Important Notes

Uninstall Exchange
Exchange can be uninstalled through GUI and Add/Remove. Before uninstalling Exchange, the following needs to be done:
1. We should move the mailbox to other server
2. Sometime there could be mailboxes left in ADUC or there could be some orphan entries, in this case:
a. Run LDAP query to check these user entries by running the LDP command.

To manually remove the Exchange,
· Follow KB Article 260338 to remove registry entries
· Remove exchange reference from ADSIEDIT by following KB Article 833396, though this article is for E2K3, but the same follows for E2K as well/
· ldifde command can be used to export user accounts:
ldifde –d “distinguished name” –f


Single Instance Storage [SIS]

If the same email is sent to multiple recipient then only one instance of the data being sent to users. This saves the size of database instead of having multiple instances of data in the same database.


If mail is sent to users in 2 different storage groups then we have 2 instances of the same mail. If user deletes the mail, only then the pointer of that mail to that user gets deleted.

Defragmentation

Also known as Offline Defragmentation. The following command is used:
eseutil /d “path of the edb file”

the speed of Defragmentation is 4 to 5 GB per hour.


As shown in the above figure, two mails 4 and 5 get deleted as a result white spaces are created. Defragmentation removes these white spaces resulting in decreasing the size of the database.
Logical size of the database: the actual content present in the database that might or might not include the white spaces.
Physical size of the database: the actual size of database.
White spaces must be removed from the database to avoid db corruption. To check the white spaces in the database, the following command is used:
eseutil /ms “path of edb file”

Defrag requires free space equivalent to 110% of the database size. For example the size of database is 50 GB, then 55GB free hard drive space must be there to run the defrag utility. On completion of defrag, the isinteg command needs to be run which removes pointers from table entries that are already deleted.
Isinteg –s -fix –test alltests


EXMERGE Utility

· Helps in importing / exporting multiple PSTs
· Breaks SIS. Increases the database size. Need to consider the database size in standard version before importing PSTs.
· Exmerge knows which PST is related to which mailbox
· Users whose PST are imported must have mailbox connected to them
· Before running the Cleanup Agent, must check the retention limit or else if limit set to zero, then the mailbox will get deleted permanently.
· To run Exmerge, 2 permissions are required: “Send As” and “Receive As”. These permissions are given in mailbox store in which there are user mailboxes.
Mailbox store properties – Security Tab – Administrator account – check in permissions send as and receive as
· When permissions are grayed out, it means it is explicit permission coming from parent (inherited).

To see the snapshots of Exmerge utility, Click here

ExBPA Utility
· Analysis Exchange Infrastructure
· Highlights the problems
· Performs Health Check

MBCONN Utility
Reconnects multiple users and create multiple AD users
Helps in creating a txt file through which multiple users can be created in active directory using ldifde command.
Ldifde –I –f “path of the textfile.txt”

EXCHANGE AND ANTIVIRUS

Pre-requisites before installing antivirus:
Antivirus must be exchange aware
Email sent or received is passed through a smartserver. There is Spam fighting agents like antivirus that checks the email is valid or not. Antivirus installed on exchange server gets integrated with information store services [MSExchangeIS]. We can check the virus scan key under MSExchangeIS. The value of this key must be set to zero.
Antivirus must not scan exchange related folders like
Installation folder
Database
Log Files
Inetsrv folder (Contains IIS database)
PUBLIC FOLDERS

By default public folder store is created when exchange is installed
Public folders are used to publish common information at organisation level.
Two components of PF: Public Folder Store and Public Folder Tree
Public folders are email enabled.
By default, every user is able to see public folders and add information to it by posting a message or creating new folders.
A child public folder cannot be created by anyone else apart from the owner, unless permissions are given.
Anything created in public folder is a “POST”
Any folder created in Outlook or at server is only a PF Tree or structure, the content gets stored in the public folder store (database: pub1.edb and pub1.stm)
PF Tree is also called as MAPI tree as it can be accessed through Outlook
Each PF store has one associated PF Tree.
The default PF Tree is a MAPI Tree. MAPI Tree is unique to the organisation.
NON=MAPI Trees can be created and accessed through OWA
By default, Public Folders are hidden from GAL. To view the same:
Public Folder properties – Exchange Advanced Tab – Uncheck “Hide from Exchange Address List
There are 3 types of permissions in Public folder: Client Permission, Directory Rights and Administrative Rights
There are four major categories of roles in Client Permission: None, Owner, Author, Publisher, and Contributor. These roles can be set to users based on which they can edit, create or delete Public Folders. Permissions can also be set for users who should not have access to these folders.
Event ID: 1216 for standard edition and Event ID: 1217 for enterprise edition

