exchange Server 2007 uses DNS for
the following:
- An Exchange server contacts DNS to get service locator records (SRV) to
locate Active Directory domain controllers.
- An Exchange server contacts DNS servers to retrieve MX (mailbox) records and
to locate SMTP domains. Edge Transport servers must be configured as follows:
- The internal interface must be configured to resolve internal addresses.
- The external interface must be configured to resolve Internet or public DNS
names.
- An Exchange server uses DNS to resolve hosts names, especially when locating
hosts on the Internet.
Server Preparation
As you study this section, answer the following questions:
- What components need to be installed before installing Exchange for any
server role?
- What additional components are required by a Mailbox server?
- What are the minimum hardware requirements for Exchange Server 2007?
- How do the RAM requirements for a Mailbox server differ from those of a
Client Access server?
- When do you install the SMTP and NNTP components on the Edge Transport
server?
This section covers the following exam objectives:
- 102. Prepare the servers for Exchange installation.
Server Preparation Facts
Before installing Exchange Server 2007, you must first evaluate the type of
hardware that is available. The hardware and directory requirements of Exchange
2007 are outlined in the following table:
| Architecture |
Exchange Server 2007 supports only 64-bit processors in a production
environment. This change increases the total amount of memory that can be used
by Exchange. Supported processors are:
- Intel processors that support Intel Extended Memory 64 Technology (for
example Intel Xeon or Intel Opteron processors).
- AMD processors that support AMD64 (for example AMD Athlon processors).
You should be aware of the following information concerning processors:
- You must choose a processor that works with the x64-based version of
Windows Server 2003.
- Because Intel Itanium processors cannot be used with x64-based versions of
Windows Server 2003, they cannot be used with Exchange 2007.
- Exchange Server 2007 shows significant performance benefits when employing
dual-core processors.
- A 32-bit version of Exchange is available, but is only supported in testing
and training environments.
- Management tools can be installed on 32-bit processors in production
environments. To do this, you must download the 32-bit version of Exchange 2007.
|
| Operating system |
You can install Exchange Server 2007 on the following operating systems:
- x64-bit Windows Server 2003 SP1 or later.
- 64-bit versions of Windows Server 2008 is supported beginning with Exchange
2007 SP1.
- 32-bit versions of Windows Server 2003 are supported only in testing and
training environments (and only with the 32-bit version of Exchange).
|
| RAM |
The minimum RAM requirement to support Exchange 2007 is 2 GB per server.
Depending upon the server role being installed, the recommended RAM is:
- Edge Transport server: 2 GB minimum or 1 GB per core (whichever is higher),
with a maximum of 16 GB per server.
- Hub Transport server: 2 GB minimum or 1 GB per core (whichever is higher),
with a maximum of 16 GB per server.
- Client Access server: 2 GB minimum or 1 GB per core (whichever is higher),
with a maximum of 8 GB per server.
- Unified Messaging server: 2 GB minimum or 1 GB per core (whichever is
higher), with a maximum of 4 GB per server.
- Mailbox server: Recommended 2 GB minimum, with an additional 2-5 MB per
mailbox, with a maximum of 32 GB per server.
- Multi Role (Hub, CAS, UM, Mailbox): Recommended 4 GB minimum, with an
additional 2-5 MB per mailbox, with a maximum of 8-32 GB per server (depending
on the combination of roles installed).
You should know the following about selecting memory for your Exchange 2007
server:
- 32 GB is not a physical limitation; rather, it is currently the most
cost-efficient memory configuration.
- The major advantage of having large amounts of RAM on a server is that it
significantly lessens the workload of the disk subsystem.
- The disadvantage of implementing larger RAM is the cost of the RAM and
installation is high compared to the amount of performance gained.
- Depending on the system, you might need to choose slower memory in order to
get up to the maximum supported memory. Installing more memory might require
using slower RAM.
|
| Free disk space |
An Exchange Server 2007 installation requires:
- At least 1.2 GB of available disk space for the installation.
- 200 MB of available disk space on the system drive.
- An additional 500 MB of disk space for each Unified Messaging (UM) language
pack you install.
- On Hub Transport and Edge Transport servers, 4 GB of space for message
queues. (This requirement has been reduced to 500 MB on Exchange 2007 SP1.)
|
| File System |
To install Exchange 2007, the following disk partitions should be formatted
as NTFS:
- System partition
- Partitions containing database files
- Partitions that store Exchange binary files
- Partitions containing storage group files, including transaction log files
- Partitions containing other Exchange files
|
| Disk subsystem |
The disk subsystem must have enough storage capacity to support the I/O
operations of the server and also support the amount of mailbox space allotted
to each user. Exchange server 2007 supports:
- Locally-attached storage
- Storage Area Networks (implementation of Fibre Channel technology is ideal)
- IP SCSI Network-Attached Storage technology.
Be aware of the
following when designing disk use for Exchange 2007:
- Although you can install Exchange 2007 on a single disk, for maximum
performance you should use different disks for system files, database files, and
transaction log files.
- Because of the increase in RAM in Exchange 2007, you can have a smaller
number of large disks without seeing a decrease in performance.
|
| Additional requirements |
A system must meet the following additional requirements to install Exchange
2007:
- A local- or network-accessible DVD-ROM drive.
- Screen resolution set to 800 x 600 pixels or
higher.
|
Before installing Exchange 2007, the following components are required for
all server roles:
- .NET Framework 2.0
- PowerShell 1.0
- Microsoft Management Console 3.0
- All necessary hotfixes
Note: If you use the Setup wizard in the graphical installation, these
components (except for the hotfixes) will be added automatically.
Once the common criteria is in place, you must install the individual
required components of whichever server roles you install:
| Mailbox server |
A Mailbox server requires the following components:
- Internet Information Services (IIS)
- Enable network COM+ access in IIS
- World Wide Web Publishing Service (W3SVC)
|
| Unified messaging server |
A Unified Messaging server requires the installation of:
- The Microsoft Speech Engine service
- The Windows Media Audio Voice Codec
- The Windows Media Encoder
- Microsoft Core XML Services (MSXML) Version 6.0
|
| Client Access server |
The Client Access server requires:
- World Wide Web Publishing Service (W3SVC)
- RPC/HTTP proxy Windows networking component on any computer that provides
Microsoft Outlook Anywhere access (recommended one per site)
- ASP.NET version 2.0
- Distributed Transaction Coordinator Service
|
| Edge Transport server |
An Edge Transport server requires the Active Directory Application Mode
(ADAM) to be installed before the Edge Transport server can be installed. It is
best to accept all of the default settings during the ADAM installation.
Note: If you are installing Exchange 2007 SP1, install Active
Directory Lightweight Directory Services (AD LDS) instead.
|
Note: When installing an Exchange server role in Exchange 2007, it is
not necessary to install the SMTP or the NNTP components before installation is
initiated, as was the case in Exchange 2003. If you install the Hub Transport
server role or the Edge Transport server role on a machine, it
cannot
have the SMTP service or the NNTP services installed on it. In addition, the
NWLink IPX/SPX/NetBIOS Compatible Transport Protocol must not be installed on
any Exchange server.
Client computers or mobile devices must have the following installed to run
certain applications:
| Outlook |
To use Microsoft Outlook to access an Exchange 2007 mailbox, you must have
one of the following versions of Outlook installed on the client's computer:
- Outlook 2002
- Outlook 2003
- Office Outlook 2007
|
| Outlook Web Access |
The client computer must have a Web browser installed. Microsoft Internet
Explorer must be installed if Integrated Windows authentication is
employed. |
| Mailbox access for mobile devices |
For mobile devices access to mailboxes requires the following:
- Windows Mobile 2003 Second Edition
- Windows Mobile 5.0 with the Messaging and Security Feature Pack (MSFP)
- A non-Windows operating system that are compatible with Exchange ActiveSync
|
Installation
As you study this section, answer the following questions:
- Which command do you run to install the Mailbox server role? The Client
Access server role?
- Which switch would you use to add a role to an existing Exchange server?
- When would you use the Upgrade option?
- How do you prevent a transport server from starting automatically following
server installation?
- What is the effect of installing the Unified Messaging server role and the
Mailbox server role on the same machine?
After finishing this section, you should be able to complete the following
tasks:
- Run Exchange Server 2007 setup from either the Management Console or the
Management Shell.
This section covers the following exam objectives:
Exchange Installation Facts
Using a role-based server model simplifies the Exchange 2007 installation
process. Instead of responding to multiple configuration questions, you simply
choose the role(s) to install on a specific server. To install Exchange 2007 on
a server, you need the appropriate permissions:
- To install a server role after Active Directory has been prepared, you must
be delegated the Exchange Organization Administrator role and have membership in
the local Administrators group on the server.
- Additional permissions are required if you need to prepare legacy
permissions, extend the schema, create the Exchange organization, or prepare the
domain for Exchange installation.
- After the first Exchange server has been installed, you can designate other
administrators who can install the server by provisioning the server.
Provisioning identifies a user account that is allowed to perform the
installation. Users are added to the Exchange View-Only Administrator role and
are given the necessary permissions to install Exchange on the server (similar
to the permissions given through the Exchange Server Administrator role).
Exchange 2007 provides two methods of running the server installation:
| Setup wizard |
The Setup wizard is the graphical installation tool for Exchange 2007. Start
the Setup wizard by running Setup.exe from the Exchange installation
disc. You can choose between two installation types:
- Choosing a Typical installation installs the Mailbox role, Hub Transport
role, Client Access role, and Management Tools.
- Choosing a Custom installation lets you choose the specific role(s) to
install, implement clustering, or install only the Management Tools.
Be aware of the following when using the Setup wizard.
- Active Directory preparation tasks will be performed if they have not
already been completed (as long as you have the appropriate permissions).
- If the server prerequisites (such as the Microsoft Command Shell, MMC
Console 3.0, and the .NET framework) have not yet been installed, you will be
provided with links to add these components.
- After you install a role on the server, you cannot use the Setup wizard to
add any additional server roles. To install additional server roles, you must
use Add or Remove Programs from Control Panel or install the role(s) from the
command line prompt.
|
| Unattended setup |
An unattended setup uses the Setup.com program with various switches
to customize the installation. With Setup.com you can:
- Install any supported combination of server roles.
- Add or remove server roles.
- Configure clustering.
- Install the management tools.
- Create the Exchange organization (if the installation is the first install).
- Save the Setup command and options as a script for running on other servers.
The management tools will be installed automatically when any server
role is installed. |
Use the following switches with
Setup.com to install Exchange 2007
from a command line in unattended mode:
| /roles (/r) |
/roles (/r) specifies which server roles will be installed.
Apply the following switches:
- ET or E specifies the Edge Transport server.
- HT or H specifies the Hub Transport server.
- CA or C specifies the Client Access server.
- MB or M specifies the Mailbox server.
- UM or U specifies the Unified Messaging server.
- MT or T specifies the Management Tools.
For example, to install Exchange 2007 with the Client Access and Mailbox
server roles, enter Setup.com /roles:MB,CA or Setup.com /r:M,C
into a command prompt. |
| /mode |
/mode specifies the setup mode.
- Install is the default mode used to install a new Exchange 207 server
or to add server roles to an existing server.
- Upgrade is used to upgrade an existing Exchange server that predates
Exchange 2007.
- Uninstall is used to uninstall Exchange 2007. Add the /roles
parameter to remove an individual role.
- RecoverServer is used to restore Exchange files and local
configuration settings on a failed Exchange 2007 server.
If you do not specify a mode, the default Install mode will be
used. |
| /OrganizationName (/on) |
/OrganizationName (/on) specifies the name of the
organization. This parameter is required if you are installing the first server
in an organization and you have not run Setup /PrepareAD. This parameter
cannot be used if you are installing a server in an existing Exchange
organization or if you have already run Setup /PrepareAD.
Note: You must be a member of the Enterprise Admins group to use the
/on switch. |
| /SourceDir |
/SourceDir specifies the location of the install files. |
| /TargetDir (/t) |
/TargetDir (/t) specifies the directory in which
Exchange 2007 will be installed. |
| /DomainController (/dc) |
/DomainController (/dc) specifies a domain controller to use.
The domain controller that is specified must be:
- In the same Active Directory site as the server on which Setup is run.
- Running Windows Server 2003 SP1.
You should know the following about the /dc parameter:
- You can use NetBIOS or a fully qualified domain name (FQDN) format to
specify a domain controller.
- Setup will select a domain controller to use if /dc is not used.
- When you prepare Active Directory and domains for Exchange 2007 or when you
install Exchange 2007 into an environment which contains domain controllers that
are running Windows Server 2000, you must run Setup with the /dc
parameter to specify the domain controller that is running Windows Server 2003
SP1.
|
| /AnswerFile |
/AnswerFile specifies the location of a file that contains the setup
parameters. Use this file to install the same parameters on multiple computers.
An example of the Setup command to use the answer file is:
Setup.com /Mode:Install /Roles:Mailbox
/AnswerFile:C:\AnswerFile01.txt. |
| /DoNotStartTransport |
Setup starts the Microsoft Exchange Transport service after installing
either the Hub Transport or Edge Transport server role by default. The
/DoNotStartTransport parameter specifies that the Microsoft Exchange
Transport service will not start when Setup completes. |
| /EnableLegacyOutlook |
/EnableLegacyOutlook specifies that you have client computers that
are running Microsoft Outlook 2003 or earlier and will cause Exchange 2007 to
create a public folder database on the Mailbox server.
- This can only be used if you are installing the first Mailbox server in an
organization.
- This command is done by default when you install the first Mailbox server in
an existing Exchange 2003 or Exchange 2000 organization.
|
| /LegacyRoutingServer |
/LegacyRoutingServer specifies the Exchange 2003 or Exchange 2000
bridgehead server on which you will create a routing group connector. This will
allow Exchange 2007 to coexist with either Exchange 2003 or Exchange
2000. |
| /EnableErrorReporting |
/EnableErrorReporting enables the Microsoft Error Reporting Service
to collect information about how you use Exchange 2007 and about any issues you
may encounter. |
| /DisableErrorReporting |
/DisableErrorReporting causes the Microsoft Error Reporting Service
to stop collecting information about how you use Exchange 2007 and about any
issues you may encounter. |
| /NoSelfSignedCertificates |
/NoSelfSignedCertificates is used if you have a PKI in the
organization and you do not want Setup to create self-signed certificates in the
case where no other valid certificate is found for Secure Sockets Layer (SSL) or
Transport Layer Security (TLS) sessions. |
| /AdamLdapPort |
/AdamLdapPort specifies the Lightweight Directory Access Protocol
(LDAP) port to use for the Edge Transport server role Active Directory
Application Mode (ADAM) instance. Know the following about this command:
- You can specify any valid unused port number.
- The default port is 50389.
- You can use this command only if you are installing the Edge Transport
server role.
|
| /AdamSslPort |
/AdamSslPort specifies the SSL port to use for the Edge Transport
server role ADAM instance. Know the following about this command:
- You can specify any valid unused port number.
- The default port is 50636.
- You can use this command only if you are installing the Edge Transport
server role.
|
| /PrepareAD (/p) |
/PrepareAD (/p) is used to prep the Active Directory schema
manually. This switch is optional because the schema is created automatically
during installation. |
| /NewProvisionedServer |
/NewProvisionedServer: <server name> (/nprs:
<server name>) creates a placeholder server object in Active
Directory so you can delegate the setup of a server. Know the following about
this parameter:
- Setup.com creates a placeholder server object in Active Directory for the
local server if you do not specify a server name with this parameter.
- The server that you specify must have a machine account in Active Directory.
- To run this parameter, you must have an existing Exchange organization in
Active Directory, you must be delegated the Exchange Organization Administrator,
and you must have at least one Exchange 2007 server installed in the
organization.
- Use the /ServerAdmin: <user or group> parameter to
identify a user or group account that will have permissions to a provisioned
Exchange server.
- Permissions allow for installing a server role, but do not allow
uninstalling Exchange.
|
| Cluster Mailbox Service switches |
The following CMS switches allow you to manage a new mailbox cluster.
- /NewCms creates a new Exchange 2007 clustered Mailbox server.
- /RemoveCms specifies that you want to remove an Exchange 2007
clustered Mailbox server.
- /RecoverCms specifies that you want to recover an Exchange 2007
clustered Mailbox server.
- /CMSName specifies the name of the Exchange 2007 clustered Mailbox
server.
- /CMSIPAddress specifies the static IP address of the Exchange 2007
clustered Mailbox server.
- /CMSSharedStorage specifies that this cluster node uses shared
storage.
- /CMSDataPath specifies the path for shared disks.
Note: You can install only the Mailbox server role on a cluster.
|
Server Role Deployment Facts
You should know the following about server role deployment:
- In a typical environment, a single server can be used to host the Hub
Transport, Mailbox, Client Access, and Unified Messaging server roles.
Coexisting server roles are administered as separate entities.
- If you deploy server roles on more than one machine, best practice dictates
that you use the following installation order:
- Client Access server role
- Hub Transport server role
- Mailbox server role
- Unified Messaging server role
- For messages to flow correctly, you must install the Mailbox and Hub
Transport server roles in each Active Directory directory service site.
- For client access to function properly, you must install a Client Access
server in each Active Directory site that has a Mailbox server.
- The Edge Transport server must be deployed on its own server; it
cannot coexist on the same computer with any other server role.
- You can run the Edge Transport server role in an existing Exchange 2000 or
2003 environment because it runs independently of all other server roles.
- Though the Edge Transport server can be deployed at any time during the
deployment phase, it will not be fully functional until the Hub Transport server
role is installed and the Edge Transport server is subscribed to it.
- Because the Unified Messaging server is very CPU-intensive, you should
consider deploying it on its own server. If not, then the quality voice prompts
and feedback may suffer.
- If the Unified Messaging server is deployed on a computer that does not have
any other Exchange 2007 roles installed on it, the organization must contain
other Exchange 2007 servers which have the Mailbox, Hub Transport, and Client
Access server roles installed.
- Clustering can only be implemented for the Mailbox server role. If a Mailbox
server implements clustering, it cannot share hardware with any other server
roles.
- It is possible to only install the Exchange Management Console, the Exchange
Management Shell, the help file, and the Management Tools on a computer that
does not have any other roles installed on it.
- It is not possible to perform a direct upgrade from Exchange 2000 and 2003
to Exchange 2007; you must perform a transitional upgrade instead. To begin the
transition, you should install the Client Access server role in each Active
Directory site that has a Mailbox server.
- Front-end Exchange 2000 or Exchange 2003 servers cannot provide access to an
Exchange 2007 Mailbox server.
Post Installation
As you study this section, answer the following questions:
- How can you filter messages in the Exchange setup log?
- What is the difference between an internal relay and an external relay
accepted domain?
- Which Exchange administrator role do you need to configure accepted domains?
- How do you get accepted domain configurations onto an Edge Transport server?
- What must you do before you can run the Security Configuration Wizard on an
Exchange server?
After finishing this section, you should be able to complete the following
tasks:
- Create and manage accepted domains.
- Use the Security Configuration Wizard to analyze the security of your
Exchange server.
This section covers the following exam objectives:
- 103. Install Exchange.
- 104. Configure Exchange server roles.
Post Installation Tasks
After you have prepared Active Directory for Exchange installation, and
before installing the first Exchange server, verify the following Active
Directory configuration:
- The Exchange Install Domain Servers group is a member of the Exchange
Servers USG in the root domain.
- There is a new organizational unit (OU) in the root domain called Microsoft
Exchange Security Groups which contains the following new Exchange USGs:
- Exchange Organization Administrators
- Exchange Recipient Administrators
- Exchange View-Only Administrators
- Exchange Servers
- ExchangeLegacyInterop
- The Exchange Servers USG on each domain controller in a domain in which
Exchange 2007 is installed has permissions on the Manage Auditing and Security
Log policy.
- There is a new global group in the Microsoft Exchange System Objects
container called Exchange Install Domain Servers.
Following Exchange server installation, use the following steps to complete
the installation:
- Run the Get-ExchangeServer cmdlet in the Exchange Management Shell to
verify the installation. You should see a list of all Exchange 2007 server roles
that are installed on the specified server.
- Examine the Application log for any error messages. Troubleshoot
accordingly.
- Review the setup log files using the Get-SetupLog files command. Use
the following commands to check the setup log files:
- Get-SetupLog c:\exchangesetuplogs\exchangesetup.log -error
generates a list of only the errors and warnings logged during setup.
- Get-SetupLog c:\exchangesetuplogs\exchangesetup.log generates a list
of all events logged during setup in a format that can be sorted or explored in
the Exchange Management Shell.
- Get-SetupLog c:\exchangesetuplogs\exchangesetup.log -tree generates a
list of all events logged during setup and presents the results in an indented
tree format.
- Get-SetupLog c:\exchangesetuplogs\exchangesetup.log -error -tree
generates a list of only the errors and warnings logged during setup and
presents the results in an indented tree format.
- Check the Exchange server documentation to verify that all necessary
services used by the Exchange role(s) have been installed and started.
- Run Exchange Server Best Practices Analyzer to verify that the Exchange
configuration meets Microsoft best practice standards.
- Complete the tasks under the Finalize Deployment tab in the Exchange
Management Console under the Microsoft Exchange node. These tasks are required
to complete the installation and include the following:
- Entering the product key
- Configuring the offline address book for distribution
- Configuring ActiveSync and SSL for the Client Access server
- Creating a subscription for the Edge Transport server
- Configuring authoritative domains for the organization and the Edge
Transport server
- Configuring Unified Messaging
- Configuring DNS
- Optionally, you can complete the suggested tasks under the End-to-End
Scenario tab.
- Run the Security Configuration Wizard to check the security of your
configuration.
Following server installation, you must perform additional tasks to configure
recipients and enable end-to-end mail flow in the organization.
Accepted Domains Facts
As part of the post installation process, you must configure
accepted
domains. Accepted domains identify the SMTP namespaces domains for which the
organization sends or receives e-mail. There are three types of accepted domains
in Exchange 2007:
| Authoritative |
A domain is considered authoritative if your Exchange organization hosts
mailboxes for recipients within the domain.
- When you install the first Hub Transport server, the fully qualified domain
name (FQDN) for the forest root domain is configured as an authoritative
accepted domain.
- If your external SMTP domain (for example mycompany.com) does not match the
FQDN of the forest root (such as mycompany.local), you will need to add the
external SMTP domain as an authoritative domain.
|
| Relay |
A relay domain is a domain for which a server accepts mail but is not
authoritative. Messages are sent to the SMTP server, then relayed to the
authoritative domain. Allowing relay of mail to all domains (known as an open
relay) is not a good practice, and could overload your server and result in
your server SMTP server being blacklisted. There are some occasions, however,
when relay for non-authoritative domains is necessary. In Exchange, you would
configure one of two types of relay domains:
- An internal relay is an e-mail domain where some or all of the
recipients do not have mailboxes in the Exchange organization. Internal relay is
handled by Hub Transport servers. Examples of situations that require an
internal relay include:
- When your internal system deploys both Exchange and non-Exchange mail
servers. The internal relay allows routing to the mailboxes on the non-Exchange
systems.
- When you have two forests configured with GAL synchronization. The internal
relay allows routing of messages from one forest to another.
- An external relay is an e-mail domain where messages are routed
outside of the Exchange organization and outside of the perimeter network.
Messages are relayed by Edge Transport
servers.
|
You should know the following about creating accepted domains:
- You must be an Exchange Organization Administrator to configure accepted
domains.
- It is recommended to configure accepted domains on the Hub Transport server
and populate them to the Edge Transport server using the Edge Subscription
process.
To create accepted domains, either use the New Accepted Domain Wizard in the
Exchange Management console, or use the
New-AcceptedDomain cmdlet in the
Exchange Management Shell.
- Use the -Name parameter to give the accepted domain entry a name.
- Use the -DomainName parameter to identify the domain name.
- Use the -DomainType parameter to identify the accepted domain type
(Authoritative, InternalRelay, or ExternalRelay).
- Use the /MakeDefault option to specify that the accepted domain is
the default domain, meaning that it is associated with outbound messages that
have encapsulated addresses for non-Exchange e-mail system interoperability.
- You don't have to set this parameter if you don't have to interoperate with
a non-Exchange e-mail system in your organization.
- For the first accepted domain that is created in the organization, the
default value is $true. For subsequent accepted domains, the default
value is $false.
- You cannot modify a default accepted domain. If you want to change the
default accepted domain, you must create a new accepted domain and set it as
Security Configuration Wizard Facts
As part of the post installation process, you can use the Security
Configuration Wizard to reduce security vulnerabilities. The Security
Configuration Wizard provides a simple and easy way to lock down a Windows
Server based on a predefined role. If the Security Configuration Wizard isn't
already installed on your computer, install it through the Add/Remove Windows
Components option of Add/Remove Programs in the Control Panel.
Before you can run the wizard, you must first register your Exchange 2007
database. This is done by entering one of the following commands at the command
prompt:
- To register a standard knowledge base, enter scwcmd register
/kbname:"ex2007kb" /kbfile: "C:\Program Files\Microsoft\Exchange
Server\Scripts\Exchange2007.xml" /d.
- To register an Edge server, enter scwcmd register /kbname:"ex2007Edgekb"
/kbfile: "C:\Program Files\Microsoft\Exchange
Server\Scripts\Exchange2007Edge.xml" /d.
After you have registered your knowledge base, all of the applicable roles
for Exchange 2007 should be listed when you view the security configuration
database. Perform the following steps to use the Wizard to create your security
policy:
- Start the Security Configuration Wizard by entering run scw into a
command prompt.
- Select each of the roles that are installed on your server then click
Next.
- Select whichever features, options, and services you would like installed on
your computer by following the successive prompts in the Security Wizard.
- The rest of the Security Configuration Wizard will allow you to create the
parameters that will be used for your security policy on your Exchange 2007
server.
- You can save the policy settings and apply them later by running the wizard
again.
Consider using the Security Configuration Wizard to configure the following
elements to improve your security policy:
- Firewall ports
- Running services
- Authentication
- Registry settings
- Service packs to be employed
- Auditing
- IIS configuration
Chapter # 03
Storage Management
Storage
As you study this section, answer the following questions:
- Which disk interfaces are supported by Exchange?
- What is the difference between a store and a storage group?
- How many mailbox stores should you put in a storage group?
- Why do you put log files and database files on separate disks?
- What RAID configurations are recommended for Exchange? Which configuration
should you not use?
This section covers the following exam objectives:
- 104. Configure Exchange server roles.
Storage Concepts Facts
Databases within Exchange are organized as follows:
| Store |
A store is a database of Exchange information. There are two types of
Exchange stores:
- A Mailbox store holds the information that comprise mailboxes in
Exchange 2007, such as data, data definitions, indexes, checksums, and flags.
Sent and received e-mails are held in the mailbox store.
- A Public Folder store holds information that can be shared by users.
Messages posted to public folders are held in the public folder store.
|
| Storage Group |
A storage group is a collection of stores. There is no limit to the
storage group size. All stores in a storage group:
- Share the same transaction logs.
- Are handled by the same instance of the Exchange store.
A Recovery Storage Group (RSG) is a special storage group used for recovering
Mailbox stores. With the recovery storage group you can:
- Mount mailbox databases and extract data from them.
- Recover data from a backup or copy of a database without disturbing user
access to current data.
|
Stores and storage groups exist only on Mailbox servers. The number of stores
and storage groups your Exchange 2007 server can hold depends on the version of
Exchange you're running:
- Exchange 2007 Enterprise edition supports up to 50 storage groups and 50
stores.
- Exchange 2007 Standard edition supports up to 5 storage groups and 5 stores.
- Both editions support a maximum of five databases per storage group, and
all five databases can be mailbox stores. However, the recommended configuration
is to place each store in its own storage group.
- Both editions support only one storage recovery group and one Public Folder
store per server.
Stores are made up of various files, as described in the following table:
| .edb |
An .edb file is located in the actual database itself. All of a user's
messages, folders, public folders, contacts, appointment information, etc. is
all stored in the .edb file. |
Can exceed multiple GB. |
| .log |
A .log file is an ESE transaction log file.
- Log files are used to protect data that has not yet been backed up.
- Log files are deleted during a full or incremental backup.
|
All .log files are 1 MB. |
| .jrs |
A .jrs file is a reserve log file which is used to commit any transactions
that are still in memory in the event of the server running out of disk space.
|
All .jrs files are 1 MB. |
| .chk |
A .chk file is used to identify which log files have been committed to the
database. |
The size of .chk file varies from 2-3 KB. |
These files are managed by the Extensible Storage Engine (ESE). ESE is a
transactional database that writes information into RAM memory and into a log
file. Once it is in the log file, it will be written to disk. The ESE takes the
following steps to write information into database files:
- The ESE writes a message into memory RAM when it arrives at the server.
- At the same time that information is written to RAM, it's written into the
current .log file. All current log files are named E00.log. The information is
written in a sequential format until the log file is full. What happens when the
log file is full depends on the type of logging enabled on the storage group.
| Default Logging |
When the E00.log file is full it is renamed and a new log file gets created.
This method requires more disk space because there might be multiple log files
on the server. This is the recommended configuration to ensure that no data is
lost. |
| Circular Logging |
When the E00.log file is full, the log file is overwritten with a new log
file of the same name. This method saves disk space because there is only one
log file at a time. However, recovery from a failed server can only be done up
to the most recent full backup. Because of this, with circular logging enabled,
you should only perform Full backups, and these backups should be very
regular. |
- Once it has been committed to the log file, the information is written to
the .edb file.
- The checkpoint file is updated to indicate that the transaction log has been
committed to the database.
The ESE uses this process to compensate for the different ways in which data
is written to database files and log files, such as:
- Data is written to an .edb file non-sequentially.
- Data is written to a .log file from top to bottom sequentially.
Data that is written sequentially is much easier for a disk to read and thus
is much faster. For this reason, data is always committed to a log file first
before it is written to the database file. The checkpoint file is then updated
to indicate that the log file has been used.
Storage Design Facts
When implementing stores and storage groups, keep in mind the following
recommendations:
| Disk interface |
When choosing the disk interface for your Mailbox server, consider the
following:
- Serial ATA (SATA) are cheap and have large capacity, but are typically
unsuited for a server environment. Before implementing SATA as a storage
solution, be sure to research the vibration and heat characteristics of the
specific drive. Be sure to also use a write caching controller for maximum
performance.
- Small Computer System Interface (SCSI) disks are well suited for Exchange
servers. They are faster than SATA disks, but have smaller overall capacity.
- Serial Attached SCSI (SAS) is a progression of parallel SCSI into a
point-to-point serial peripheral interface in which controllers are linked
directly to disk drives. SAS offers many advantages over both SCSI and SATA
drives.
- Internet SCSI (iSCSI) is a network-attached storage device that uses
Ethernet. iSCSI is the only network-based storage solution supported by Exchange
2007 (other NAS solutions are not supported). When implementing iSCSI, be sure
to dedicate the Ethernet communication network to storage only.
- Fibre Channel creates a storage area network (SAN). Before implementing
Fibre Channel, check the hardware documentation for Exchange support.
|
| Disk speed |
The number of operations per second is a much more important factor than the
basic speed of the disk. In a server environment, the most common action is a
user opening an e-mail, which is a rather small operation. For this reason, it's
more important to have a disk with high I/O per second capacity instead of a
high transfer rate. |
| Stores and storage groups |
Although you can create more than one store in a storage group, Microsoft
recommends that you put each store in its own storage group. For example, if you
need five stores, create five storage groups. |
| Disk configuration |
Place the operating system, pagefile, log file, and database files on
different disks. A sample configuration could be as follows:
- C:\ = operating system files
- D:\ = pagefile
- E:\ = transaction log file
- F:\ = database files
If you have multiple stores, put each log
file and each database file on a different disk.
- Putting the log file and the database file on different disks improves
performance. Each file type requires a different disk access method (sequential
vs. random).
- Putting each file on a different disk also allows the system to access
multiple stores at the same time.
- Placing separate files on different disks limits the amount of data loss
when a single disk fails.
|
| Disk protection |
For both log and database files, implement RAID 0 + 1 for fault tolerance
and performance.
- For transaction logs, you can implement RAID 1 disks with acceptable
performance.
- Using RAID 5 on a disk with a database file actually decreases performance
because RAID 5 disks typically require extra time to write parity data to disk.
Only consider using RAID 5 if you have small capacity and high speed disks.
|
| Replication |
The following clustering implementations can be implemented to increase
availability of your Exchange 2007 databases:
- Local Continuous Replication (LCR) maintains a copy of the production
storage group on a second set of disks that are connected to the same server
using built-in asynchronous log shipping and log replay technology.
- Cluster Continuous Replication (CCR) combines the asynchronous log shipping
and replay technology of Exchange 2007 with the failover and management features
provided by the Microsoft Windows Cluster service.
|
| Database size |
Recommended database sizes are as follows:
- 100 GB with LCR or CCR implementation
- 200 GB without LCR or CCR implementation
Splitting large databases into multiple smaller databases is advantageous in
situations in which there is a large number of users or service level agreements
that require faster restore times. The main disadvantage is the increased
complexity in storage design. |
Exchange Server 2007 is offered in a Standard and Enterprise editions. Design
your storage in accordance with the limitations described in the following
table:
| Database Storage Limit |
16 TB per database |
16 TB per database |
| Database Support |
5 databases |
50 databases |
| Storage Group Support |
5 storage groups |
50 storage groups |
| Local Continuous Replication |
Supported |
Supported |
| Cluster Continuous Replication |
Not supported |
Supported |
| Single Copy Clusters |
Not supported |
Supported |
Storage Management
As you study this section, answer the following questions:
- What administrative roles do you need to create a storage group?
- When do you run the Set-StorageGroup cmdlet?
- What administrative roles do you need to create a mailbox store?
