Hello fellow Exchange Admins, Yesterday I exported a 30GB Mailbox as a .pst file to our SFTP server. At about 90% the MailboxExportRequest stalled with StalledDueToSource_DiskLatency.

No other exports were running from the source server. I even disabled all scheduled tasks that could have an impact on the database where the mailbox is mounted.

However, the export request always switched to: StalledDueToSource_DiskLatency

As a consequence, the export started to loop. It just created a new folder hierarchy and started to export the items again.

Therefore the export .pst was growing much bigger than the initial mailbox size. In other words, this can blow up your storage capacities if you have a large mailbox and leave the export overnight! Not to mention that the export is useless afterward.

In this post, I want to share how I worked around the StalledDueToSource_DiskLatency condition.

Let’s start at the beginning:

You can find more useful details on monitoring export requests here:

Monitor Mailbox Exports

The pain started whenever the export reached completion of 100%.
The job was relinquished due to large delays and unfavorable server health on the source server-side.

As can be seen in the image below the export status stayed inProgress.
While SyncStage was CopyingMessages and StatusDetail was StalledDueToSource_DiskLatency:

Therefore the export job was relinquished:

Eventually, the export started all over again. StatusDetail: CreatingFolderHerarchy:

Then PercentComplete was 10% again:

As a result, the size of the export PST grew much bigger than the initial mailbox size.

After all, the solution for me was to switch the mailbox database that hosts the mailbox to another copy within the DAG:

Work around StalledDueToSource_DiskLatency

After the database is switched to another server try to export the mailbox with a new export request.
Given that the new server has no performance or disk issues the export should complete in a normal manner.

Have a nice day

The post StalledDueToSource_DiskLatency Mailbox Export appeared first on Webbanshee.

Hello folks, Today I would like to share my experience so far on how to export a mailbox with New-MailboxExportRequest. There are a couple of parameters to query to get useful information about the status of an export request.

As long as everything goes smooth you will probably just need the percentage information. But when the New-MailboxExportRequest stalls or stops with an error you will be happy to have some additional parameters to query at your disposal.

So let’s get to the point straight away:

Start to export a mailbox with New-MailboxExportRequest:

After you have started the export request check the progress:

First, a short info on the -IncludeReport switch:

When this switch is used in accordance with select Report the ouptut looks like this:

The output displays the currently processed items. Depending on the mailbox size the output can get much longer. Below the report, the output of other parameters you have selected is displayed.

New-MailboxExportRequest relevant infos that can be selected:

Modify parameters of a mailbox export request:

To modify the parameters of an existing mailbox export request you will need to suspend the request first. This can be useful when you retrospectively want to change the BadItemnLimit or want to raise the priority.

Suspend the mailbox export request:

Now change the parameters [Example: BadItemLimit]

Resume the mailbox export request:

Remove-MailboxExportRequest

Here are two arguments to remove mailbox export requests you don’t need anymore:

• To export a mailbox with New-MailboxExportRequest with the same request name.
• Further, do some housekeeping and keep your environment clean and transparent.

Have a nice day!

The post Export Mailbox New-MailboxExportRequest appeared first on Webbanshee.

Hi there, we have upgraded our servers. ADFS servers are running on Windows Server 2019 Core now. Therewith the method of the yearly renewal of the Token Signing Certificate has changed to PowerShell only.

I have just finished the renewal of the Token Signing Certificate via Powershell in our test environment. In this post, I will sum up the steps.

In case you want to renew the Token Signing certificate via GUI on an appropriate server see this post: Renew ADFS Token Signing Certificate

Let’s start with a short description of relevant ADFS properties: [Get-ADFSProperties | fl *cert*]

With that being said we are good to go. Log on to your ADFS Server Core.

Query the secondary Token Signing and Decrypting certificates

Note the thumbprints. You will need them later.

Export the secondary Token Signing Certificate

Export the certificate to a location you can reach from the application servers. I usually export the cert to a local folder on the ADFS server.

Import the certificate from your ADFS Server Core to all Exchange servers

The certificate will be imported to the Trusted Root Certification Authority of LocalMachine:

You can check that the certificate has been imported successfully via remote MMC from a GUI server:

Of course you can check it with PowerShell as well:

Promote the new secondary certificate to primary on ADFS Server Core

Set AutoCertificationRollover to False to be able to promote your secondary certificate to primary:

Query the thumbprint of the new Token Signing and Decrypting certificates:

Note the thumbprint of both certificates.

