LEARN EXCHANGE TROUBLESHOOTING

Exchange TOPICS


1) Introduction to Exchange 2000: It comes with 2 versions Std and enterprise.
2) Pre-requites to install Exchange-IIS services ( NNTP SMTP WWW services )
Active directory should be installed.
Healthy DNS.
Forest prep: Schema admin and Enterprise admin.
Add specific attributes and classes.

Domain prep: Domain admin and local admin
Creates MESO container in ADUC and creates two groups: EES and EDS.
To install additional exchange server in same domain no need to run forest prep, we can run domain prep.

Exchange services: Microsoft exchange System Attendant.-
Information store
MTA Stacks.
Pop3
Management
Routing engine
Imap4
Site replication service
Exchange Event service.


Database: EDB and STM

Stores Not Mounting: 1) Check if the exchange services are running.
3) If services are not running-Dcdiag, netdiag, check or force replication, DNS configuration, Nslookup. Check event id’s in application log..
4) If Services are running properly-check the consistency of the database by eseutil /mh “path of database” If log files are present.
5) Check for sequence and health eseutil /ml “path of database” with E00 log prefix we can check the health from start.
6) Now commit the log files manually-eseutil /r e00 /L “path of log file” /d “path of the database file” /s “path of the system path file or check pt file” Known as SOFT RECOVERY.
7) If log files are not present ask for recent good backup….
Types of back up.
1) Online 2) offline.
1) Online backup-are divided into three
a) Full-copies edb+stm+log files and it will purge the committed log files.
b) Incremental backup-Backs up log files from last full or last incremental backup. It will purge the committed log files.
C) Differential Backup- will back up from last full and last incremental back up.
2) OFFLINE backup-Flat file copy stores dismounted.
8) If there is a back up restore the back up-While restore it creates restore.env file to the TEMP location given. We need to check the sequence of the log files. The last log file in temp-should be in sequence with the first log file in original location of the database.
9) To see the contents of the restore.env file
Eseutil /cm”path of restore.env”
10) to commit these log files Eseutil /cc “path of restore.env”

11) If there is no backup-Make sure we have a Flat file copy of the database to another location.
Run the following command Eseutil /P ”path of the edb” It remove the corrupt log files. Runs at 4-5 gb/hr. Requires 25% GB of free space.

12) Offline defrag-Eseutil /d “path of edb file”
Required 110% free space. Cerates Temp files.
/T=redirect output of temp location.
After the command successfully temp location is deleted.
13) Run ISINTEG –s -fix –test All Tests. Runs at 10 gb/hr. Log signature and Database signature changes. It deletes the pointers.
14) Check for Antii-virus.





Recovery server
Used to recover one or more emails or mailboxes- exchange 2000 only.

To recover in the same production environment for emails and mailboxes we need too dismount the store and the downtime is long. So we cerate a recovery server.
ORG name and Ag name should be same
Storage group should be same with mailboxstore.
We need to have a good recent backup.
We can u se find /I “o” and “ou” to check for Ag and org name.
We can use the legacy Dn tool in recovery server to change the Ag and ORG name.

Recover an EMAIL-restore the backup, Mount the stores and Create the user whose mailboxes need to recover. Reconnect the mailboxes
Run Exmerge and Export the PST of the user to the production environment. Give send as and receive as permission. Breaks the SIS(Single instance Storage)


Now Use Exmerge in the production environment to import the user Pst and connect the mailbox. Mount the database.
We can also use MBCONN from Exchange cd.. and connect mailboxes and create users using LDIFDE –I –f c:\temp.txt. path of the filename.


Disaster Recovery

Can be done if we have the recent good backup.
· Dc should have complete information about the exchange server in the schema partition.

PROCEDURE-

· Need to have exchange container in the ADSI edit.
· Make sure new exchange server should have same drive letter and partition for database and log location.
· Join new hardware to network with same hostname.
· Make sure the OS version and sp’s are same.
· IIS and Pre-requities for exchange
· Install setup /disaster recovery
· No need for domainprep but in some scenarios we might need to run.
· Restore the back up
· Mount the database(do not mount the database at startup should not be checked mailbox properties)
· If the error message same hostname exists in the network we need to reset the computer account in ADUC.