- Where must you run the Move-DatabasePath cmdlet from?
- What must you do if you create a user mailbox to function as the journaling
recipient?
- When both mailbox database and mailbox storage quotas exist, which set of
quotas are applied?
After finishing this section, you should be able to complete the following
tasks:
- Create storage groups and mailbox stores.
- Manage storage group and mailbox store properties.
This section covers the following exam objectives:
- 104. Configure Exchange server roles.
Storage Management Facts
To create a storage group, the account you use must be delegated as the
Exchange Server Administrator role and local Administrators group for the target
server. Use the following commands to manage storage groups in the Exchange
Management Shell:
- Use New-StorageGroup to create a new storage group or a new recovery
storage group on a Mailbox server.
- Use Get-StorageGroup to view the information about the storage group
that was created.
- Use Remove-StorageGroup to delete a storage group.
- Use Set-StorageGroup to set a storage group's attributes in
Active Directory directory service. Use -CircularLoggingEnabled with a
value of $true to enable circular logging (the default value is
$false). When using circular logging, you should only perform full
backups. Reserve this option for storage groups that support Network News
Transfer Protocol (NNTP) folders (in public folder stores), which do not require
log files.
- Use Move-StorageGroupPath to move storage group log files to a
specified location. All mailboxes are dismounted before the move and are
inaccessible until the move completes.
- Use the -LogFolderPath switch to indicate the folder where log files
will be stored. These files need to be on a disk that is very large.
- Use the -SystemFolderPath switch to indicate the folder where system
files will be stored. This file needs to be on a disk that is very fast. By
default, the system path and transaction log locations are the same.
To create a mailbox, the account you use must be delegated as the Exchange
Recipient Administrator role and the Account Operator role for the applicable
Active Directory containers. Use the following commands to manage mailbox
databases in the Exchange Management Shell:
- Use New-MailboxDatabase to create a mailbox database object in the
Storage Group container under the specified server object. Note: Only one
database can be added to a storage group that has local continuous replication
enabled.
- Use Get-MailboxDatabase to view one or more mailbox database objects
from a storage group, server, or organization.
- Use Mount-Database to mount a database in a storage group on a
Microsoft Exchange Server 2007 Mailbox server.
- Use Dismount-Database to dismount a database in a storage group on a
Microsoft Exchange Server 2007 mailbox server.
- Use Move-DatabasePath to set a new path to the location of a database
on the specified Mailbox server and to move the related files to that location.
Note: The location of database files cannot be configured from a remote
server.
- Use Set-MailboxDatabase to set the attributes of a mailbox database.
- Use Remove-MailboxDatabase to delete a mailbox database object.
Note: Remove-MailboxDatabase removes the database object from
Active Directory, but it does not remove the physical database files. You must
remove the database files manually after you run the
Remove-MailboxDatabase command.
Database settings are described in the following table:
| Journal recipient |
Journaling is the ability to record and retain all communications in
an organization. This is done so that departments within an organization such as
financial services, insurance, and healthcare industries can maintain records of
communication that occurs between employees as they perform daily business
tasks. Journaling recipients are assigned to receive copies of the
communications so they can be archived and reviewed at a later time if needed.
If a journal recipient is specified for a mailbox database, every message that
enters or leaves the mailbox database will be sent to the journal recipient.
Examples of journal recipients are:
- Another mailbox
- A shared mailbox
- A Sharepoint site
- Third-party journaling solution
- A public folder
Note: When the recipient is a user mailbox,
the user must be enabled in Active Directory.
You should know the following about journaling and recipients:
- Standard journaling (called per-mailbox database journaling) enables
journaling on the entire mailbox database. All messages to and from the database
are journaled. Premium journaling (also called per-recipient journaling)
lets you configure journaling for specific recipients or senders or on an
organization-wide basis.
- You must configure standard journaling individually on each mailbox database
in your organization.
- Journaling functions are actually performed by Hub Transport servers.
- Enabling journaling saves information in Active Directory.
- The Journaling agent on the Hub Transport server uses this data to direct
messages to the journal recipient.
- The Journaling agent must be running on the Hub Transport server to perform
journaling tasks.
|
| Deletion settings |
Deleted items and mailboxes are stored in a queue marked for deletion before
they are permanently deleted. Saving items in the queue lets you restore deleted
messages or mailboxes. You can set the amount of time deleted items will be
retained by using the following command options:
- Use -DeletedItemRetention to specify the length of time to keep
deleted items.
- Use -EventHistoryRetentionPeriod to specify the length of time to
keep event data in the event history table in the Exchange store.
- Use -MailboxRetention to specify the length of time to keep deleted
mailboxes.
- Use -RetainDeletedItemsUntilBackup to specify whether to retain
deleted items until the next backup occurs. The two possible values for this
parameter are $true or $false.
|
| Maintenance schedule |
Setting a maintenance schedule increases the efficiency of an organization
by performing the following tasks on a set schedule:
- Online defragmentation.
- Remove files, messages, and data objects that have passed their retention
period from the databases and public folders in an organization.
You should know the following about maintenance schedules:
- Use the -MaintenanceSchedule option to specify when maintenance will
be done on the mailbox database.
- It is recommended to perform maintenance on your system daily at a time when
there is little activity.
- The maintenance window refers to the amount of time configured for
performing maintenance tasks. If all necessary maintenance tasks cannot be
performed in the amount of time allotted in the maintenance schedule, the next
session will start where the last maintenance activity left off.
Not mounting a store after a reboot is beneficial if you want to perform an
offline maintenance procedure on the store. You should know the following about
mounting a store:
- Use the -MountAtStartup switch to specify whether or not the mailbox
database will be mounted when the Microsoft Exchange Information Store service
starts. The two possible values for this parameter are $true or
$false.
- Use -AllowFileRestore to specify whether a restore on the database is
allowed to overwrite data. The two possible values for this parameter are
$true or $false. Set this value to $true prior to starting
a database restore operation.
Note: If no users can access mailboxes in the store, you should verify
that the store is mounted. |
| Storage limits |
A storage quota is a storage size limit for a mailbox or a public folder.
Storage quotas allow administrators to:
- Control the size of mailboxes.
- Manage the growth of mailbox databases.
Use the following switches to configure storage quotas:
- The following attributes apply to all mailboxes in the mailbox database that
do not have their own prohibit send quota attributes set:
- Use -ProhibitSendQuota to specify the mailbox size at which users
associated with mailboxes in this mailbox database can no longer send messages.
- Use -ProhibitSendReceiveQuota to specify the mailbox size at which
the user associated with this mailbox can no longer send or receive messages.
- Use -QuotaNotificationSchedule to specify when quota messages are
sent to mailboxes that have reached one of the quota values.
- Use -IssueWarningQuota to specify the mailbox size at which a warning
message is sent to the user.
The quota limits configured for a mailbox database are used as the default
limit for all mailboxes in the database. More or less restrictive settings can
be applied on a per-mailbox basis. These settings take precedence over the
database setting. |
Chapter # 04
Recipients
Recipient Types
As you study this section, answer the following questions:
- How is a mail user different from a user mailbox?
- What is the difference between a dynamic distribution group and a
universal distribution group?
- What is unique about linked mailbox user accounts?
This section covers the following exam objectives:
- 201. Configure recipients.
- 202. Configure mail-enabled groups.
- 203. Configure resource mailboxes.
Recipient Facts
A
recipient is an Active Directory object that has Exchange mail
capabilities. The following table explains the Exchange 2007 recipient
types:
| User mailbox |
A user mailbox is associated with an Active Directory user account.
- All of the messages, calendar items, documents, contacts, tasks, and other
data that are associated with a mailbox-enabled user are hosted on one of the
mailbox servers within an Exchange organization.
- A mailbox-enabled user can log on to the domain and access resources on the
network according to the permissions and groups to which they are assigned.
- User mailboxes are the most common type of Exchange recipient.
Note: The mailbox data that is stored in the Exchange mailbox database
is marked for deletion and the associated user account is also deleted from
Active Directory when a mailbox is removed. The user account can be retained by
disabling the mailbox. |
| Mail user |
A mail user is a mail-enabled Active Directory user that has an e-mail
address associated with an account, but whose mailbox is stored on an external
mail system. For example, a contractor who is working for the organization but
is using their own e-mail address. |
| Mail contact |
A mail contact is a mail-enabled Active Directory contact that contains
information about people or organizations that exist outside an
Exchange organization. Mail contacts are used to make it easier for users within
an organization to locate the contact details of people outside of the
organization. A mail contact is similar to a mail user, but a contact can't be
used for logon. |
| Mail-enabled universal distribution group |
A universal distribution group is a mail-enabled
Active Directory distribution group object that is used to distribute e-mail
messages to a large number of people in an organization, such as entire
departments or groups. Note: Unlike previous versions of Exchange, a
distribution group in Exchange 2007 must be a universal group. |
| Mail-enabled universal security group |
A universal security group is a mail-enabled
Active Directory security group object used to grant access permissions to
resources in Active Directory in addition to distributing messages to
departments or groups. Use a security group if you need to use the group to
control access to resources in addition to using it for mail
distribution. |
| Dynamic distribution group |
A dynamic distribution group is a distribution group whose membership
is defined by the results of a query (as opposed to a defined set of recipients)
which is executed every time a message is sent to the group. This is optimal for
environments in which people move groups or buildings often and e-mail groups
need to be able to accommodate changes as they occur. Note: Because of
the additional load that is placed on global catalog servers when a dynamic
distribution group query is run, it is best to limit the amount of dynamic
distribution groups that are created. |
| Mail-enabled non-universal group |
A non-universal group is a mail-enabled Active Directory global or
local group object which has been brought over from previous versions of
Exchange. You can manage these groups with Exchange 2007, but not create
them. |
| Room mailbox |
A room mailbox is assigned to a meeting location. Use room mailboxes to
schedule meeting rooms. When you create a room mailbox, a disabled user account
is created for the room. You then specify a user who manages the room, or you
can configure a calendar so schedule requests are handled
automatically. |
| Equipment mailbox |
An equipment mailbox is assigned to a resource that does not have a specific
location. Examples include a portable projector or a company car. You can use
equipment mailboxes for requesting and scheduling equipment use. Like a room
mailbox, an equipment mailbox has a disabled user account and a managing user.
You can also configure the calendar for automatic scheduling. |
| Mail-enabled public folder |
A mail-enabled public folder is a public folder that can receive messages.
Messages that are sent to e-mail addresses are posted in public
folders. |
| Linked mailbox |
A linked mailbox is a mailbox that is assigned to an individual user in a
separate, trusted forest. Multiple forests usually exist for the following
reasons:
- An organization deploys one forest for user accounts for the staff and
deploys a second forest for the resources for the organization such a print
services or Exchange.
- Administration requirements are distinct for different parts of the
organization.
- Different areas of the organization require distinct schemas.
- Multiple companies have merged together.
You should understand the following about linked mailboxes:
- When a linked mailbox is created, a mailbox and a disabled user account are
created in the forest which hosts the Exchange organization. Once the mailbox
has been created, it is then linked or associated with a user account that
resides in the second forest.
- To assign an account from the second forest to the mailbox, a trust
relationship must exist between the domain that contains the Exchange server and
the domain in which the user account resides.
|
| Shared mailbox |
A shared mailbox performs the same functions as a user mailbox, but is
associated with multiple Active Directory user accounts.
Note: Even though Exchange 2007 supports shared mailboxes, it is a
de-emphasized feature that can only be managed through the Exchange Management
Shell. It is recommended to use resource mailboxes or
Microsoft SharePoint Portal Server portals for collaboration instead of shared
mailboxes. |
| Legacy mailbox |
A legacy mailbox is a mailbox which resides on an Exchange Server 2003 or
Exchange 2000 Server. |
| Mail forest contact |
A mail forest contact is a read-only recipient object from another forest
that is created and managed by Microsoft Identity Integration Server (MIIS)
synchronization. Mail forest contacts cannot be removed or modified through the
Exchange Management Console or the Exchange Management Shell. |
| Microsoft Exchange recipient |
The Microsoft Exchange recipient is a special recipient object that:
- Differentiates system-generated messages from other messages.
- Replaces the “System Administrator” sender that was used for
system-generated messages in earlier versions of Microsoft Exchange Server.
|
Recipient Management
After finishing this section, you should be able to complete the following
tasks:
- Create user mailboxes and resource mailboxes.
- Create mail users and contacts.
- Create distribution groups and dynamic distribution groups.
This section covers the following exam objectives:
- 201. Configure recipients.
- 202. Configure mail-enabled groups.
- 203. Configure resource mailboxes.
Recipient Management Facts
You can manage recipients from both the Management Console or the Management
Shell, although there are some features or settings that might not be available
from the Management Shell. The following table describes various management
tasks:
| Create a recipient |
When you create a recipient, you create a new Active Directory object and
add mail capabilities to that object. Use the following cmdlets to create new
recipients:
- Use New-Mailbox to create a user mailbox or resource mailbox. Use the
-Room or -Equipment switches to create specific resource mailbox
types.
- Use New-MailContact and New-MailUser to create contacts and
mail users.
- Use New-DistributionGroup to create a mail-enabled group. Use the
-Type switch to identify the group type (Distribution or
Security).
- Use New-DynamicDistributionGroup to create a new dynamic distribution
group.
|
| Mail-enable an object |
When you mail-enable an object, you add mail capabilities to an existing
Active Directory object. Use the following cmdlets to mail-enable an object:
- Enable-Mailbox
- Enable-MailContact, Enable-MailUser
- Enable-DistributionGroup
Note: When you mail-enable
a group, the group must be a universal group. |
| Delete a recipient |
Deleting a recipient removes the Active Directory object.
- Use Remove-Mailbox to delete a mail-enabled user account. Use the
-Permanent $true switch to delete the mailbox and its contents in
addition to the user account (the default setting is $false). If you do
not delete the mailbox, you can link it to another recipient.
- Use Remove-MailContact, Remove-MailUser,
Remove-DistributionGroup, and Remove-DynamicDistributionGroup to
delete other mail-enabled Active Directory objects. These objects do not have an
associated mailbox, so only the object is deleted.
|
| Mail-disable a recipient |
When you disable an object, you remove Exchange recipient information from
the object, but the object still exists in Active Directory. Use the following
cmdlets to mail-disable an object:
- Disable-Mailbox (the mailbox still exists but is not linked to a
user)
- Disable-MailContact, Disable-MailUser
- Disable-DistributionGroup, Disable-DynamicDistributionGroup
|
| Connect a disconnected mailbox |
If you delete a recipient but do not delete the mailbox, or if you
mail-disable a recipient, the mailbox still exists but is not associated with an
Active Directory user. To connect a mailbox to a user, use the
Connect-Mailbox cmdlet. The Active Directory object must already exist.
If you do not specify an object, Exchange will search for a matching object.
|
| Configure recipient properties |
Use the following cmdlets to configure recipient properties (such as maximum
send and receive message size or quotas):
- Set-Mailbox
- Set-MailContact, Set-MailUser
- Set-DistributionGroup, Set-DynamicDistributionGroup
To modify group membership:
- Use Add-DistributionGroupMember or
Remove-DistributionGroupMember for distribution groups.
- Use Set-DynamicDistributionGroup to change group filter criteria.
|
| View recipient properties |
Use the corresponding Get command to view recipient settings:
- Get-Mailbox
- Get-MailContact, Get-MailUser
- Get-DistributionGroup, Get-DynamicDistributionGroup
To view group membership:
- Use Get-DistributionGroupMember to view members of distribution
groups.
- To view members of a dynamic distribution group, use the Management Console
to view the properties of the group. On the Conditions tab, click the
Preview button to generate the list of members based on the current
conditions.
You can also use the Get-User and Get-Group
cmdlets to view properties of Active Directory objects. Some Exchange properties
will be listed for the users or groups. |
| Convert a recipient |
Mailbox objects in Exchange can be converted from one type to another. You
can convert:
- A user mailbox to resource mailbox, or a resource mailbox to a user mailbox
- A user mailbox to shared mailbox, or a shared mailbox to a user mailbox
- A shared mailbox to user mailbox, or a shared mailbox to a resource mailbox
Use Set-Mailbox -Type with one of the following options:
Regular, Room, Equipment, or Shared. You cannot
convert a mailbox through the Management Console. |
Recipient and Mailbox Management
After finishing this section, you should be able to complete the following
tasks:
- Configure properties on recipient objects.
This section covers the following exam objectives:
- 201. Configure recipients.
- 202. Configure mail-enabled groups.
- 203. Configure resource mailboxes.
- 205. Move mailboxes.
Recipient Properties Facts
The settings you can configure on specific recipients depends on the
recipient type. In most cases, you can use the Management Console or the
Management Shell to configure all recipient properties. The following table
lists common recipient properties that you can configure.
| Message size restrictions |
Message size restrictions limit the size of messages that can be sent or
received. In addition to configuring settings on recipients, size restrictions
can also be set on the following objects in Exchange:
- Organizational limits apply to all Exchange 2007 servers that exist
in the organization.
- Global limits apply to all Exchange 2007 and Exchange Server 2003
servers that exist in the organization.
- Connector limits apply to any messages that use the specified Send
connector, Receive connector, or Foreign connector for message delivery as
defined on Hub Transport servers or Edge Transport servers.
- Server limits apply to a specific Hub Transport server or Edge
Transport server.
The maximum message size that can be sent or
received by a specific recipient is the most restrictive (smallest) size set on
the various objects. For example, setting a larger message size restriction for
a mailbox will not have an effect if a smaller size is set on the Hub Transport
server used to send the message to the mailbox.
In addition to setting the maximum send and receive sizes, you can use the
-MaxSafeSenders switch to specify the maximum number of senders that can
be included in the safe senders list. This property can only be set through the
Management Shell. |
| Message delivery restrictions |
Message delivery restrictions accept or reject messages based on the sender.
Use message delivery restrictions to:
- Only accept messages from a specific list of senders.
- Reject messages from a specific list of senders.
- Require that all senders are authenticated (accept messages only from users
within the organization).
From the command prompt:
- Use -AcceptMessagesOnlyFrom or -RejectMessagesFrom to
identify allowed or blocked users or contacts.
- Use -AcceptMessagesOnlyFromDLMembers or
-RejectMessagesFromDLMembers to identify allowed or blocked distribution
lists (groups).
|
| Non-delivery |
When mail cannot be delivered to a recipient, one of the following responses
can be configured to take place:
- Out of office messages can be sent to external senders.
- Microsoft Outlook and Exchange Server Non-Delivery Reports (NDRs) are
generated when e-mail cannot be delivered to a recipient.
- Mailboxes can be configured to accept NDRs when they are created.
- NDRs can be forwarded to internal mailboxes.
|
| Hide from address lists |
Use Set-Mailbox -HiddenFromAddressListsEnabled to specify whether
this mailbox is hidden from other address lists. The two possible values for
this parameter are $true or $false.
This setting is useful in instances when a mailbox address should not be made
public in the global catalog server, for example, special inboxes that are only
used for communication between the senior members of a company. |
| Quota |
A quota is a set restriction on the size of mailboxes. Use the following
cmdlets to set quotas:
- Use Set-Mailbox -ProhibitSendQuota to specify the mailbox size at
which the user associated with this mailbox can no longer send messages.
- Use Set-Mailbox -ProhibitSendReceiveQuota to specify the mailbox size
at which the user associated with this mailbox can no longer send or receive
messages.
Note: The quota limits configured for a mailbox database are used as
the default limit for all mailboxes in the database. When quotas are configured
on a per-mailbox basis, those settings take precedence over the default settings
for the database. |
| Messaging Records Management (MRM) |
Messaging
Records Management (MRM) allows you to:
- Remove content that has no legal or business value.
- Create policies that will simplify the process of complying with company
policy, government regulations, or legal needs in regards to e-mail
communications.
To configure MRM, you must be a member of Exchange Organization Administrator
role. MRM entails the following process:
- An administrator applies managed content settings to a user's mailbox
folders.
- An administrator or the user places these managed folders in the user's
mailbox.
- The user sorts individual messages or entire folders into the managed
folders according to organization policy.
- Messages in managed folders are periodically processed by Exchange according
to the folder content settings.
- When a message reaches a retention limit, it is archived, deleted, or
flagged for user attention, or the event is simply logged.
|
| Delivery options |
Use delivery option settings to:
- Configure a forwarding mailbox. Messages are forwarded or copied to the
designated recipient.
- Allow other users to send e-mail using a specific account, add authorized
users to the Send on behalf list. Messages sent from authorized users
will show "Sent on behalf of OriginalUser by DelegatedUser" in the From
field of a message.
- Set a limit on the maximum number of recipients for a message.
Use
the following cmdlets to configure delivery options:
- Use Set-Mailbox -DeliverToMailboxAndForward to specify whether
messages sent to this mailbox will be forwarded to another address.
- Use Set-Mailbox -ForwardingAddress to specify a forwarding address
where messages will be sent if the -DeliverToMailboxAndForward switch is
set to $true.
- Use Set-Mailbox -GrantSendOnBehalf to specify the distinguished name
(DN) of other mailboxes that can send messages on behalf of this mailbox.
- Use Set-Mailbox -MaxBlockedSenders to specify the maximum number of
senders that can be included in the blocked senders list.
|
| Mailbox features |
Mailbox features control the allowed client access methods for the
recipient. The following features can be enabled on a per-mailbox basis:
- Outlook Web Access
- ActiveSync
- Unified Messaging
- MAPI
By default, all users are allowed all access. Use the
Set-CASMailbox cmdlet to enable or disable access for specific
features. |
| Resource settings |
Resource settings identify specific characteristics of the room or the piece
of equipment. By default, both room and equipment mailboxes have a capacity
property that you can configure. Use the console or the Set-Mailbox
-ResourceCapacity cmdlet to specify the capacity of the resource mailbox.
In addition, you can define custom properties that apply to the object. To
define a custom attribute:
- Use Set-ResourceConfig to define the property. The property is
created in Active Directory by extending the schema. Each property must be
identified as either a Room property or an Equipment property. For example, you
could define a property called Whiteboard that applies to a Room.
- Add the specific property to the resource mailbox. You can select the
resource from a list in the Console, or use Set-Mailbox -ResourceCustom
to identify the custom properties associated with the resource.
|
| Calendar settings |
Resource mailbox calendar settings allow you to:
- Retrieve the Calendar Attendant configuration on the target mailbox.
- Enable calendar processing for a mailbox.
- Specify a list of users who can approve or reject requests sent to this
resource mailbox.
- Enable or disable calendar processing on the mailbox.
Use
Get-MailboxCalendarSettings to retrieve the Calendar Attendant
configuration and Set-MailboxCalendarSettings to enable calendar
processing for a mailbox. |
| Members |
A member of a distribution group receives all messages that are sent to the
distribution group. To view group membership:
- Use the Management Console or Get-DistributionGroupMember to view
members of distribution groups.
- To view members of a dynamic distribution group, use the Management Console
to view the properties of the group. On the Conditions tab, click the
Preview button to generate the list of members based on the current
conditions.
To modify group membership, use the Management Console or:
- Use Add-DistributionGroupMember or
Remove-DistributionGroupMember for distribution groups.
- Use Set-DynamicDistributionGroup to change group filter criteria.
|
| Expansion server |
Expansion
servers perform the functions necessary to send messages to distribution groups.
When a message is sent to a distribution group, the expansion server performs
the following process:
- The server receives a message.
- The server accesses the distribution group membership.
- The server sends the message to each recipient in the membership list.
In Exchange 2007, distribution groups are configured to use any Hub Transport
server as a distribution group expansion server by default. Specific servers can
be specified as expansion servers by using Set-DistributionGroup
-ExpansionServer. |
| Managed by |
The Managed by property identifies a user who is in charge of the
group. This user receives delivery reports for the
group. |
Note: To allow a user to modify recipient settings, add the user as an
Exchange Recipient Administrator.
Resource Scheduling Facts
For Room and Equipment mailboxes, you can configure automatic scheduling so
that meeting requests sent to the resource mailbox are processed automatically.
There are two methods to enable automatic scheduling:
- With Calendar Attendant scheduling, the Calendar Attendant is responsible
for granting scheduling requests based on the resource calendar.
- With booking policies, you define policies that identify who can schedule
resources, when the resource can be scheduled, and the message that users
receive in response to a booking request.
You cannot use the Management Console to configure resource scheduling. Use
the
Set-MailboxCalendarSettings cmdlet to enable and configure scheduling
requests. The following table describes various resource scheduling tasks:
| Configure automatic booking |
To configure automatic booking, you must enable the booking type. Use the
-AutomateProcessing switch to enable or disable automatic scheduling on
the mailbox.
- The None parameter disables resource scheduling.
- The AutoUpdate parameter enables resource scheduling using the
Calendar Attendant.
- The AutoAccept parameter enables scheduling using resource booking
policies that you define.
|
| Identify resource delegates |
A resource delegate is a user assigned to the resource that approves or
rejects meeting requests that are not processed automatically. For example, the
delegate approves requests that do not meet the defined policies. Use the
-ResourceDelegates switch to identify one or more users who are resource
delegates. |
| Identify who can schedule a resource |
When you enable resource booking, you manually identify who can submit
meeting requests. Use the following switches to enable booking submissions from
all users:
- When -AllBookInPolicy is set to $true, all users can submit
scheduling requests. Requests that meet the defined policies are approved
(booked) automatically.
- When -AllRequestInPolicy is set to $true, all users submit
scheduling requests. Requests that meet the policy conditions are sent to the
resource delegate for approval.
- When -AllRequestOutOfPolicy is set to $true, users can submit
requests that do not meet policy conditions. These requests must be approved by
a resource delegate.
Use the following switches to identify a list of
users who are allowed to submit scheduling requests:
- Use -BookInPolicy to identify a list of users whose requests are
granted automatically as long as those requests meet the policy conditions.
- Use -RequestInPolicy to identify a list of users who can submit
requests, but whose requests must be approved by the resource delegate.
- Use -RequestOutOfPolicy to identify a list of users who can submit
requests that do not meet policy conditions. Requests must be approved by a
resource delegate.
|
| Configure policy settings |
When using resource booking, use the following switches to configure when
the resource can be scheduled:
- Use -ScheduleOnlyDuringWorkingHours to limit scheduling during normal
work times.
- Use -AllowRecurringMeetings to allow or disable scheduling requests
that occur on a regular basis.
- Use -BookingWindowInDays to require that booking requests be made the
specified number of days before the scheduled time.
- Use -AllowConflicts to allow the resource booking agent to grant
requests that conflict.
|
Additional command switches allow you to configure the response sent to
meeting organizers, remove attachments or comments from the calendar entries, or
delete non-calendar requests.
Note: To run the
Set-MailboxCalendarSettings cmdlet, users must
have the Exchange Organization Administrator role. This is because settings
affect not only the recipient, but also organizational-wide settings.
Moving Mailboxes Facts
When you move a mailbox, you move the data in the mailbox from one mailbox
database to another. Be aware of the following when using
Move-Mailbox:
- You can move a mailbox to a different database on the same server, to a
different server within the same forest, or to a different server in another
forest. (To move a mailbox from one forest to another, you must use the
Move-Mailbox cmdlet.)
- You can move mailboxes from Exchange 2000/2003 servers to Exchange 2007, or
from Exchange 2007 to Exchange 2000/2003.
- To move a mailbox, the account you use must be delegated as the Exchange
Recipient Administrator role and the Account Operator role for the applicable
Active Directory containers.
- By default, when you move a mailbox the source mailbox data is not deleted.
Use -SourceMailboxCleanupOptions DeleteSourceMailbox to delete the source
mailbox after the move.
- Only one instance of the Move Mailbox wizard can be run at a time from the
Exchange Management Console. You can, however, run multiple instances of the
Exchange Management Console and run an instance of the Move Mailbox Wizard from
each.
- The move will fail if the size limit on the source mailbox exceeds the size
limit of the target database. Use -MailboxSizeLimitOptions PreserveSource
to set the mailbox size limit for the source mailbox on the target mailbox.
- Use the -PreserveMailboxSizeLimit switch to keep the current user
mailbox settings when moving a mailbox.
- Move-Mailbox does not change the user account association. You cannot
use Move-Mailbox to move the mailbox from one user to another.
- When moving mailboxes from Exchange 2007 to Exchange 2003, you might run
into cases where the user rule size on the mailbox exceeds the maximum size
limit for user rules on Exchange 2003 (Exchange 2007 supports 64 KB for rules,
while Exchange 2003 only supports 32 KB). If the 2007 mailbox has rules larger
than 32 KB, use the -IgnoreRuleLimitErrors switch to not move the rules.
While the
Move-Mailbox cmdlet is useful, it does have its limitations.
The following table describes the processes used to move and merge mailboxes for
various situations:
| Move a single mailbox within a forest |
Use the Move Mailbox wizard or the Move-Mailbox cmdlet to move a
mailbox and its contents from one mailbox database to another. |
| Move a mailbox across forests |
You can use Move-Mailbox to move mailboxes across forests. Use the
following process:
- Move the user account from the source forest to the target forest using the
Active Directory Migration Tool (ADMT) version 3.0.
- Run $SourceCredential = Get-Credential to create a credential object
that contains account information for the source forest.
- Run $TargetCredential = Get-Credential to create a credential object
that contains account information for the target forest.
- Run the Move-Mailbox cmdlet to move the mailbox. In addition to the
target database and the mailbox identity, you will need to supply the following:
- -SourceForestCredential $SourceCredential
- -TargetForestCredential $TargetCredential
- Either the -GlobalCatalog switch (to identify a target global catalog
server) or the -SourceForestGlobalCatalog switch.
- The -NTAccountOU to identify the location of the user account.
When moving mailboxes across forests, be aware of the
following:
- You must have the Exchange Recipient Administrator role for the Exchange
organization and the Exchange Server Administrator role and local Administrators
group for both the source and target forests and servers.
- You must have a domain controller running Windows Server 2003 in both the
source and target domains.
- You can move from Exchange 2000/2003 to Exchange 2007, or from Exchange 2003
to Exchange 2007 across forests. You cannot move mailboxes from Exchange 2007 to
Exchange 2000 across forests.
- Use -SourceMailboxCleanupOptions DeleteSourceNTAccount to
delete the source user account and mailboxes if all three of the following are
true:
- You are moving a user's mailbox to a new forest.
- You have already moved the user account to the new forest using the ADMT.
- You want to delete both the source mailbox and the source user account after
the mailbox is moved.
|
| Move an entire mailbox database on the same server |
If you need to move an entire mailbox database and all of its mailboxes to a
different location on the same server, use the following process:
- If necessary, run Move-StorageGroupPath or the console wizard to move
the log files.
- Run Move-DatabasePath or the console wizard to move the database
file.
- Run Move-Mailbox with the -ConfigurationOnly switch to change
the configuration information in Active Directory so that the mailboxes all
point to the new location of the database.
|
| Move an entire mailbox database to a different server |
If you need to move an entire mailbox database and all of its mailboxes to a
different server, use the following process:
- Commit any uncommitted log files to the database.
- Use Get-StorageGroup myServer\myStorageGroup | fl LogfilePrefix to
identify the log file prefix number.
- At a command prompt, run ESEUTIL /R prefix.
- Create the database on the target server.
- Set the This database can be over written by restore attribute on the
target database using the console or run Set-MailboxDatabase with the
-AllowFileResore switch.
- Copy the database files from the source server to the target server in the
same location as the target server database files.
- Mount the target database.
- Run Move-Mailbox with the -ConfigurationOnly switch to change
the configuration information in Active Directory so that the mailboxes all
point to the new location of the database.
Mailbox databases can only
be moved between Exchange 2007 servers in the same Exchange
organization. |
| Merge mailboxes across forests |
When you move mailboxes across forests, the user mailbox might be
unavailable for a time. To move mailboxes with minimal interruption of mail
service, use the following process:
- Run Move-Mailbox to move the mailbox to the target forest. Do not
delete the user account or the mailbox.
- Run ADMT to migrate the user account to the target forest. Disable access to
the source mailbox. This causes the user account to use the mailbox in the
target forest.
- Run Move-Mailbox with the -AllowMerge switch to merge the
source mailbox with the target mailbox. Only messages that were sent or received
during the transition will be merged into the target mailbox.
- Manually delete the user account and the mailbox in the source forest.
|
| Move a mailbox to a different user |
When you use the Move-Mailbox cmdlet, the mailbox is moved to a
different location but is still associated with the same user account. If you
have a mailbox for one user that you want to associate with another user:
- Run Disable-Mailbox to unlink the mailbox from the source user
account or Remove-Mailbox to delete the user account.
- Run Connect-Mailbox to mail-enable the target user account and link
the mailbox to the user.
Note: You cannot connect a mailbox to
a user that already has a mailbox. The target user account must not be
mail-enabled, and must be in the same forest as the disconnected
mailbox. |
| Export mailbox data to another mailbox |
If you want to move mailbox data to a different user who already has a
mailbox, you will need to export the mailbox contents from the source mailbox
and import it into the target mailbox.
- Run the Export-Mailbox cmdlet to export and import the data in a
single step.
- All data in the source mailbox is copied into a folder in the destination
mailbox.
- You can export data from connected and disconnected mailboxes.
- The source mailbox and its data are not deleted. If connected, the source
mailbox remains connected.
- You can only export mailbox data within a forest.
- With Exchange 2007 SP1, you can also export data to a .pst file. You can
then use the Import-Mailbox cmdlet to import the .pst file into a
mailbox.
|
| Restore mailbox data |
If a disconnected mailbox no longer exists, you can move mailbox data to the
same or another mailbox by restoring the mailbox. To recover a lost mailbox:
- Create a recovery storage group.
- Create a mailbox database in the recovery storage group.
- Set the This database can be over written by restore attribute on the
target database using the console or run Set-MailboxDatabase with the
-AllowFileResore switch.