Promote both secondary certificates ( Token Signing and Decrypting ) to primary:

Verify that the new certificates have the primary status:

Switch AutoCertificateRollover back to True:

Check it:

Introduce the new Token Signing Certificate to the Exchange organization

It is enough to fire the following command once from an Exchange Server within your organization:

Verify the AdfsSignCertificateThumbprint:

Restart IIS:

Or Restart IIS remotely:

Now try to login via web frontend to your application servers. ( try an Outlook on the Web login )

That’s it

Stay healthy!
 

The post ADFS Server Core Token Signing Certificate appeared first on Webbanshee.

Did you ever receive inquiries about strange mailbox behavior like users state that mails have been deleted without any interaction of the mailbox owner? In cases like this, you are happy to enable Mailbox Audit Logging on the affected mailbox.

This post is about how to enable Mailbox Audit Logging on a certain mailbox and configure the auditing parameters to provide the most relevant insights. Let’s get to the point straight away:

Enable Mailbox Audit Logging on a mailbox

Check the audit status on a certain mailbox:

Enable Mailbox Audit Logging:

Define operations that should be audited:

Depending on what circumstances make a mailbox audit logging necessary you can change the predefined audit operations to more relevant ones. Find a list of actions logged by mailbox audit logging here.

Usually, I completely change the actions for AuditOwner. AuditOwner = MailboxOwner
To do so use the following command:

Set-Mailbox MailboxName -AuditOwner “Create, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems,MailboxLogin”

Adjust the logged actions according to the list by Microsoft mentioned above.
Use -AuditAdmin or -AuditDelegate instead of -AuditOwner to change logged operations for Admin or Delegates.

Search Mailbox Audit Logs

Define your query:

The Search-MailboxAuditLog CMDlet seems only to work out of an Exchange Management Shell. Out of an ISE loaded with an Exchange PS-Snapin, I always get an error.

Undoubtedly the filter for date ranges in connection with the Search-MailboxAuditLog CMDlet is somewhat imprecise. If you want to query a range from 3 days ago until today for instance I recommend setting the end date of the query to the date of tomorrow. Otherwise, it can happen that no results will be shown for the current day or even the day before.

Stay safe folks!
 

The post Mailbox Audit Logging – Enable and Search Logs appeared first on Webbanshee.

If you want to add a secondary IP Address without using the Change Adapter Options in the GUI ( especially on Windows Core servers ) you could use sconfig or simply add the IP address with PowerShell.

In my case, I wanted to add a secondary IP address to a certain interface on some Windows Server Core servers. Unfortunately, an Invalid Index error was thrown when I chose the appropriate interface under sconfig – Network Settings:

However, I faced this error a couple of months ago already when I wanted to Disable IPv6 in my test lab.

Because this time it was production servers I didn’t want to change any settings while adding secondary IP addresses to the servers. The only option was to add a secondary IP address via PowerShell.

… and here we go:

Add Secondary IP Address to Network Interface:

List Network Interfaces with name and Interface Index

Display existent IPs on chosen Network Interface

To list IPv4 and IPv6 IP addresses:
Get-NetAdapter -ifIndex  ifIndex Number | Get-NetIPAddress | select IPAddress | ftTo display only IPv4 addresses:
Get-NetAdapter -ifIndex ifIndex Number | Get-NetIPAddress | where {$_.AddressFamily –eq “IPv4”} | select IPAddress

Add new IP address

New-NetIPAddress –IPAddress “IpAddress goes here” –PrefixLength 24 –InterfaceIndex ifIndex Number

The command adds the IP address to the ActiveStore and the Persistent Store.
You can read more about the PolicyStore values here.

Verify that add a secondary IP address was successful

Get-NetAdapter -ifIndex ifIndex Number | Get-NetIPAddress | where {$_.AddressFamily –eq “IPv4”} | select IPAddress

Thats all. You don’t need to specify a default Gateway since this has most likely be done already with the initial IP address.