REPLICATION OF PUBLIC FOLERS

Public Folder properties – Replication Tab – Add the second server – Apply – Ok [Replication starts between the two servers]. Users of the 1st server take a lot of time to access the content of the public folder in the second server and vice versa, to avoid this latency, replication is done.
Replication of Public Folders is scheduled with lowest priority.
To check replication, increase the diagnostic logging of MSExchangeIS with relevant category to maximum [KB Article: 842273]
Replication happens with mail flow.
Like USN, CN [Content/Change Number] tracks down the list of changes made on any server.
Information Store creates CN for any change in public folder
This message is sent to all servers which have the replica of the affected public folder
Exchange treats these messages as system messages and are addressed to system mailbox. It contains data in binary form.
As per replication schedule the information store sends all replication messages out to other servers.
Receiving servers accept the replication message and CN is compared to their existing CN, hence the PF is updated with changes.
If CN list indicates that other replicas have newer update than available on server, the server requests a backfill.

Public folder store is a database whose folders are by default have access to all email enabled users in the organization. The user when opens his profile in outlook is always able to see the Top Level Hierarchy

PF has three types of replications - namely hierarchy, content and backfill. There is event id attached to each one of them, which indicate the working of the same.

Hierarchy - 3018 and 3028 for outgoing messages and incoming messages respectively. This replication is done at the organization level for public folders. All folders created within the default Public folder (MAPI) are visible to all users. The hierarchy replication by default is done every 5 minutes.

Content - 3020 and 3030 for outgoing messages and incoming messages respectively. The content of the public folder store is not replicated by default, a replica of the exchange server needs to be created in the replica tab of the public folder so that the pf store contents can be replicated. This is done to avoid latency in bandwidth and to avoid any failures in any of the exchange servers. Though, even without replication, the content of the folder can be visible, but could take a long time to access. The content replication is done every 15 minutes.

Backfill - 3014 and 3024 for outgoing and incoming messages request respectively. / 3019 and 3029 for outgoing and incoming messages response respectively. This replication is done automatically when content replication is taking place. If there is any kind of miss in the sequence of pages being replicated, the backfill replication contacts the source server by sending a message that the missing page was not received and the source resends the same.

Status – 3017 and 3027 for outgoing messages and incoming messages respectively. Tells the other server whether the store is alive or not.

TROUBLESHOOTING PF REPLICATION [KB Article: 842273]

1. Check for latest service packs and hotfixes installed.
2. Check the mail flow between the two exchange servers by sending mail from one user to another.
3. Check PF Configuration [proxyAddress attribute ]
4. Check the replica entry. Use PFDAVAdmin tool.
5. Enable diagnostic logging on both servers to maximum to check event IDs
6. Post an item so that all events could be tracked
a. Event ID: 3018 on source server for hierarchy replication
b. Event ID: 3028 on destination server for hierarchy replication
c. Event ID: 3020 on source server for content replication
d. Event ID: 3030 on destination server for content replication
e. Event ID: 3014 on source server for backfill request replication
f. Event ID: 3024 on destination server for backfill request replication
g. Event ID: 3018 on source server for backfill response replication
h. Event ID: 3028 on destination server for backfill response replication
i. Event ID: 3017 on source server for status replication
j. Event ID: 3027 on destination server for status replication
7. Modify any old public folder
8. Enable Message tracking on both servers and then check from message center as to where the message is being stuck.
10. If message stuck in local delivery queue – override permission by adding a DWORD skipPublicMDBRestriction and set value to 1. [KB Article: 830181]
11. Check authentication level “integrated with windows” must be checked.
12. If the message indicates some other name apart from the target server, check for “smarthost”.
13. Ask for any other server hosted, if yes, then remove the entry of that server from smarthost field and create a SMTP connector (routing groups) and mention the name of that server. By this way, the smarthost will be bypassed for replication.
14. SMTP service routing engine must be restarted.
15. Check for any antivirus installed and temporarily disable the same.