- Restore the mailbox database to the recovery database.
- Mount the recovery database.
- Run Restore-Mailbox to restore a mailbox from the recovery database
to a target mailbox.
When restoring data, be aware of the following:
- You can restore data from one mailbox to the same mailbox or to a different
mailbox.
- You can only restore data to a mailbox in the same Exchange organization.
- When restoring to the same mailbox, you can either merge data into the
existing mailbox, or copy all data into a target directory. Use the
-TargetFolder switch to identify the target directory. Restored data does
not overwrite existing data.
- When restoring to a different mailbox, you must include the
-TargetFolder switch.
|
Bulk Recipient Management
As you study this section, answer the following questions:
- What is the function of pipelining when running cmdlets for multiple
objects?
- How does the Whatif switch affect a cmdlet for multiple objects?
- What is the difference between WhatIf and ValidateOnly?
After finishing this section, you should be able to complete the following
tasks:
- Use pipelining to combine multiple cmdlets.
This section covers the following exam objectives:
- 206. Implement bulk management of mail-enabled objects.
Recipient Bulk Management Facts
The primary method of performing recipient management tasks on multiple
recipients is by using Management Shell scripts that operate on multiple
objects. The basic format for such scripts is to use a
Get- cmdlet to
retrieve a list of objects, then use
piping (also called
pipelining) to feed that list into another command that performs certain
actions. Use the
| character to combine multiple cmdlets together. For
example, the following cmdlet shows three cmdlets piped together:
Get-Mailbox | where { $_.ResourceType -eq "Shared" } |
Set-Mailbox -MaxSendSize "300KB"
Cmdlets are executed in order, left to right, with the results of previous
cmdlets being fed into subsequent ones. In the example listed above, the cmdlet
performs the following actions:
- Get a list of mailboxes.
- From the list of mailboxes, filter out only those that have a
ResourceType property of Shared.
- From the list of filtered mailboxes, change the maximum send size to 300KB.
The
Where-Object cmdlet has the following syntax:
- Use { } to enclose the script block that defines the filter.
- $_ is a special variable that contains the current pipeline object.
- ResourceType is a specific property of the object. The object
property is added to the object variable with a period.
- -eq is a comparison operator. Operators include:
- -lt Less than
- -le Less than or equal to
- -gt Greater than
- -ge Greater than or equal to
- -eq Equal to
- -ne Not equal to
- -like Like (used for string comparisons)
- -notlike (used for string comparisons)
When using
-like and -notlike, you can use * for wildcard matching.
When comparing text strings, enclose the text in quotes.
- Shared is the value that will be compared when filtering the results.
The following table lists some additional settings you can use when executing
cmdlets.
| WhatIf |
Use the -WhatIf switch to cause a command to display the objects that
would be affected by running the command and what changes would be made to those
objects.
- -WhatIf allows you to see whether the changes that would be made to
objects match your expectations, without the worry of modifying those objects.
- Place -WhatIf at the end of a command.
|
| Confirm |
Use the -Confirm switch to cause a command to stop processing before
any changes are made.
- -Confirm allows you to step through changes to objects to make sure
that changes are made only to the specific objects that you want to change. A
confirmation prompt is displayed for each object before the Exchange Management
Shell modifies the object.
- Use the -Confirm parameter with a value of $False if you want
to override the default behavior of the Exchange Management Shell and suppress
the confirmation prompt for cmdlets on which it is automatically applied.
- Place -Confirm at the end of a command.
|
| ValidateOnly |
Use the -ValidateOnly switch to cause a command to evaluate
all the conditions and requirements that are needed to perform the operation
before any changes are applied.
- The command runs through the whole process and performs each action as it
would normally, but it does not change any objects when -ValidateOnly
is applied.
- Run the command again without -ValidateOnly if the -ValidateOnly
run was successful to make the changes.
- Place -ValidateOnly at the end of a command.
|
| Write-Error |
To report errors while a command runs, pipe a cmdlet to the Write-Error
cmdlet. |
Following are additional examples of using pipelining to perform bulk
recipient tasks:
| Cmdlet: |
Get-Mailbox -Server Mail1 | Move-Mailbox -TargetDatabase "Mail2\First
Storage Group\Executives" |
| Function: |
Get a list of mailboxes on Mail1, then move each mailbox to the Executives
database on Mail2. |
|
|
| Cmdlet: |
Get-DistributionGroup | Set-DistributionGroup
-RequireSenderAuthentication $true |
| Function: |
Get a list of all distribution groups, then configure each group to allow
only authenticated users to send mail to the group. |
|
|
| Cmdlet: |
Get-User | where { $_.RecipientTypeDetails -eq "User" } | where
{$_.DistinguishedName -like "*CN=Mrktg*"} | Enable-Mailbox -Database
"Mrktg" |
| Function: |
Get a list of Active Directory User accounts that are not mail-enabled but
are enabled for logon (RecipientTypeDetails = User), then filter the list to
include only user accounts that are in the Mrktg OU. Create a mailbox and
mail-enable each user that meets the criteria. |
|
|
| Cmdlet: |
Get-Group | where {$_.RecipientTypeDetails -eq
"MailUniversalDistributionGroup"} | where {$_.Members -like "*Mary Cooper*" } |
Remove-DistributionGroupMember -member "Mary Cooper" |
| Function: |
Get a list of mail-enabled distribution groups of which Mary Cooper is a
member. Remove Mary Cooper as a member of each
group. |
As you work with the Management Shell constructing complex cmdlets, use the
following process:
- Use a Get- command to examine the available properties for one
specific object. Identify properties that will help you construct filters that
apply only to the specific objects you want to modify.
- Construct a where clause to filter on the specific property and
values.
- Combine a Get- command with the where clause and execute the
cmdlet. The list of objects returned are those objects that meet the cmdlet
criteria. Verify that the list meets your expectations.
- Add a Set- command to perform the actions you want. Execute the
entire cmdlet with the -WhatIf switch to see what would happen when the
cmdlet runs.
- (Optional) If the results meet your expectations, run the cmdlet with the
-ValidateOnly switch to make sure that any prerequisites are met.
- Run the completed cmdlet.
E-mail Address Policies
As you study this section, answer the following questions:
- What is the e-mail address format of the default e-mail policy?
- What should you include if you wanted to limit the %i component of an
e-mail address to a single letter?
- What is the format of an e-mail address listed in a policy as
%g.%s@company.com?
- What happens to mail-enabled distribution groups when you use the
Department condition for an e-mail policy?
- When are e-mail policies applied?
After finishing this section, you should be able to complete the following
tasks:
- Design and configure e-mail policies for your Exchange organization.
This section covers the following exam objectives:
-
304. Configure policies.
E-mail Address Policy Facts
E-mail Address policies are used to automatically generate e-mail addresses
for Exchange recipients within your organization. Policies can be used to
generate e-mail addresses for a number of environments, such as SMTP, X400,
Lotus Notes, or Novell GroupWise. When you create an e-mail address policy, the
following properties must be specified:
| Recipient types |
You can choose the types of recipients to which the policy will apply,
including:
- Users who have Microsoft Exchange Server 2007, Exchange Server 2003, and
Exchange 2000 Server mailboxes.
- Users who have external e-mail addresses.
- Users who have Exchange resource mailboxes.
- Contacts with external e-mail addresses.
- Security groups or distribution groups that have been
mail-enabled.
|
| Conditions (filters) |
Conditions apply additional filters to recipients based on recipient
properties. The e-mail address policy will only apply to those recipients that
meet the conditions. You can filter on the following properties:
- States or provinces
- Department
- Company
- Custom attributes (1-15) defined on each recipient
The above conditions are the predefined conditions in the Exchange Management
Console. You must use the Exchange Management Shell to create a custom query for
the e-mail address policy if you wish to specify additional conditions. After
selecting conditions that will be applied, you must configure values for each
condition.
Note: The State or Province, Department, and Company conditions are
based on attributes that are applicable only to mailboxes, mail users, and mail
contacts and thus do not apply to mail-enabled distribution groups. If you
configure conditions for an e-mail address policy, you will in effect be
excluding all mail-enabled distribution groups. To define conditions that match
distribution groups, use conditions that match custom attributes. |
| E-mail address |
The e-mail address setting identifies the format that will be used to
generate the e-mail address. When choosing the e-mail address format, you have
two choices:
- Select SMTP Address to choose from a list of precanned (predefined)
e-mail address formats. You can choose one of the following local (left side)
formats:
- Alias (alias@mycompany.com)
- FirstName.LastName (john.smith@mycompany.com)
- FirstInitial + LastName (jsmith@mycompany.com)
- FirstName + LastInitial (johns@mycompany.com)
- LastName.FirstName (smith.john@mycompany.com)
- LastInitial + FirstName (sjohn@mycompany.com)
- LastName + FirstInitial (smithj@mycompany.com)
If you have
multiple accepted domains configured, you can also choose the domain portion of
the address to use. You can choose any authoritative domain or internal relay
domain (external relay domains cannot be selected when using the precanned
formats).
- Select Custom Address to configure non-SMTP addresses or SMTP addresses
using a format other than the precanned formats. When configuring e-mail
addresses, you can use variables to customize the format as explained in the
following link: E-mail Address Variables.
|
| Schedule |
By default, e-mail address policies are applied when you create or modify
the policy. If desired, you can configure the policy to be applied on a
schedule. |
To configure e-mail address policies in the Management Console, beneath
Organization Configuration select the Hub Transport node, then use
the E-mail Address Policies tab. Use the following cmdlets to create and
manage e-mail address policies:
- Use Get-EmailAddressPolicy to return all of the attributes on a
policy or set of policies.
- Use New-EmailAddressPolicy to create a new e-mail address policy.
- Use Remove-EmailAddressPolicy to remove an existing e-mail address
policy.
- Use Set-EmailAddressPolicy to set the Active Directory directory
service attributes for an e-mail address policy.
- Use Update-EmailAddressPolicy to apply an e-mail address policy
immediately. When the cmdlet is run, the e-mail address policy is applied to all
applicable recipients.
You should know the following about e-mail policies:
- A default policy is created automatically. It applies to all recipients and
uses the e-mail address format of alias@domain where alias is the
Exchange alias and domain is the authoritative domain created during
installation.
- You can edit the default policy to modify the address format or add
additional addresses. You cannot modify the recipients or the conditions, and
you cannot delete the default recipient policy.
- You can create multiple e-mail address policies. Each policy has a priority.
- Policies are applied in order (highest to lowest).
- Policies apply only to the recipients specified in the policy that meet the
filter conditions.
- Only a single policy applies to each user. The policy used for the recipient
is the policy with the highest priority that meets the filter criteria.
- The default policy has the lowest priority. Its priority cannot be changed.
If no other policies have been applied to a recipient, the default policy will
be used (it matches all remaining recipients).
- Policies are applied at the following times:
- When you create or modify a policy using the Management Console, the policy
is applied immediately or according to the schedule. Select Do not apply
to modify the policy without applying it immediately. Note: Modifying an
existing policy with Set-EmailAddressPolicy does not automatically apply
the changes.
- When you create or modify a recipient, e-mail address policies are evaluated
and applied as necessary.
- Immediately, by using the Update-EmailAddressPolicy cmdlet or by
applying the policy manually in the Management Console.
- You cannot use the Exchange Management Console to view the members of a
policy if you used the Exchange Management Shell to create the policy. You must
use the Get-Recipient cmdlet in the Exchange Management Shell.
- To prevent e-mail address policies from being applied to specific
recipients, disable the Automatically update e-mail addresses based on email
address policy setting in the properties for the recipient.
- You can configure a policy to create more than one address for a recipient.
When more than one address exists, one is designated as the primary
address. The primary address is the address used as the return e-mail address
when a recipient sends mail.
- When you view the properties for a recipient, the primary address will be
designated in bold. To change the primary address for a recipient, you must
first prevent the recipient from receiving e-mail addresses from a policy. Then
select the new primary address from the list and click Set as Reply.
- You can define e-mail addresses for specific recipients in addition to those
created by the applicable e-mail address policies. When the e-mail address
policy is applied, existing e-mail addresses are not deleted or modified. New
addresses will be generated if necessary, and the primary address set according
to the policy.
Chapter # 05
Client Access
Client Access Servers
As you study this section, answer the following questions:
- What is the URL a client uses to connect to a Client Access server through
Outlook Web Access?
- What are the protocols e-mail clients can use to communicate with the Client
Access server?
- Which client type does not use a Client Access server for retrieving mail
from a Mailbox server?
- Where must you deploy Client Access servers?
This section covers the following exam objectives:
- 306. Configure client connectivity.
Client Access Server Facts
All access that is not done through a MAPI protocol is sent through a Client
Access server. Client Access servers are similar to Exchange 2000 or Exchange
2003 front-end servers. E-mail clients using a protocol such as HTTP, POP3,
IMAP4, or services such as Exchange ActiveSync or Outlook Anywhere, connect to a
Client Access server, and the Client Access server handles all communication
with the Mailbox server. The Client Access server uses the following general
process to communicate with the client and the Mailbox server:
- The e-mail client initiates a connection to the Client Access server.
- The Client Access server contacts a domain controller and authenticates the
user.
- After authentication, the Client Access server queries Active Directory to
identify the location of the user's Mailbox server.
- The Client Access server communicates with the Mailbox server using RPC.
- Data from the user's mailbox is sent to the Client Access server.
- The Client Access server renders the data based on the type of client that
has connected, then sends the data to the client.
You should be aware of the following regarding how the Client Access server
communication process works:
- In most cases, the Client Access server is responsible for rendering the
mailbox data in a format compatible for the e-mail client. This places a greater
load on the Client Access server than was required for front-end servers in
previous Exchange versions. If you are upgrading an existing Exchange server for
use as an Exchange 2007 Client Access server, it is important that the server
has the proper hardware requirements to be able to support the increased
processing demands.
- An Exchange 2007 Client Access server can be configured as a front-end
server for an Exchange 2003 mailbox server. When this is the case, the Client
Access server acts like a front-end server; mail data rendering occurs on the
Exchange 2003 server.
- Clients using Outlook Web Access (OWA) use one of the following URLs to
connect to the Client Access server:
- Exchange 2007 servers now use http://servername/OWA.
- Clients retrieving mail on Exchange 2000/2003 servers must use
http://servername/exchange. If Exchange 2007 clients use this URL, they
will be redirected to the http://servername/OWA URL after authentication.
- Communication between the e-mail client and the Client Access server uses
one of the following protocols:
- RCP over HTTP or HTTPS for Outlook Anywhere
- HTTP or HTTPS for Outlook Web Access and ActiveSync
- POP3 (port 110) or IMAP (port 143) for other clients
- The Client Access server communicates with the Mailbox server using one of
the following protocols:
- RPC for Exchange 2007 Mailbox servers
- RPC over HTTP for Exchange 2003 servers
- You must have a Client Access server in each Active Directory site where you
have Mailbox servers. The Client Access server communicates only with Mailbox
servers within its own site.
- POP3 and IMAP clients use SMTP to send messages. To send mail, these clients
must be able to connect to a Hub Transport or an Edge Transport server.
- If possible, clients should connect using port 587. This new port allows for
authentication before sending mail, and is used by many ISP's to control who can
send mail.
- Connections can also use port 25. Servers typically connect using port 25.
Exchange Clients
As you study this section, answer the following questions:
- How does Outlook communicate with the Mailbox server?
- What client requirements are necessary to access e-mail through Outlook Web
Access?
- What features are provided by the Calendar Concierge Service?
- Which virtual directory do ActiveSync users access?
- How does the external URL to a virtual directory differ from the internal
URL to the same virtual directory?
- How does the Autodiscover service affect user profile creation?
This section covers the following exam objectives:
- 306. Configure client connectivity.
Exchange Clients Facts
An e-mail client is a software application that supports specific protocols
and provides the user with an interface to a server. Exchange Server 2007
supports the following e-mail clients:
| Outlook |
Microsoft Outlook is a desktop e-mail client application. You can use
Outlook to connect to Exchange servers, or to POP3 or IMAP servers. Outlook is
typically used in a corporate environment to connect to an Exchange
organization. When connecting to an Exchange server within a firewall, Outlook
uses RPC to communicate directly to the Mailbox server. |
| Outlook Anywhere |
Outlook Anywhere is a feature of Outlook that lets you use Outlook to
connect to Exchange through a firewall.
- The client computer running Outlook Anywhere requires Windows XP SP2 or
higher.
- Outlook Anywhere connects to a Client Access server using RPC over HTTP.
- You must manually enable Outlook Anywhere support on the Client Access
server.
Outlook Anywhere on the client lets you use Cache mode. With
Cache mode:
- Messages are downloaded to the client computer.
- Messages are available even when the client is not connected to the
Internet.
- You can reply to and compose new messages, even when a connection to the
Exchange server is not present.
- When a connection is re-established, new messages are downloaded and any
composed messages are sent.
|
| Outlook Web Access (OWA) |
Outlook Web Access (OWA) is a browser-based method of accessing your
mailbox. The client system only needs a compatible browser to send and receive
e-mail. For example, with OWA you can use a public kiosk with an Internet
connection and a browser to access your mailbox.
- The interface within the browser is similar to the Outlook interface.
- Advanced features in OWA that mimic the Outlook experience are available
only with Internet Explorer 6.0 or higher.
- When you install a Client Access server, OWA is installed and enabled by
default.
- Clients access mail using the URL: http://servername/OWA.
Note: Outlook Web Access no longer provides access to public folders
in Exchange 2007. If you wish for Outlook to continue having the ability to
access public folders, you must maintain an Exchange 2003 server within your
organization. |
| Exchange ActiveSync |
Exchange ActiveSync is a protocol used by Internet-enabled mobile devices to
send and retrieve Exchange data.
- ActiveSync synchronizes e-mail messages, calendar items, contacts, and
tasks.
- With Direct Push, a connection is initiated by the Exchange server and
changes are sent to the mobile device. This allows for notification of new mail
without the end-user having to initiate a connection with the server.
- With Remote Wipe, if the mobile device is lost or stolen, you can issue a
command remotely and all data on the mobile device will be deleted.
- ActiveSync is installed and enabled by default on the Client Access server.
|
| POP3/IMAP clients |
E-mail clients that use POP3 or IMAP, such as Outlook, Outlook Express, and
Eudora, can connect to a Client Access server.
- Clients communicate with the Client Access server using POP3 (port 110) or
IMAP (port 143) for retrieving messages.
- Clients use SMTP for sending mail. This means that clients do not
communicate with a Client Access server when sending mail.
- When you install a Client Access server, POP3 and IMAP are installed but
disabled. You must enable these services to provide access to these clients.
- Clients must connect to a Client Access server in the same site where their
Mailbox server is located.
|
Be aware of the following regarding communication between the e-mail client
and the Client Access server:
- Outlook clients inside the private network communicate directly with the
Mailbox server using RPC for both sending and receiving mail. However, the
Client Access server is still required for features such as Autodiscovery and
Availability.
- All clients (except internal Outlook clients) use the Client Access server
for retrieving mail.
- POP3 and IMAP clients must connect to a Hub Transport or Edge Transport
server for sending mail. This connection uses SMTP over port 25 or 587.
Client Features Facts
Exchange 2007 has introduced a number of new features for clients, as listed
in the following table:
| Outlook Web Access (OWA) |
Outlook Web Access has been completely rewritten for Exchange 2007. The goal
of Outlook Web Access is to provide an Outlook environment for users who are
working remotely or from a laptop. The following features are available in
Outlook Web Access in Exchange 2007:
- Improved drag-and-drop support.
- The ability to browse through user's address books.
- The ability to view SharePoint sites without the user needing a VPN or any
other type of connectivity to the network.
- The ability to view file shares on the network.
Outlook Web Access comes in two editions:
- A light version is available for users who are not running the newest Web
browsers.
- A premium version which requires Internet Explorer version 6.0 or later.
This premium version includes:
- Access to drag-and-drop.
- The ability to right-click to get context-sensitive menus within a Web
browser.
- Additional features such as spell check.
Note: Outlook Web Access no longer provides access to public folders
in Exchange 2007. If you wish for Outlook to continue having the ability to
access public folders, you must maintain an Exchange 2003 server within your
organization. |
| Calendar Concierge Service |
The Calendar Concierge Service in Exchange 2007 is made up of four
components:
- The Calendar Attendant is a service that processes meeting requests
for users.
- The Scheduling Assistant is available for users with the premium
version of Outlook Web Access or who use Outlook on a desktop. The scheduling
system analyzes the availability of those who are invited to a meeting to
recommend the best available time to schedule the meeting.
- The Resource Booking Attendant works with resource mailboxes which
are used to manage resources such as conference rooms or projectors.
- The Availability Web Service analyzes the contents of a user's
calendar to manage their free/busy availability and make this information live
to others in the organization. In previous versions of Exchange, public folders
were used to facilitate free/busy information, but were only updated every hour.
This caused for information to frequently be outdated. For this reason, Exchange
2007 has replaced the use of public folders with the Availability Web Service.
|
| Offline Address Book Distribution |
In previous versions of Exchange, offline address books were distributed
through the use of a public folder on the Exchange server.
- Exchange 2007 implements a virtual directory on the Client Access server.
When a user wants to download a copy of the global address book, they can
contact the CAS, then locate the virtual directory from which they can download
the virtual address book. This is done using Background Intelligent Transfer
Service (BITS), which uses HTTP for data transfers and will only download when
there is available bandwidth.
- The format for the Offline Address Book in Exchange 2007 offers better
compression and better support for delta updates and changes.
|
| Autodiscover |
The Autodiscover service in Exchange 2007 is designed to make it easier for
users to set up their profiles in Outlook (Outlook Anywhere) or for their
Exchange ActiveSync devices. The Autodiscover service automatically adds the
following information to a user's profile:
- The server on which the user's mailbox resides
- The user's display name
- Separate connection settings for internal and external connectivity
- The URLs for Exchange features associated with the user
- Outlook Anywhere server settings
The Autodiscover service must be
deployed and configured for Outlook 2007 clients to automatically connect to
Microsoft Exchange features such as the offline address book, the Availability
service, and Unified Messaging (UM). |
Client Services Facts
Exchange server uses the following features to enable and control client
access through various client e-mail applications:
| IIS Virtual Directories |
When you install a Client Access server, several virtual directories are
created in IIS. These virtual directories are used by client applications and
services to connect to the Client Access server. Virtual directories include:
- /Autodiscover is used by clients to retrieve information about servers and
services and retrieve user profile settings.
- /EWS is used by the Exchange Web Services
- /Exchweb is used by Exchange 2000/2003 clients
- /Exchange is used by Outlook Web Access clients
- /Exadmin is used for administrator access to virtual directories
- /Microsoft-Server-ActiveSync is used by ActiveSync clients
- /OAB is used to access the Offline Address Book
- /owa is used by Outlook Web Access to connect to Exchange 2007 servers
- /Public is used by Outlook Web Access to access public folders
- /UnifiedMessaging is used to support Unified Messaging features
Clients connect to the various services by including the virtual
directory name with the URL. For example, clients using Outlook Web Access to
connect to an Exchange 2003 mailbox use a URL such as
http://mail.mycompany.com/Exchange. |
| Internal and External URLs |
For each virtual directory, you can configure both an internal and an
external URL to connect to the service.
- The internal URL is used for communication within the Exchange
organization. During installation, the internal URL is created automatically
using an internal fully-qualified domain name based on the servername and the
domain, plus the appropriate virtual directory. By default, internal clients
connect automatically using the preconfigured internal URL.
- The external URL is the address that will be used by users to access
their accounts through an e-mail client outside of the organization (through the
Internet). The external URL (for example, mail.company.com/owa) must be
manually configured. To allow Internet access to mail clients, you must
configure the external URL for the virtual directory on at least one Client
Access server.
Virtual directories exist in IIS. As an Exchange
administrator, you can use the Exchange Management console or the Management
Shell to manage the Exchange virtual directories. Some properties can also be
managed through the IIS console. |
| Redirection and Proxy |
Client applications must be able to communicate with a Client Access server
in the same site where the Mailbox server resides. If your organization includes
multiple sites, you could simply enable an Internet-facing Client Access server
in each site and have external clients connect to the server at that site.
In some cases, however, you might not want to provide an Internet-facing
Client Access server in each site, or you might have users who connect to Client
Access servers in sites other than where their mailbox resides. When a Client
Access server receives a connection request from a user whose mailbox is in a
remote site, the following takes place:
- If the Client Access server in the site with the mailbox is configured with
an external URL, the client request is redirected to that Client Access
server. The client communicates directly with the Client Access server in that
site.
- If the Client Access server in the site with the mailbox is not configured
with an external URL, the first Client Access server acts as a proxy for
the client. Requests are forwarded from the connecting Client Access server to
the Client Access server in the remote site. The remote Client Access server
then contacts the Mailbox server, and returns responses back to the first Client
Access server. The client remains connected to the first Client Access server,
and that server coordinates all communications with the remote Client Access
server.
Be aware of the following regarding redirection and proxy:
- Redirection is only supported for Outlook Web Access (OWA) clients.
- Proxying is not supported for POP3 and IMAP clients. POP3 and IMAP clients
must connect to a Client Access server in the same site as their Mailbox server.
- ActiveSync clients can use proxying, or they should connect to a Client
Access server in the same site as their Mailbox server.
- Both redirection and proxy requires that Windows Integrated authentication
is used. This means that the client must be a domain member. If a browser is
used, Internet Explorer 6.0 or higher must be used. For this reason, you would
not use redirection or proxy to allow OWA access from public computers. If you
rely on proxy or redirection, users can only connect with computers that are
domain members.
|
| Autodiscover |
In Exchange 2007, the Service Connection Point (SCP) object in Active
Directory contains the information for Exchange in the organization. When an
Outlook or ActiveSync client connects, it queries Active Directory for the SCP
object to retrieve service and profile settings. When an internal client
connects, the following process takes place:
- Outlook queries the SCP object in Active Directory.
- The Client Access server returns the Autodiscover URL to the client.
- The client connects to Autodiscover using HTTPS.
- Autodiscover returns the addresses of services and profile settings.
External clients connect using a slightly different process:
- The client tries to query Active Directory. Because the client is external,
it can't communicate with Active Directory.
- The client then tries one of two URLs to contact the Autodiscover service:
- https://mycompany.com/autodiscover/autodiscover.xml
- https://autodiscover.mycompany.com/autodiscover/autodiscover.xml
- If a connection is successful, Autodiscover returns the addresses of
services and profile settings.
Note: Both of these Autodiscover URLs use an SSL connection. For this
reason, it is important that you have a trusted third-party certificate
installed on your Client Access server so that those on an external network can
have access to the SSL connection. |
Client Access Configuration
As you study this section, answer the following questions:
- Which ports should you open on the Client Access server to allow access
through Outlook Anywhere?
- Why is it a good idea to disable POP3 and IMAP4 if you do not need them?
- What are the certificate requirements when using Outlook Anywhere?
- What do you need to configure to enable Internet clients to connect with a
Client Access server using Outlook Web Access?
After finishing this section, you should be able to complete the following
tasks:
- Enable Outlook Anywhere on the Client Access server.
- Configure external URLs to allow Internet access to the Client Access
server.
- Enable and disable client access features for specific users.
- Enable and disable POP3 and IMAP4 access.
This section covers the following exam objectives:
- 306. Configure client connectivity.
Client Access Server Deployment Facts
As you plan and implement the configuration of Client Access servers in your
network, be aware of the following:
- You must have at least one Client Access server in your Exchange
organization, even if you only have internal Outlook users. The Client Access
server is used for features such as Autodiscover and Availability.
- You must have a Client Access server in each site where there are mailboxes
if you use anything but Outlook as the client application.
- If your Client Access server accepts connections for clients whose mailboxes
are on both Exchange 2007 and Exchange 2000/2003 servers, do not install the
Mailbox role on the Client Access server.
- To allow clients to retrieve mail from the Internet, you must allow the
Client Access server to be contacted by Internet hosts. The Client Access server
must have a DNS A record.
- The Client Access server must be a domain member. For this reason, it should
not be directly exposed to the Internet. Put the Client Access server behind a
firewall to protect it.
- Open the necessary firewall ports to allow traffic to the Client Access
server:
- Exchange ActiveSync, Outlook Anywhere, and Outlook Web Access use port 80
for HTTP connections.
- Exchange ActiveSync, Outlook Anywhere, and Outlook Web Access use port 443
for HTTPS connections.
- POP3 uses port 110.
- IMAP4 uses port 143.
- After the Client Access server has been installed, run the Security
Configuration Wizard to lock down the server. You will need to import the
Exchange 2007 role definitions before using the Security Configuration Wizard.
IIS uses SSL to provide secure HTTP communications. By default, the Client
Access server uses a self-signed certificate for SSL.
- Outlook Web Access and ActiveSync can accept the self-signed certificate. To
support Outlook Anywhere, you must get a third party certificate.
- To use SSL with Outlook Anywhere, you must install the RPC over HTTP
component. Use Add/Remove Windows Components to do this.
- When requesting a certificate, make sure you include all DNS names for the
server in the certificate.
- When you import the certificate, be sure to import it into the computer's
certificate store (not the administrator's certificate store).
- After importing the certificate, use the IIS console to enable SSL on the
virtual directories used by the clients.
- Certificates can be enabled for use with POP3 and IMAP4 in addition to
Outlook Web Access and Exchange ActiveSync.
Use the following cmdlets to manage certificates:
- Use New-ExchangeCertificate to create a new self-signed certificate
or create a certificate request. You can also use the Request New Certificate
wizard in the IIS console to create a certificate request.
- Use Import-ExchangeCertificate to import the certificate that you
have received from your certification authority into the machine's certificate
store.
- Use Get-ExchangeCertificate to view the certificates that are stored
in the local computer store.
- Use Enable-ExchangeCertificate to specify which Exchange services
will use a particular certificate.
Configuring Client Support
Depending on the client and the connection type, you might need to perform
configuration tasks on both the Client Access server and the client. The
following table describes the configuration tasks required for each client.
| Outlook |
Outlook is used by internal clients to send and retrieve mail. Outlook uses
RPC to communicate directly to the Mailbox server. A Client Access server is
used for the Autodiscover and Availability services.
Configuring Outlook for internal clients requires no configuration at the
client or the Client Access server:
- When you install a Client Access server, Autodiscover is already configured
for internal clients.
- After installing Outlook on the client, when you run it for the first time
it retrieves configuration information from the Autodiscover service and
configures itself for the user automatically.
|
| Outlook Anywhere |
Outlook Anywhere is a feature in Outlook that allows for external access to
the user mailbox. Outlook Anywhere communicates with the Client Access server
for mail access. To configure Outlook Anywhere:
- On the client, enable Outlook Anywhere and point it to use the Client Access
server.
- On the Client Access server, you must enable Outlook Anywhere and configure
an external host name. The external host name is the DNS name that Outlook
Anywhere uses when connecting to the Client Access server.
- You can perform both tasks in the Management console.
- Use Enable-OutlookAnywhere to perform both tasks at once. Use
Set-OutlookAnywhere to change the external host name.
To use Autodiscover on external clients, you must also set
an external URL for additional virtual directories:
- To configure the Offline Address Book, use Set-OABVirtualDirectory
-externalurl https://mail.mycompany.com/OAB
- For Unified Messaging, use Set-UMVirtualDirectory -externalurl
https://mail.mycompany.com/UnifiedMessaging/Service.asmx
- For Exchange Web Services, use Set-WebServicesVirtualDirectory
-externalurl https://mail.mycompany.com/EWS/Exchange.asmx
|
| Outlook Web Access (OWA) |
Outlook Web Access (OWA) provides browser access to e-mail. To configure
OWA:
- The client only requires an Internet connection and a Web browser. Although
most browsers are supported, Internet Explorer 6.0 or later is required for
certain advanced features or when using redirection or proxy.
- On the server, OWA access is enabled by default. To allow Internet access,
you must configure an external URL for the OWA virtual directory (such as
mail.mycompany.com/owa).
|
| ActiveSync |
ActiveSync is used by mobile devices to connect to Exchange data. To
configure ActiveSync:
- Connect the client device to a Windows system and use the Windows Mobile
Device Center to configure connection parameters.
- On the server, ActiveSync is enabled by default. You must configure an
external URL for the /Microsoft-Server-ActiveSync virtual directory (such as
mail.mycompany.com/Microsoft-Server-ActiveSync). You must also complete
the configuration for Autodiscover as noted above.
Note: To
disable ActiveSync, use the IIS console to disable the Web
application. |
| POP3 or MAPI |
To configure POP3 or MAPI access:
- Configure the client application with:
- The IP address or DNS name of the Client Access server for receiving mail.
The Client Access server must be in the same site as the user's Mailbox server.
- The IP address or DNS name of a transport server for sending mail. If the
client is used only internally, point it to a Hub Transport server. If it is
used from the Internet, point it to an Edge Transport server. If possible,
configure the client to use port 587.
- On the server, you must start the POP3 or MAPI service. In addition, you
should change the service startup action to Automatic.
- Use the Services MMC snap-in to perform both tasks.
- In the power shell, use Set-PopSettings, Set-ImapSettings, or
Set-Service to change the service startup type, and Start-Service
or Stop-Service to start or stop the services. (For example,
Start-Service -service msExchangePOP3.)
- From a command prompt, use Net start or Net stop to start or
stop the service (for example Net start MSExchangeIMAP).
On the server, you can also modify the IP address and port
number used for POP3 or IMAP. Use Set-PopSettings or
Set-ImapSettings with the UnencryptedOrTLSBindings and SSLBindings
options to configure the IP address and port. After making these changes, you
must restart the service. |
In addition to enabling and configuring access on the Client Access server,
you can control user access using specific client applications through settings
in the user mailbox. By default, all access methods are enabled for all user
mailboxes. Use the Management console or the following cmdlets to manage client
access on a per-mailbox basis:
- Use Set-CASMailbox to enable or disable specific access methods.