16-GB Limit
Eventid-1112 and 445

· Applies to STD edition of exchange 2000

Online Maintenance-mailbox properties-database Tab.

It will cleanup emails and mailboxes.
Runs on a schedule
Recommended not run Online Maint. With backup because it will terminate the Online maintenance.

Track online maintenance-eventid: 700-starting.
1221-in process
701-finish
It creates whitespaces.

PROCEDURE:

1) Increase the database size by 1gb bby following registry key-HKLM/CCS/Services/Msexchnage /private information store
Create TempDatabaseSizelimitExtension
Look for Event Id-9657.

2) Stop the SMTP SVC.
3) Delete unwanted emails
4) Mount the stores
5) Set retention limit as Zero.
6) Force Online maintenance
7) Offline defrag (stores dismount)
8) Mount the stores and start SMTP service.
9) Delete the registry key.









Exchange and Antivirus

1. Anti-virus should be exchange aware
2. Integrates with exchange information store service because of mail flow.
3. In registry- HKLM/CCS/Services/Msexchnage /private information store look for performance key virusscan-1 and background scanning-0.
4. Folders need to be excluded during the scan-
A) exchange folder
B) database folder
C) log files
D) Inetsrv folder.









Outlook and OWA

Cached mode-Existing emails and Gal can be accessed even after user is offline
In cached mode file name .OST gets created and has the caching of the existing emails
OAB provides data of Gal in the offline mode.

Non-cached mode- Online mode where the client has to be connected to server in order to access Gal and mails


OWA-Outlook Web access interface for Non-mapi clients to access emails.














PUBLIC FOLDER

1. Every user who has mailbox can access public folder and also create by default.

2. We cab cerate public folder from ESM and Outlook


3. Public folder tree is called a MAPI tree.

4. In an Org. can have only one MAPI tree.


5. Relation of public store to Mapi tree is 1-1

6. We can create Non-mapi Tree from IIS known as virtual directory and can access OWA for Non-mapi tree.


7. The Path of the Public folder tree is always called top-level hierarchy

8. By default in E2k all PF’s are mail enabled.
And in E2k3 are mail disabled.

9. Database is divided into IPM SUB TREE and NON-IPM SUBTREE.
10. IPM tree Is called MAPI tree and NON-MAPI IPM TREE- known as system folders(Right click on PF)


11. Replicas and ghosted folders- the TLH is replicated to all stores in the hierarchy

12. Public folder replication-4 types.
Hierarchy replication-
b) Content replication
c) Backfill replication
d) Status replication


TROUBLESHOOTING

1. Check mail flow- at source and destination server.
2. Determine the proxyaddress on the public folder adsiedit

3. Increase diagnostic logging-right click server properties on public folder replication messages-

1
Replication AD Updates
2
Replication Incoming Messages
3
Replication Outgoing Messages
4
Non-Delivery Reports
5
Replication Backfill
6
Replication General
On source and destination server

4. Enable message tracking to track messages-on source and destination.

5. Check if t he messages are stuck in local delivery que we need to change the registry key-hklm/system/ccs/services/exchange transport/create a key name parameters and Dword SkipPublicMDBRestriction.


6. stop anti-virus services

7. Check weather old files are replicating or not. If not modify the old items.


8. Tools-PFDAVADMIN-checks- Item level permission, checks and fixes DACL issues, calendar permissions, recover deleted folder, sets limits on folder.











Recipient Update Service


1) Recipient Policies: defines email address which is supposed to be stamped bases on ladap filter
We can have only one primary SMTP and can have multiple secondary SMTP.

When new policy is created the lowest no. has the highest priority.

Attribute- Purporated search: is equal to LDAP filter.

Address List- Logical grouping of the exchange recipients.