PFDAVADMIN Tool

Add/Remove replica in multiple public folders
If some folders do not replicate after making changes, the item level permissions can be checked.
Set limit on specific folders
Check DACL [Discretionary ACL] for damaged permission so as to bring default permissions back
Recover deleted folders [will be visible in the tool in red color]
Can give client permissions on specific folder.


RECIPIENT UPDATE SERVICE [RUS]

RUS stamps the email address but recipient policy defines which email address is assigned to mailbox based on filter [LDAP Query].
Filter defines which email address is to be stamped on which user.
Default email policy: usermailboxname@domainname applicable on all mailboxes and mail enabled groups.
RUS has a ABV_DG.DLL file that gets loaded in memory when system attendant service is running and RUS starts working.
RUS stamps an email after every 15 minutes.
Email Address Policy: By default all email stamp applicable to all mailboxes in an organisation
Primary SMTP: It shows senders email address. At any given time there can be only one primary SMTP. The user can send email only through this.
Secondary SMTP: when multiple users send email to my different email addresses, yet I receive all of them in my mailbox. For example, my primary email account – rd@wipro.com and I want that if people send mail to my other account rd@support.wipro.com I should be able to receive them in my primary mailbox.
Can have multiple email addresses associated with one mailbox
Can define unlimited secondary email addresses
Cannot send mail through secondary email address
Default Policy properties – select email address policy tab – click on new button – define secondary address – secondary email address in small letters (we can set secondary email to primary)

For example there are some users in US and some in India and want different email addresses like
For US users: @wipro.co.us
For Indian users: @wipro.co.in

In the above scenario, new Recipient policy needs to be defined.
Right click on Recipient Policy – New Recipient policy – select Email Address check box – give any name – define LDAP Query – click Modify button – select Advanced tab – select field and search users who are in US – define new email address: New LDAP Query is generated. Users that get filtered with this query get the secondary email address from default policy. Recipient policy with highest priority will apply first for the user.

The LDAP filter Attribute is PURPORATEDSEARCH

GLOBAL ADDRESS LIST [GAL]

Address List is a logical grouping of users of similar types based on criteria.
All email enabled / exchange recipients are listed in GAL.
Contains address list of all users, groups, contacts and public folders
showInAddressBook attribute contains the distinguished name of GAL or address list to which the user belongs.

OFFLINE ADDRESS BOOK [OAB]

If the outlook profile is configured in cache mode then OAB can be checked in local account folder.
OAB is updated through a mail message sent by Exchange to OAB folder under system public folder.
OAB provides access to GAL when user is offline
OAB does not have its own filter.
Outlook must be configured in cache mode to view OAB.

SYSTEM POLICY

To make management of mailboxes easy like setting limits on mailboxes on different stores
There are three types of system policy, namely:
Server Policy
PF Store Policy
Mailbox Policy

Some Attributes STAMPED by RUS

showInAddressBook
HomeMDB: defines user resides in which store. Contains the distinguished name of the mailbox store. Domain partition
ProxyAddress: defines email address types like SMTP and X.400
mail: displays email address of user
msExchHideFromAddressList: if value set to TRUE, then that user or public folder will not be listed in GAL and will also remove entries from showInAddressBook attribute.
For mail enabled recipients, three important attributes are:
mailNickName: contains the first part of the email address
LegacyExchangeDN: defines the organisation name, AG name and alias of the users, groups and public folders. Incase of PF, instead of alias name the GUID is displayed.
displayName: displays only alias
msExchHomeServerName: shows user belongs to which server.
hideDLMembership: the value is set to TRUE for those users who should not be able to see the complete GAL. for example, users in the sales department should be able to see users in their department only.



Difference between Enterprise RUS and Domain RUS

Enterprise RUS is created with the first exchange server in the forest. Like PF store, System Attendant and MTA are mail-enabled objects at the enterprise level. This is updated when there is a change in the recipient policy and modifications in the forest. It will stamp email to those objects that are present in the configuration partition.
Domain RUS is responsible only for a single domain. It cannot stamp child or trusted domain. Stamps the proxyAddress (based on recipient policy) of the users and groups. Updates everytime a user is created, deleted or modified. It will stamp email to those objects that are present in the domain partition.