- Use Get-CASMailbox to view the status of each method for all users.
- To configure settings for all users, use a command similar to the following:
Get-CASMailbox | Set-CASMailbox -owasenabled $false.
Use the following cmdlets to manage the Autodiscover service:
- Use New-AutodiscoverVirtualDirectory to create a new Autodiscover
virtual directory if you have multiple domains in your organization.
- Use Remove-AutodiscoverVirtualDirectory to remove an existing
Autodiscover virtual directory.
- Use New-OutlookProvider to create a new Autodiscover object within
Active Directory.
- Use Set-OutlookProvider to configure an existing Autodiscover object
within Active Directory.
- Use Get-OutlookProvider to query Active Directory to view the
information contained within the current SCP object which resides in Active
Directory.
Use the following cmdlets to manage the Offline Address Book:
- Use Get-OABVirtualDirectory to return the information available about
the current configuration of an existing Offline Address Book virtual directory
on the Client Access server.
- Use New-OABVirtualDirectory to create a new Offline Address Book
virtual directory on the Client Access server.
- Use Set-OABVirtualDirectory to configure an Offline Address Book
virtual directory on the Client Access server.
- Use Remove-OABVirtualDirectory to remove an existing Offline Address
Book virtual directory on the Client Access server.
Policy Management
As you study this section, answer the following questions:
- Which cmdlet would you use to link an ActiveSync policy to a user?
- What permissions are required to create and modify ActiveSync policies?
- When using managed folders, which object do you configure to modify the
retention period, the managed folder or the policy?
- What is the primary purpose of a managed folder policy?
- How can you prevent managed folder policies from applying to a specific
user?
This section covers the following exam objectives:
ActiveSync Policy Facts
An ActiveSync policy enforces ActiveSync settings for specific users. Use
ActiveSync policy settings to:
- Enable and disable device features such as Bluetooth, infrared (IrDA),
Remote Desktop, Desktop Sync, POP3 or IMAP4 e-mail, browser, text messaging, or
camera.
- Enforce mobile device password settings including alphanumeric passwords,
password history, minimum password length and complexity, and failed password
attempts.
- Requiring encryption settings for synchronization or S/MIME messages.
- Allow access to the storage card or installing unsigned applications.
- Configure settings for the size and frequency of downloading messages and
attachments.
You can create policies through the Management Console, but only a limited
number of password settings are available for editing. Use the PowerShell
cmdlets to configure all policy settings:
- Use New-ActiveSyncMailboxPolicy to create the policy and configure
settings when the policy is created.
- Use Set-ActiveSyncMailboxPolicy to modify policy settings and
Get-ActiveSyncMailboxPolicy to view policy settings.
- Use Set-CASMailbox with the -ActiveSyncMailboxPolicy switch to
link a policy to a user. Each user can have a single associated policy. A user
is not required to have a policy.
Note: With Exchange 2007 SP1, a default ActiveSync policy is created
automatically. The default policy is automatically applied to new mailboxes. Use
Set-ActiveSyncMailboxPolicy with the
-IsDefaultPolicy switch to
designate which policy is the default.
You must be assigned the Exchange Organization Administrator role to manage
ActiveSync policies, and the Exchange Recipient Administrator role to link a
policy with a recipient.
Messaging Records Management (MRM) Facts
Messaging Records Management (MRM) is a feature of Exchange 2007 Enterprise
Edition that can be used to manage e-mail and other content for government or
regulatory compliance. With MRM, users can keep messages that they are required
to retain and remove content with no legal or business value. MRM used the
following components:
- Content is managed by identifying managed folders. A managed folder
is a mailbox folder to which settings are applied. A managed folder has the
following settings:
- The retention period identifies the length of time an item is held in
the managed folder.
- The retention period start action identifies when the retention
period begins, either when the item is delivered or when it is moved into the
folder.
- The retention period end action identifies what takes place when the
retention period length is past. Actions include deleting the item, moving it to
another folder, or flagging the item as past the retention period.
- The managed folder assistant is a service that runs and enforces the
managed folder settings. It identifies messages that are past the retention
period and takes the specified action.
- Managed folders are grouped together with managed folder policies.
Each policy identifies one or more managed folders that are managed as a group.
- Policies are linked to user mailboxes. When you link a policy to a mailbox,
the managed folders identified in the policy are added to the user mailbox (if
they don't already exist). The managed folder assistant then applies the
settings and takes actions on folders in the mailbox.
Managed folders can be administered through the Management Console or the
Management Shell. Use the following process to configure MRM:
- Create managed folders, or identify default folders that are to be managed
with MRM. Use New-ManagedFolder to create managed folders.
- Configure managed content settings to the folder such as the retention
period and action. Use New-ManagedContentSettings and
Set-ManagedContentSettings in the Management Shell.
- Create a policy. Use New-ManagedFolderMailboxPolicy to create the
policy and Set-ManagedFolderMailboxPolicy to modify folders associated
with the policy.
- Apply a policy to user mailboxes. Use Set-Mailbox with the
-ManagedFolderMailboxPolicy switch in the Management Shell.
- Run the managed folder assistant to enforce managed folder settings. Use
Set-MailboxServer with the -ManagedFolderAssistantSchedule switch
to run the assistant on a schedule so that actions are taken on a periodic
basis. You can also manually run the assistant using the
Start-ManagedFolderAssistant cmdlet.
Be aware of the following when using managed folders:
- Messaging Records Management (MRM) requires Exchange 2007 Enterprise
Edition. In addition, each mailbox that uses MRM requires an Exchange Server
Enterprise client access license (CAL).
- Managed content could include files that are not e-mail messages.
- Implementing managing folders typically means that mailbox sizes will need
to be bigger to hold the additional content.
- The first time the assistant runs, it might take a long time and a lot of
system resources to create the necessary folders and apply the actions to
messages already in the folders. Be sure to run it in off hours.
- Each policy can apply to multiple managed folders.
- Each user can only have one associated policy.
- To turn off MRM for a user, just unlink the user from the policy. Use
Set-Mailbox with the -RemoveManagedFolderAndPolicy switch.
- To disable MRM for an entire server, remove all managed folders or remove
all managed folder policies.
Chapter # 06
Public Folders
Public Folders
As you study this section, answer the following questions:
- How do users access public folder data?
- What is a public folder tree?
- How does a public folder store differ from a mailbox store?
- How does the EnableLegacyOutlook option affect the Exchange Server
2007 setup?
- How do you configure a public folder mailbox to reject senders?
- How many public folder databases can you have on a Mailbox server?
- What is a public folder referral?
After finishing this section, you should be able to complete the following
tasks:
- Create a public folder store.
- Create and manage public folders.
This section covers the following exam objectives:
- 204. Configure Public Folders.
- 305. Configure Public Folders.
Public Folders Facts
A
public folder is a repository for data that can be accessed by
multiple users thus providing a simple and efficient way to collect, organize,
and share Exchange 2007 collaborative applications such as calendars, contact
lists, task lists, and message lists. Much like a mailbox store, public
folders:
- Are managed by the Information Store.
- Are an ESE database that uses transaction logging.
- Are subject to the same best practice rules that are applicable to mailbox
stores, such as:
- The database and log files should be stored on separate disks.
- There should only be one store per storage group.
Note:
Microsoft is encouraging Exchange 2007 users to switch to
the SharePoint Platform to reduce the use of public folders for creating
collaborative applications.
A
public folder store is a database file that resides on an Exchange
server. When a public folder is created, it is stored on the Exchange server in
a public folder store. The components that are associated with a public folder
store are as follows:
- The hierarchy is a list of all of the public folders that exist
within an organization. This is also referred to as the public folder
tree. It is possible to nest multiple public folders within the public
folder tree; however, it is best practice not to exceed 250 subfolders per
folder.
- A deep hierarchy consists of many vertically nested folders with few
higher-level folders.
- A wide hierarchy consists of many higher-level folders with fewer
vertically nested subfolders.
Note: Deep public folder hierarchies
scale better and perform better than wide hierarchies.
- Content represents the data (addresses, contacts, messages etc.) that
is stored within a public folder store.
- The directory is an object that is created in Active Directory to
represent the public folder.
Public folders are managed using the following platforms:
| Microsoft Outlook |
Microsoft Outlook is the preferred tool for users to manage public folders
in Exchange 2007. Through Outlook, a user can:
- Design and manage forms.
- Set permissions for control access.
- Create, rename, and delete public folders.
|
| Exchange Management Shell |
The Exchange Management Shell (PowerShell) is the primary tool for managing
the public folder environment from the server. The following tasks can be
performed from the Exchange Management Shell:
- Modify, create, delete, and query the status of public folders.
- Start, stop, pause, and query the status public folder application.
- Create, modify, or delete the public folder stores in the Exchange
organization.
|
| Management Console |
Because the Exchange Management Shell is the primary tool for managing
public folders from the server, the Management Console only provides minimum
tools for public folder management:
- A wizard to create a new public folder if one doesn't already exist on the
Exchange 2007 server.
- Access to a limited amount of management tasks related to existing public
folder stores.
Note: Unlike previous versions of Exchange, the console does not allow
administration of individual public folders or the public folder
tree. |
A public folder is created using the following steps:
- An instance (replica) of the public folder content is created on a public
folder store on the server that will host it.
- An object is created in Active Directory to represent the folder.
- An entry is added to the public folder hierarchy (tree) and made visible to
all Outlook users with access permission.
- The Information Source Service (ISS) automatically replicates the hierarchy
to every server in the organization that has a public folder store.
You should know the following about public folders in Exchange 2007:
- Previous versions of Exchange allowed multiple public folder trees and
multiple public folder stores; however Exchange Server 2007 only allows one
public folder tree and one public folder store to be created on any Exchange
2007 server.
- Exchange 2007 only supports the default MAPI folder tree which is divided
into the following subtrees:
- A default public folder (also known as the IPM_Subtree) can be
accessed by users directly by using client applications such as Outlook.
- A system public folder (also known as the Non IPM_Subtree) cannot be
accessed by users directly by using conventional methods, but instead is used by
client applications such as Outlook to store information such as offline address
books, free and busy data, and organizational forms. The public folders tree
contains additional system folders that do not exist in general purpose public
folder trees, such as the EFORMS REGISTRY folder.
- A mail-enabled folder is a public folder that has an e-mail address.
A mail-enabled folder can have messages posted to it, and it can also send
e-mail messages to users and possibly receive e-mail messages from users as
well. By default, public folders are not mail-enabled.
Public Folder Management Facts
You should know the following about public folder management:
- Public folder stores are not automatically installed on every server. A
public folder database will be created on the Mailbox server when one of the
following actions occurs:
- If /EnableLegacyOutlook is used during installation in the Management
Shell to specify that you have client computers that are running Microsoft
Outlook 2003 or earlier.
- If you answer Yes to the Do you have any client computers running
Outlook 2003 or earlier in your organization? prompt in the installation
wizard in the Management Console.
- The following client applications access public folders in the RTM version
of Exchange 2007:
- Microsoft Office Outlook 2007
- Microsoft Office Outlook 2003
- IMAP4 compatible applications such as Outlook Express
- All client computers running Outlook 2003 or older versions of Outlook
require public folders to be deployed so that they can connect to Exchange to
provide features such as free and busy information and offline address book
(OAB) downloads.
- If Cluster Continuous Replication (CCR), Local Continuous Replication (LCR),
or Standby Continuous Replication (SCR) are implemented, there can only be one
public folder database in the organization (you cannot have a public folder
database on more than one server).
- If you are implementing public folders, the Client Access server role and
the Mailbox server role should not be deployed on the same server.
- Any mailbox databases that are associated with a public folder database that
is to be removed must have another public folder database configured to be the
default public folder database.
- The public folder inherits the parent folder's administrative and client
access permissions when new public folders are created.
- It is best practice to deploy dedicated public folder servers in large
enterprise topologies where public folders are heavily used.
- Implementing fewer larger public folder databases is more scalable and
manageable than having several smaller public folder databases.
- You can turn the commands that you use to manage public folders in the
Exchange Management Shell into a script. Running scripts in the Exchange
Management Shell allows you to automate complex or frequently performed tasks to
make public folder administration faster and easier.
Use the following cmdlets to manage public folder databases:
- To create a new public folder database, use New-StorageGroup to
create the storage group (if it doesn't exist), then use
New-PublicFolderDatabase to create the public folder database. You can
only create a single public folder database on each Exchange 2007 Mailbox
server.
- New public folder databases are created in a dismounted state. Use
Mount-Database to mount the database.
- Use Get-PublicFolderDatabase to view public folder database settings.
- Use Set-PublicFolderDatabase to set attributes of public folder
databases.
- Use Remove-PublicFolderDatabase to delete public folder databases.
Removing a public folder database does not delete the database files. Before
removing a public folder database, certain conditions are required. Use the
following steps:
- Change all mailboxes to point to another public folder database.
- Move all public folder content to another server.
- Delete unneeded folders.
- Delete the store. Note: If you are removing the last public folder
database in the organization, you must use Remove-PublicFolderDatabase
-RemoveLastAllowed in the Management Shell. This task cannot be performed
from the Management Console. Only remove all public folders from an organization
if there are no remaining Exchange 2003 or earlier servers or Outlook 2003
clients.
Use the following cmdlets to manage folders:
- Use Get-PublicFolder to retrieve the attributes of a public folder or
a set of public folders.
- Use New-PublicFolder to create a new public folder with the specified
name.
- Use Remove-PublicFolder to remove an existing public folder.
- Use Set-PublicFolder to set the attributes of public folders.
Use the following cmdlets to manage mail-enabled public folders:
- Use Enable-MailPublicFolder to mail-enable public folders. Use
Disable-MailPublicFolder to mail-disable a public folder.
- Use Get-MailPublicFolder to retrieve mail-related information about
mail-enabled public folders.
- Use Set-MailPublicFolder to configure the mail-related settings of
mail-enabled public folders.
Public Folder Replication Facts
Public folder replication is the transferal of public folder data between
public folder stores in the same top level hierarchy. Folder replication is also
used to keep databases synchronized when multiple public folder databases which
are located on separate servers support a single public folder tree. Replicating
public folder data:
- Increases the fault tolerance of the public folder data.
- Places copies of the data on local servers. Accessing data from local
servers can reduce WAN link usage and improve access times.
Replication of the various public folder components takes place as described
in the following table:
| Hierarchy |
The hierarchy is the public folder tree or organization. The hierarchy for
the default public folder tree is replicated automatically to other Exchange
servers within the organization by the Information Store through hierarchy
replication messages. Modification of the following public folder information
results in hierarchy replication:
- Replica list
- Folder's position in the public folder tree
- Permissions
- Folder name
Note: Changing the e-mail addresses for a mail-enabled public folder
does not cause hierarchy replication to occur. |
| Content |
Content replication occurs when messages are sent to public folders or when
data is added. A content replica is a copy of the folder that includes
content.
- Public folder data or contents are not replicated automatically.
- You must configure public folder content replication manually between
servers.
- When you configure replication, you can configure the schedule and frequency
that replication occurs.
- The content of folders is replicated through content replication messages
between replicas of individual folders.
|
| Directory entry |
The directory entry is the Active Directory object and its properties.
Directory entries are replicated automatically through Active Directory
replication. |
Use the following cmdlets to configure replication:
- Use Set-PublicFolder with the -Replicas switch to identify
specific servers that will hold replicas of a public folder.
- Use Update-PublicFolder to start content synchronization of a public
folder.
- Use Update-PublicFolderHierarchy to start content synchronization of
the public folder hierarchy.
- Use Suspend-PublicFolderReplication to stop public folder replication
for the organization.
- Use Resume-PublicFolderReplication to resume content replication when
it has been stopped.
- Use Set-PublicFolderDatabase -ReplicationPeriod to specify the
interval at which replication of public folders or content updates may occur.
You can select precanned replication intervals or you can create a
custom schedule. By default, public folder replication is scheduled to
run every 15 minutes.
- Use Set-PublicFolderDatabase -ReplicationSchedule to specify the time
intervals during which replication of public folders or contents may occur. The
replication schedule uses the format: Day.hh:mm AM/PM-Day.hh:mm AM/PM to
indicate the start time and stop time when replication is allowed. If you omit
AM or PM, a 24 hour clock is used (for example, 23:00 = 11:00 PM).
- Use Set-PublicFolderDatabase -ReplicationMessageSize to specify the
size of replication messages.
- Small items may be aggregated into a single replication message that can be
as large as this setting.
- Items larger than this setting are replicated with messages larger than this
size.
- In addition to configuring replication for the database, you can configure
replication for specific folders. Use Set-PublicFolder to configure
replication settings for a specific folder.
When a user connects to a public folder store and the store does not contain
a copy of the content the user is requesting, Exchange automatically redirects
the user to a server that does contain the content. This process is known as
public folder referral. Accessing a public folder referral entails the
following process:
- A user connects to Exchange and uses a MAPI client application to request
access to a public folder.
- The MAPI client attempts to read the content for a specific public folder,
initially querying the default public folder database for the content. If the
default public folder database is a content replica for the folder in question,
the process is complete.
- If there is no replica on the default public folder database,
Exchange returns a list of replicas to the client. The replica list is sorted by
that server’s perspective of connection costs to each of the other listed
content replicas.
- The MAPI clients attempt to access each replica in the list by doing the
following:
- Connecting to the server
- Attempting to locate the folder
- Attempting to read the folder's content
- If a failure occurs, the client attempts to access the next replica server
in the list. This action is repeated until the client has attempted to access
all replica servers in the custom list.
Public folder referrals have an associated
cost number that is used to
optimize message flow by calculating the most appropriate route that the client
application can use to access public folders on remote servers. The numbers
range from 1 to 100.
- An administrator can specify a list of referral servers and assign routing
costs to each server to redirect server traffic. The maximum public folder
referral cost that Exchange administrators can set for a public folder database
is 100, unless they are members of the Domain Admins group or the Enterprise
Admins group in the Active Directory directory service, in which case they can
set the Active Directory site link cost up to or greater than 500.
- Connection costs are determined by querying Active Directory Sites and
Services for the site connector cost information of the other Mailbox servers in
the organization on which a public folder database resides.
- Cost information is refreshed once every hour.
Use the following commands to configure public folder referrals:
- Use Set-PublicFolderDatabase -CustomReferralServerList to
manually assign public folder referral costs to individual servers.
- Costs can be any positive number.
- Servers not included on the list are not included for referrals.
- If this parameter is set with no servers in the list, there are no public
folder referrals.
- Use Set-PublicFolderDatabase -UseCustomReferralServerList to specify
whether to use the server costs specified by the
-PublicFolderReferralServerList switch.
- If set to $true, the server uses the
-PublicFolderReferralServerList switch costs to make public folder
referrals.
- If set to $false, the -PublicFolderReferralServerList
switch is cleared and the server uses Active Directory inter-site costs to
make public folder referrals.
Keep in mind the following facts about public folder data replication:
- Even if you have not configured public folders to be replicated, public
folder replication is occurring if you have two or more public folder databases
in your organization.
- When a public folder or its contents is modified, the public folder database
that contains the replica of the modified public folder sends a descriptive
e-mail message to the other public folder databases that host a replica of the
public folder.
- Only new information going into the original public folder is replicated.
- Because public folder replication and storage group replication cannot be
combined, Cluster Continuous Replication (CCR), Local Continuous Replication
(LCR), or Standby Continuous Replication (SCR) are available for a public folder
database only if there are no other public folder databases in the organization.
- Replicating public folder data can decrease the WAN traffic associated with
data access. However, it does cause an increase in WAN traffic due to
replication traffic. Depending on the number of users, replication traffic might
be less than data access traffic.
- When configuring replication, you specify the public folder store that will
host a replica of the public folder.
- The amount of time that data in two replicas is different is called
replication latency. Replication latency is dependent on the replication
schedule. It is also associated with the amount of time it takes to replicate.
- Determine the importance of current data being available in the replicated
public folder, then adjust the replication schedule to reflect that level of
importance.
- The replication process uses the Active Directory attributes of the public
folder databases, not the Active Directory attributes of individual public
folders.
Public Folder Client Access
As you study this section, answer the following questions:
- What is the primary tool for managing public folders, permission, and public
folder content?
- What is the difference between Editor and Publishing Editor
permissions?
- What can a user with Nonediting Author permissions do?
- How are permissions set on a child folder?
After finishing this section, you should be able to complete the following
tasks:
- Use Outlook to manage public folders.
- Configure public folder permissions.
This section covers the following exam objectives:
- 204. Configure Public Folders.
- 305. Configure Public Folders.
Public Folder Client Access Facts
With the release of Exchange Server 2007, Microsoft is decreasing support for
public folders and are encouraging customers to use the SharePoint Platform for
collaboration applications. For this reason, Outlook 2007 is the first version
of Outlook that does not require public folders. A number of changes have been
made to Exchange 2007 to compensate for this shift:
| Offline Address Book (OAB) |
An Offline Address Book (OAB) is used by users to access their address book
when offline. In the past, public folders were used to locate user information
when offline. In Exchange 2007, the Client Access server acts as a Web
distribution point which utilizes the Background Intelligent Transfer Service
(BITS) to download offline address books using the HTTP protocol. This
functionality is not available by default, so it must be set up during
configuration of the Client Access server if it is to be implemented. Users can
find the Offline Address Book publication point using the Autodiscover
feature. |
| Free/Busy |
When a user wished to schedule a meeting and check the availability of
colleagues in previous versions of Outlook, Outlook would contact the Exchange
server, retrieve the free/busy information for the recipients, then return that
information to the user. The problem with this scenario was that information
might have been out of date due to multiple public folders replicated on
different servers. For this reason, free/busy information is now retrieved using
the Availability service that runs on the Client Access server. The Availability
service queries the user's mailbox server to verify availability. |
| Outlook security settings |
Outlook security settings also no longer use public folders. The Outlook
client is now configured through the registry. Group policies are used to push
information out to clients thus removing the need for using a public
folder. |
| Organizational forms library |
The organizational forms library has been replaced by Microsoft InfoPath
forms. |
Outlook is the preferred client application for accessing public folders.
Support for accessing public folders through clients other than Outlook
(including Outlook Web Access) depends on the Exchange 2007 version:
| Exchange 2007 release to manufacturing (RTM) |
To provide public folder access to clients other than Outlook (including
Outlook Web Access) in the RMT version of Exchange 2007:
- The mailbox database's home public folder server must be running
Microsoft Exchange Server 2003 or Microsoft Exchange 2000 Server.
- The Client Access server role must be on a dedicated server.
- Because public folders do not appear in the default Outlook Web Access user
interface, you must use the /public virtual directory on the Client
Access server to reach public folders. This means that OWA users must log on
using a URL such as https://mail.mycompany.com/public instead of
https://mail.mycompany.com/owa.
|
| Exchange 2007 service pack 1 (SP1) |
Exchange 2007 SP1 supports public folder access using Outlook Web Access.
Users continue to use the normal OWA URL for access
(https://mycompany.com/owa), and you do not need to keep an Exchange 2003
server for public folder access.
Exchange 2003 public folders will be available to Exchange 2007 mailboxes
only if the following conditions are true:
- SSL is disabled on the home public folder server that is assigned to the
user's mailbox.
- The /owa and /public virtual directories must have the same
SSL setting.
- The Client Access server role must be on its own designated server.
- The /public virtual directory has not been renamed.
|
Content can be submitted to a public folder in the following ways:
- Users can submit content through Microsoft Outlook 2007 using standardized
public folder forms.
- Users and outside organizations can send content to public folders which are
mail-enabled. Mail-enabled public folders are e-mail recipients that can also be
used for message journaling. Public folders are not mail-enabled by default;
they must be manually mail-enabled by entering the
Enable-MailPublicFolder cmdlet into the Management Shell's command
prompt.
Users typically manage public folders through Outlook. In Outlook 2007,
public folders do not show by default. Use the
Folder List option to show
public folders. Users can create folders, specify the type of content that can
be posted in a folder, post content, and manage permissions. When specifying
permissions, the following options are available:
| Owner |
All permissions (including Folder owner and Folder contact), Edit and Delete
all items |
| Publishing Editor |
Create items, Read items, Create subfolders, Folder visible, Edit and Delete
all items |
| Editor |
Same as Publishing Editor except without Create subfolders |
| Publishing Author |
Create items, Read items, Create subfolders, Folder visible, Edit and Delete
Own items |
| Author |
Same as Publishing Author except without Create subfolders |
| Nonediting Author |
Create items, Read items, Folder visible, Edit None and Delete Own |
| Reviewer |
Read items, Folder visible, Edit and Delete None |
| Contributor |
Create items, Folder visible, Edit and Delete None |
| None |
Folder visible, Edit and Delete None |
Note: If you manually choose a permission combination not represented
by a role, the role is listed as Custom.
Keep in mind the following regarding managing client permissions:
- By default, the Anonymous user is configured with Contributor permissions.
This means that anyone can add content to a public folder. This permission
allows users to submit items to mail-enabled public folders.
- When you create a child folder, permissions from the parent folder are
copied to the child folder.
- Changes made to the parent folder permissions are not automatically
propagated to the child folders.
- Use Get-PublicFolderClientPermission to retrieve the user permissions
for a public folder.
- Use Add-PublicFolderClientPermission to add permissions to public
folders.
- Use Remove-PublicFolderClientPermission to remove permissions from
public folders.
- Use Get-PublicFolderAdministrativePermission to get the
administrative permissions for a public folder or a public folder hierarchy.
Administrative permissions control configuring settings for the public folder.
- Use Add-PublicFolderAdministrativePermission to add administrative
permissions to a public folder or a public folder hierarchy.
- Use Remove-PublicFolderAdministrativePermission to remove
administrative permissions for a public folder or a public folder hierarchy.
Chapter # 07
Message Flow
Message Flow Concepts
As you study this section, answer the following questions:
- Why is a Hub Transport server required even if your organization only has a
single Mailbox server?
- How do remote mail flow and local mail flow differ?
- What functions are performed during the categorization process? Which
servers perform categorization?
- What role do site link costs play in message routing?
- Why are there two different site link cost values for each link?
- How does delayed fan-out affect message delivery?
- Which authentication type uses TLS for mutual authentication?
Message Flow Facts
Mail
flow is the term used to describe the movement of incoming and
outgoing mail within an Exchange organization. In Exchange 2007, all mail is
routed (including mail sent and received on the same Mailbox server) through a
Hub Transport server before it is delivered to a Mailbox server. All external
mail must additionally go through an Edge Transport server. The use of transport
servers for all mail delivery allows you to apply transport rules to mail,
regardless of its origin or destination. With these rules you can control
delivery or apply filters, such as anti-spam and antivirus, to all mail.
Exchange transport servers use
connectors to define how inter-server
communication takes place. The connector describes how the transport servers
communicate with other transport servers, with legacy Exchange servers, with
other messaging systems, and with devices on the Internet. There are three types
of connectors:
- Send connectors control outbound communications.
- Receive connectors control inbound communications.
- Foreign connectors control outbound communications with servers that do not
use SMTP for communication.
The following table describes how messages are routed in various
scenarios.
| Local Mail Flow |
If a user sends a message to another user whose mailbox resides on the same
server, the following steps are performed:
- The message is received by the Mailbox server.
- The Mailbox server submits the message to the Hub Transport server using
RPC.
- The Hub Transport queries the Domain Controller or the Global Catalog server
to determine the location of the recipient and a method of delivery.
- The message is forwarded to the user's mailbox on the Mailbox server.
- The recipient is notified of new mail.
|
| Inbound Mail Flow |
Inbound mail flow are messages that have been received from the Internet. In
a typical inbound mail flow scenario, the following steps take place:
- A message is received by an Edge Transport server from an external host
using SMTP over port 25.
- The Edge Transport server verifies that the address is a valid address in
the organization then applies message hygiene (such as antivirus and anti-spam
scans) to the message.
- The Edge Transport server transfers the message to a Hub Transport server
using SMTP over port 25.
- The Hub transport server queries the Domain Controller to locate the
recipient's mailbox.
- The Hub Transport server communicates with the Mailbox server using MAPI and
RPC and delivers the message.
Note: It is possible to deploy an Exchange environment without
deploying an Edge Transport server. If you choose to create an environment
without an Edge Transport server, you can choose to deploy the anti-spam and
antivirus agents found on the Edge Transport server on the Hub Transport server
instead. |
| Outbound Mail Flow |
Outbound mail flow represents messages that are sent to an external entity,
such as Internet recipients. In a typical outbound mail flow scenario, the
following steps take place:
- A message is received by the Mailbox server.
- The Mailbox server sends the message to the Hub Transport server using RPC.
- The Hub Transport server recognizes that the recipient is an external
recipient and checks to see where to forward the message. If an Edge Transport
server is present in the environment, then there will be a Send connector that
identifies the Edge Transport server. The Hub Transport server sends the message
to the Edge Transport server using SMTP over port 25.
- The Edge Transport server will do one of the following, depending on its
routing configuration:
- If it is configured with a Send connector that uses another smart host (such
as an e-mail server at your ISP), it will forward the message on to the
alternate smart host.
- If it is configured to route messages using a DNS server:
- The server queries the DNS server for an MX record that identifies the
server(s) which are responsible for managing e-mail for the recipient domain.
- The DNS server provides the Edge Transport server with the IP address and
the name of the recipient mail server.
- The Edge Transport server initiates a connection to the remote SMTP server
using port 25.
|
| Remote (Inter-site) Mail Flow |
Remote mail flow represents messages that are being sent to other Exchange
servers but are located in different sites. The following scenario demonstrates
the default behavior of how Hub Transport servers relay messages between sites:
- A message is submitted by a user to the local Mailbox server.
- The Mailbox server submits the message to the Hub Transport server using
RPC.
- The Hub Transport server categorizer queries the Global Catalog server to
identify the site location of the recipient's Mailbox server.
- The Hub Transport server sends the message to the destination site.
- A Hub Transport server in the destination site receives the message, then
forwards it to the appropriate Mailbox server.
Inter-site mail
delivery typically uses implicit (automatic or built-in) Send connectors to
identify the destination mail servers. |
Site Link Cost Facts
During the message delivery process, the Hub Transport server performs a
process called
categorization. Categorization includes the following
processes:
- With recipient resolution, the server examines the message recipient
to determine its location. For addresses inside the organization, Active
Directory is queried to identify the site of the Mailbox server.
- The server then analyzes Active Directory site information to make a
routing decision and identify the site path to the destination Active
Directory site.
- The server also performs message conversion, and applies any
configured filters.
When Exchange starts, it calculates a set of routing tables that identify the
Active Directory site topology. When a message is received for delivery, the
routing process uses the topology map to determine how to best reach the
destination site. When multiple paths exist to a destination, Exchange selects a
single path with the lowest cost. To understand how this route is selected, you
should be aware of the following:
- An Active Directory site is a group of well-connected computers,
typically at the same physical location.
- Sites are connected by logical paths or connectors called site links.
- The site link cost is a relative number that corresponds to the
underlying network reliability, speed and available bandwidth.
- The default link cost is 100. You can use Active Directory Sites and
Services to modify the site link cost for specific links (between 1 and 99,999).
- Faster or more preferred links are assigned a lower cost. To force
traffic over one link, set a lower cost. For example, set a lower cost for
high-speed links to force traffic over the high speed link. Configure a higher
cost for dial-up links that are used as backup links.
Exchange uses site membership and site link costs to select a single best
route to the destination server.
- The cost to the destination is calculated by adding the site link costs of
all links connecting the sites along the path.
- The path with the lowest aggregate site link cost to the destination site is
selected.
- If two paths have the same aggregate cost, Exchange selects the route with
fewer hops.
- If two paths have the same cost and the same number of hops, the system
compares the names of the Active Directory site nearest to the destination by
alphabet (or by number). It then chooses the site name lowest in alphabetic (or
numeric) order. If the same site is nearest to the destination in two equal
paths, Exchange moves back along the path until a unique site is found.
By default, Exchange uses the Active Directory site link costs for message
routing decisions. If the existing costs are insufficient for Exchange message
routing, you have two options:
- Modify the site link costs in Active Directory Sites and Services. Most
Exchange administrators will not have permission to modify these costs, and
changing the costs might negatively affect other services that rely on these
costs.
- Assign Exchange costs for each link. The Exchange link cost provides an
alternate link cost that is used by Exchange. The Exchange link cost is used
instead of the Active Directory link cost (if it exists). Use the
Set-ADSiteLink cmdlet to configure an Exchange site link cost.
When considering site costs, be aware of the following:
- After the Hub Transport server identifies the destination site for a
message, the message is sent directly to the destination, disregarding the site
route. For this reason, you must have a Hub Transport server in each site
that has a Mailbox server.
- Once a path is determined, alternate paths are not considered. This means
that under normal circumstances, if delivery fails, an alternate path is not
identified. Alternate delivery is only calculated at regular intervals or for
specific changes that affect the Active Directory topology or the Exchange
configuration.
- The Hub Transport server forwards messages to the next hop in the path to
the destination. The next hop is not the same as the next Active Directory site
in the path, nor is it the next site with a Hub Transport server. In most cases,
the next hop is the destination site for the Mailbox or other server.
- While Active Directory site links can use either the IP or SMTP protocols,
Exchange 2007 uses only the IP protocol because there are limitations on the
types of data that can be replicated over SMTP. IP has no such limitations.
Inter-site Routing Facts
For delivery of messages within a site, Hub Transport servers send messages
directly to the Mailbox, Hub Transport, or Edge Transport server. For delivery
of messages
between Active Directory sites, Hub Transport servers
identify the destination site and queue the message for delivery directly to
that site. Hub Transport servers in the destination site receive these messages
and forward them to other Hub Transport servers, Edge Transport servers, or
Mailbox servers.