ShowIn Addressbook: Attribute defines which objects appear on which address list. Helps to resolve name for MAPI clients.

HomeMDb-Dn of mailbox store to which a particular user belongs.

MsExchhomeservername: gives the dn of the object belongs to which server.








COMMON FAILURES:

3RD Party proxy address
Insufficient permissions for object (policy test)
Incorrect configuration DNS.
Duplicate names in active directory.
Rus running on a front end server.
Incorrect configured recipient policy,


Troubleshooting:

Check Rus configuration-Pointing to t he right Dc and exchange server.

Take ldp dump.
Increase diagnostic logging.event id:8011 and 8012.
Source Msexhcange al and SA.

MSexchangepolicies included-stamps obectguid
Check proxyaddress attribute
USN changed<>\Private-

Dword value- Database Size Limit in GB

Check the timing of the database size-runs at 24hrs interval.

Set early warnings prior to reaching the DB size by default 10% threshold,


Warningbuffer-will dismount the database as per size
Set in registry.

Eventid:1216 checks the increase in the DB
9685 database has mounted and physical size has increased.






DIRECTORY ACCESS


-component of exchange which provides information regarding domain controllers and gc servers.

-has three components
Dsaccess and dsproxy
Categorizer

Dsaccess- discovers topology within and environment.
When SA starts the process is performed automatically.

Dsaccess fires again every subsequent 15 mins.

Configuration dc- it reinstates in 8 hrs. If the Dc is failed dsaccess will choose the next reliable dc and will ping the fail dc and it will reinstate tht Dc in next 8 hrs.

NSPI Proxy- client sends requests to the exchange server and then it is passed to gc for the first time and next time when the client sends requests it has local cache of the gc so it will contact directly to the GC. So exchange acts as proxy for the GC outlook sr1

TROUBLESHOOTING:

· Increase diagnostic logging check event id: 2080

Server Name Actual server name

Roles Displays the AD role (G – Global Catalog, D – Domain Controller, C – Config DC)

Reachability Ports reachable via TCP/IP (0x1 – GC port 3268, 0x2 – DC port 389, 0x4 – Config DC port 389, 0x7 – All 3)

Synchronized Indicates whether the “isSynchronized” flag is set to TRUE (same bit flags used in Reachability)

GC Capable Indicates whether the server is a Global Catalog server (0 – False, 1 – True)
PDC Indicates whether the server is a PDC Emulator for its domain (0 – False, 1 – True)

SACL Right Indicates whether DSAccess has permissions to read the Security Access Control List (SACL) for the Configuration naming context (0 – False, 1 – True)

Critical Data Indicates whether DSAccess found this Exchange server in configuration container (0 – False, 1 – True)

NetLogon Indicates whether the server is running the NetLogon service (same bit flags used in Reachability)

OSVersion Indicates whether the server is at least Windows 2000 SP3 or Windows Server 2003

· Ping each reported server
· Use ldp dump
· Nslookup
· Check cpu usage
· Policytest
· Dcdiag /v
· Check Ad configuration.









OFFLINE ADDDRESS BOOK

Usres can work offline and can connect to exchange server and download the offline address list to obtain information abt the other users in OAB.

It cannot filter.It contains default address list which represents the Default Gal.

By default runs at 5.00 Am
Files are compressed before they are addd in system folders so that the outlook download is minimal.

System Attendant is is responsible to generate the OAbgen.dll file.(MAPI application Via NSPI)

OABGen.dll creates- version2 3a and 4
It also generates incremental offline address book.

Files are in .OAb format

OAB should be populated in mailbox properties.
Attribute-MSexchangeuseOAB

Rus Should Stamp the “Showinaddressbook” so object wwould be visible in Gal.

Version-2 ANSI format, 3a-unicode, 4-E2k3 SP2-compress the files for more minimal download.
Unable to download OAB. 0x80040104

Check topology
Check services
Check OAB is defined on the mailbox store
Increase diagnostic logging
Rebuild OAB
Check error in outlook whn user is in cached mode.