Remove IP Address from Network Interface:

List Network Interfaces with name and Interface Index

Display existent IP addresses that can be removed on chosen Network Interface

We focus here only on IPv4 addresses. See point above to display IPv6 as well.
Get-NetAdapter -ifIndex ifIndex Number | Get-NetIPAddress | where {$_.AddressFamily –eq “IPv4”} | select IPAddress

Copy IP address to remove from the output.

Remove IP address

add secondary IP address verify

Get-NetAdapter -ifIndex ifIndex Number | Get-NetIPAddress | where {$_.AddressFamily –eq “IPv4”} | select IPAddress

I have compiled the above steps in a script to make it more convenient:

Script to Add/Remove IP Address

The post Add Secondary IP Address Windows Server appeared first on Webbanshee.

Hello Folks, this is just a simple post on how to open and enter a Remote PowerShell Session from one server to another. A lot of tasks on different servers can be accomplished in a convenient way from one server.

For instance if you want to Change the Keyboard Layout on the login screen of a new Server Core installation.

We will use the cmdlets below to open, enter, exit, and remove a Remote PowerShell session.

Remote PowerShell Prerequisites:

If you want to go for sure firstly check the PS-Remoting state of the remote computer with:

Afterward, verify the state of the WinRM service on the remote computer that it is running:

Remote PowerShell Session Cmdlets:

Ok, here we go …

Create a Remote PowerShell Session with New-PSSession:

Check the newly created session with Get-PSSession:

Enter a session directly as an interactive session with Enter-PSSession:

Enter-PSSession -ComputerName NameOfRemoteComputer
Enter-PSSession -name NameOfSession.
 
As a result, PowerShell switches to the entered interactive session:
 

You can perform tasks on the target server via PowerShell from the localhost within this session now.
Enter-PSSession does not require a session that has been created with New-PSSession before.

Find more on how to run Remote Commands from a Remote PowerShell Session here.

Exit an interactive session with Exit-PSSession:

Disconnect a session with Disconnect-PSSession:

Reconnect a disconnected PowerShell session:

Remote PowerShell Session to Exchange Server

To connect with a Remote PowerShell Session to Exchange use:

You can verify the session with name ExchangeSession you just openend with Get-PSSession:

The Exchange CMDLets will be available now.

The same can be done from an Exchange Management Shell to connect through a Remote PowerShell session to another Exchange Server:

That’s all. 
 
 
To display the output of a PowerShell command completely without ellipses take a look here:

Expand PowerShell Output
 

The post Remote PowerShell Session to Server Core appeared first on Webbanshee.

To be able to change the input language on Server Core’s Welcome Screen with ALT + SHIFT you first will need to install the the input method of your preferred language.

Open a remote Power Shell session from another server so you can log in with your preferred language layout. You can also log in directly to the server using the server core’s default language layout.

In case you log in directly type powershell into the CMD window.

Check the WinUserLanguageList for installed languages:

The Get-WinUserLanguageList cmdlet returns language settings regarding input method, spelling, and text prediction. Accordingly, this example shows a Server 2019 Core with only the default language installed:

Change the input language by adding your preferred layout to the list:

You can find a list of language codes here: List of Language Codes

Find the relevant Syntax in the BCP 47 Code column.

In our example, we will add German as an additional input method.
As a result, one will be able to change the input language to German already at the login screen as well.

Check the WinUserLanguageList again:

$UserLangList
The output will show the additional input language:

From this point, you will be able to change your keyboard language with ALT + SHIFT

Remove input language from the language list:

Just in case it is needed you can remove a language as follows …

First, you will need the position of the language you want to remove:

$UserLangList

Bear in mind that the first language is position 0 and hence the second language is position 1!

Remove the language by pointing to the appropriate [position number]:

Verify that the language has been removed:

$UserLangList

The German input method has been removed from the WinUserLanguageList.

Enjoy your day and stay safe.  

The post Change the Input Language on Server Core appeared first on Webbanshee.

Assuming the HiddenFromAddressListsEnabled attribute is set to $False on the mailbox or distribution group.

When an entry is missing in the Global Address List it is not necessarily needed but good to know if we can find the object in the GAL on the server.

If an entry is missing in the Global Address List you can query the GAL on the server:

Independently from the outcome of the above PowerShell commands I usually update the Offline Address Book and the Global Address List afterward.

I have put in the option to query the Global Address List for the missing entry because I usually do it.

Ok here we go > Update the Offline Address Book:

Now update the Global Address List:

In most cases, this solves it.
 