It is important that you do not confuse the site routing decision with
Network-layer routing that takes place to route packets from one destination to
another. The purpose of the Exchange routing process is to identify an Active
Directory site route to the destination site. Under normal message processing,
this site route is not used for relaying messages to the destination site. For
example,
- A Hub Transport server in Site A performs categorization and finds that the
destination mailbox is located in Site E.
- The Hub Transport server identifies the Active Directory site path as Site
A-Site B-Site C-Site D-Site E.
- The Hub Transport server in Site A initiates contact with a Hub Transport
server in Site E.
- The message is sent using normal Network layer routing directly to
the Hub Transport server in Site E.
Under normal circumstances, Hub Transport servers in sites along the site
route do
not receive or forward messages. The site route path is only
used when direct delivery is not possible or when other special conditions
exist. The following table describes three conditions that affect how messages
might be relayed in transit.
| Queue at Point of Failure (Backoff) |
After a Hub Transport server identifies the destination Active Directory
site, it tries to initiate a connection directly with a Hub Transport server in
that site. If a Hub Transport server in that site does not respond, Exchange
uses the backoff process to attempt to deliver the message to a Hub
Transport server as close to the destination site as possible. When the original
delivery fails:
- The sending server identifies the Active Directory site path to the
destination with the lowest overall cost. For example, a message sent from Site
A to Site E might identify the optimal path to be Site A-Site B-Site C-Site
D-Site E.
- The server steps backwards through the sites until it finds a site with a
Hub Transport server. For example, it will attempt delivery to Site C if a Hub
Transport server is not located in Site D.
- It then attempts to initiate contact with the Hub Transport server in that
site.
- If successful, the message is delivered to the Hub Transport server in the
path. In this example, if a Hub Transport server in Site C responds, the message
is forwarded to that server.
- If unsuccessful, the server continues to step backwards through the path,
contacting Hub Transport servers until one responds.
- After the message is delivered to an intermediary Hub Transport server, that
server performs the categorization process to identify the recipient and the
routing information. It queues the message for delivery and attempts to contact
a Hub Transport server in the destination site.
The goal of this
feature is to deliver the message to a Hub Transport server to a site as close
to the destination as possible. Once communications with the destination site
are restored, the Hub Transport server delivers the message to the
site. |
| Hub Sites |
By default, Hub Transport servers send messages directly to a Hub Transport
server in the destination Active Directory site. If there are multiple Hub
Transport servers in the site path to the destination, Hub Transport servers
along the path do not receive and process those messages unless
the site is designated as a hub site.
When you designate a hub site, you tell Exchange to forward messages to a Hub
Transport server in the hub site instead of forwarding the message directly to
the destination site. For example, if the path from Site A to Site E was Site
A-Site B-Site C-Site D-Site E, and if Site C was designated as a hub site:
- The Hub Transport server performs categorization and identifies the route to
the destination.
- Because the route contains a hub site, the server forwards the message to a
Hub Transport server in Site C.
- The Hub Transport server in Site C performs categorization, identifying the
destination recipient and the route.
- Because the remaining route does not include a hub site (i.e. Site D is not
a hub site), the message is forwarded directly to Site E.
Be aware of
the following with hub sites:
- Use the Set-AdSite cmdlet to designate a hub site. While you can
designate any site as a hub site, the site must contain at least one Hub
Transport server for messages to stop at the site and be processed before being
forwarded.
- Hub Transport servers in hub sites will only process messages if the lowest
cost route includes the hub site. For example, if the lowest cost path from Site
A to Site E was Site A-Site F-Site E, and if Site C was designated as a hub
site, the message would be sent directly to Site E and would not be
routed through the hub site.
- You might need to designate a hub site when a firewall prevents SMTP
communication directly between two Hub Transport servers, or when you want to
configure message processing on a specific Hub Transport server for all messages
sent between sites. For example, you could force all messages to go through a
hub site where specific message restrictions are enforced.
|
| Delayed Fan-out |
Delayed fan-out is an Exchange 2007 feature that minimizes network traffic
for messages that have multiple recipients. When a message with multiple
recipients is received at a Hub Transport server, the following process takes
place:
- Each unique recipient is identified. This means that if the recipient is a
group, individual group members are identified.
- The lowest cost site path is calculated for each recipient.
- To accommodate destinations in different sites, the message must be split
(or copied).
Delayed fan-out optimizes the splitting process by
delaying the split until unique paths in the route are encountered. For example,
- A user sends a message from Site A to recipients in Site C and Site D.
- The Hub Transport server in Site A identifies the optimal path to both sites
as follows:
- To Site C, use Site A-Site B-Site C.
- To Site D, use Site A-Site B-Site C-Site D.
- The Hub Transport server forwards the message to the last shared site in the
path. In this example, a single copy of the message is sent to Site C.
- A Hub Transport server in Site C performs categorization. It splits the
message and sends one copy to the Mailbox server within Site C, then forwards a
second copy to Site D.
- A Hub Transport server in Site D receives the message, performs
categorization, and forwards it to the appropriate Mailbox server(s) in its site
based on the recipient location.
|
Communication Security Facts
By default, communication between Exchange 2007 servers is secured as
follows:
- Communication between Mailbox servers and Hub Transport servers use RPC
which includes a weak form of encryption. For added security, you can require
IPSec on these connections.
- Communication between Hub Transport servers and between Hub and Edge
Transport servers use mutual authentication and TLS. The TLS session uses the
self-signed certificate that is created with each transport server when it is
installed. You can replace the self-signed certificate with a third-party
certificate.
- Communication between Internet hosts and Edge Transport servers is not
secured.
You can customize the authentication used to communicate with an Exchange
2007 server by modifying the properties of the Send and Receive connectors. The
following table describes the various options:
| None |
Does not require authentication. This option is most commonly used to
communicate with smart hosts that allow anonymous connections, or on Edge
Transport servers to receive mail from Internet hosts. |
| Transport Layer Security (TLS) |
When TLS is used, the server offers to establish a TLS connection with the
communicating partner. |
| Domain Security |
Domain Security is an Exchange 2007 feature that provides for secure
exchange of e-mail with partner domains. Domain Security uses TLS with mutual
authentication to establish a session between Exchange servers. To configure
Domain Security, enable TLS and then identify the list of domains with which
communications are allowed. |
| Basic Authentication |
Basic authentication requires a user to submit a user name and password for
authentication. These credentials are sent in clear text, so best practice
dictates that you do not use Basic authentication without some form of
encryption. |
| Basic Authentication over TLS |
This method requires the use of TLS before authentication can take place.
After the TLS session is established, basic authentication is used for
authentication. TLS protects the clear text username and password. |
| Integrated Windows |
Integrated Windows authentication is available only on Receive connectors.
When enabled, the client negotiates the use of either NTLM or
Kerberos. |
| Exchange Server Authentication |
This option identifies the authentication used between Exchange servers.
- When communicating with previous Exchange servers, either NTLM or Kerberos
is used.
- When communicating with Exchange 2007 servers, TLS is
used.
|
| Externally Secured |
An externally secured connection enforces no authentication or encryption.
It is assumed that the connection between devices is secured using some other
method. When choosing this option, make sure to implement security controls,
such as IPSec, to protect traffic. Be aware that Exchange cannot verify the
security of this type of connection. |
Connectors
As you study this section, answer the following questions:
- What is the difference between a partner and internal
connector?
- Which connector type is created at the organization level?
- What is the role of the Send connector source server? How is the source
server different from the smart host?
- How do you designate all domains in a Send connector's address space?
- How do you manage load balancing for Send connectors?
- When do you configure a foreign connector?
- What does a foreign connector do with messages sent to the foreign system?
After finishing this section, you should be able to complete the following
tasks:
- Create Send connectors.
- Create Receive connectors.
This section covers the following exam objectives:
- 301. Configure connectors.
Receive Connector Facts
A Receive connector is a logical object that controls the inbound flow of
SMTP messages from e-mail clients and servers, both internally and from the
Internet.
- Receive connectors apply to specific servers, and control how the server
listens (and accepts) inbound mail.
- Receive connectors for Hub Transport servers are stored in Active Directory
beneath the server object. Receive connectors for Edge Transport servers are
stored in ADAM.
- During installation of a Hub Transport server, two Receive connectors are
automatically created: one for receiving mail from clients, and a second
(Default) for receiving mail from other mail servers. During Edge Transport
server configuration, two Receive connectors are created: one for receiving mail
from the Internet, and a second for receiving mail from internal mail servers.
- Each Receive connector is configured to listen for messages sent to a
specific IP address and port combination from a range of IP addresses.
For each Receive connector on a server, the IP address, port, and address range
combination must be unique.
- You can modify the default Receive connectors, or create new ones to control
message processing. For example, create custom Receive connectors to:
- Assign specific servers to process messages received from specific clients.
- Configure special connectors to apply custom features to specific source
addresses, such as message sizes, number of recipients, or number of inbound
connections allowed.
To configure Receive connectors, you must have the Exchange Server
Administrator role on a Hub Transport server, or be a member of the local
Administrators group on an Edge Transport server. Receive connectors have the
following properties:
| General |
On the General tab, you can configure:
- The connector name.
- The logging level.
- The fully qualified domain name (FQDN). This is the value that will be
supplied by the server in response to HELO and EHLO queries (requests to get the
attention of a mail server). By default, the FQDN is the authoritative domain.
|
| Network |
Use the Network tab to configure the IP address, port, and recipient IP
address ranges.
- You can configure multiple IP address and port combinations.
- You can configure multiple IP address ranges. Use the following formats:
- a.b.c.d to specify a single IP address.
- a.b.c.0/24 to identify a subnet address and a mask value using the mask bit
count.
- a.b.c.0-255.255.255.0 to identify a subnet address and a mask value.
- The combinations of address, port, and recipient ranges must be unique
between all connectors on that server.
- For Hub Transport servers, the two default connectors are configured as
follows:
- The Client connector is configured to listen on all assigned (local) IP
addresses on port 587. It will accept mail from all IP addresses
(0.0.0.0-255.255.255.255).
- The Default connector is configured to listen on all assigned IP addresses
on port 25, accepting mail from all IP addresses.
|
| Authentication |
Use the Authentication tab to identify the accepted method(s) of
authentication. On a Hub Transport server:
- The Client connector accepts TLS, Basic with TLS, and Integrated Windows
authentication.
- The Default connector accepts TLS, Basic with TLS, Exchange Server, and
Integrated Windows authentication.
|
| Permission Groups |
Permission Groups identify the clients and servers that are allowed to use
the connector. Permission Groups use the user account or group membership to
identify the type of user that is connecting. Permission Groups have preset
permissions. Permission Groups are:
- Anonymous users are unauthenticated users. Users or computers who
authenticate with the Anonymous user account belong to this Permission Group.
- Exchange users are all authenticated users.
- Exchange servers include Hub Transport servers, Edge Transport
servers, Externally Secured servers, and (on Hub Transport servers) other
Exchange Servers.
- Legacy Exchange Servers are members of the Exchange Legacy Interop
group and include all Exchange 2000/2003 servers.
- Partners are identified by the Partner Server account. Partners are
members who belong to identified domains when using Domain Security for
authentication.
Note: You cannot add or remove
Permission Groups, modify how members are identified, or change the preset
permissions. |
When you create a new connector, you select a connector type. Authentication
and Permission Group settings are configured based on the type you choose. After
the connector is created, you can modify and customize all settings. The
following table lists each type:
| Internet |
Select the Internet type to accept mail from anyone on the Internet or from
Internet SMTP servers.
- A Receive connector on an Edge Transport is automatically configured to
accept mail from all locations.
- You can create a Receive connector on a Hub Transport server using this
option, but this configuration is not recommended.
- This option uses TLS authentication and allows Anonymous users.
|
| Internal |
Choose the Internal type to accept mail from Exchange servers. Use this
connector type when configuring cross-forest connectors or to receive mail from
a third party transfer server.
- Both Hub Transport and Edge Transport servers are automatically configured
with a connector with this configuration to accept mail from other Exchange
servers.
- During configuration, the port is automatically set to 25.
- TLS and Exchange Server authentication is used.
- Allowed Permission Groups are Exchange servers and Legacy Exchange Servers.
|
| Client |
Choose the Client type to accept e-mail from Exchange clients or clients
using POP3 or IMAP4.
- The port is automatically set to 587.
- TLS, Basic with TLS, and Integrated Windows authentication is accepted.
- The Exchange users Permission Group is allowed.
|
| Partner |
Choose the Partner type to accept e-mail from partner organizations.
- TLS with Domain Security is used for authentication.
- The Partners Permission Group is allowed.
- Following the configuration of the Receive connector, you must use the
Set-TransportConfig cmdlet to identify allowed partner domains.
|
| Custom |
Choose a Custom type to manually configure authentication and Permission
Groups during creation. Select this type when configuring Receive connectors on
an Edge Transport server to accept mail from third party transfer servers,
external relay domains, or a Microsoft Exchange Hosted Services
server. |
Use the following cmdlets to configure Receive connectors:
- Use New-ReceiveConnector to create a new Receive connector.
- Use Get-ReceiveConnector to view the configuration information for an
existing Receive connector within the Exchange organization.
- Use Set-ReceiveConnector to modify an existing Receive connector.
- Use Remove-ReceiveConnector to delete an existing Receive connector.
- Use Set-TransportConfig to identify partner domains when using Domain
Security.
Send Connector Facts
A Send connector is a logical object that controls the delivery of mail sent
from an Exchange server to another mail server (both Exchange and non-Exchange
servers).
- Send connectors apply to all servers in the organization and are therefore
stored in Active Directory beneath the Exchange organization.
- When you install a Hub Transport server, no Send connectors are created.
Instead, implicit Send connectors are automatically computed as required for
internal mail delivery.
- When you configure an Edge Transport server for end-to-end mail flow, two
Send connectors are created automatically (if they do not already exist) to
allow sending mail to the Internet and sending mail to internal mail servers.
- Each connector is configured with a list of domain names. Servers use
connectors to identify how to deliver messages to the listed domains.
In addition to the connector name, logging level, and FQDN, you can configure
the following properties for a Send connector.
| Address space |
The address space identifies the destination SMTP domains for which the Send
connector will be used. When a server needs to send mail, the domains in
available connectors are examined. The connector with the best domain match is
then used. You can list individual domains, or use one of the following
conventions:
- Use * to designate all domains. A Send connector on an Edge Transport server
is created to send mail to Internet hosts with * as the address space.
- Use *.domain.domain to identify all subdomains of the listed domain.
Using the Management Console, you can only configure the domain names,
and the connector will use SMTP as the transport type. Using cmdlets you can:
- Add a cost to the address space. The cost is used to select a connector when
two connectors equally match the destination domain.
- Set the connector scope so that the connector can only be used by Hub
Transport servers within the same site. By default, connectors are used by any
Hub Transport server in the organization.
|
| Network |
The Network tab identifies where to send message when the connector is used.
Messages are forwarded in one of two ways:
- When DNS MX records are used, the transport server queries DNS to locate an
MX record that is authoritative for the destination domain. The message is then
forwarded to the mail server.
- When a smart host is used, messages are forwarded to another mail server for
delivery. For example, you might forward all outbound Internet mail to a mail
server located at your ISP.
When using a smart host, you can configure
the authentication that will be used to communicate with the smart host. When
using DNS, you have the option of using Domain Security for authentication.
|
| Source Server |
The Source Server tab identifies transport servers that are responsible for
processing mail sent to the connector. Connectors use the address space,
network, and source server settings as follows for sending mail:
- When a transport server receives mail, it checks applicable Send connectors
to find the connector that best matches the destination domain.
- Once the appropriate connector is identified, it uses the list of source
servers to locate a transport server that is responsible for the connector.
- If the mail server is listed as a source server, or if the source server is
in the same site, the message is forwarded to the source server. Otherwise, the
message is forwarded to a Hub Transport server in a site with a source server,
and then forwarded again (if necessary) to a source server.
- The source server uses either DNS to deliver the message to a mail server
that is authoritative for the domain, or it forwards the message to a listed
smart host.
You can list multiple source servers to provide for
redundancy and load balancing. If more than one source server is listed, the
closest source server (using Active Directory sites) will be used. If multiple
source servers are in the same site, message processing will be shared by all
listed servers. |
| Permissions |
Send connectors have a limited set of permissions that control how headers
are handled in outgoing mail.
- Permissions identify specific header characteristics.
- If the header characteristic is not allowed, the header is stripped from the
message before forwarding.
- Send connector permissions can only be set through
cmdlets.
|
| Linked Receive connectors |
A linked connector is a Send connector that is linked or associated with a
Receive connector. When a server with a linked connector uses a Receive
connector to accept inbound mail, it will use the linked Send connector to
forward the message without using any other selection criteria. Linked
connectors can only be configured through cmdlets. |
When you create a new Send connector, you choose from the following types.
The connector type automatically configures some of the network and source
server settings.
| Internet |
Choosing the Internet type configures * as the address space. This
configuration typically uses Edge Transport servers as source servers to relay
messages to the Internet. |
| Internal |
Choosing the Internal type configures the connector to use a smart host for
message relay.
- Hub Transport-to-Hub Transport servers use implicit Send connectors for
sending internal mail.
- A Send connector using an Edge Transport server as a source server and Hub
Transport servers as smart hosts routes inbound Internet mail to the internal
organization.
- Choose the Internal type to configure an Edge Transport server to relay mail
to an Exchange 2003 bridgehead server, or to configure a Hub Transport server to
relay to bridgehead servers in the same forest.
|
| Partner |
Choosing the Partner type configures the connector to use DNS lookup with
mutual TLS for authentication. The Set-SendConnector -RequireTLS command
enforces that messages are only sent when a TLS connection has been
established. |
| Custom |
Choosing the Custom type lets you change all connector properties during
connector creation. Select this type to:
- Manually configure Send connectors with Edge Transport servers and the
Exchange organization.
- Configure Send connectors to Hub Transport or bridgehead servers in other
forests.
- Send mail to a third party transfer agent or an external relay
domain.
|
Use the following cmdlets to configure Send connectors:
- Use New-SendConnector to create a new Send connector.
- Use Get-SendConnector to view the configuration information for an
existing Send connector.
- Use Set-SendConnector to modify an existing Send connector.
- Use Remove-SendConnector to delete a Send connector.
Foreign Connector Facts
A Foreign connector is a logical object that controls the sending of messages
to non-SMTP mail systems or to fax systems. Foreign connectors act much like
Send connectors. Foreign connectors use the following properties to control how
mail is sent:
- The address space lists destination domains to which the connector applies.
- Source servers are identified that can process mail sent using the Foreign
connector. Like Send connectors, you can identify multiple source servers for
availability or load balancing.
- The drop directory identifies a file system location where messages
are placed awaiting retrieval by the non-mail system. The drop directory must be
accessible to all source servers as well as the foreign messaging server.
- In addition, the Hub Transport server uses the Replay directory to receive
messages from a foreign system. The foreign system places messages in the Replay
directory. The transport server checks this directory periodically for messages
that it needs to process.
Note:
You cannot create Foreign connectors on an Edge Transport
server.
You must use cmdlets to create and manage Foreign connectors. Be aware of the
following regarding the drop directory:
- The drop directory location is identified using two values:
- RootDropDirectoryPath is a server-wide value that identifies a parent
path that can store multiple drop directories. By default, this value will be
blank, which is interpreted by Exchange to be the Exchange installation
directory (by default C:/Program Files/Microsoft/ExchangeServer).
- DropDirectory identifies the drop directory name. This value can
contain an absolute or a relative path. If it is a relative path,
RootDropDirectoryPath and DropDirectory are combined to get the
drop directory location. If it is an absolute path, the drop directory path will
be used (however, the root drop directory must not be specified).
- When you create a new Foreign connector, the DropDirectory name will
be the same as the connector name (unless you explicitly configure it).
- Each Foreign connector uses its own drop directory.
- The foreign system must be configured to retrieve messages from the drop
directory.
- When you create the Foreign connector, the file system directory will
not be created. You must create the directory before or after defining
the Foreign connector.
- If you change the drop directory location used by the Foreign connector, the
new directory must exist or be manually created. You must also manually move any
items from the old directory to the new directory.
- You can configure a UNC path or a local path for the root drop directory.
Use the following cmdlets to configure Foreign connectors:
- Use New-ForeignConnector to create a Foreign connector.
- Use Get-ForeignConnector to view the configuration information for a
Foreign connector.
- Use Set-ForeignConnector to modify a Foreign connector, including the
DropDirectory path.
- Use Remove-ForeignConnector to delete a Foreign connector.
- Use Set-TransportServer to set the RootDropDirectoryPath or
the Replay directory for the server.
Transport Policies
As you study this section, answer the following questions:
- You want to create a transport rule to be used by multiple Hub Transport
servers. Where must you create the rule?
- What must you do to use the same transport rule on multiple Edge Transport
servers?
- How do you prevent transport rules from running on a Hub Transport server?
- What is a hub site? How does it affect the application of transport rules to
messages?
- How does premium journaling differ from standard journaling?
After finishing this section, you should be able to complete the following
tasks:
- Configure transport rules.
- Configure journaling on a database.
This section covers the following exam objectives:
- 301. Configure Connectors.
- 303. Configure transport rules and message compliance.
Transport Policy Facts
Transport policies provide an easy, flexible way for administrators to
process, filter, store, and modify e-mail messages. Use transport policies to
comply with legal or regulatory requirements on controlling or storing e-mail
messages, or to enable message handling features to meet your organization's
needs. Transport policies are applied to mail messages by a software process
(called an
agent) running on Hub Transport and Edge Transport servers.
Exchange has two agents:
| Transport Rule agent |
The Transport Rule agent applies filtering rules to e-mail messages.
Individual messages are examined by the Transport Rule agent to look for
predefined criteria such as:
- Sender or recipient address
- Subject or body contents
- Header information
- Message size
There are two different Transport Rule agents: the
Transport Rule agent runs on Hub Transport servers, and the Edge Rule agent runs
on Edge Transport servers. |
| Journaling agent |
The Journaling agent is responsible for recording all e-mail through a
transport server. The e-mail record includes details about each message such as
the sender, recipient, and the subject. There are two types of journaling:
- Standard journaling applies journaling actions to a specific mailbox
database. For this reason it is also referred to as per-mailbox database
journaling. Standard journaling is enabled on each mailbox database by adding a
journal recipient. The journal recipient is the recipient who receives
journal reports.
- Premium journaling allows you to apply journaling actions to specific
recipients or groups. Premium journaling requires an Exchange Enterprise Client
Access License (CAL) and is also called per-recipient journaling.
|
You configure Transport Rule policies by defining Transport Rules. A
Transport Rule consists of the following components:
- Conditions identify the characteristics to look for in an e-mail
message. Conditions look for a predicate (such as the recipient address
or the subject field) and match properties (or values) such as a specific
recipient or certain words in the subject line.
- Exceptions identify characteristics that are excluded, even if the
message matches the rule conditions. Like conditions, exceptions match
predicates and properties.
- Actions identify what should take place when a specific mail message
matches all of the conditions without matching any exception. Possible actions
include:
- Logging an event.
- Modifying the subject text.
- Adding a recipient, CC recipient, or BCC recipient to forward the message to
other recipients.
- Setting values within the message, such as modifying the header or setting
the Spam Confidence Level (SCL).
- Rejecting the message (deleting the message and sending a Non-Delivery
Report (NDR)).
- Deleting the message without an NDR.
- Quarantining the message.
- Dropping the connection with the sending server.
The easiest way to create Transport Rules is to use the Transport Rules
Editor wizard in the Exchange Management Console. Using cmdlets to create
Transport Rules requires the following process:
- Create a variable for each condition, identifying the predicate for the
condition.
- Assign one or more values to each condition variable. The value identifies
the property for the predicate that must match.
- Create a variable for each exception, identifying the predicate for the
exception.
- Assign one or more values to each exception variable.
- Create a variable for each action, identifying the specific action to take.
- If the action includes setting a value or modifying message properties,
assign values to the action variable.
- Create the Transport Rule, identifying the condition, exception, and action
variables created previously.
The following example shows creating a Transport Rule named
DrugSpam
that sets the Spam Confidence Level (SCL) for messages that match specific words
in the subject unless they have come from a specific sender:
$myCondition1 = Get-TransportRulePredicate SubjectContains
$myCondition1.Words = @("viagra", "meds")
$myException1 = GetTransportRulePredicate From
$myException1.Addresses = @((Get-Mailbox "Betty Apple"))
$myAction1 = Get-TransportRuleAction SetScl
$Action.SclValue = 7
New-TransportRule -Name "DrugSpam" -Condition @($myCondition1) -Exception @($myException1) -Action @($myAction1)
When managing Transport Rules, be aware of the following:
- You can configure Transport Rules for Hub Transport and Edge Transport
servers. However, there are differences for available predicates and values for
each server type.
- Transport Rules are applied as part of the categorization process. To
prevent rule processing on a server, disable the corresponding agent.
- Use the Get-TransportAgent cmdlet to see if the agent is running on
the server.
- On the Hub Transport server, use Enable-TransportAgent -Identity
"Transport Rule agent" to enable the agent. On the Edge Transport server,
use Enable-TransportAgent -Identity "Edge Rule agent".
- Use Disable-TransportAgent to disable the agent on the server.
- Configuring a Transport Rule on a Hub Transport server makes the rule
available on all Hub Transport servers in the organization. Configuring a rule
on an Edge Transport server applies only to that Edge Transport server. In other
words, for Hub Transport servers, create the rule once to be available on all
Hub Transport servers; for Edge Transport servers, you must create the rule on
each applicable server.
- Enabling, disabling, modifying, or removing Transport Rules on Hub Transport
servers performs the action on the rules within the organization. Taking these
actions on an Edge Transport server affects only the rules on the Edge Transport
server.
- Use Get-TransportRule to view existing Transport Rules.
- Use Enable-TransportRule and Disable-TransportRule to enable
and disable rules. Disabling a rule prevents it from being applied when the
agent runs. By default, rules are enabled when they are created.
- Use Remove-TransportRule to delete a Transport Rule.
- Use Set-TransportRule to modify a Transport Rule.
- Use Export-TransportRuleCollection and
Import-TransportRuleCollection to export and import rule collections. For
example, use these cmdlets to clone transport rule configurations between Edge
Transport servers.
- By default, Hub Transport servers send messages directly to a Hub Transport
server in the destination Active Directory site. If there are multiple Hub
Transport servers in the site path to the destination, Hub Transport servers
along the path do not receive and process those messages unless
the site is designated as a hub site. For example, if the site topology
was Site A-Site B-Site C, if Site A sends a message to Site C, transport rules
on Site B will not be applied. To force transport rules running on the Hub
Transport server in Site B to be applied:
- Designate Site B as a hub site (run Set-ADSite).
- Make sure the site link costs force messages to use the route that includes
Site B.
- If a condition or an exception uses a distribution group, the group should
be created as a universal security group.
- If you create a rule with no conditions and no exceptions, the rule will be
applied to all messages.
- To match messages with a blank subject line, use ^$ as the string to
match.
- When deploying new rules or modifying existing rules, test rules before
deploying them.
- To use a custom message in the NDR when rejecting messages, you must use a
Transport Rule on a Hub Transport server. You cannot use a custom rejection
message on Edge Transport servers.
Edge Transport Servers
As you study this section, answer the following questions:
- What is the role of the ADAM database?
- How do the edgesync - default-first-site-name to internet and
edgesync - default-first-site-name Send connectors differ?
- What is the relationship between the Edge Transport server and the Active
Directory site?
- What is the effect of resubscribing an Edge Transport server to a site after
adding a new Hub Transport server?
After finishing this section, you should be able to complete the following
tasks:
- Create an Edge Subscription for an Edge Transport server.
- Customize connector properties for Edge Transport servers.
This section covers the following exam objectives:
- 104. Configure Exchange server roles.
Edge Transport Server Facts
The Edge Transport server controls mail flow into and out of the Exchange
organization. The Edge Transport server is designed to be implemented in a
perimeter network as the Internet-facing gateway. It acts as an SMTP relay and
smart host for your organization. In addition to controlling mail flow to and
from the Internet, you can configure antivirus and anti-spam filters and
implement other message restrictions on the Edge Transport server. Implementing
these restrictions at the network perimeter reduces the amount of unwanted
e-mail traffic entering your internal network.
When you first install an Edge Transport server, a Receive connector is
automatically created to enable it to receive mail from both the Internet and
the internal network. However, to configure end-to-end mail delivery, you must
link the Edge Transport server to the Exchange organization. You do this through
the Edge Subscription process.
- To improve security in the perimeter network, the Edge Transport server does
not have direct access to a domain controller for Active Directory information.
- Active Directory information is stored on the Edge Transport server in an
instance of the Active Directory Application Mode (ADAM) database. This is a
read-only database that contains only the objects needed by the Edge Transport
server. ADAM provides the Edge Transport server with an LDAP directory service
that provides the server with the benefits of Active Directory without putting
the organization at high risk by placing domain controllers or global catalog
servers in the perimeter network.
- After the subscription has been established, any relevant changes in Active
Directory are copied to the ADAM database.
- Edge Subscriptions link an Edge Transport server to an Active Directory site
that contains one or more Hub Transport servers. Hub Transport servers use the
EdgeSync protocol to transfer Active Directory information to the ADAM database.
- While you can deploy an Edge Transport server without creating a
subscription, you must create an Edge Subscription to use anti-spam filters,
recipient lookup, safelist aggregation, or Domain Security (mutual TLS
authentication with partner organizations).
Use the following process to configure an Edge Transport server and create an
Edge Subscription:
- Install the Edge Transport server.
- On the Edge Transport server, run the New-EdgeSubscription cmdlet.
This exports information about the Edge Transport server to an XML file.
- Copy the XML file to a Hub Transport server in the site you want to link to
the Edge Transport server.
- Run New-EdgeSubscription on the Hub Transport server, or use the New
Edge Subscription wizard in the console to import the subscription. Note:
You must complete the subscription process within 24 hours of creating the
subscription file on the Edge Transport server. After that time has elapsed,
restart the subscription process by resubscribing from the Edge Transport
server.
During the installation and Edge Subscription process, the following things
happen:
- The Edge Transport server is made a member of the Exchange organization.
- The following settings are transferred from Active Directory to the ADAM
database:
- Accepted domains
- Remote domains
- Message classifications
- Safe Senders lists
- Recipients
- TLS Send and Receive Domain Secure lists
- Internal SMTP Servers list
- List of Hub Transport servers in the subscribed Active Directory site
- The following connectors are created:
| Receive |
Accept mail from the Internet |
Network = Listen on port 25 for all configured IP addresses. Accept mail
from all IP addresses.
Authentication = TLS, Domain Security, Exchange Server
authentication.
Permission Groups = Anonymous users, Exchange servers,
Partners |
| Send |
Implicit connector allowing send to Hub Transport servers in the forest |
N/A |
| Send |
Send mail to Hub Transport servers in the subscribed site |
Address space = * (meaning all domains)
Network = Use DNS records.
Note: If you route mail through a smart host in your ISP, be sure to
modify this setting accordingly. |
| Send |
Send mail to the Internet |
Address space = -- (meaning all authoritative domains)
Network =
-- (meaning all Hub Transport servers in the
site) |
Note: If Send connectors already exist,
for example if an Edge Transport server is already subscribed to the site, the
new Edge Transport server is added to the list of source servers for the
connectors.
When placing an Edge Transport server in a firewall, use the following
firewall settings to allow necessary communications between the Internet, the
Edge Transport server, and the internal network:
External
Internal |
25/TCP |
Allows SMTP traffic between the Edge Transport server and the Internet, and
between the Edge Transport server and the internal network. |
| External |
53/TCP |
Allows the Edge Transport server to perform DNS resolution and reverse DNS
lookup for outgoing mail recipients. |
| External |
80/TCP |
Allows the Edge Transport server to update virus signatures and protocol
definitions from Internet servers. |
| Internal |
50389/TCP |
Allows the LDAP tools to communicate with ADAM instance on the Edge
Transport server. |
| Internal |
50636/TCP |
Allows the Hub Transport server to replicate recipient and configuration
data using LDAP S or LDAP over SSL to ADAM on the Edge Transport
server. |
| Internal |
3389/TCP |
Standard RPD port used for remote management through internal
services. |
Edge Subscription Management Facts
Use the following cmdlets to manage Edge Subscriptions:
- Use New-EdgeSubscription on the Edge Transport server to create the
subscription file. Use the cmdlet with the -FileName parameter on a Hub
Transport server to import the subscription.
- Use Get-EdgeSubscription to retrieve information about the Edge
subscription.
- Use Start-EdgeSynchronization to force immediate synchronization
between the Edge Transport server and Active Directory.
Be aware of the following regarding Edge Subscription configuration:
- The Edge Transport server is subscribed to an Active Directory site. Each
Edge Transport server can only be subscribed to a single site in a single
Exchange organization.
- Each site can have multiple subscribed Edge Transport servers. You must
perform the subscription process on each Edge Transport server. When there are
multiple Edge Subscriptions for a site, load balancing will be used to evenly
distribute outgoing mail between all Edge Transport servers.
- As you add Hub Transport servers to a site or to the forest, automatic
implicit Send connectors allow the Hub Transport server to locate and route mail
to the Edge Transport server. No additional configuration is required as you add
Hub Transport servers.
- If a site does not have an Edge Subscription, the Hub Transport server in
that site will forward mail to a Hub Transport server in a site with an Edge
Subscription. To improve outbound mail flow, consider subscribing one (or more)
Edge Transport servers to each Active Directory site.
- Adding and removing Hub Transport servers from a site does not affect mail
flow unless you remove the last Hub Transport server from a site. Without a Hub
Transport server in the subscribed site, the Edge Transport server is left
orphaned, and mail cannot flow between the internal organization and the Edge
Transport server.