Working of RUS

Open RUS property and check that it is pointing to the functional exchange server and Domain Controller.
Update interval should be “Always Run”
Force RUS by selecting “Update Now” – will stamp only those user objects are have been newly created or not have been stamped. Attribute: msExchReplicateNow – value will be set to TRUE.
“Rebuild” option can also be forced – will stamp all the users in the address list, right from the beginning. This is not recommended as when rebuild is working, nothing else can be done on the server. Attribute: msExchDoFullReplication – value will be set to TRUE.
msExchPoliciesIncluded: contains the objectGUID of policy followed by a user.
msExchPoliciesExcluded: contains the objectGUID of policy not followed by a user. These two attributes are checked in domain partition for a particular user, group, PF or contact.

TROUBLESHOOTING RUS

check configuration
Check replication. [dcdiag and netdiag]
check proxyAddress
remove garbage value from gatewayProxy
policy
check GAL
Check the filter
Run policytest

Dial-Tone

Dial-tone is method of restoring a corrupted database using the recovery storage group (E2K3).

1. Dismount the store
2. Move the database (edb and stm) files and log files (if any) to a different location.
3. Mount the store. Though the store will be blank yet the mail flow would start.
The dial-tone database is running.

4. Create a Recovery Storage Group.
5. Add the database making sure the path is where the db files were moved to. Make sure the database can be overwritten is checked.
6. Restore the database using the ntbackup tool.
7. check the state of the database – Clean shutdown. Try to commit all log files.
8. Use the Exmerge utility to merge the restore database with dial-tone database.
9. Dismount the dial-tone store.
10. Mount the recovery store

When DB size is reached 16 GB in standard version, stores get dismounted
Increase the size of database by 1 GBCurrentControlSet / Services / MSExchangeIS / / PrivateGUID {1} REG DWORD = Temporary DB Size Limit Extension. Set the value to 1Event ID: 9657 is generated
Mount the stores
Stop the SMTP service so that there is no mail flow.
Set the mail retention limit to zero
Ask users to delete unwanted emails
Force Online Maintenance to run. This will create whitespaces in the database for deleted mails. It generates Event ID: 700 and when finished event ID: 701 and 1221 is generated. Online Maintenance is also called as Online Defragmentation.
Dismount the stores
Run Offline Defrag to delete whitespaces.
Remove the registry entry.
Mount the stroes.
[1] For each store there is a separate GUID in registry under PrivateGUID. This GUID can be matched with system mailbox GUID for that store.

LEARN EXCHANGE TROUBLESHOOTING

Exchange TOPICS


1) Introduction to Exchange 2000: It comes with 2 versions Std and enterprise.
2) Pre-requites to install Exchange-IIS services ( NNTP SMTP WWW services )
Active directory should be installed.
Healthy DNS.
Forest prep: Schema admin and Enterprise admin.
Add specific attributes and classes.

Domain prep: Domain admin and local admin
Creates MESO container in ADUC and creates two groups: EES and EDS.
To install additional exchange server in same domain no need to run forest prep, we can run domain prep.

Exchange services: Microsoft exchange System Attendant.-
Information store
MTA Stacks.
Pop3
Management
Routing engine
Imap4
Site replication service
Exchange Event service.


Database: EDB and STM

Stores Not Mounting: 1) Check if the exchange services are running.
3) If services are not running-Dcdiag, netdiag, check or force replication, DNS configuration, Nslookup. Check event id’s in application log..
4) If Services are running properly-check the consistency of the database by eseutil /mh “path of database” If log files are present.
5) Check for sequence and health eseutil /ml “path of database” with E00 log prefix we can check the health from start.
6) Now commit the log files manually-eseutil /r e00 /L “path of log file” /d “path of the database file” /s “path of the system path file or check pt file” Known as SOFT RECOVERY.
7) If log files are not present ask for recent good backup….
Types of back up.
1) Online 2) offline.
1) Online backup-are divided into three
a) Full-copies edb+stm+log files and it will purge the committed log files.
b) Incremental backup-Backs up log files from last full or last incremental backup. It will purge the committed log files.
C) Differential Backup- will back up from last full and last incremental back up.
2) OFFLINE backup-Flat file copy stores dismounted.
8) If there is a back up restore the back up-While restore it creates restore.env file to the TEMP location given. We need to check the sequence of the log files. The last log file in temp-should be in sequence with the first log file in original location of the database.
9) To see the contents of the restore.env file
Eseutil /cm”path of restore.env”
10) to commit these log files Eseutil /cc “path of restore.env”

11) If there is no backup-Make sure we have a Flat file copy of the database to another location.
Run the following command Eseutil /P ”path of the edb” It remove the corrupt log files. Runs at 4-5 gb/hr. Requires 25% GB of free space.