Recovery storage group

Ground rules: e2k+sp3 or higher
Same Ag
If the MBS is already added to RSg then next store will be from the same SG.

Recover mail items for a user
Information store automatically redirects all restore operations to RSG. Event id: 9635

When mauilbox store is added in RSG look for “msexchangeorigmdb” on MBS of RSg it will have the Dn of the production Mailbox store which tells which mailbox to merge.



Dial tone

Create RSg and Add MBS

Copy Edb and Stm file in RSG folder 50 gb

So now we have t he blank database

Run the repair on the corrupted Database.48 gb

Swap the Edb and Stm files or change the path “meexchedbfile” and msexchslvfile” in adsiedit
Then run exmerge to recover remaining 1 gb by connecting the mailbox or just right click exchange tasks-SP3

-reduces downtime
Override registry for RSG. So restore will go directly to production.
– HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
– Create a DWORD value named “Recovery SG Override” and set its data value to 1.















UPGRADING TO 2003

W2k------ e2k
W2k------E2k3
W2k3xxxxxx e2k
Before upgrade
We need to run adprep /forestprep in a DC
Adprep /domainprep
It will update active directory.

Again run forestprep and domain prep to install exchange 2003.

How do Exchange Server rules work?

You've been using Outlook for years now and you've probably established some delivery rules for yourself. Maybe mail from your manager is automatically routed to a subfolder of your inbox. If you're using Outlook 2003 or later, you've got an automatically maintained rule to handle junk mail. If you've ever set your Out Of Office, that's handled by a rule too.

But how do rules actually work? What's the implementation like? Obviously, I won't get into the grimy details (trade secrets and all), but I can pass along the basics.

First, the rules infrastructure is fully documented on MSDN. Those among you brave enough to explore this documentation may be inspired to write a little app which will enumerate your inbox rules and print them out on the console for detailed inspection of just what Outlook creates. I wrote such an app for internal diagnostic purposes (which means I most likely can't share it with you, sorry). Oh wait! Someone else has already published something here!

A rule consists of two fundamental properties, and a bunch of other support properties which mostly won't matter for this discussion. The important ones are the rule's conditions, and the rule's actions. Simplistically, if the incoming mail passes the restriction, the rule engine subsequently carries out the actions. The rule engine itself is completely agnostic to the intentions of the rule creator. In other words, the rule engine doesn't care what the title of the rule type in Outlook's wizard is – it only applies the restriction and then if that passes, it carries out the actions.

The conditions are expressed as a MAPI Restriction. As each mail is delivered, the restriction on each rule is applied to the incoming message. The restriction describes a complex property value comparison tree, such as (the received time > somedatetime AND the sender's display name starts with "Bob" AND the body contains "Loser") OR (the message size is greater than 2k). Such restrictions are also used for searching for messages, filtering views, and so on. In this case, the restriction is applied to the incoming message. This means that rules cannot check against dynamic values, such as the current system time or how big the mailbox is. It's constrained to checking properties of the message against constant values. One exception to this is how the Junk Mail rule works, which I'll describe later.

Outlook has a variety of pre-canned restrictions that it uses and I won't go into the exact nature of each one (yes, I know, you're just burning to know what the precise nature of each of these is, but you can use the sample app I linked to above to study the precise nature of each of the rule types). I will point out an important design point though: rules which are of the form "FROM some DISTRIBUTION GROUP" actually means "if the sender is a direct or indirect member of that DL". This often confuses people because they create a rule like "mail from , move to the folder". What ends up happening is all mail from anyone on the "my team DL" starts having their mail moved to that folder. If you think about it, it makes complete sense. However, more often than not, folks really wanted the rule "mail SENT TO , move it".