- It is possible to enable end-to-end mail flow into and out of your
organization by installing an Edge Transport server and manually creating the
necessary Send connectors. However, without a subscription you cannot take
advantage of features available through Active Directory (anti-spam, recipient
lookup, safelist aggregation, mutual TLS).
- If desired, you can create a subscription and suppress Send connector
creation. This replicates Active Directory information to ADAM, but does not
create the Send connectors. Following subscription, create necessary Send
connectors manually. You might need to do this if you have accepted domains that
are configured as external relay domains.
- After subscription, you can no longer create connectors or configure
accepted domains on the Edge Transport server. Instead, configure these settings
within the Exchange organization. The EdgeSync process replicates these changes
to the Edge Transport server.
When you create a subscription, you run
New-EdgeSubscription on one
Hub Transport server in the site. After a subscription has been established,
Active Directory information is replicated to the ADAM database on the Edge
Transport server.
- The first time synchronization takes place could take a significant amount
of time due to the amount of data that needs to be copied.
- Active Directory data is periodically copied to the ADAM database at the
following intervals:
- Accepted domains, connection configurations, internal Hub Transport servers,
and message classification are replicated hourly.
- A list of valid recipients is synchronized every four hours.
- The topology is synchronized every 5 minutes.
- If Active Directory data is not appearing in the ADAM database, use the
Start-EdgeSynchronization cmdlet to force immediate synchronization.
- When you create a subscription, all Hub Transport servers in that site will
participate in the EdgeSync process, making them available to synchronize data
with the Edge Transport server.
- When you add a new Hub Transport server to a site with a subscription, that
Hub Transport server will not automatically participate in the EdgeSync
process with the Edge Transport server. To enable new Hub Transport servers to
participate in synchronization, resubscribe the Edge Transport to the site.
Because of the way that Edge Transport servers are linked to Active Directory
sites, you should be aware of special processes that should be followed when
modifying the subscription configuration. The following table lists various
procedures to follow.
| Resubscribe an Edge Server to the same site |
You might need to resubscribe an Edge Transport server to a site to allow
new Hub Transport servers to participate in the EdgeSync process or if the
security credentials of the Edge Transport server have changed or been
compromised. To resubscribe to the same site, use the same process as creating
an original subscription:
- On the Edge Transport server, run the New-EdgeSubscription cmdlet.
- Copy the XML file to a Hub Transport server in the same site.
- Run New-EdgeSubscription on the Hub Transport server, or use the New
Edge Subscription wizard in the console to import the subscription.
When resubscribing within the same site, you do not need to remove the
existing subscription. The initial synchronization process will be faster
because the ADAM database is not deleted. |
| Permanently remove a subscription |
If you need to permanently remove an Edge Transport server, use the
following process:
- Disable all Receive connectors on the Edge Transport server.
- From a Hub Transport server, run Remove-EdgeSubscription. Allow the
process to complete.
- Run Remove-EdgeSubscription on the Edge Transport server. This
deletes the ADAM database on the Edge Transport server.
|
| Subscribe to a different site |
To move a subscription from one site to another, you first remove the
existing subscription, and then resubscribe in the new site. Complete the
following process:
- Disable all Receive connectors on the Edge Transport server.
- From a Hub Transport server, run Remove-EdgeSubscription. Allow the
process to complete.
- On the Edge Transport server, run the New-EdgeSubscription cmdlet.
- Copy the XML file to a Hub Transport server in the new site.
- Run New-EdgeSubscription on the Hub Transport server, or use the New
Edge Subscription wizard in the console to import the subscription.
When resubscribing to a new site, you do not remove the subscription
from the Edge Transport server. By keeping the ADAM database on the server, you
reduce the time required for the initial
synchronization. |
Anti-spam and Antivirus
As you study this section, answer the following questions:
- What is the difference between blocking *@.cheapmeds.com and blocking
sandy.smith@cheapmeds.com?
- How does the IP Block List differ from the IP Block List
Providers?
- How can a block-list provider outage affect mail flow?
- How can a user retrieve an attachment that is stripped from a message using
attachment filtering?
- How can you block mail addressed to invalid recipients?
- What is the role of sender reputation in allowing or blocking e-mail
messages?
- What action must you perform on a periodic basis when using Safelist
Aggregation?
After finishing this section, you should be able to complete the following
tasks:
- Configure spam filters on an Edge Transport server.
This section covers the following exam objectives:
- 302. Configure the antivirus and anti-spam system.
Anti-spam and Antivirus Facts
Exchange 2007 has included multiple anti-spam and antivirus agents to detect
and reduce malware. The anti-spam agents work cumulatively to reduce the amount
of unsolicited e-mail that enters an organization. The following table describes
the various components in the order in which they are applied.
| IP Allow List |
The IP Allow List is an administrator-defined list of IP addresses, IP
address ranges, or IP address and subnet masks. If an IP address or IP address
range matches an entry on the IP Allow list, the Connection Filter agent
forwards the message to the Sender Filtering process. |
| IP Block List |
The IP Block List is an administrator-defined list of IP addresses, IP
address ranges, or IP address and subnet masks. If an IP address or IP address
range matches an entry on the IP Block list, the Connection Filter agent drops
the SMTP connection and the message. You can set an expiration time for each
entry on the IP Block list. When the expiration time is reached, the entry is no
longer blocked. |
| IP Allow List Providers |
IP Allow List provider services (often referred to as IP safe lists
or white lists) compile lists of IP addresses that are not spam
producers. When you configure a list provider, the Connection Filter agent
queries the list provider to see if the IP address is on the approved list. If
the list provider approves an IP address, the Connection Filter agent forwards
the message to the Sender Filtering process. |
| IP Block List Providers |
IP Block Provider services (often referred to as real-time block
lists or RBLs) compile lists of IP addresses from which spam originates. The
Connection Filter agent queries the IP Block List provider service to see if the
connecting IP address is on the list. If it is, the Connection Filter agent
drops the SMTP connection and the message. |
| Sender Filtering |
Sender Filtering compares a sender to an administrator-defined list of
senders or sender domains that are not allowed to send messages to the
organization. To block a sender, use one of the following methods:
- To block a single sender, use the format:
username@domainname.com.
- To block an entire domain, use the format: *@.domainname.com.
- To block an entire domain and all subdomains, use the format:
*@*.domainname.com.
You can configure two different actions for a message from a blocked sender:
- Reject message deletes the message and sends a Non-Delivery Report
(NDR).
- Stamp message accepts the message, but labels the message as having
come from a blocked sender.
|
| Recipient Filtering |
Recipient Filtering examines the recipient address to make decisions about
accepting or rejecting messages. Recipient Filtering uses two data sources:
- The Recipient Block List identifies specific recipients that are blocked
from receiving messages.
- Recipient Lookup compares the recipient address with the list of valid
recipients within your organization. To use Recipient Lookup on an Edge
Transport server:
- Subscribe the server to an Active Directory site. The server can then search
for recipient information in the ADAM database.
- In Recipient Filtering, select the Block messages sent to recipients not
listed in the Global Address List option. This compares the recipient
address with valid addresses within your organization.
Note: The Recipient Filter agent only performs
lookups for authoritative domains. An Edge Transport Server that is not
configured as authoritative but accepts and forwards messages for another domain
does not perform recipient lookups. It still blocks non-authoritative recipients
specified in the Recipient Block List, though.
When the Recipient Filtering agent processes a recipient, it will take one of
two actions:
- If the recipient does not exist in the organization, if it is on the block
list, or if it is prevented from receiving mail from the Internet, a User
unknown message is sent to the sending server.
- If the recipient is enabled to receive Internet mail, is a valid recipient,
and is not on the block list, a Recipient OK message is sent.
The automatic sending of responses to the sending server regarding
recipient status could allow spammers to stage a directory harvest attack where
messages are sent to common recipients in your organization, looking for valid
and active accounts. To prevent the effectiveness of these attacks, Exchange
includes a feature called tarpitting. Tarpitting delays the return of the
status messages (by default 5 seconds), making automated processing on the
sending system difficult to implement. To configure the response time, use
Exchange Management Console or Exchange Management Shell to set the
TarpitInterval value on the Receive connector. |
| Sender ID Filtering |
Sender ID is designed to quell spoofing which occurs when a spammer
impersonates a legitimate sender and domain. Sender ID depends on the IP address
of the sending server, which is also known as the purported responsible
address (PRA). Sender ID uses Sender Policy Framework (SPF) records
published on DNS servers to identify the valid mail senders for a specific
domain.
- When the Edge Transport server receives an incoming connection, it queries
the sender's domain for an SPF record.
- If an SPF record exists, the Edge Transport server determines if the sending
server's IP address is authorized to send e-mail from that domain.
You
can configure the following actions to take if the sender fails the checks:
- Reject the message and send an NDR message to the sending server.
- Delete the message and send a fake OK message to the sending server. This
prevents the sending server from retrying message delivery.
- Stamp the message with a Sender ID status and continue delivery. The Sender
ID status is used by the Content Filtering agent to compute the Spam Confidence
Level (SCL). This is the default action.
Note: If the From: IP address is missing, the Sender ID status cannot
be set. In this case, Exchange continues to process the message without updating
the Sender ID, but the message is not deleted or rejected. |
| Content Filtering |
Content Filtering uses the Intelligent Message Filter, a machine-learning
technology that evaluates e-mail messages based its knowledge of both legitimate
and spam e-mail characteristics. The Content Filter evaluates messages,
calculates the likelihood of the message's legitimacy, and assigns the message a
Spam Confidence Level (SCL) of 0-9, with 9 most likely being spam.
You configure the Content Filtering agent to take specific actions on
messages that reach a certain threshold value. If the SCL is equal to or greater
than the threshold value you can:
- Quarantine the message on the server.
- Reject the message with a rejection notification sent to the originator.
- Delete the message without a rejection message being sent to the originator.
Note: The Intelligent Message Filter does not scan messages over 11
MB. Messages over 11 MB pass through the Content Filtering agent without being
processed.
You can further customize the Content Filter agent in the following ways:
- Allow Phrases are approved words or phrases. They automatically get an SCL
of 0.
- Block Phrases are unapproved words or phrases and get an automatic value of
9.
- You can add SMTP e-mail addresses, senders, and sender domains as exceptions
to which filtering does not apply.
- If you have a subscription on the Edge Transport server, you can configure
safelist aggregation. Safelist aggregation collects the Safe Senders
List, Safe Recipients List, and trusted contacts from individual Outlook users
and aggregates (combines) these lists into a single exception list to the
Content Filtering rules.
Note: You can configure allowed
recipients (exceptions) through the Management Console. The only way to
configure allowed senders is by using the Set-ContentFilteringConfig
cmdlet with either the -BypassedSenderDomains or -BypassedSenders
switches. |
| Sender Reputation |
Sender reputation is determined using persisted data about the IP address of
the sending server. From this data, the system generates a Sender Reputation
Level (SRL). SRLs are calculated using the following statistics:
- HELO/EHLO analysis uses the HELO and EHLO commands to retrieve information
about the domain name or IP address of the sending SMTP server. Spammers
frequently forge the HELO/EHLO to use it for malicious purposes.
- Reverse DNS lookup submits the sending server's IP address to DNS and
compares the result with the domain name in the HELO/EHLO command.
- Previously calculated SCL ratings are used to identify servers that send a
high proportion of spam messages.
- An open proxy test checks to see if the sending server is configured as an
open SMTP proxy. The Edge Transport server attempts to connect back to itself
from the sending SMTP server. If the connection is successful, the sending
server is identified as an open proxy.
- IP reputation anti-spam updates from Microsoft Updates is also used to
calculate the SRL.
The SRL is a number between 0 and 9 that indicates if a sender is likely a
source of spam. The closer to 9 the assigned SRL is, the more likely the sender
is a source of spam. When you configure Sender Reputation, you set a threshold
and a time duration.
- The threshold identifies the SRL block value. For messages at or above the
threshold, the sender is added to the Blocked Senders list. The action taken on
the message depends on the settings for Sender Filtering.
- The duration time identifies how long the sender remains on the Blocked
Senders list.
Note: Sender reputation only takes effect after a
sender has sent 20 or more messages. |
| Attachment Filtering |
Attachment filtering applies filters to e-mail attachments based on MIME
content type, file name, or file extension. Actions taken by the filter include:
- Reject the message and the attachment. In this case, the sender receives a
failure message.
- Silently delete the message and the attachment without notifying the sender
or recipient.
- Strip the attachment but allow the message through. Stripped attachments are
replaced with a text file that indicates the action take. This is the default
action.
As a best practice, you should avoid stripping attachments from the following
types of messages:
- Digitally signed, as this invalidates the digitally signed message.
- Encrypted, as this renders the message unreadable.
- Rights-protected, as this renders the message unreadable.
Note: Messages and attachments that have been blocked and attachments
that have been stripped cannot be retrieved. |
| Antivirus Scanning |
Virus scanning is performed by Forefront Security for Exchange Server. When
Forefront Security for Exchange detects an infected message, it deletes the
message, generates a notification, and sends it to the recipient's mailbox.
Exchange Server 2007 ships with a 120-day trial version of Forefront Security
for Exchange Server. After 120 days, you must license it separately.
Additional antivirus defenses should be deployed to scan all e-mails within
your Exchange organization, both in transit and those already in the store.
Exchange provides support for antivirus vendors through:
- VSAPI which provides a standard method of accessing messages within an
organization.
- Transport agents which scan messages with antivirus and anti-spam filters as
they pass through Hub and Edge Transport servers.
As a final step in securing your environment against viruses, you should
ensure that all individual computers have virus protection running on
them. |
| Outlook Junk E-mail |
The Outlook Junk E-mail filter operates on client machines. Messages are
evaluated based on several factors (arrival time, message content, message
structure), including metadata collected by the anti-spam filters (such as the
SCL settings added to messages). Individual users can customize settings to move
messages to the Junk E-mail folder or delete messages automatically. Users can
also create their own Safe and Blocked Senders lists, which function in
conjunction with the Safe Sender list aggregation. |
Anti-spam and Antivirus Configuration Facts
Be aware of the following when implementing anti-spam and antivirus
solutions:
- Filtering is typically configured on Edge Transport servers. However, you
can also configure filters on Hub Transport servers.
- Filtering is controlled through various agents that run on transport
servers.
- The Connection Filter agent applies IP Block/Allow and IP Block/Allow List
provider filters. However, each feature can be enabled or disabled individually.
- Each remaining filter type has its own agent.
- By default, all agents are enabled on Edge Transport servers, but disabled
on Hub Transport servers.
- To enable a filter agent or feature, use a cmdlet similar to the
following:
Set-ContentFilterConfig -Enabled: $true
The specific
cmdlet you use depends on the filter type. For example, use
Set-IPAllowListProvider to enable the IP Allow List feature,
Set-IPBlockListConfig to enable the IP Block List, or
Set-RecipientFilterConfig to enable recipient filtering.
- You must configure filtering settings on each Edge Transport server
individually.
- IP Block and Allow lists identify IP addresses of servers that are blocked
or allowed to send mail. They do not identify individual senders by e-mail
address.
- Because IP Block and IP Allow lists can be difficult to maintain, you should
use allow and block list providers for connection filtering.
- Use IP Allow lists to create temporary exceptions to block list providers,
such as when a sender has been incorrectly listed.
- Use IP Block lists to temporarily block senders until they can be added to
the provider's list.
- Outages or delays at the list provider can cause delays in processing
messages on the Edge Transport server, which in turn can cause mailflow
bottlenecks.
- The only way to retrieve stripped attachments or attachments on rejected or
deleted messages is to resend the message. Be sure to modify the filter settings
before resending to allow the attachment through.
- To have messages written to a quarantine mailbox, best practice dictates
that you use the following steps:
- Create a dedicated quarantine storage group.
- Create a dedicated quarantine mailbox store.
- Create a mailbox in the quarantine mailbox store.
- Delegate rights to the quarantine mailbox to the appropriate personnel.
- Create a profile in Outlook to view the messages.
- Enable message quarantine and designate the quarantine mailbox in Content
Filtering.
- To use Safelist aggregation:
- Run Update-SafeList for each user. This cmdlet pulls Safelist
information from the mailbox and stores it in Active Directory.
- Use pipelining to run the cmdlet for all user mailboxes. For example:
Get-Mailbox | where {$_.RecipientType -eq
[Microsoft.Exchange.Data.Directory.Recipient.RecipientType]::UserMailbox } |
Update-SafeList
- The command must be periodically run to pull new information from the Safe
Senders list. To do this, create a script and use the AT command to
schedule the script to run on a schedule.
- Run the content filter agent on the Edge Transport server.
- The Edge Transport server must have an edge subscription to pull the
information from Active Directory.
Use the following commandlets to configure Receive connectors in the Exchange
Management Shell:
- Use Enable-AntispamUpdates to retrieve antispam updates from the
Microsoft Update Server.
- Use Get-AntispamUpdates to view the status of antispam updates.
- Use Add-AttachmentFilterEntry to configure a filter for a specific
file or extension. Use Set-AttachmentFilterListConfig to modify the
action to take when a matching attachment is found.
Filtering Process Facts
As you troubleshoot mail delivery (or failure), it is important to understand
the order in which agents run and what happens when specific conditions are
encountered. Exchange 2007 uses the following process to apply anti-spam
filtering:
- The Connection Filtering agent is the first agent to run. It does the
following:
- If the sending server's IP address is on the IP Allow list, the message is
sent to the Sender Filtering agent. Additional connection filters are not
applied.
- If the sending server's address is not on the IP Allow list, the agent
checks the IP Block list. If the sending server's address is on the list, the
message is rejected and no further processing takes place.
- If the sending server's address is not on either list, the agent checks the
IP Allow List. If the sending server's address is on the allow list, the message
moves to the Sender Filtering agent.
- If the sending server's address is not on the IP Allow List, the agent
checks the Real-Time Block Lists (RBLs) of the configured IP Block List
providers. If the sending server's address is on one of the RBLs, the message is
rejected.
- If the message makes it through the Connection Filtering agent, the message
moves to Sender Filtering.
- If the sender is on the blocked senders list, the message is either rejected
(deleted) or stamped as having come from a blocked sender.
- If the sender is not on the list, or if the message is stamped, the message
moves to Recipient filtering.
- If Sender Filtering does not reject the message, the Recipient Filter agent
checks the Recipient Block List and also compares the recipient to the list of
valid recipients (if so configured).
- If the recipient is blocked or does not exist, Exchange rejects the message
and sends a response to the sending server.
- If the recipient is not blocked and exists, Exchange sends a confirmation to
the sending server and the message moves to the next anti-spam agent.
If the message is addressed to multiple recipients, the blocked or
nonexistent recipients are removed and the message moves to the next anti-spam
agent.)
- If the message still contains valid recipients, Exchange runs Sender ID
filtering. Depending on the configuration, the system can reject, delete, or
stamp the message and send it to the next anti-spam agent.
- Prior to applying Content Filtering, the Content Filter agent checks the
following five conditions:
- The sender's IP address is on the Connection Filtering IP Allow list.
- The message recipient(s) are on the exceptions for content filtering.
- All recipients' mailboxes have the AntiSpamBypassEnabled parameter
set to $True.
- All recipients have the sender on their Outlook Safe Sender lists (updated
to the Edge Transport server through safelist aggregation).
- The sender is a trusted partner or on the organization's list of senders
that are not filtered.
If any of the above conditions is true, the
message is sent to antivirus processing. If none of the conditions are true,
content filtering is applied, and the messages is assigned an SCL. Based on the
SCL, the following actions can occur:
- The message is deleted.
- The message is rejected and a rejection response is sent to the sending
server.
- The message is quarantined.
If no action is taken, the message
continues to the next anti-spam agent.
- If connection, sender, recipient, or sender ID filtering has taken an
action, then sender reputation filtering is activated.
- If less than 20 messages have been received from the sender, the sender
reputation filter takes no action.
- If more than 20 messages have been received, the sender reputation filter
assigns the sender an SRL.
If the rating level is at or above the
threshold, then the sender is temporarily placed on the Blocked Sender list, and
the action specified for Sender Filtering is applied to the message. If the
message is allowed, the message moves to the next anti-spam agent.
- If attachment filtering detects a content type that has been blocked, it
takes the configured action. If the attachments are approved or stripped, the
message moves to antivirus scanning.
- After virus scanning, the message moves to the client where local virus
scanning is applied, and where the message is subject to the scrutiny of the
Outlook Junk E-mail folder threshold. If the threshold is met or exceeded, the
message is put in the Outlook user's Junk E-mail folder. If it is not met, it is
delivered to the user's Inbox.
Chapter # 08
Availablity & Recovery
High Availability
As you study this section, answer the following questions:
- How do you add redundancy to Hub Transport servers? Edge Transport servers?
- Which type(s) of replication protects against server failure?
- What are the additional hardware requirements necessary for implementing
local continuous replication?
- Why does Cluster Continuous Replication offer better protection than both
Local Continuous Replication and Single Copy Cluster?
- What is the effect on load balancing when the Hub Transport server role
resides on the same server as the Mailbox server role?
After finishing this section, you should be able to complete the following
tasks:
- Enable and configure local continuous replication.
This section covers the following exam objectives:
- 504. Configure high availability.
High Availability Facts
High availability solutions in Exchange 2007 rely upon the following
technologies:
| Continuous Replication |
Continuous replication replicates Exchange data between two nodes.
- With Local Continuous Replication (LCR), a copy of a storage group is
created and maintained on a second set of disks that are connected to the same
server as the production storage group.
- With Cluster Continuous Replication (CCR), two computers (called
nodes) are configured in an active/passive cluster configuration. The
active node maintains the production copy of the Mailbox server, and the passive
node maintains the copy, which is kept current in case the active node fails
over to the passive node.
|
| Log Shipping |
Log shipping applies the log files of a production database to a copy
of the database. This allows you to create a copy of a storage group and
maintain that copy current. Both LCR and CCR use automatic log shipping.
|
| Autodiscover |
Autodiscover allows a user to connect automatically to the mailbox
after the mailbox database has moved from one server to another. |
| Database Portability |
Database portability allows a mailbox database to be mounted on any
server in the same organization. When users try to connect, the Exchange 2007
Autodiscover service automatically directs them to the new location. Portability
only applies to mailbox databases; public folder databases are not portable. You
should replicate public folder data between servers to move it rather than copy
it. |
| Cached Exchange Mode in Outlook |
Cached Exchange mode places a copy of the user's mailbox on the local
machine. The copy synchronizes with the mail server when connections become
available. This allows users to work offline, or to continue to work if the
Mailbox server is unavailable. |
| Load Balancing |
Load balancing distributes the resource load across the designated
servers. You can implement network load balancing using hardware (a dedicated
server) or by using a software solution, such as the Network Load Balancing
(NLB) service in Windows. |
| Round Robin DNS |
Round Robin DNS allows you to perform load balancing by using the DNS
server to spread the work load between multiple servers. DNS round robin works
as follows:
- An A record identifies a specific service. The A record contains multiple
server IP addresses.
- When a user request is made for the IP address of the service name, DNS
supplies the first IP address in the list.
- The next request gets the second IP address in the list, and so on, rotating
through each server in the A list.
DNS round robin provides load balancing only; not fault tolerance. If one of
the listed servers goes down, the DNS server will still continue to supply its
IP address in turn as clients request host name
resolution. |
The table below describes the high availability solutions for each of the
server roles.
| Hub Transport |
To provide load balancing and fault tolerance for Hub Transport servers,
simply install multiple Hub Transport servers in each Active Directory site. To
provide load balancing and fault tolerance for Send connectors, add multiple Hub
Transport servers as source servers.
- Exchange automatically load balances mail processing tasks between all Hub
Transport servers within the site.
- Exchange automatically determines when a Hub Transport server is unavailable
and routes messages to the remaining Hub Transport servers in the site.
- If there is no Hub Transport server within the site available, messages move
into the queue where they remain until a Hub Transport server does become
available or the messages expire.
Note: If you install your Hub Transport server on the same machine as
your Mailbox server, your Hub Transport server does not do true load balancing.
This is because the local server is preferred for sending mail by all users that
have mailboxes on that server. |
| Client Access server |
The Client Access server role is responsible for handling all non-MAPI
communications, and is used for Outlook Web Access (OWA), POP3, IMAP4, and
ActiveSync clients. To provide load balancing:
- Configure multiple Client Access servers and use round robin DNS.
- Configure a dedicated server (hardware solution) or a service like Windows
Server 2003's Network Load Balancing.
|
| Edge Transport |
The Edge Transport role is responsible for accepting e-mail from the
Internet, performing message hygiene, and sending messages out to Internet
recipients.
- To improve out-bound mail flow performance within a site, install at least
one Edge Transport server in each site.
- To provide fault tolerance and load balancing, subscribe multiple Edge
Transport servers in each site. Outbound requests will be routed evenly between
available Edge Transport servers.
Note: If the Edge Transport
server subscribed to a site is unavailable, messages will queue on a Hub
Transport server at that site until the Edge Transport server comes back online.
Messages will not be re-routed to other Edge Transport servers subscribed
to other sites. |
| Unified Messaging server |
The Unified Messaging server role is responsible for providing voice
activated access to user's mailboxes and voicemail and providing integrated
voicemail, calendars, faxes, and e-mail. High availability is provided by
installing a second Unified Messaging server and implementing a dial plan that
will be used by the VoIP gateway to direct requests to the first available
server in a round-robin fashion. |
| Mailbox server |
Mailbox servers provide e-mail storage, Public Folder databases, and other
services. To maintain Mailbox server high availability, use one of the following
solutions:
- To provide data redundancy in the event of a disk failure, implement Local
Continuous Replication.
- To provide service redundancy in the event of a server failure, implement a
Mailbox cluster with a shared disk subsystem.
- To provide both service and data redundancy, implement Cluster Continuous
Replication.
|
Mailbox Server Availability Facts
The following table contains the three main types of replication and cluster
implementations available in Exchange 2007:
| Local Continuous Replication (LCR) |
Local Continuous Replication (LCR) is a single-server configuration in which
a copy of the production storage group is created and maintained on a second set
of disks using built-in asynchronous log shipping and log replay technology. The
production storage group is called the active copy while the copy of the
storage group is called the passive copy. LCR reduces production costs in
the following ways:
- A quick switch to the secondary copy of data reduces the recovery time in
the event of data-level failure.
- LCR significantly reduces the amount of regular full backups.
- Backups can be taken from the passive copy storage group, allowing the
active storage group to remain in full production.
- Any type of storage can be used with LCR, including SCSI, iSCSI, and serial
or directly attached storage.
Using LCR, if the active copy experiences a failure, you can manually
deactivate the active copy and activate the passive copy. Alternatively, you can
also configure the path statement within the Exchange Management Console for the
database to point to the passive copy. The main advantage of using LCR is that
you only need to have a single server with a second disk subsystem installed.
The main disadvantage of LCR is that it only provides data fault tolerance (in
the event of a disk failure), but does not provide service redundancy (if the
server fails).
Note: Using LCR adds an additional 30-40% workload to your Exchange
server. |
| Single Copy Cluster (SCC) |
Single Copy Cluster (SCC) uses shared storage in a failover cluster
configuration which allows multiple servers to manage a single copy of storage
groups. Because nothing in a single copy cluster is shared between the nodes,
nodes have access to shared data, but cannot access it at the same time. SCC
uses the Windows Clustering feature available in Windows Server
2003 Enterprise or Datacenter editions.
The clustered Mailbox server (known as an Exchange Virtual Server in previous
Exchange versions) is not associated with any one node. If the node that is
currently hosting the clustered mailbox server experiences problems, then
failover takes place and the clustered mailbox server goes offline until another
node takes control of it and brings it online. If the clustered mailbox server
needs to be manually switched to a different node (a process called
handoff), this can be done with the Move-ClusteredMailboxServer
cmdlet in the Exchange Management Shell.
You should know the following about SCC:
- SCC provides service redundancy, but not data redundancy. Failure in the
disk system makes data unavailable.
- The use of a shared subsystem adds additional cost to the cluster.
- To create an SCC, you must create a failover cluster using the Microsoft
Windows Cluster service of Windows Server 2003 Enterprise Edition.
- Exchange 2007's SCC is very similar to the clustering solution which was
available with Exchange 2003 but includes many improvements, such as:
- SCC setup is integrated into Exchange setup which reduces the learning curve
previously associated with cluster configuration.
- Clustered Mailbox server tasks have been integrated into the Exchange
Management tools.
- Each clustered Mailbox server is configured with optimized default settings
which eliminate the need for an administrator to perform such tasks manually.
|
| Cluster Continuous Replication |
Cluster Continuous Replication (CCR) combines the asynchronous log shipping
and replay technology of Exchange 2007 with the failover and management features
provided by the Microsoft Windows Cluster service. CCR does not have a single
point of failure and provides high availability by replicating data on a passive
node, so the clustered Mailbox server can operate on either node at any time.
You should know the following about CCR:
- CCR configuration is made up of two computers (nodes) joined in a single
failover cluster,
- A file share witness monitors the clustered nodes and coordinates log
shipping and failover activities. The two nodes use the file share witness to
track which node is in control of the cluster. Best practice dictates that you
run the file share witness on a Hub Transport server in the Active Directory
site containing the cluster nodes.
- Continuous replication is asynchronous in that logs are not copied until
they are closed and not in use by the Mailbox server.
- CCR places very little overhead on the active node because the passive node
contacts a secured share on the active node to copy and replay log files.
- The designation of active and passive nodes automatically reverses after a
failover.
- CCR supports Volume Shadow Copy Service (VSS) backups on the passive node
which allows administrators to offload backups from the active node.
- Because both nodes must fail before backups are needed, the amount of data
on backup storage is reduced. Backups can be done on a weekly full cycle with
daily incremental.
- When updates need to be installed or when the node requires maintenance, run
the Move-ClusteredMailbox cmdlet to move the virtual server from the
active node to a passive node.
- The cost advantage of CCR is that it does not require a shared storage
subsystem as is required with other clustering technologies.
|
Use the following steps to configure a CCR solution:
- Install Exchange on the active and passive nodes.
- Create a cluster between the active and passive nodes.
- Mount the database to the active node.
- Each storage group and its database are copied to the passive node from the
active node in an operation called seeding.
- Log copying and replay are continuously performed. The Microsoft Exchange
Replication Service on the passive node connects to the secured file share on
the active node and uses the Server Message Block (SMB) protocol to pull (copy)
the log files.
Use the following steps to create an SCC two-node cluster:
- Install Windows Server 2003 Enterprise Edition on two nodes.
- Install Network Interfaces on both servers, one connected to a private
interface that provides a heartbeat functionality which runs between both
cluster nodes, the other connected to a public interface which is accessible to
clients.
- Install a shared storage subsystem so that the quorum drive and the data
drive are shared. The shared storage subsystem must be validated and it must be
on the Windows Server Cluster Compatibility List.
- A virtual Exchange server is created between the two nodes.
Availability Configuration Facts
The following table lists the configuration tasks to perform to enable each
type of availability solution for Mailbox server data.
| Local Continuous Replication (LCR) |
When implementing LCR:
- To enable LCR, you can have only one database in the storage group.
- To avoid running out of possible drive letters, consider using volume mount
points.
- The passive copies of files should be on different physical disks and use a
different disk controller than the active copies.
- The amount of disk space available in the passive copy should be similar to
that used by the active copy.
- When using LCR, you can create larger databases (up to 200 GB instead of the
recommended 100 GB limit).
To enable LCR on an existing storage group,
use the Management Console or the following cmdlets in this order:
- Run Enable-DatabaseCopy and identify the database name and the path
to the database copy.
- Run Enable-StorageGroupCopy and identify the storage group name and
the path to the log file copies.
|
| Single Copy Cluster (SCC) |
Use the following steps to create an SCC two-node cluster:
- Install Windows Server 2003 Enterprise Edition on two nodes.
- Install Network Interfaces on both servers, one connected to a private
interface that provides a heartbeat functionality which runs between both
cluster nodes, the other connected to a public interface which is accessible to
clients.
- Install a shared storage subsystem so that the quorum drive and the data
drive are shared. The shared storage subsystem must be validated and it must be
on the Windows Server Cluster Compatibility List.
- A virtual Exchange server is created between the two nodes.
|
| Cluster Continuous Replication (CCR) |
Use the following steps to configure a CCR solution:
- Install Exchange on the active and passive nodes.
- Create a cluster between the active and passive nodes.
- Mount the database to the active node.
- Each storage group and its database are copied to the passive node from the
active node in an operation called seeding.
- Log copying and replay are continuously performed. The Microsoft Exchange
Replication Service on the passive node connects to the secured file share on
the active node and uses the Server Message Block (SMB) protocol to pull (copy)
the log files.
|
Data Recovery
As you study this section, answer the following questions:
- What type of operation should you perform first if a message or mailbox has
been deleted?
- What is the default retention period for deleted items?
- How does a soft delete differ from a hard delete? When is each
executed?
- What is the relationship between a mailbox deleted item retention value and
a mailbox store deleted item retention value?
- How can you recover a deleted mailbox after the retention time has past?
After finishing this section, you should be able to complete the following
tasks:
- Configure mailbox and database storage limits.
- Manage disconnected mailboxes and mail users.
This section covers the following exam objectives:
- 502. Recover messaging data.
Data Recovery Facts
To minimize restore from backup operations, Exchange server includes the
deleted item and deleted mailbox retention features. When the user deletes a
message or an administrator deletes a mailbox, they are kept in the mailbox
database for a specified period of time. During that time, the user can recover
the deleted message, or the administrator can recover the deleted mailbox.
Deleted item retention is configured on both the client system and the
mailbox store, with recovery taking place on the client from within Outlook. Be
aware of the following facts regarding deleted item retention:
- The deleted item retention is configured by a setting on the mailbox store
for all mailboxes. The default value is 14 days.