12) Offline defrag-Eseutil /d “path of edb file”
Required 110% free space. Cerates Temp files.
/T=redirect output of temp location.
After the command successfully temp location is deleted.
13) Run ISINTEG –s -fix –test All Tests. Runs at 10 gb/hr. Log signature and Database signature changes. It deletes the pointers.
14) Check for Antii-virus.





Recovery server
Used to recover one or more emails or mailboxes- exchange 2000 only.

To recover in the same production environment for emails and mailboxes we need too dismount the store and the downtime is long. So we cerate a recovery server.
ORG name and Ag name should be same
Storage group should be same with mailboxstore.
We need to have a good recent backup.
We can u se find /I “o” and “ou” to check for Ag and org name.
We can use the legacy Dn tool in recovery server to change the Ag and ORG name.

Recover an EMAIL-restore the backup, Mount the stores and Create the user whose mailboxes need to recover. Reconnect the mailboxes
Run Exmerge and Export the PST of the user to the production environment. Give send as and receive as permission. Breaks the SIS(Single instance Storage)


Now Use Exmerge in the production environment to import the user Pst and connect the mailbox. Mount the database.
We can also use MBCONN from Exchange cd.. and connect mailboxes and create users using LDIFDE –I –f c:\temp.txt. path of the filename.


Disaster Recovery

Can be done if we have the recent good backup.
· Dc should have complete information about the exchange server in the schema partition.

PROCEDURE-

· Need to have exchange container in the ADSI edit.
· Make sure new exchange server should have same drive letter and partition for database and log location.
· Join new hardware to network with same hostname.
· Make sure the OS version and sp’s are same.
· IIS and Pre-requities for exchange
· Install setup /disaster recovery
· No need for domainprep but in some scenarios we might need to run.
· Restore the back up
· Mount the database(do not mount the database at startup should not be checked mailbox properties)
· If the error message same hostname exists in the network we need to reset the computer account in ADUC.





16-GB Limit
Eventid-1112 and 445

· Applies to STD edition of exchange 2000

Online Maintenance-mailbox properties-database Tab.

It will cleanup emails and mailboxes.
Runs on a schedule
Recommended not run Online Maint. With backup because it will terminate the Online maintenance.

Track online maintenance-eventid: 700-starting.
1221-in process
701-finish
It creates whitespaces.

PROCEDURE:

1) Increase the database size by 1gb bby following registry key-HKLM/CCS/Services/Msexchnage /private information store
Create TempDatabaseSizelimitExtension
Look for Event Id-9657.

2) Stop the SMTP SVC.
3) Delete unwanted emails
4) Mount the stores
5) Set retention limit as Zero.
6) Force Online maintenance
7) Offline defrag (stores dismount)
8) Mount the stores and start SMTP service.
9) Delete the registry key.









Exchange and Antivirus

1. Anti-virus should be exchange aware
2. Integrates with exchange information store service because of mail flow.
3. In registry- HKLM/CCS/Services/Msexchnage /private information store look for performance key virusscan-1 and background scanning-0.
4. Folders need to be excluded during the scan-
A) exchange folder
B) database folder
C) log files
D) Inetsrv folder.









Outlook and OWA

Cached mode-Existing emails and Gal can be accessed even after user is offline
In cached mode file name .OST gets created and has the caching of the existing emails
OAB provides data of Gal in the offline mode.

Non-cached mode- Online mode where the client has to be connected to server in order to access Gal and mails


OWA-Outlook Web access interface for Non-mapi clients to access emails.














PUBLIC FOLDER

1. Every user who has mailbox can access public folder and also create by default.

2. We cab cerate public folder from ESM and Outlook


3. Public folder tree is called a MAPI tree.

4. In an Org. can have only one MAPI tree.


5. Relation of public store to Mapi tree is 1-1

6. We can create Non-mapi Tree from IIS known as virtual directory and can access OWA for Non-mapi tree.


7. The Path of the Public folder tree is always called top-level hierarchy

8. By default in E2k all PF’s are mail enabled.
And in E2k3 are mail disabled.

9. Database is divided into IPM SUB TREE and NON-IPM SUBTREE.
10. IPM tree Is called MAPI tree and NON-MAPI IPM TREE- known as system folders(Right click on PF)


11. Replicas and ghosted folders- the TLH is replicated to all stores in the hierarchy

12. Public folder replication-4 types.
Hierarchy replication-
b) Content replication
c) Backfill replication
d) Status replication