If the message meets the restriction criteria, the actions are then carried out. While Outlook rarely creates rules with multiple actions within, it's possible to have a list of actions on one rule. The possible actions are:

• Move the message to another folder*
• Copy the message to another folder*
• Reply to the message (with a given template message)
• Send an "Out Of Office" reply (with a given template message)
• Fail delivery with a specific error code
• Forward the message to another address
• Delegate the message to another address (a lot like forward, but it preserves original sender info)
• Tag the message with a specific property value
• Permanently delete the message (Outlook doesn't use this when you create a rule with a delete action. Instead, it creates a MOVE action with the Deleted Items as the destination folder)
• Mark the message as read
• And finally, the big one: defer to the client to carry out client-defined actions.

The asterisk on Move and Copy refers to what to do if the server can't reach the destination database. In this case, the server turns it into a "defer to client" action where it specifies to the client a) the move or copy action and b) the destination that should be used. As you can see, the server itself is pretty constrained on the kinds of things it can do, yet Outlook offers all these wonderful actions that can be carried out. This is accomplished via the "deferred" action. The client stores in the action any relevant data it needs and the server will later notify the client that it needs to carry out a deferred action on a message, and includes whatever the client stored in the rule (such as, perhaps, the WAV data for the sound to play, for example).

Because a single rule could have conflicting actions, or even because multiple rules that may apply to the message could have conflicting actions, the server pulls off trickery to make sure everything happens correctly. For example, you may have two MOVE rules which apply to a message. You can't move a message to two different folders at once, yet that's the end result (the server treats subsequent MOVEs as if they were COPYs instead).

Exchange Server rules are only executed during delivery. Outlook provides a "Run Rules Now" feature, but that's implemented entirely by Outlook. The server is not involved. Also, realize that server rules are not ever executed after delivery is complete. If you witness spontaneous changes happening to your inbox, this is either Outlook carrying out deferred actions, or someone else logged into your mailbox is changing things under your feet.

What about the Junk Mail Rule? How does it adjust itself based on the administrator's configuration of the move action threshold? The administrator's configuration lives in Active Directory, so how could the rule dynamically retrieve this value for comparison against the Spam Confidence Level value stamped on all incoming messages? Well, there's a one-off cheat just for this. The rule itself is crafted to compare the Spam Confidence Level against the constant value -1. The rule execution engine pre-scans the restriction, looking for this specific comparison. If it finds it, it replaces the constant -1 with the current value in Active Directory, and then the restriction is applied to the incoming mail.

You may be thinking: "but what about two mailboxes, each with a reply rule that replies to the other mailbox? Won't that cause a mail storm?" Well, ordinarily, yes. However, our rules engine is smarter than that. As a rule is triggered on a message, the rule's ID is stamped into an ever-growing property of "I've already run this rule" history. Therefore, if a message "comes back", the rules engine can check to see if any particular rule is in this rule history and avoid running it again. So, if mbx1 sends mail to mbx2, which autoreplies back to mbx1, which autoreplies back to mbx2, the rules engine will detect the loop and not execute the rule that would otherwise cause another autoreply back to mbx1.

Forgot to mention subject line on an official mail??? We can avoid it.

If you want to avoid sending official mails with out a subject please perform the following steps:

1. Open your outlook

2. Press Alt+F11. This opens the Visual Basic editor

3. On the Left Pane, one can see "Microsoft Outlook Objects" or "Project1", expand this. Now one can see the "ThisOutLookSession".

4. Double click on "ThisOutLookSession". It will open up a code pane.

5. Copy and Paste the following code in the right pane. (Code Pane)

=============================================================================================

Private Sub Application_ItemSend(ByVal Item As Object, Cancel As Boolean)

Dim strSubject As String

strSubject = Item.Subject

If Len(Trim(strSubject)) = 0 Then

Prompt$ = "Subject is Empty. Are you sure you want to send the Mail?"

If MsgBox(Prompt$, vbYesNo + vbQuestion + vbMsgBoxSetForeground, "Check for Subject") = vbNo Then

Cancel = True

End If

End If

End Sub

=============================================================================================

6. Save this and now close the VB Code editor.

From now on, this macro will make sure you do not make the mistake of sending a mail without a subject line .

Cheers

In this blog space you will find various issues i faced as an exchange administrator and what i did to resolve the same