- You can configure a deleted item retention value for a mailbox. This setting
overrides the mailbox store setting.
- A soft delete occurs when a user deletes a message in Outlook. The
message is placed in the Deleted Items folder. Items in the Deleted Items
folder can still be viewed and recovered my simply moving the message to the
destination folder.
- A hard delete occurs when a user deletes a message with the Shift key
or deletes the item from the Deleted Items folder. These items are not
placed in the Deleted Items folder, but they still exist and can be
recovered.
- By default, you can recover hard-deleted items only from the Deleted
Items folder. To enable recovery from folders other than the Deleted
Items folder, create the following registry DWORD
value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Options\DumpsterAlwaysOn
= 1 (decimal)
After changing the registry value, restart Outlook.
- To recover a hard-deleted item, select the folder in Outlook, then choose
Recover Deleted Items... from the Tools menu in Outlook. You can
then select the messages you want to recover.
- To retrieve messages that have past the deleted item retention time, you
must restore the mailbox from backup to an alternate location, then extract the
messages you want to retrieve.
Deleted mailbox retention is configured and recovery is performed on the
Mailbox server. Be aware of the following facts regarding deleted mailbox
retention:
- The deleted mailbox retention is configured by a setting on the mailbox
store. The default value is 30 days.
- Mailboxes are disconnected when you:
- Use Disable or Remove in the Management Console.
- Run the Disable-Mailbox cmdlet or the Remove-Mailbox cmdlet
without the -Permanent $true switch in the Management Shell.
- Disconnected mailboxes can be recovered. Mailboxes removed with the
-Permanent $true switch cannot be recovered and must be restored.
- To recover a disconnected mailbox:
- Go to the Disconnected Mailbox folder in the Management Console.
- Run the Connect-Mailbox cmdlet.
- When you recover a mailbox, the target recipient cannot already have a
mailbox. To merge messages from disconnected mailboxes into an existing mailbox,
use the Export-Mailbox cmdlet.
- To recover a mailbox that is past the mailbox retention time, you must
restore the mailbox from backup.
Database Backup and Restore
As you study this section, answer the following questions:
- What is the difference between a copy backup and a full backup?
- Why should you not mix differential and incremental backups?
- What factors should you consider when designing a backup strategy?
- What advantages can VSS backups have over legacy streaming backups when
restoring data?
- What can happen to the log files if you do not back up all the stores in a
storage group at the same time?
After finishing this section, you should be able to complete the following
tasks:
- Back up a mailbox database.
- Use the Recovery Storage Group (RSG) to restore a database or an individual
mailbox.
This section covers the following exam objectives:
- 501. Configure backups.
- 502. Recover messaging data.
Backup Types Facts
While Local Continuous Replication (LCR) and Cluster Continuous Replication
(CCR) can provide your system with a level of protection by offering near-time
copies of the running database, they cannot replace regular database backups.
Where LCR and CCR offer fast recovery options, backups allow you to recover a
database to a past point in time, and protect against complete disk or system
failure or catastrophic failures that affect an entire location.
The following table identifies the different types of backups:
| Full |
A full backup:
- Backs up the entire database including the log files.
- Purges the log files.
- Reduces the amount of restore time, but requires the longest amount of time
for each backup.
You should know the following about full backups:
- When restoring from a full backup, restore only the last full backup.
- Most backup strategies combine periodic full backups with incremental or
differential backups (but never with both at the same time).
Note: Best practice dictates that you perform daily full backups if
you do not run LCR or CCR. If you use a replication strategy, best practice
dictates that you perform weekly full backups. |
| Copy |
A copy backup:
- Backs up the entire database including the transaction logs.
- Does not delete the log files.
You should perform a copy backup to get a copy of the current data without
interrupting the backup schedule. For example, you might perform a copy backup
before a restore or before you make significant changes to your system such as
installing a service pack. |
| Incremental |
An incremental backup:
- Backs up only the transaction log files since the last time a full backup or
incremental backup was run.
- Purges the log files. This means that each incremental backup only backs up
information that has been changed since the last full or incremental backup.
You should know the following about incremental backups:
- When restoring from an incremental backup, you restore the last full backup
and each incremental backup made since the full backup.
- Combining full with incremental backups gives you the quickest backup
strategy, but takes the longest to restore.
- An incremental backup will not back up the .edb files.
- You cannot do incremental backups if you use circular logging.
- Because the incremental backup deletes the log files each time the backup is
done, this option minimizes disk space used.
|
| Differential |
A differential backup:
- Backs up the transaction log files since the last full backup.
- Does not delete the log files.
You should know the following about differential backups:
- When restoring from a differential backup, you restore the last full back up
and then the last differential backup.
- Differential backups take a little longer to back up than incremental
backups, but restoration is faster.
- You cannot do differential backups if you use circular logging.
|
Note:
When using third-party backup tools, the interaction of
the backup software with the log files might differ from the backup types
described here.
A backup strategy identifies the type and the frequency of backup operations,
as well as the operations necessary to restore data. Acceptable backup
strategies are:
- Perform full backups every night.
- Perform a full backup each week, with incremental backups every other day.
- Perform a full backup each week, with differential backups every other day.
Note: Do not mix differential and incremental backups.
When choosing a backup strategy, consider:
- The amount of time each day you have to devote to backups (called the backup
window). Because backup operations affect system performance, most
backups are performed at night during periods of little or no activity.
Depending on your system load, you might find that you have a very short backup
window each night, with longer windows on weekends.
- How quickly you need to be able to restore data in the event of an incident.
For example, restoring a full backup is the quickest recovery method, followed
by full with differential backups, followed by full with incremental backups.
- The effect of backup operations on the log files. Depending on your
requirements, you might want backup operations to purge the log files to
conserve disk space.
- The amount of data you must recover in a disaster. For example, if a day's
loss of data is unacceptable, best practice dictates daily backups.
- Any recovery service level agreements (SLAs) in place.
Databases should not exceed a size that can be backed up within the backup
window and that meets SLA and user performance requirements.
Backup Facts
There are two supported methods for accessing backup data in Exchange
2007:
| Legacy Streaming |
Legacy streaming is the traditional method of backup. The backup program
included with Windows Server 2003 (NTBackup) is Exchange-aware and is capable of
performing a legacy streaming backup of Exchange data. When a legacy streaming
backup is initiated:
- The backup application notifies the database engine that a backup is being
started.
- The database engine creates a file that is used as a marker that the backup
is occurring.
- The backup application freezes the database.
- The backup application backs up the database.
- The backup application copies the marker file which contains any additional
transactions and log files which took place during the backup.
The main disadvantage of a streaming backup is that it can take several hours
to complete, and a full backup might be impossible to complete during the backup
window. |
| Volume Shadow Copy Service (VSS) |
Volume Shadow Copy Service (VSS) is a component of Windows Server 2003 that
takes a point-in-time snapshot of files on the disk. By enabling VSS, you can
quickly back up and restore files. An Exchange Server 2007 backup with Volume
Shadow Copy services uses the following process:
- The backup program runs according to the established schedule.
- The backup program uses a VSS Requestor to command VSS to make a shadow copy
of the designated storage group(s).
- To prepare to make the shadow copy, VSS communicates with the Exchange
writer. Exchange performs the following actions:
- It prohibits administrative actions against the designated storage groups.
- It checks volume dependencies and prohibits write operations to database and
transaction log files (but it does allow read-only access).
- VSS contacts the appropriate storage provider to make the shadow copy of the
volume(s) that contain the storage group(s). For an effective solution, this
copy is completed within 20 seconds.
- After completing the shadow copy, VSS contacts the Exchange writer and
Exchange returns to its normal operational state.
- The VSS Requestor verifies the shadow copy before it confirms a successful
backup operation to Exchange.
The main advantage to VSS is that it allows you to back up a large amount of
data in a comparably small amount of time. |
Be aware of the following when performing backups:
- Windows Backup uses legacy streaming to perform backups of Exchange data.
You must use a third-party tool to perform VSS backups.
- Using Windows Backup, you can only back up data at the mailbox store level.
You cannot back up individual mailboxes. Some VSS tools allow you to back up
individual mailboxes (although backing up the entire mailbox database gets
individual mailbox data as well).
- Because all mailbox stores in a storage group share the same log files, you
should back up the entire storage group at once. When you do not back up all of
the stores in the storage group, the log files may not be deleted properly.
- Windows Backup can only back up the active copy of the database. VSS
solutions let you also back up the passive copy in a cluster.
- Legacy streaming backups can only be restored to the same database or to the
Recovery Storage Group (RSG). VSS backups can be restored
to the same location, a different location on the same server, or to a different
server within the same organization.
- Legacy streaming backups can only restore the entire mailbox database. After
the database is restored, you can merge or export selected data. Some VSS backup
solutions allow you to restore individual mailboxes.
- Regardless of the backup tool you use, you can only have one active backup
job at a time on a storage group, but you can have different jobs working on
different storage groups.
Permissions required for backup are:
| Basic Exchange Backup and Restore |
A basic backup of Exchange data requires membership in the following groups:
- Backup Operators
- Local administrator group on the machine from which the backup is run
- Domain Administrators group
|
| Back Up the System State and Exchange Program Files |
A backup of the system state and Exchange Program Files requires membership
in the following groups:
- Backup Operators in the domain in which Exchange 2007 is installed
- Local administrator group on the machine from which the backup is run
- Exchange View-Only Administrator role in the domain in which Exchange 2007
is installed
|
Database Restore Facts
The steps you use to restore mailbox data depend on the type of data you want
to restore and the destination for the data. The following table describes
various restore operations.
Note: All processes described in the table are for restore operations
using NTBackup that has taken a legacy streaming backup of the Exchange
database. For procedures using a VSS backup tool, consult the tool
documentation.
| Restore from backup |
If you want to restore a database that is lost, or if you want to simply
overwrite the existing copy of a database, use the following process:
- If the database no longer exists, create it. Dismount the database.
- Configure the database so that it can be overwritten.
- In the Management Console, edit the database properties and select This
database can be overwritten by a restore.
- In the Management Shell, run Set-MailboxDatabase with the
-AllowFileRestore $true switch.
- Run the backup program and restore each backup set depending on the backup
strategy you are using:
- Restore the last full backup.
AND
- Restore the last differential backup or each incremental backup.
While restoring the last backup in the set, choose the Last Restore
Set option. With this option selected, the transaction logs are replayed
following the completion of the restore operation.
- Mount the database. Reset the option to prevent the database from being
overwritten by future restores. Take a new backup of the restored database.
|
| Restore to a different location |
Exchange 2007 incorporates a feature called database portability that
allows you to recover a mailbox database to any server in the same Exchange
organization. To restore a mailbox database to a new location through database
portability, do the following:
- Make sure the database is in a Clean Shutdown state. (If it is not, run
Eseutil /r.)
- Create a new storage group with the same name as the original storage group.
Note: You can only restore directly to a different server if the storage
group and database names are the same. If you want to restore the database to a
different name, you must first restore the database, then move the files to the
new location.
- Create a new database with the same name as the original.
- Set the new database to be overwritten.
- Restore the database. During the restore,
- Choose Catalog a backup file.
- When choosing the restore destination, choose Alternate location and
identify the target server.
- After the restore, mount the database, remove the allow overwrite option,
and back up the new database.
|
| Restore a single mailbox |
If you want to restore a deleted mailbox, or restore specific messages that
have been deleted or that exist only on the backup medium, you will need to
restore the mailbox database to a Recovery Storage Group (RSG). After the mailbox database
is restored, you can extract the mailbox or the messages you need to restore.
The easiest way to use a recovery storage group is to launch the Exchange
Server Disaster Recovery Analyzer Tool (ExDRA) by selecting Database Recovery
Management in the Management Console. After launching the tool, use the
following process:
- Create the recovery storage group and identify the database to restore.
- When you create the RSG, you link it to an existing storage group. Only
databases from the linked storage group can be restored into the RSG.
- An empty database is also created from the settings you specify.
- The database is configured to allow overwrites during a restore.
- Restore the database into the recovery storage group. This overwrites the
new database in the recovery group.
- Mount the database in the recovery storage group.
- Merge selected mailboxes from the recovery database into the target
database. Mailbox data is merged into the existing mailbox. Only items that do
not exist in the current mailbox are merged from the backup.
- If desired, dismount the recovery database and delete the recovery storage
group.
|
| Restore specific mailbox data |
When you use the ExDRA tool, you have some limited options for filtering
what data is merged from the backup (filter by date and subject). Using the
Management Shell, you have more control over the contents that are copied from
the backup. To use the recovery storage group from the shell:
- Use New-StorageGroup with the -Recovery switch to create the
recovery storage group.
- Use New-MailboxDatabase to create the database in the recovery group.
- Use Set-MailboxDatabase with the -AllowFileRestore switch to
permit the restore operation to overwrite the recovery database.
- Restore the database from backup into the recovery storage group.
- Use Mount-Database to mount the recovery database.
- Use Set-MailboxDatabase with the -AllowFileRestore switch to
permit the merge operation to overwrite the target database.
- Use Restore-Mailbox to merge data from the recovery database to the
target database.
- Use the -identity switch to specify the target mailbox. Use the
-RSGMailbox switch to identify the mailbox from the recovery group. If
you omit -RSGMailbox, the source mailbox will be the same as the target
mailbox.
- To copy data to a folder instead of merging the mailbox, include the
-TargetFolder switch. Data from the recovery mailbox will be copied into
the destination folder.
- To merge data into the destination mailbox, omit the -TargetFolder
switch.
- When restoring to a different mailbox, you must include the
-TargetFolder switch. This means you cannot merge data from one mailbox
to a different mailbox.
- Use additional switches to filter copied or merged data based on recipient,
sender, date, subject or message content, attachment filenames or content, or
folder name.
|
A tool commonly used in database recovery is the Exchange Server Database
Utilities (
Eseutil.exe) tool. Using
Eseutil, you can restore data
to or repair a corrupt database.
Eseutil allows you to verify, modify, or
repair Exchange database files. The table below describes some switches commonly
used with
Eseutil.
| Defragmentation /d |
The /d switch performs an offline defragmentation of the
database. |
| Repair /p |
The /p switch repairs a corrupt offline database by removing pages
that can't be fixed. |
| Restore /c |
The /c switch displays the restore log file (Restore.env) and
controls hard recovery after restoring from a legacy online backup. |
| Recovery /r |
The /r switch replays (or rolls forward) transaction log files to
restore a database to internal consistency or bring an old copy of the database
up to date. |
Dial Tone Recovery Facts
Dial tone recovery provides users with an empty mailbox that has basic
e-mail functionality. Dial tone recovery minimizes the disruption of e-mail
services for end-users by providing a mailbox as quickly as possible. This empty
mailbox provides limited e-mail services for users until full services can be
provided. Users will not be able to access data from their original mailboxes,
but they will be able to send and receive e-mail using the new mailboxes.
Dial tone recovery is not a feature of Exchange, but rather it is a recovery
strategy that leverages the recovery storage group, database portability, and
mailbox merge features in Exchange 2007. You can use dial tone recovery to
provide e-mail service:
- During a mailbox database restore operation. During a restore operation,
users are unable to access the database that is being restored. Depending on the
size of the database, the time to complete the restore operation might be
unacceptably long.
- While a failed server is being rebuilt or is waiting for parts.
- During a move of mailboxes from one server to another, such as during a
server upgrade or replacement.
Using dial tone recovery involves the following basic steps:
- Create the dial tone database. The dial tone database can be on the same
server as the failed database or on a different server. Users gain e-mail access
through the mailbox in the new dial tone database.
- Restore the failed database using your backups and recovery strategy.
- Swap the dial tone database with the restored database. This step restores
e-mail access through the original mailbox. Users now have access to all data in
the original mailboxes. Messages sent or received while connected to the dial
tone database are now unavailable.
- Merge the databases. Merging the databases copies the data from the dial
tone database into the original database. All data, including messages sent and
received while connected to the dial tone database, are now available.
The following table lists procedures for using dial tone recovery in
different circumstances:
| Restore to the same server |
If you have a failure of a mailbox server, you can create the dial tone
database on the same server to provide temporary access until the original
database can be restored. To perform a dial tone recovery to the same server:
- Create a new database with the same name as the original database in the
same storage group. This step assumes that the original database no longer
exists.
- Create the recovery storage group linked to the target storage group.
- Restore the lost database to the recovery storage group.
- Swap the restored database with the dial tone database.
- Merge the dial tone database into the restored database.
|
| Restore using a second server for the dial tone database |
You can create a dial tone database on a different server, for example in
the case of a server failure that makes the original server unavailable. To use
a different server for dial tone recovery:
- Create the storage group (if desired) and a new mailbox database on the new
server.
- Use Move-Mailbox with the -ConfigurationOnly switch to point
all recipients from the original database to the dial tone database. Mailbox
data is not moved.
- Restore the original database to the original server.
- Use Move-Mailbox with the -ConfigurationOnly switch to point
all recipients from the dial tone database back to the original database.
- On the original server, create the recovery storage group linked to the
storage group that contains the restored database.
- Move the dial tone database to the recovery storage group.
- Mount the dial tone database.
- Merge content from the dial tone database into the restored database.
|
| Restore to a new server |
You can use a dial tone database to permanently move mailboxes to a new
server, for example if the original server is being upgraded or won't be
repaired. To permanently move users to the new dial tone database:
- Create the storage group and a new mailbox database on the new server. Use
the same storage group and database names.
- Use Move-Mailbox with the -ConfigurationOnly switch to point
all recipients from the original database to the dial tone database. Mailbox
data is not moved.
- Create the recovery storage group on the new server linked to the storage
group that contains the dial tone database.
- Restore the original database to the recovery storage group.
- Swap the restored database with the dial tone database.
- Merge the dial tone database with the restored database.
|
Chapter # 09
Monitering & Reporting
System Performance
As you study this section, answer the following questions:
- What is the difference between a statistic and an object?
- What things can you monitor using Process Monitor?
- What are the differences between the Exchange Load Generator and the
Exchange Stress and Performance (ESP) tool?
- What practices can you implement to reduce CPU load?
- Where should you look for problems if clients report slow Exchange server
response and both RPC requests and operations/second are low?
This section covers the following exam objectives:
- 402. Monitor system performance.
- 404. Monitor client connectivity.
- 405. Create server reports.
- 406. Create usage reports.
Performance Monitoring Tools
You can use the following tools to monitor performance and gather information
about Exchange or the operating system.
| Performance Monitor |
System Monitor (sometimes called Performance Monitor or PerfMon) is a
Windows operating system monitoring tool that provides performance data on
system resources, such as CPU usage, available memory, and disk activity. You
can also use System Monitor to monitor system hardware, the operating system, or
Exchange-specific processes. System Monitor uses objects and counters to
identify statistics that can be tracked.
- An object is a statistic group, often corresponding to a specific
type of hardware device or software process (such as the number of users
connected or the total number of logins started per second).
- A counter is a specific statistic you can monitor. Note:
Counters that apply specifically to Exchange Server begin with the label
MSExchange.
System Monitor includes the Performance Logs and Alerts snap-in with the
following components:
- Use Counter Logs to track counter statistics over a period of time. Counter
logs can be saved to different log formats:
- Use text files (comma or tab delimited) to import data into a spreadsheet
program.
- Use binary files to save data that is intermittent. Select a circular file
to save all data into a single file, overwriting the contents when the log is
full.
- Use SQL database files to import statistics into SQL server in order to
perform data comparisons or data archival.
- Use Trace Logs to capture events logged by software processes. Trace logs
are stored in trace files.
- Sequential files start new files when one file is full.
- Circular files save all data to a single file, overwriting data when the
file is full.
- Use Alerts to configure triggers that take an action when a counter reaches
a threshold value. When you configure an alert you specify:
- The counter you want to watch.
- A threshold limit (a counter value that you want to watch for).
- An action to take when the threshold value is reached. For example, you can
write an event to a log, send a message, or run a program.
|
| Network Monitor |
Network Monitor is a network traffic capture and monitoring tool. You can
use Network Monitor to capture traffic between two computers to help in
troubleshooting communication errors and performance. To use Network Monitor:
- Install Network Monitor on the Exchange server or a host that communicates
with the server.
- Run Network Monitor with an account that is a member of the local
Administrators group.
- To analyze traffic between two computers, build a database of address pairs
to help in filtering traffic. When you use an address pair, you will see only
the traffic between the selected hosts.
- To analyze traffic, you should temporarily disable network encryption (such
as IPSec).
|
| Process Monitor |
Process Monitor is an advanced monitoring tool that combines the features of
File Monitor and Registry Monitor. Use Process Monitor to view information
about:
- Process and thread startup and exit
- DLL and kernel-mode driver loads
- File system and registry activity
- Thread stacks
- Process details
Advanced filtering options help you sort and
filter data to narrow your search. |
| Exchange Load Generator |
The Exchange Load Generator simulates the load on an Exchange server from
MAPI clients. Run the tool on client computers. The tool sends multiple
messaging requests to the server to simulate an actual load. Be aware that the
Exchange Load Generator:
- Only simulates the load from one client. You can run the tool from multiple
client computers.
- Only simulates messaging requests coming from the client. It does not take
into account other types of loads such as logon/logoff, incoming mail (including
spam), non-MAP protocol communications, loads from mobile devices, or public
folder use.
- Can be used in Active Directory Users and Computers to export a list of user
accounts to a test environment.
You should only use the Exchange Load
Generator in a test environment. |
| Exchange Stress and Performance (ESP) |
Exchange Stress and Performance simulates multiple concurrent client
sessions over a wide range of protocols. ESP includes modules that test on a
variety of protocols. You can run multiple modules from a single client computer
to simulate separate clients. Use ESP to analyze the following types of traffic:
- SMTP
- Outlook Web Access (including WebDAV traffic)
- POP3, IMAP4
- Lightweight Directory Access Protocol (LDAP)
- Network News Transfer Protocol (NNTP)
ESP does not simulate
MAPI protocols. You should only use ESP in a test environment. |
| Exchange Profile Analyzer (EPA) |
The Exchange Profile Analyzer collects statistics contained in mailboxes to
create a user profile. The user profile identifies average statistics for
average users doing typical mail tasks (such as sending mail or browsing a
folder). EPA includes several tools:
- EpaCmd.exe is the command-line tool.
- EpaWin.exe is the graphical version.
- EpaOWACmd.exe is a command-line tool for analyzing Outlook Web Access
statistics.
- EpaSummarizer.exe is a command-line tool that combines data from
multiple individual runs and combines them into a single aggregated file.
Be aware of the following:
- You can collect data for a specific mailbox, all mailboxes on a server, or
all mailboxes on all servers.
- To run EPA, the account must have full access to all mailboxes analyzed,
have the Exchange View-Only Administrator role, and not be a member of
the Domain Administrators or the Enterprise Administrators groups.
- Collection tools include a number of data collectors. Exchange Server
collectors gather statistics about the Exchange mailboxes (such as the number of
items, average sizes, number of recipients). OWA collectors gather statistics
about specific actions (such as logon/logoff, send mail, edit mail).
|
You can also use the
Get-Process cmdlet to retrieve information about
the processes running on an Exchange server.
Performance Monitoring Facts
One of the main tools you will use in monitoring Exchange Server performance
is the Performance Monitor. The following table lists specific counters to watch
to evaluate server and Exchange performance:
| Processor\%Processor Time (_Total) |
Processor\%Processor Time (_Total) reports the processor utilization.
You can track utilization for all processors, for a specific processor, or for a
specific process.
- This counter should be below 90% for the total processor.
- This counter should be below 70% for Exchange utilization.
|
| System\Processor Queue Length |
System\Processor Queue Length identifies the number of threads that
are waiting in the processor queue. There is a single queue for all processors.
This counter should be less than 2 on a consistent basis. |
| Network Interface\Bytes Total/sec |
Network Interface\Bytes Total/sec reports the rate that the network
card processes data. It includes all network traffic, not just Exchange traffic.
- For a 100 Mbps network card, the value should be below 6-7 MBps.
- For a 1000 Mbps (gigabit) network card, the value should be below 60-70
MBps.
|
| Network Interface\Packets Outbound Errors |
Network Interface\Packets Outbound Errors shows the number of
outbound packets that were not transmitted because of errors.
This value should be 0. |
| MSExchangeIS\RPC Requests outstanding |
MSExchangeIS\RPC Requests outstanding reports the number of RPC
requests that are waiting to be processed.
A consistently high number could indicate a problem (check the following
latency statistic to verify). |
| MSExchangeIS\RPC Latency average |
MSExchangeIS\RPC Latency average reports the delay (in millisecond)
for RPC traffic.
This value should be less than 70 ms. |
| MSExchangeIS\RPC Requests |
MSExchangeIS\RPC Requests reports the average RPC requests.
This value should be less than 50. |
| Logical Disk\Average Disk Queue Length |
Logical Disk\Average Disk Queue Length reports the number of disk
access requests waiting to be processed.
This value should reach 0 every minute or less (this means that the queue is
being cleared on a regular basis). |
Logical Disk\Average Sec/Read
Logical Disk\Average Sec/Write |
The disk read and write statistics report the latency (delay) in reading
from or writing to the disk.
This value should be less than 50 ms. |
Take the following actions to correct any problems that are found:
- To reduce the CPU load:
- Offload tasks to other servers and stop all unnecessary services running on
the Exchange server.
- Perform maintenance and backup tasks during off-peak hours.
- Stage the startup of maintenance tasks to reduce sudden peaks in CPU load.
- Upgrade processors or add additional processors to multi-processor systems.
- To reduce the load on the network card:
- Replace faulty network cards. Upgrade to faster cards if possible.
- Restructure the network with switches or routers to reduce collisions and
broadcast traffic.
- Install two network cards in the server to create a separate network for
server-to-server traffic (used by the Exchange server to communicate with a
global catalog server) and client-to-server traffic (used by clients to
communicate with Exchange servers).
- RPC traffic problems have a direct negative impact on the user experience.
If users report slow Exchange response, examine the RPC statistics.
- If both RPC requests and operations/second are low, check for problems in
the network or at the client.
- If either or both statistics are high, troubleshoot the Exchange server.
Back Pressure Facts
Back pressure is an automatic system resource monitoring feature on
Exchange 2007 transport servers. When resource utilization for tracked
statistics reaches specific levels, the server takes corrective action or stops
accepting new connections and messages until resource utilization returns to an
acceptable level.
Exchange servers automatically monitor the following statistics and assign a
rating (Normal, Medium, or High) to the resource utilization:
| Free disk space for queue database files |
100 x (disk_size - 4GB)/disk_size)
Yields a percentage of free disk
space |
96% |
98% |
100% |
| Free disk space for queue log files |
100 x (disk_size - (25 x 20MB)/disk_size)
Yields a percentage of free
disk space |
96% |
98% |
100% |
| Uncommitted transactions in memory (transactions waiting to be written to
disk) |
n/a |
40 |
60 |
100 |
| Physical memory used by EdgeTransport.exe |
100 x (EdgeTransport.exe_Memory/Total_Memory) |
71% |
73% |
75% |
| Total system physical memory utilization |
100 x (Used_Memory/Total_Memory) |
90% |
92% |
94% |
Note: Virtual memory is not used when calculating memory
statistics.
The resource monitor checks system statistics every 2 seconds. When a problem
is found, Exchange takes steps to correct the problem. During subsequent
monitoring intervals, if the problem still exists or gets worse, additional
actions are taken. The following table lists various conditions and the actions
taken by the server. Conditions are listed in the order taken; if the first
action does not resolve the problem, subsequent actions could be taken.
| EdgeTransport.exe memory above Normal |
If the percentage of physical memory used by EdgeTransport.exe is above
Normal, memory garbage collection is triggered. |
| Uncommitted transactions above Normal |
If the total number of uncommitted transactions in memory (called a
version bucket) is above Normal, Exchange forces uncommitted transactions
to be written to the log file. |
| Any resource on a Hub Transport server at Medium |
If any resource utilization level on a Hub transport server reaches a Medium
level, the following actions are taken:
- New connections to non-Exchange servers are not accepted.
- Messages in the Pickup or Replay directories are not processed.
Local mail delivery within the Exchange organization is still
possible, meaning that the Hub Transport server still accepts messages from
Mailbox servers. |
Any resource on a Hub Transport server at High
Any resource on an Edge
Transport server at Medium or High |
If the resource utilization for any statistic on a Hub Transport server is
High, or if any resource on an Edge Transport server is Medium or High, the
following actions take place:
- No new connections from any server are accepted (including from Mailbox
servers).
- Messages in the Pickup or Replay directories are not processed.
Incoming mail flow essentially stops at this point. |
| EdgeTransport.exe memory still above Normal (after preceding actions have
failed to correct the problem) |
If the EdgeTransport.exe memory utilization percentage is still above Normal
after preceding actions have failed to correct the problem, the following
actions are taken:
- The Microsoft Exchange Transport service is restarted.
- Following the restart, messages in the submission queue are not
automatically processed.
|
| Uncommitted transactions remain high |
If the total number of uncommitted transactions remains high, the following
actions are taken:
- The transport dumpster is disabled. The dumpster is used with CCR or LCR for
activating replication and is only used if the service has an unscheduled
outage.
- Message delivery to remote queues (including messages to remote Active
Directory sites) is disabled. Delivery to local mailboxes still takes place.
|
| EdgeTransport.exe memory at Medium or High, or total memory at High |
If the EdgeTransport.exe memory remains at Medium or High, or the total
memory utilization is at High, message dehydration occurs. With message
dehydration, unnecessary portions of the message in memory, such as MIME
content, are stripped in an effort to make more memory available.
|
To identify problems caused by the back pressure feature, check the
Application log in Event Viewer. Look for log entries with
MSExchangeTransport as the Event Source and Resource Manager as
the Event Category. Following are some sample error messages
- Error 15001: "The resource pressure changed from Normal to Medium."
- Error 15002: "The resource pressure is constant at High."
- Error 15003: "Private bytes consumption changed from Medium to High."
To correct the problem, use the Performance Monitor to identify the exact
resource with the problem (memory or disk). Take the necessary actions to free
up or add resources (such as stopping unnecessary services, deleting unneeded
files from disk, adding memory, or adding disk space). As a temporary solution,
you can also change the settings that control back pressure monitoring:
- Settings are saved in the EdgeTransport.exe.config file.
- The default location of the file is at C:\Program Files\Microsoft\Exchange
Server\Bin\.
- Edit the file to enable or disable resource monitoring, change the location
of the queue database files, control how often the server checks resource
utilization, or change the values that determine the Normal, Medium, or High
values.
- By default, Exchange Server requires 4 GB free for queue database files (500
MB free for Exchange 2007 SP1).
- By default, Exchange Server requires 500 MB free for the database log files.
Client and Server Reports
As you study this section, answer the following questions:
- What is the difference between what is returned by Get-Mailbox and
Get-MailboxStatistics?
- What is the relationship between Get-LogonStatistics and OWA?
- How can you use EpaSummarizer.exe to analyze performance data?
- What data can you retrieve using Get-MailboxServer?
- Which tool would you be more likely to use to get statistics for an
individual user, Performance Monitor counters or Management Shell cmdlets?
After finishing this section, you should be able to complete the following
tasks:
- Create Exchange server performance and usage reports.
This section covers the following exam objectives:
- 404. Monitor client connectivity.
- 405. Create server reports.
- 406. Create usage reports.
Client Monitoring Facts
The following table lists various Management Shell cmdlets you can use to
gather statistics for client and server reports:
| Mailbox statistics |
Use Get-MailboxStatistics to view information about a specific
mailbox, all mailboxes in a database, or all mailboxes on a server. If you use
Get-MailboxStatistics with no parameters, it returns information for all
mailboxes on all databases on the current server. Information displayed
includes:
- Number and storage size of items
- Number and storage size of deleted items
- Last logon user account with last logon and logoff date and time
- Client version
- The server, storage group, and database name
- If disconnected, the date the mailbox was disconnected
- Whether the mailbox is below or over the storage limit
Note: The Get-Mailbox cmdlet returns the configuration
settings for a mailbox, not information about what is in the mailbox. |
| Mailbox folder statistics |
Use Get-MailboxFolderStatistics to view information about folders
within a specific mailbox such as the number and size of items and the number of
subfolders. |
| Public folder statistics |
Use Get-PublicFolderStatistics to view statistics for public folders.
Information shown includes:
- Number and storage size of items
- Number and storage size of deleted items
- Date and time of creation, last modification, and last access
|
| Logon statistics |
Use Get-LogonStatistics to view currently active sessions for a
recipient, a database, or a server. When used without parameters, shows
statistics for all databases on the server. Information shown includes:
- Client MAC address, IP address, adapter speed and client version
- Currently open messages, folders, and attachments
- Username, logon time, and last access time
- Successful number of RPC calls
Note: Outlook Web Access
(OWA) continually connects and reconnects as necessary. Running
Get-LogonStatistics might not show users connected with OWA, even when
there are many active users. |
| View enabled client access features |
Use Get-CASMailbox to view the enabled client access methods for a
mailbox. Detailed information available with format-list include:
- E-mail addresses and primary SMTP address
- List of ActiveSync device IDs and partnerships
- OWA features that are enabled (calendar, contacts, tasks, notes, spell
checker, signatures, public or private computer access)
- POP and IMAP enabled features
|
| ActiveSync device information |
Use Get-ActiveSyncDeviceStatistics to retrieve the list of devices
that are configured to synchronize with a specified user's mailbox and return a
list of statistics about the devices. You can retrieve statistics for a specific
device, or for all devices associated with a mailbox. Information includes:
- Device name, model, and operating system
- Date and time of last attempted and successful synchronization
- The recovery password for the device
|
You can also gather statistics using Performance Monitor. You can view
current and total statistics, or create a log to capture data over time. The
following table lists common objects and counters for monitoring client
connections.
| MSExchange ActiveSync |
MSExchange ActiveSync applies to the service, can't filter by device.