TROUBLESHOOTING

1. Check mail flow- at source and destination server.
2. Determine the proxyaddress on the public folder adsiedit

3. Increase diagnostic logging-right click server properties on public folder replication messages-

1
Replication AD Updates
2
Replication Incoming Messages
3
Replication Outgoing Messages
4
Non-Delivery Reports
5
Replication Backfill
6
Replication General
On source and destination server

4. Enable message tracking to track messages-on source and destination.

5. Check if t he messages are stuck in local delivery que we need to change the registry key-hklm/system/ccs/services/exchange transport/create a key name parameters and Dword SkipPublicMDBRestriction.


6. stop anti-virus services

7. Check weather old files are replicating or not. If not modify the old items.


8. Tools-PFDAVADMIN-checks- Item level permission, checks and fixes DACL issues, calendar permissions, recover deleted folder, sets limits on folder.











Recipient Update Service


1) Recipient Policies: defines email address which is supposed to be stamped bases on ladap filter
We can have only one primary SMTP and can have multiple secondary SMTP.

When new policy is created the lowest no. has the highest priority.

Attribute- Purporated search: is equal to LDAP filter.

Address List- Logical grouping of the exchange recipients.

ShowIn Addressbook: Attribute defines which objects appear on which address list. Helps to resolve name for MAPI clients.

HomeMDb-Dn of mailbox store to which a particular user belongs.

MsExchhomeservername: gives the dn of the object belongs to which server.








COMMON FAILURES:

3RD Party proxy address
Insufficient permissions for object (policy test)
Incorrect configuration DNS.
Duplicate names in active directory.
Rus running on a front end server.
Incorrect configured recipient policy,


Troubleshooting:

Check Rus configuration-Pointing to t he right Dc and exchange server.

Take ldp dump.
Increase diagnostic logging.event id:8011 and 8012.
Source Msexhcange al and SA.

MSexchangepolicies included-stamps obectguid
Check proxyaddress attribute
USN changed<>\Private-

Dword value- Database Size Limit in GB

Check the timing of the database size-runs at 24hrs interval.

Set early warnings prior to reaching the DB size by default 10% threshold,


Warningbuffer-will dismount the database as per size
Set in registry.

Eventid:1216 checks the increase in the DB
9685 database has mounted and physical size has increased.






DIRECTORY ACCESS


-component of exchange which provides information regarding domain controllers and gc servers.

-has three components
Dsaccess and dsproxy
Categorizer

Dsaccess- discovers topology within and environment.
When SA starts the process is performed automatically.

Dsaccess fires again every subsequent 15 mins.

Configuration dc- it reinstates in 8 hrs. If the Dc is failed dsaccess will choose the next reliable dc and will ping the fail dc and it will reinstate tht Dc in next 8 hrs.

NSPI Proxy- client sends requests to the exchange server and then it is passed to gc for the first time and next time when the client sends requests it has local cache of the gc so it will contact directly to the GC. So exchange acts as proxy for the GC outlook sr1

TROUBLESHOOTING:

· Increase diagnostic logging check event id: 2080

Server Name Actual server name

Roles Displays the AD role (G – Global Catalog, D – Domain Controller, C – Config DC)

Reachability Ports reachable via TCP/IP (0x1 – GC port 3268, 0x2 – DC port 389, 0x4 – Config DC port 389, 0x7 – All 3)

Synchronized Indicates whether the “isSynchronized” flag is set to TRUE (same bit flags used in Reachability)

GC Capable Indicates whether the server is a Global Catalog server (0 – False, 1 – True)
PDC Indicates whether the server is a PDC Emulator for its domain (0 – False, 1 – True)

SACL Right Indicates whether DSAccess has permissions to read the Security Access Control List (SACL) for the Configuration naming context (0 – False, 1 – True)

Critical Data Indicates whether DSAccess found this Exchange server in configuration container (0 – False, 1 – True)

NetLogon Indicates whether the server is running the NetLogon service (same bit flags used in Reachability)

OSVersion Indicates whether the server is at least Windows 2000 SP3 or Windows Server 2003

· Ping each reported server
· Use ldp dump
· Nslookup
· Check cpu usage
· Policytest
· Dcdiag /v
· Check Ad configuration.









OFFLINE ADDDRESS BOOK

Usres can work offline and can connect to exchange server and download the offline address list to obtain information abt the other users in OAB.