I usually wait 15 Minutes [ one AD sync cycle ] before notifying the customer.
The user should download the Address Book afterward or restart Outlook.
In OWA new entries should be visible straight away.
 

If the problem persists check the showInAddressBook attribute on the object in AD:

Compare the values of the attribute showInAddressBook with an account or DL that is available in the Global Address List and add them accordingly if one or more entries are missing.

If appropriate entries are missing here you wouldn’t get a result when querying the GAL for the missing entry at the beginning of this post. Further it is likely that HiddenFromAddressListsEnabled is set to $true.

When HiddenFromAddressListsEnabled is set to $true:

Find some examples at the end of this Microsoft description.
 
If all entries are visible in showInAddressBook you should be fine.
Otherwise add the missing entries under showInAddressBook.

 
Have a nice day!
 
 
Want to activate an Out of Office message while retaining the formating?

Out Of Office Multiline Message through PowerShell

The post Entry is missing in the Global Address List appeared first on Webbanshee.

You can read more about the mentioned vulnerability and download the patch from Microsoft here.

Tasks before installing CU14 Exchange 2016:

Order of install:

The CU installation itself took between 2 and 3 hours on the servers in our environment.

Experiences after CU14 Exchange 2016 has been installed:

Experiences vulnerability patch KB4536987:

Good Luck!
 
A general description how to install a Cumulative Update on Exchange 2016 can be found here:
 
Install CU Exchange 2016

The post CU14 Exchange 2016 and KB4536987 appeared first on Webbanshee.

Hello Folks. To filter mails for certain criteria like sender, recipients, domain, header-information and more it makes sense to create a new Mail Flow Rule ( former Transport Rule ) and associate it with an action of your choice.

You could, for example, use a Mail Flow Rule to pretend [EXT] to the subject when a mail comes from an external sender or you could use a rule to classify emails with certain header-information as SPAM and move them to the user’s Junk-Mail folder.

Ok, let’s get into it. In this example we will create a rule that tags mails from external senders with [EXT]:

Create a new Mail Flow Rule via ECP:

> In ECP navigate to mail flow > rules and click the + icon. Choose Create a new rule.

The Drop-Down offers several templates for new rules.
We won’t use them here since we want to create a new Mail Flow Rule from scratch.

Specify the name and criteria of the new Mail Flow Rule:

We will create a rule which pretends [EXT] to the message subject when a mail comes from a sender outside of your organization.

> Specify the name of the rule
> Click More options

For an Exchange environment hosting a single tenant:

> Under Apply this rule if choose The sender… > is external/internal
> Set it to Outside the organization
> Add another condition
> Choose The recipient… > domain is
> Add the domain for which you want to mark external mails
> Under Do the following… choose Prepend the subject of the message with…
> Enter your preferred tag ( e.g. [EXT] )

> Further down set Match sender address in message to > Envelope

For a multi-tenant Exchange environment:

Exchange considers a sender to be external if:
• The sender’s email address isn’t in an accepted domain.
• The sender’s email address is in an accepted domain that’s configured as an external relay domain.

In a multi-tenant environment where tenants send mails between each other, the sender will not be considered as an external sender from the recipient’s point of view since the sender’s domain is an accepted domain. This means we cannot use the same conditions as we have used in a single-tenant environment.

> Under Apply this rule if choose The sender… > address matches any of these text patterns
> Enter @ as a specified word or phrase
> Add another condition
> Choose The recipient… > domain is
> Add the domain for which you want to mark external mails
> Under Do the following… choose Prepend the subject of the message with…
> Enter your preferred tag ( e.g. [EXT] )
> Under Except if choose The sender > domain is
> Enter one or more domains you don’t want to be marked as an external sender

> Further down set Match sender address in message to > Envelope

Create a new Mail Flow Rule using PowerShell:

For an Exchange environment hosting a single tenant

Create a new Mail Flow Rule using the New-TransportRule cmdlet with the following parameters:

A Short explanation of the used parameters:

For a multi-tenant Exchange environment
Create a new Rule with the parameters below:

A Short explanation of the used parameters:

Summary:

Find a description on the conditions here: Mail flow rule conditions

Have a nice day!
 

The post Mail Flow Rule Mark External Mail appeared first on Webbanshee.