- Average request time
- Current, queued, total, and average requests processed
- Total number of specific commands processed by ActiveSync (such as Get Item,
Send Mail, and Sync)
|
MSExchangeIS Mailbox
MSExchangeIS Public |
MSExchangeIS Mailbox gathers statistics about the information store
process on a Mailbox server. You can gather statistics for all stores or
specific stores. Statistics include:
- Active and peak number of client logons
- Average message delivery time
- Total and average number of messages and recipients
- Total and average number of reads, writes, and deletes
- Total and average number of messages submitted by clients or sent to
transport servers
The MSExchangeIS Public object reports
similar statistics for public folders. |
MSExchangePop3
MSExchangeImap4 |
MSExchangePop3 gathers statistics about the POP3 service. Statistics
include:
- Current, failed, and rejected connections
- Total and active SSL connections
- Statistics for command rates and failures (commands include AUTH, LIST,
QUIT, USER)
The MSExchangeImap4 object reports similar
statistics for the IMAP4 service. |
| MSExchange OWA |
MSExchange OWA reports overall statistics for all OWA users on a
server. Statistics include:
- Average response time
- Current and total number of users (you can also get user counts based on
Light or Premium OWA)
- Logons per second
- Total messages sent
|
| MSExchangeIS Client |
MSExchangeIS Client gathers statistics for Client Access servers. You
can gather statistics for a specific client type (such as ActiveSync, POP3, or
Outlook Anywhere). Statistics include:
- RPC latency
- RPC bytes sent and received
- Database access statistics
|
Note: Most Performance Monitor objects apply to the entire server, not
to individual objects such as recipients or mailboxes.
Finally, you can use the Exchange Profile Analyzer (EPA) to gather mailbox
and client access statistics:
- Run EpaCmd.exe or EpaWin.exe to gather statistics about
mailboxes. Exchange Server collectors gather statistics about the Exchange
mailboxes (such as the number of items, average sizes, number of recipients).
- Run EpaOWACmd.exe to gather statistics about Outlook Web Access (OWA)
access. OWA collectors gather statistics about specific actions (such as
logon/logoff, send mail, and edit mail).
- Run EpaSummarizer.exe to aggregate data from multiple EPA sessions.
Server Monitoring Facts
Most server monitoring is done through gathering statistics in Performance
Monitor. You can view current and total statistics, or create a log to capture
data over time. The following table lists common objects and counters for
monitoring server performance related to Exchange.
| MSExchangeTransport Queues |
MSExchangeTransport Queues reports statistics for queues on a server.
In most cases, counters are combined values for all queues on the server.
Statistics include:
- Current, average, and total messages queued for delivery in all queues
- Total and average number of items delivered
- Number of items queued for delivery that have expired
- Number of items in the following queues:
- All mailbox queues (you cannot filter on specific mailbox queues)
- All remote queues
- Poison queue
- Submission queue
- Unreachable queue
|
MSExchangeTransport SmtpSend
MSExchangeTransport SmtpReceive |
MSExchangeTransport SmtpSend reports statistics for sent SMTP
messages. You can gather statistics for the entire server, or for messages sent
to specific connectors. Statistics include:
- Current, total, and average messages, size, and number of recipients
- Current, total, and average connections
- Current, total, and average bytes sent
MSExchangeTransport
SmtpReceive reports similar statistics for received SMTP messages. |
MSExchange Connection Filtering Agent
MSExchange Content Filter
Agent
MSExchange Recipient Filter Agent
MSExchange Sender Filter
Agent
MSExchange Sender Id Agent |
Spam filtering on Edge Transport servers is performed by various filtering
agents. Use the counters for the specific filter agents to gather server-wide
statistics on spam filtering activities.
- Use counters for the Connection Filtering agent to gather statistics about
messages that match IP block or allow filters.
- Use counters for the Content Filter agent to gather statistics about
messages scanned, messages passed, and the total number of messages with each
SCL rating.
- Use counters for the Recipient Filter agent to gather statistics about
messages blocked by the recipient block list.
- Use counters for the Sender Filter agent to gather statistics about messages
evaluated and filtered based on sender.
- Use counters for the Sender ID agent to gather statistics about messages
marked with various sender ID statuses (such as Non-Existent Domain, Malformed
Domain, Not Permitted Sender, Neutral, or Pass).
|
As you gather server information, you might also need to verify server
configuration, or identify servers with specific configuration parameters. Use
the following Management Shell cmdlets to retrieve configuration
information:
- Use Get-ExchangeServer to view attributes of all or a specific
Exchange server. This cmdlet returns information on all Exchange servers
regardless of role. The attributes returned are those common to all Exchange
server roles and includes:
- The Exchange edition and version number
- Roles filled by the server
- Active Directory site and OU information
- Use Get-MailboxServer, Get-ClientAccessServer, or
Get-TransportServer to view attributes for servers with a specified role.
These cmdlets return attributes specific to the server role, in addition to
returning the Exchange version number.
- Use Get-Mailbox to view mailbox configuration information.
- Use Get-CASMailbox to view enabled client features and associated
settings.
In addition to viewing server information, you can verify the server
configuration using the following commands and utilities:
- Run the Best Practices Analyzer to examine the server and generate a report
of recommended changes to make to the configuration.
- Run Test-SystemHealth to verify that all necessary services are
installed and working based on the configured server roles.
- Run Test-ServiceHealth to query the roles installed on an Exchange
server, then checks the status of the services that have a Startup value of
Automatic.
- Run Test-OutlookWebServices to verify the Autodiscover service
settings that are used by Outlook 2007 and some ActiveSync clients.
- Run Test-WebServicesConnectivity to perform basic operations to test
and verify the functionality of Outlook Anywhere and the Exchange Web Services.
- Run Test-Mailflow on a Mailbox server to verify that the Mailbox
server can send a message. You can send messages from a specific mailbox to a
destination mailbox on the same or a different Mailbox server. This cmdlet
verifies that the Mailbox server and any Hub Transport servers can communicate
for mail delivery.
- On a Client Access server, verify client connectivity using the
Test-OwaConnectivity, Test-MapiConnectivity, and
Test-ActiveSyncConnectivity cmdlets.
Queue Management
As you study this section, answer the following questions:
- How many Mailbox queues or Remote Delivery queues will a Hub Transport
server have?
- What is the relationship between the poison message queue and Exchange
Server?
- What is the effect of adding the Resubmit parameter to the
Retry-Queue cmdlet?
- How does the system treat delivery of suspended messages? Removed messages?
- What is the difference between resume and retry of a message queue?
After finishing this section, you should be able to complete the following
tasks:
- Use the Queue Viewer to manage delivery queues.
This section covers the following exam objectives:
- 401. Monitor mail queues.
Message Queue Facts
In the Exchange 2007 messaging environment, messages are placed in queues as
they wait to be sent. Queues are stored in an Extensible Storage Engine (ESE)
databases on transport servers. Exchange 2007 queues can hold up to a million
messages, so in the event of a server failure, the database can be retrieved and
mounted onto another server, at which point the queued messages will be sent to
their recipients.
The method of routing for a message determines the type of queue in which the
message will be stored. There are several types of message queues in Exchange
2007:
| Unreachable queue |
The Unreachable queue holds messages that cannot be routed to their
destination because a route to the recipient cannot be determined (i.e. the
recipient or recipient domain is unknown within the system). Messages where the
destination SMTP server has been determined but where the server doesn't respond
are not put in the Unreachable queue. Each transport server has only one
Unreachable queue. |
| Mailbox Delivery queue |
Mailbox Delivery queues only exist on Hub Transport servers. They hold
messages for recipients whose mailbox data is stored on a Mailbox server within
the same site as the Hub Transport server. A Hub Transport server has a Mailbox
Delivery queue for every unique destination Mailbox server. |
| Submission queue |
The Submission queue holds messages routed through the Hub Transport or the
Edge Transport server that are waiting to be processed. The categorizer
processes messages in the Submission queue and determines how they will be
routed based on the recipient information. After the message is categorized, it
is placed into a queue for delivery. Each Exchange 2007 transport server has
only one Submission queue. |
| Remote Delivery queue |
Remote Delivery queues hold messages that will be delivered using SMTP to
recipient mailboxes that reside on remote servers. A queue exists for each
unique remote destination.
- On a Hub Transport server, Remote Delivery queues hold messages to be sent
to remote Active Directory sites.
- On an Edge Transport server, Remote Delivery queues hold messages that are
routed to an external SMTP domain or smart host.
When a message is
received from a new remote destination, a Remote Delivery queue is dynamically
created. Once the messages have been successfully delivered, the queue expires
and is automatically deleted three minutes later (you can configure this time to
be longer or shorter). |
| Poison Message queue |
The Poison Message queue is used to isolate messages that contain errors
that are potentially harmful to Exchange Server. When a fatal error occurs,
Exchange server places currently-processing messages in the Poison Message queue
to isolate the message from the rest of the system (just in case the message was
the cause of the fatal error).
- This queue is only viewable in the case that messages have been directed to
the queue.
- Delivery of all messages within the Poison Message queue is suspended.
- If you determine that a message is not harmful, you can resubmit it to the
Submission queue for processing. Likewise, you can delete messages in the Poison
Message that you consider harmful to the system.
- There is one Poison Message queue on each transport server.
|
Queue Management Facts
Message queues can be configured by using the Queue Viewer in the Exchange
Management Console or by entering cmdlets the Exchange Management Shell. The
following table lists various queue management tasks:
| Suspend or resume queue |
When you suspend a queue, you suspend all outbound activities on a queue.
Messages can still arrive in the queue, but no messages leave. When you resume a
queue, you restart outbound activities for a suspended queue.
In the Exchange Management Shell, use the Suspend-Queue and
Resume-Queue cmdlets. |
| Retry queue |
When a queue fails to make a connection to the next hop, a retry timer
schedules subsequent connection tries. The retry queue action forces an
immediate connection attempt rather than waiting for the next scheduled try.
In the Exchange Management Shell, use the Retry-Queue cmdlet. You can
also use the Retry-queue cmdlet with the Resubmit parameter to
return messages to the Submission queue. You can do this for messages with the
following status:
- Mailbox or Remote Delivery queues with a Retry status (messages in the
queues cannot be suspended).
- Messages in the Unreachable queue that are not suspended.
- Messages in the Poison Message queue.
|
| Suspend or resume message |
When you suspend a message, you temporarily prevent its delivery. You can
prevent its delivery to recipients in a specific queue, or you can prevent its
delivery to all recipients in all queues. The resume message action reverses
suspend and allows a message to be delivered. You can also use the resume
message action to resubmit messages in the poison queue.
In the Exchange Management Shell, use the Suspend-Message or
Resume-Message cmdlets. |
| Remove message |
Where the suspend action temporarily prevents delivery, the remove action
deletes the message without delivery. You can prevent its delivery to recipients
in a specific queue, or you can prevent its delivery to all recipients in all
queues. You can configure the remove action to send an NDR (non-delivery report)
to the sender or to delete the message without generating an NDS.
In the Exchange Management Shell, use the Remove-Message cmdlet. The
-WithNDR $true option sends the NDR, and the -WithNDR $false
option does not send the NDR. |
| Export message |
The export action lets you copy a message from a queue on a Hub Transport
server to a specified file path within the Exchange organization. The message is
not deleted from the queue, but a copy is saved to the specified location. To
perform the export action, use the following process:
- Suspend the message.
- Export the message.
- Resume (or remove) the message.
In the Exchange Management Shell,
use the Export-Message cmdlet. |
You should also know these additional cmdlets for working with messages and
queues:
- Use Get-Message to view the details of one or more messages in a
queue on a Hub Transport server or an Edge Transport server.
- Use Get-Queue to view the configuration of a queue on a Hub Transport
server or an Edge Transport server.
Message Tracking and Mail Flow
As you study this section, answer the following questions:
- An Exchange server has the Hub Transport and the Mailbox roles installed.
How many log directories will it have by default?
- How would you enable message tracking on a server with both the Hub
Transport and Mailbox roles?
- You run Set-TransportServer -MessageTrackingLogMaxDirectorySize 250MB
on a Hub Transport server. How much data can the directory hold?
- What kinds of data do you find in the message tracking logs?
- When are message tracking logs automatically deleted?
- How does adding the > "filename" parameter change the output of
the Get-MessageTrackingLog cmdlet?
This section covers the following exam objectives:
- 403. Perform message tracking.
Message Tracking Facts
The Message Tracking log records message activity as messages are transferred
between servers and server roles. You can examine the message logs to help with
mail flow troubleshooting. A message log exists on all Edge Transport, Hub
Transport, and Mailbox servers. To configure the message tracking logs:
- Use Set-TransportServer on Edge and Hub Transport servers.
- Use Set-MailboxServer on Mailbox servers.
- If a server has both the Hub Transport and the Mailbox roles, it will have
two sets of logs. Use Set-TransportServer to set the Hub Transport server
log properties, and Set-MailboxServer to set the Mailbox server log
properties.
The following table describes the log file settings:
| -MessageTrackingLogEnabled |
Enables or disables message tracking. Message tracking is enabled by
default. |
| -MessageTrackingLogPath |
Configures the path to the message tracking logs.
- The default location is C:\Program Files\Microsoft\Exchange
Server\TransportRoles\Logs\MessageTracking. This location must be a local
path.
- Log files are named as follows:
- On transport servers, the log file name starts with MSGTRK. On
Mailbox servers, the name starts with MSGTRKM.
- Following the prefix is the date.
- Following the date is a sequence number.
- Following the sequence number is the .log extension.
- If a server has both the Hub Transport and the Mailbox roles, it will have
two sets of log files (with the corresponding prefix).
- When you change the log file location, existing logs aren't copied to the
new location.
- When you change the location, the target directory will be created if it
does not exist.
|
| -MessageTrackingLogMaxFileSize |
Sets the maximum log file size. The default size is 10 MB. When the maximum
size is reached, a new file is created. Its name is generated by incrementing
the sequence number. |
| -MessageTrackingLogMaxDirectorySize |
Sets the maximum size of the log files within the directory.
- The setting applies to all log files with the same prefix (MSGTRK or
MSGTRKM), not to the total of all files in the directory. Files in that
directory without the corresponding prefix do not count towards the maximum.
- If the server is both a Hub Transport and a Mailbox server, there will be
two sets of log files in the same directory, with the total size of each set
being controlled by a different maximum log file setting.
- When the size of the log files in the directory reaches the maximum, older
files are deleted to make room for newer files.
|
| -MessageTrackingLogMaxAge |
Sets the maximum age (in days) for the log files. The default is 30 days.
Files older than the maximum age setting are automatically deleted. |
| -MessageTrackingLogSubjectLoggingEnabled |
Enables or disables storing message subjects in the log.
- Subject logging is enabled by default.
- Message logs store only details about the message (sender, recipient, date,
etc.) and not the message contents. For increased security, you might want to
disable storing message subjects in the log.
|
Message tracking logs contain details about each message that is processed by
the server. The log is a text file in comma separated value (CSV) format.
Information about each message that is recorded in the log includes:
- The recipient and sender e-mail address.
- Client (sending device) hostname and IP address.
- Destination server hostname and IP address.
- The message subject (if subject logging is enabled).
- An EventID. The EventID identifies the action taken on the message. Events
are:
- BADMAIL is a message submitted by the Pickup or Replay directories that
can't be delivered.
- DELIVER identifies a message delivered to a mailbox.
- SEND identifies a message sent to another server using SMTP.
- SUBMIT identifies a message submitted by a Mailbox server to a Hub Transport
or Edge Transport server. This is the only event type you will see on a Mailbox
server.
- RECEIVE identifies a message when it is put into the database (a queue).
- RESOLVE identifies that the message recipient address was modified after
performing an Active Directory lookup.
- REDIRECT identifies that the message was redirected to a different recipient
after performing an Active Directory lookup.
- EXPAND identifies that recipient information was modified by expanding
distribution group membership.
- TRANSFER identifies a message whose recipients have been modified based on
forked delivery.
- FAIL identifies messages that could not be delivered.
- DSN identifies messages that generated a delivery status notification.
- POISONMESSAGE identifies a message moved into or out of the poison queue.
- A reference field. The reference field has additional data for messages with
the DSN, SEND, or TRANSFER event IDs.
- Time and date of processing. The timestamp is in universal time code (UTC)
format.
- The MessageID and InternalMessageID.
You can view messages in the tracking logs through the Management Console
using the Message Tracking option in the Toolbox or by using the
Get-MessageTrackingLog cmdlet.
- -Sender returns message tracking log entries with the specified
sender's SMTP e-mail address.
- -Recipients returns any message tracking log entries with the
specified recipient's SMTP e-mail addresses.
- -DomainController searches for the domain controller used to make
changes to Active Directory, it does not identify the server whose logs you want
to search.
- -Reference searches messages on the reference field which allows for
searching on attributes such as the Internal-Message-ID or the
Internet-Message-ID.
- -MessageSubject searches for messages with the specified text in the
subject line.
By using the
Get-MessageTrackingLog cmdlet, you can view all messages
in the log or filter on the following criteria:
- Recipient and/or Sender
- Server
- EventID and Reference
- MessageID and/or InternalMessageID
- Subject
- Start and/or End time
Tip: When using the command shell, use
> "filename" to save
results to a file. For example, the following command searches the message log
for all messages with a DSN event, formats the information to include the sender
and the recipient, and saves the results to a file:
Get-MessageTrackingLog -EventId "DSN" | Format-List
Send*,Receive* > "C:\dsnMessages.txt"
Troubleshooting Mail Delivery
As you troubleshoot problems in mail delivery, use the following process to
identify and correct the problem:
- Use one of the following tools to identify where mail delivery has failed:
- Use the Mail Flow Troubleshooter tool to automatically analyze data,
identify potential problems, and suggest possible fixes.
- Use the Queue Viewer on a transport server to check the messages in the
queue. Look for messages with a status of Retry. Also look for messages in the
Unreachable queue.
- If you can identify a transport server where messages are stopping, run the
Test-ServiceHealth cmdlet to verify that all necessary services are
running on that server.
- Verify the configuration of all connectors. Make sure that source servers on
Send connectors are listed correctly.
- Check the Application Log in Event Viewer for any messages indicating an
error.
- For Exchange-related Resource Manager errors:
- Verify that the server has sufficient disk space for the message queues (4
GB for Exchange 2007 RTM and 500 MB for SP1).
- Check the memory utilization percentages to verify that the
EdgeTransport.exe process has sufficient memory (less than 75% utilization) and
that the overall system memory is adequate (less than 94% utilization).
Be aware that if resource utilization is high, mail flow can stop.
- Check the non-delivery report (NDR) for delivery status notification (DSN)
codes. These codes often indicate the server that reported the problem, as well
as a description of the problem. For example, the DSN code might indicate that
the destination SMTP server is unavailable, or that the recipient is unknown.
- Verify the recipient information in Active Directory.
- Verify that the global catalog information for the recipient matches the
recipient information in the message, and that the global catalog server can be
contacted.
Message Routing Facts
When troubleshooting mail delivery, it's important to understand that
messages will be queued at the point of message delivery failure. By
understanding the path the message will take, you can examine the delivery
queues on transport servers to identify potential sources of failure. When you
find the message waiting in a queue, you can troubleshoot delivery between that
server and the next hop. Exchange uses the following process to deliver
mail:
- The user creates a mail message. The Mailbox server handles the message and
submits it to the Submission queue on a Hub Transport server located in the same
Active Directory site as the Mailbox server.
- The Hub Transport server performs categorization on the messages in
the Submission queue.
- Recipient resolution identifies the recipient location.
- Routing identifies a delivery path to the recipient. Based on the
routing path, a next hop destination is identified. The next hop location could
be one of the following:
- A Mailbox server in the same site as the Hub Transport server.
- A source server for a connector located in the same Active Directory site.
This includes Edge Transport servers subscribed to the site.
- A remote Active Directory site. If the recipient is located in a remote
Active Directory site, or if the source server for a connector is in a remote
site, the next hop will be one of the following:
- If the Active Directory site link topology to the remote site includes a hub
site with a Hub Transport server, the next hop will be the first hub site in the
path.
- If the message has multiple recipients in multiple sites, the next hop will
be the last shared site in the path. Message bifurcation (or splitting) will
then be performed by a Hub Transport server in that site.
- If a hub site doesn't exist or if message splitting is not required, the
next hop will be the remote Active Directory site where the recipient or
connector source server is located.
- A remote SMTP domain name or smart host.
- If the Transport Rule agent is enabled on the server, Transport Rules are
applied to the message.
- If Transport Rules allow message delivery, the Hub Transport server takes
one of the following actions:
- If the recipient cannot be identified, the message is placed in the
Unreachable queue.
- If the next hop is a Mailbox server located in the same Active Directory
site, the message is placed in the Mailbox Delivery queue for delivery to the
Mailbox server.
- If the next hop is a Hub Transport or Edge Transport server in the same
Active Directory site, the message is placed in that server's Submission queue.
The receiving server starts at Step 2, performs categorization, and queues the
message for further delivery.
- If the next hop is a remote Active Directory site, remote SMTP domain name,
or smart host, the message is placed in the Remote Delivery queue that
corresponds to the destination.
- With the message placed in the appropriate queue on the Hub Transport
server, the server attempts delivery to the next hop location.
- Messages in the Unreachable queue remain until they expire (and are
deleted automatically) or until an administrator resubmits the message.
Resubmitting repeats the categorization process (see Step 2). If the recipient
is still unreachable, the message will end up back in the Unreachable queue.
- Messages in the Mailbox Delivery queue are delivered to the local Mailbox
server and eventually forwarded to the recipient.
- Messages in the Remote Delivery queue are sent to one of the following:
- If the destination is an Active Directory site, the message is sent to a Hub
Transport server in that site. The receiving server starts at Step 2, performing
categorization and then placing the message in the appropriate queue for
delivery.
- If the destination is a remote SMTP domain, the server uses DNS to locate an
MX record for the remote domain. The message is forwarded to the remote mail
server for the domain.
- If the destination is a smart host, the message is forwarded to the smart
host.
- If a Hub Transport server in a remote site cannot be contacted, Exchange
uses the Active Directory site topology to see if there are any additional sites
with Hub Transport servers in the path to the destination. If there are, the
message will be delivered to the site closest to the destination site. The
message is placed in the Submission queue of a Hub Transport server at the
intermediary site, where it undergoes categorization and placement in a delivery
queue. The message will remain in the delivery queue until a Hub Transport
server in the destination site responds.
The following example examines mail flow in a sample network. The Active
Directory site topology is shown in the following graphic:
Be aware of the following in this example:
- There is a Hub Transport server in each site except for Site E.
- Site C is designated as a hub site.
- The Edge Transport server is subscribed to Site F. It is configured to use
DNS records for delivery of external mail.
- The Transport Rule agent is enabled only on the Hub Transport server in Site
C, and the Edge Rule agent is enabled on the Edge Transport server.
- Site F is currently inaccessible.
The following process takes place when a message is sent from Site A to a
recipient in an external domain:
- A user creates the message. The local Mailbox server sends the message to
the Hub Transport server in Site A (Hub1) where it is placed in the Submission
queue.
- The Hub Transport server performs categorization.
- It identifies that the recipient is an external recipient, reachable through
a Send connector.
- The message needs to eventually reach the Edge Transport server in Site F.
- Exchange analyzes the Active Directory topology. Because the site link path
to Site F includes a hub site, the hub site (Site C) is chosen as the next hop.
- Because the Transport Rule agent is not enabled on Hub1, no Transport Rules
are applied.
- The message is placed in the Remote Delivery queue on Hub1 with a next hop
of Site C.
- The message is delivered to the Submission queue on a Hub Transport server
in Site C (Hub3).
- The Hub Transport server in Site C performs categorization:
- It identifies that the recipient is an external recipient, reachable through
a Send connector.
- The message needs to eventually reach the Edge Transport server in Site F.
- Exchange analyzes the Active Directory topology. Because the remaining path
does not include a hub site, Site F is chosen as the next hop.
- The Transport Rule agent is enabled on Hub3. Transport Rules are applied to
the message.
- Transport Rules allow for message delivery, so the message is placed in the
Remote Delivery queue on Hub3 with a next hop of Site F.
- Delivery is attempted to Site F. Because the site is currently unavailable,
the Hub3 steps backwards through the site link topology. Although Site E is the
next closest site, that site does not include a Hub Transport server. Site D is
the next closest site with a Hub Transport server. The message is queued for
delivery to Site D.
- The message is delivered to the Submission queue on the Hub Transport server
in Site D (Hub4).
- The Hub Transport server in Site D performs categorization:
- It identifies that the recipient is an external recipient, reachable through
a Send connector.
- The message needs to eventually reach the Edge Transport server in Site F.
- Exchange analyzes the Active Directory topology. Because the remaining path
does not include a hub site, Site F is chosen as the next hop.
- Because the Transport Rule agent is not enabled on Hub4, no Transport Rules
are applied.
- The message is placed in the Remote Delivery queue on Hub4 with a next hop
of Site F. If message delivery fails, the Hub Transport server continues to try
because there are no more sites in the path that contain a Hub Transport server.
- Once communication to Site F is restored, the message is delivered to the
Submission queue on a Hub Transport server in Site F (Hub5).
- The Hub Transport server in Site F performs categorization:
- It identifies that the recipient is an external recipient, reachable through
a Send connector.
- The subscription to the Edge Transport server (Edge1) is a source server for
the Send connector. Because the Edge1 is in the same Active Directory site, it
is the next hop.
- Because the Transport Rule agent is not enabled on Hub5, no Transport Rules
are applied.
- The message is placed in the Submission queue on the Edge Transport server
(Edge1).
- The Edge Transport server performs categorization.
- The destination recipient is reachable through the external Send connector.
- Because the Edge Transport server is a source server for the connector, it
will forward the message to the destination.
- Because the Edge Rule agent is enabled on Edge1, Transport Rules are
applied.
- Transport Rules allow for message delivery. Because the Send connector uses
DNS for message delivery, DNS is queried to locate an MX record for the remote
SMTP domain. The message is placed in the Remote Delivery queue on Edge1 with
the remote mail server as the destination.
- The message is delivered to the remote mail server and eventually to the
recipient.
Chapter #10
Administrative Permissions
Administrative Permissions
As you study this section, answer the following questions:
- What permission assignment could you give to a consultant who needs to
review (but not alter) your Exchange organization?
- In addition to Exchange Server Administrator, what other permissions must a
user have to install a server role?
- Which administrative role would you assign to a user responsible for
creating new mailbox users?
- Which role should a user have who is responsible for monitoring mail queues?
- Which role is assigned automatically when you assign someone to the Exchange
Server Administrator role?
- What additional permissions are typically required by an Exchange Server
Administrator? What additional permissions might an Exchange Recipient
Administrator need?
After finishing this section, you should be able to complete the following
tasks:
- Assign necessary administrative permissions.
Administrative Permission Facts
Using the predefined Exchange administrator roles lets you easily assign
permissions to users based on administrative tasks. When you install Exchange,
Exchange-specific attributes are added to Active Directory. Assigning an
Exchange role to a user gives that user the ability to manage the Exchange
attributes included within the job role. Exchange administrator roles have
permissions to manage the following types of data in both Exchange and in Active
Directory:
- Global data is data in an Active Directory configuration container
that is not associated with a particular server. Global data generally affects
the whole organization, so best practice dictates that only a few trusted users
are allowed to configure or change global data. Global data includes data such
as mailbox policies, address lists, and Exchange Unified Messaging
configuration.
- Server data is contained in Active Directory under the specified
server’s node. Examples of server data include Receive connectors, virtual
directories, per-server settings, and mailbox and storage group data.
- Recipient data consists of Active Directory objects that can receive
or send e-mail messages. Examples of recipient data include user accounts,
contacts, and distribution groups.
Notice that the Exchange Management Console organizes all tasks within one of
three nodes, with each node designating both the type of data and the Exchange
role necessary to perform management tasks for objects beneath that node:
| Organization Configuration |
Global data |
Exchange Organization Administrator |
| Server Configuration |
Server data |
Exchange Server Administrator +
Local Administrator for the
server |
| Recipient Configuration |
Recipient data |
Exchange Recipient Administrator |
Using a decentralized approach to administration, you assign users to
specific roles based on the configuration tasks they need to perform. As a
general rule, when deciding what permissions are required for specific tasks,
identify the type of data that needs to be managed and then match that to the
administrative role.
The following table outlines the types of tasks that can be performed with
the standard administrative roles:
| Exchange View-Only Administrator |
Those with Exchange View-Only Administrator permissions can view all objects
and their properties and have read-only access to domain containers that house
Exchange recipients.
- This role generally allows the user to run most Get- cmdlets that
involve reading properties from Active Directory objects.
- The role does not grant permission to read configuration information
stored only on the server and not in Active Directory.
- The role does not grant permission to view messages held in
mailboxes, messages held in queues, or information stored in transport logs.
- The role does not grant permission to run any Get- command on
an Edge Transport server. This is because configuration information for an Edge
Transport server is not stored in Active Directory.
- The role does not grant permission to run many of the Get-
commands that show organization-wide Exchange settings (such as edge
subscription or site information).
|
| Exchange Recipient Administrator |
Exchange Recipient Administrators have permissions to manage Exchange
attributes on recipient objects in Active Directory. This includes:
- Using Set- commands to change Exchange attributes for users, groups,
and contacts (this includes setting mailbox settings that are stored in Active
Directory as properties of the user or contact object)
- Enabling or disabling mailboxes, mail users, mail contacts, and distribution
groups
- Connecting mailboxes to existing users
- Modifying dynamic group membership criteria
- Setting client access options for recipients (Set-CASMailbox)
- Managing public folder settings
- Updating Safe List Aggregation information (Update-SafeList)
Note: The Exchange Recipient Administrators group is a member of the
Exchange View-Only Administrators group. This means that recipient
administrators have all of the permissions assigned to view-only administrators.
|
Exchange Recipient Administrator
and
Account Operator role for the
applicable Active Directory containers |
Having only the Exchange Recipient Administrator role does not give
permissions to create new Active Directory objects or modify non-Exchange
attributes for objects. To perform these tasks, the Exchange Recipient
Administrator must also have the Account Operator role for the applicable Active
Directory containers where the Active Directory objects are located. This
additional permission is required when doing the following:
- Creating new user accounts, contacts, or groups (such as when using the
New- commands to create mailboxes, mail users, mail contacts, or
distribution groups)
- Removing mailboxes, mail users, mail contacts, or distribution groups (using
the Remove- commands deletes the Active Directory object)
- Modifying distribution group membership (group membership is a non-Exchange
attribute of the Active Directory object)
- Running Set-User, Set-Contact, and Set-Group (these
commands operate on the Active Directory object and not just the Exchange
attributes)
|
Exchange Server Administrator
and
Membership in the local
Administrators group for the target server |
Server configuration information is stored both in Active Directory as a
property of the server object and on the server itself. For this reason, users
who manage the server typically need the following permissions:
- Membership in the Exchange Server Administrator role grants the ability to
manage server properties in Active Directory.
- Membership in the local Administrators group for the server grants the
ability to manage settings on the server.
- Membership in the Exchange View-Only Administrator role grants the ability
to read properties from additional Active Directory objects. Note: When
you assign a user to the Exchange Server Administrator role, the user is
automatically assigned to the Exchange View-Only Administrator role.
Server administrators with the necessary local Administrators
membership can install Exchange on the server and perform the following tasks:
- On Mailbox servers: manage storage group and database settings, configure
replication, manage public folders, manage messages, and import and export
mailboxes.
- On Client Access servers: configure MAPI, IMAP, and POP protocols; configure
virtual directories (i.e. Autodiscover, OWA, OAB, and ActiveSync).
- On Hub Transport servers: manage queues, configure spam filters (such as
connection, recipient, and sender filters), create Receive and Foreign
connectors, and manage transport agents.
- On Unified Messaging servers: manage the custom prompts.
Get- commands that read data from the server and not from
Active Directory require that you have the Exchange Server Administrator role to
run the commands. Examples of Get- cmdlets that require this role
include:
- Get-Message
- Get-Queue
- Get-IPAllowListEntry, Get-IPAllowListProvider,
Get-IPBlockListProvidersConfig
|
| Membership in the local Administrators group for the target server |
Management tasks performed on an Edge Transport server require only
membership in the local Administrators group. The Exchange Server Administrator
role does not apply to Edge Transport servers because these servers are not
members of the Active Directory domain. |
Exchange Server Administrator,
Membership in the local Administrators
group for the server,
Exchange Recipient Administrator |
Moving a mailbox affects the mailbox stored in the mailbox database on the
server as well as configuration information for the mailbox stored in Active
Directory as a property of the user object. For this reason, moving a mailbox
requires permissions on the source and target server and the recipient object.
|
| Exchange Organization Administrator |
The Exchange Organization Administrator has permissions to manage all
Exchange objects and properties. This includes all recipients and all Exchange
servers. The Exchange Organization Administrator role is required to perform the
following tasks:
- Designating Exchange administrators
- Creating the Exchange organization and installing the first Exchange server
- Managing address lists, default and custom folders, and folder mailbox
policies (assigning a policy to a user requires only the Exchange Recipient
Administrator role)
- Managing the Offline Address Book
- Creating ActiveSync policies (assigning a policy to a user requires only the
Exchange Recipient Administrator role)
- Setting accepted domains, e-mail address policies
- Configuring transport rules and journaling
- Managing Edge subscriptions and Send connectors
- Managing Unified Messaging policies
The Exchange Organization
Administrator role is also required to run the following Get- commands:
- Get-AdSite, Get-AdSiteLink
- Get-MailboxCalendarSettings
|
No comments:
Post a Comment