It cannot filter.It contains default address list which represents the Default Gal.

By default runs at 5.00 Am
Files are compressed before they are addd in system folders so that the outlook download is minimal.

System Attendant is is responsible to generate the OAbgen.dll file.(MAPI application Via NSPI)

OABGen.dll creates- version2 3a and 4
It also generates incremental offline address book.

Files are in .OAb format

OAB should be populated in mailbox properties.
Attribute-MSexchangeuseOAB

Rus Should Stamp the “Showinaddressbook” so object wwould be visible in Gal.

Version-2 ANSI format, 3a-unicode, 4-E2k3 SP2-compress the files for more minimal download.
Unable to download OAB. 0x80040104

Check topology
Check services
Check OAB is defined on the mailbox store
Increase diagnostic logging
Rebuild OAB
Check error in outlook whn user is in cached mode.





Recovery storage group

Ground rules: e2k+sp3 or higher
Same Ag
If the MBS is already added to RSg then next store will be from the same SG.

Recover mail items for a user
Information store automatically redirects all restore operations to RSG. Event id: 9635

When mauilbox store is added in RSG look for “msexchangeorigmdb” on MBS of RSg it will have the Dn of the production Mailbox store which tells which mailbox to merge.



Dial tone

Create RSg and Add MBS

Copy Edb and Stm file in RSG folder 50 gb

So now we have t he blank database

Run the repair on the corrupted Database.48 gb

Swap the Edb and Stm files or change the path “meexchedbfile” and msexchslvfile” in adsiedit
Then run exmerge to recover remaining 1 gb by connecting the mailbox or just right click exchange tasks-SP3

-reduces downtime
Override registry for RSG. So restore will go directly to production.
– HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
– Create a DWORD value named “Recovery SG Override” and set its data value to 1.















UPGRADING TO 2003

W2k------ e2k
W2k------E2k3
W2k3xxxxxx e2k
Before upgrade
We need to run adprep /forestprep in a DC
Adprep /domainprep
It will update active directory.

Again run forestprep and domain prep to install exchange 2003.

How do Exchange Server rules work?

You've been using Outlook for years now and you've probably established some delivery rules for yourself. Maybe mail from your manager is automatically routed to a subfolder of your inbox. If you're using Outlook 2003 or later, you've got an automatically maintained rule to handle junk mail. If you've ever set your Out Of Office, that's handled by a rule too.

But how do rules actually work? What's the implementation like? Obviously, I won't get into the grimy details (trade secrets and all), but I can pass along the basics.

First, the rules infrastructure is fully documented on MSDN. Those among you brave enough to explore this documentation may be inspired to write a little app which will enumerate your inbox rules and print them out on the console for detailed inspection of just what Outlook creates. I wrote such an app for internal diagnostic purposes (which means I most likely can't share it with you, sorry). Oh wait! Someone else has already published something here!

A rule consists of two fundamental properties, and a bunch of other support properties which mostly won't matter for this discussion. The important ones are the rule's conditions, and the rule's actions. Simplistically, if the incoming mail passes the restriction, the rule engine subsequently carries out the actions. The rule engine itself is completely agnostic to the intentions of the rule creator. In other words, the rule engine doesn't care what the title of the rule type in Outlook's wizard is – it only applies the restriction and then if that passes, it carries out the actions.

The conditions are expressed as a MAPI Restriction. As each mail is delivered, the restriction on each rule is applied to the incoming message. The restriction describes a complex property value comparison tree, such as (the received time > somedatetime AND the sender's display name starts with "Bob" AND the body contains "Loser") OR (the message size is greater than 2k). Such restrictions are also used for searching for messages, filtering views, and so on. In this case, the restriction is applied to the incoming message. This means that rules cannot check against dynamic values, such as the current system time or how big the mailbox is. It's constrained to checking properties of the message against constant values. One exception to this is how the Junk Mail rule works, which I'll describe later.

Outlook has a variety of pre-canned restrictions that it uses and I won't go into the exact nature of each one (yes, I know, you're just burning to know what the precise nature of each of these is, but you can use the sample app I linked to above to study the precise nature of each of the rule types). I will point out an important design point though: rules which are of the form "FROM some DISTRIBUTION GROUP" actually means "if the sender is a direct or indirect member of that DL". This often confuses people because they create a rule like "mail from , move to the folder". What ends up happening is all mail from anyone on the "my team DL" starts having their mail moved to that folder. If you think about it, it makes complete sense. However, more often than not, folks really wanted the rule "mail SENT TO , move it".

If the message meets the restriction criteria, the actions are then carried out. While Outlook rarely creates rules with multiple actions within, it's possible to have a list of actions on one rule. The possible actions are:

• Move the message to another folder*
• Copy the message to another folder*
• Reply to the message (with a given template message)
• Send an "Out Of Office" reply (with a given template message)
• Fail delivery with a specific error code
• Forward the message to another address
• Delegate the message to another address (a lot like forward, but it preserves original sender info)
• Tag the message with a specific property value
• Permanently delete the message (Outlook doesn't use this when you create a rule with a delete action. Instead, it creates a MOVE action with the Deleted Items as the destination folder)
• Mark the message as read
• And finally, the big one: defer to the client to carry out client-defined actions.

The asterisk on Move and Copy refers to what to do if the server can't reach the destination database. In this case, the server turns it into a "defer to client" action where it specifies to the client a) the move or copy action and b) the destination that should be used. As you can see, the server itself is pretty constrained on the kinds of things it can do, yet Outlook offers all these wonderful actions that can be carried out. This is accomplished via the "deferred" action. The client stores in the action any relevant data it needs and the server will later notify the client that it needs to carry out a deferred action on a message, and includes whatever the client stored in the rule (such as, perhaps, the WAV data for the sound to play, for example).

Because a single rule could have conflicting actions, or even because multiple rules that may apply to the message could have conflicting actions, the server pulls off trickery to make sure everything happens correctly. For example, you may have two MOVE rules which apply to a message. You can't move a message to two different folders at once, yet that's the end result (the server treats subsequent MOVEs as if they were COPYs instead).

Exchange Server rules are only executed during delivery. Outlook provides a "Run Rules Now" feature, but that's implemented entirely by Outlook. The server is not involved. Also, realize that server rules are not ever executed after delivery is complete. If you witness spontaneous changes happening to your inbox, this is either Outlook carrying out deferred actions, or someone else logged into your mailbox is changing things under your feet.

What about the Junk Mail Rule? How does it adjust itself based on the administrator's configuration of the move action threshold? The administrator's configuration lives in Active Directory, so how could the rule dynamically retrieve this value for comparison against the Spam Confidence Level value stamped on all incoming messages? Well, there's a one-off cheat just for this. The rule itself is crafted to compare the Spam Confidence Level against the constant value -1. The rule execution engine pre-scans the restriction, looking for this specific comparison. If it finds it, it replaces the constant -1 with the current value in Active Directory, and then the restriction is applied to the incoming mail.

You may be thinking: "but what about two mailboxes, each with a reply rule that replies to the other mailbox? Won't that cause a mail storm?" Well, ordinarily, yes. However, our rules engine is smarter than that. As a rule is triggered on a message, the rule's ID is stamped into an ever-growing property of "I've already run this rule" history. Therefore, if a message "comes back", the rules engine can check to see if any particular rule is in this rule history and avoid running it again. So, if mbx1 sends mail to mbx2, which autoreplies back to mbx1, which autoreplies back to mbx2, the rules engine will detect the loop and not execute the rule that would otherwise cause another autoreply back to mbx1.

Forgot to mention subject line on an official mail??? We can avoid it.

If you want to avoid sending official mails with out a subject please perform the following steps:

1. Open your outlook

2. Press Alt+F11. This opens the Visual Basic editor

3. On the Left Pane, one can see "Microsoft Outlook Objects" or "Project1", expand this. Now one can see the "ThisOutLookSession".

4. Double click on "ThisOutLookSession". It will open up a code pane.

5. Copy and Paste the following code in the right pane. (Code Pane)

=============================================================================================

Private Sub Application_ItemSend(ByVal Item As Object, Cancel As Boolean)

Dim strSubject As String

strSubject = Item.Subject

If Len(Trim(strSubject)) = 0 Then

Prompt$ = "Subject is Empty. Are you sure you want to send the Mail?"

If MsgBox(Prompt$, vbYesNo + vbQuestion + vbMsgBoxSetForeground, "Check for Subject") = vbNo Then

Cancel = True

End If

End If

End Sub

=============================================================================================

6. Save this and now close the VB Code editor.

From now on, this macro will make sure you do not make the mistake of sending a mail without a subject line .

Cheers