ChrisTitus.com Resources for IT Professionals

Fixing Certification Warning Popups in Outlook 2007 and 2010.

If your users are complaining of a certification popup when logging into outlook 2007 or 2010 you probably have some issues with your Certificates on Exchange Server. Deleting and creating new certificates can cause all sorts of problems, so I wouldn't recommend it. (Unless they are expired of course.)

I recently ran into this and it was because I used the shortname for my server instead of the FQDN (Fully Qualified Domain Name) when making my certificates common name. ex. SERVER instead of Server.domain.local

Everything is working properly except for end users receiving the popup message, but after running the following commands and recycling the application pool, all was fixed.

Here is the commands I typed in EWS (SERVER = Certificate Common Name)
Set-ClientAccessServer -Identity SERVER -AutodiscoverServiceInternalUri https://SERVER/autodiscover/autodiscover.xml
---------------
Set-WebServicesVirtualDirectory -Identity "EXGSERVER\EWS (Default Web Site)" -InternalUrl https://SERVER/ews/exchange.asmx
---------------
Set-OABVirtualDirectory -Identity "SERVER\oab (Default Web Site)" -InternalUrl https://SERVER/oab
---------------
Set-UMVirtualDirectory -Identity "SERVER\unifiedmessaging (Default Web Site)" -InternalUrl https://SERVER/unifiedmessaging/service.asmx
-Open IIS Manager.
-Expand the local computer, and then expand Application Pools.
-Right-click MSExchangeAutodiscoverAppPool, and then click Recycle.

Now restart effected computers and the warning should be gone.

Edge Synchronization Creating and Renewing Certificates

Once a year you will need to create new edge certificates and re-establish the synchronization. Here is the steps to do this process (All commands are run in EWS):

Do your test emails to verify connectivity and you are finished.

Setting Email Retention Limits on Exchange 2007 Folders

Some Exchange Administrators overlook setting retention limits on mailboxes. This is very important in businesses without mailbox quotas, because most users will never empty their deleted items. Also, setting the empty deleted items GPO will upset your users.

This step-by-step will show you how to only retain the last X number of days in the deleted items folder.

1.Open Exchange Management Console and Navigate to Organization Configuration -> Mailbox.
2.Select Managed Default Folders Tab and you should see the Deleted Items folder
3.Right Click on Deleted Items folder and Select New Managed Content Settings
4.Name your new policy "X number of days retention policy"
5.Define the retention period in the wizard
6.Click Next and skip the journaling screen
7.Review Summary Screen and click New
8.Click Finish

Once you policy is made you will need to set it for specific users, you can do this manually but I'd recommend just do it in bulk to your OU that the users are under in Active Directory. (Note: If your users are all under the Users folder and not in a OU you made, I'd recommend making one as it will not only help you here, but in many places in the future as well.)

Simply run the following command and you will set the mailbox policy on all the users in your Organizational Unit (OU)
Get-Mailbox -OrganizationalUnit SBSUsers | Set-Mailbox -ManagedFolderMailboxPolicy "Deleted Items"
Now, your policy is in effect and it should be enforced overnight and when you walk in tomorrow, you'll notice all deleted items only go back 90 days.

Finding Exchange Server Version (Service Pack)

There is a couple different methods to finding the version of your exchange server.

File System %Program Files%\Microsoft\Exchange Server\bin folder (different for 2003) and right click store.exe -> Detail Tab -> Version
-------OR--------
Exchange Management Console Go to Server Configuration -> Hub Transport -> Look at Version column (Exchange 2007)
-------OR--------
Exchange Management Shell type get-exchangeserver

Write down the Version number and find it on this list. It will provide you with the proper service pack and date of exchange server.
Microsoft Exchange 2000 Server.................6.0.4417
October 2000
Microsoft Exchange 2000 Server (a)............6.0.4417
January 2001
Microsoft Exchange 2000 Server SP1...........6.0.4712
July 2001
Microsoft Exchange 2000 Server SP2...........6.0.5762
December 2001
Microsoft Exchange 2000 Server SP3...........6.0.6249
August 2002
Microsoft Exchange 2000 Server post-SP3....6.0.6487
September 2003
Microsoft Exchange 2000 Server post-SP3....6.0.6556
April 2004
Microsoft Exchange 2000 Server post-SP3....6.0.6603
August 2004
Microsoft Exchange 2000 Server post-SP3....6.0.6620.5
March 2008
Microsoft Exchange 2000 Server post-SP3....6.0.6620.7
August 2008
Microsoft Exchange Server 2003................6.5.6944
October 2003
Microsoft Exchange Server 2003 SP1..........6.5.7226
May 2004
Microsoft Exchange Server 2003 SP2..........6.5.7638
October 2005
Microsoft Exchange Server 2003 post-SP2...6.5.7653.33
March 2008
Microsoft Exchange Server 2003 post-SP2...6.5.7654.4
August 2008
Microsoft Exchange Server 2007 ...............8.0.685.24 or 8.0.685.25
December 2006
Microsoft Exchange Server 2007 SP1..........8.1.0240.006
November 2007
Microsoft Exchange Server 2007 SP2..........8.2.0176.002
August 2009
Microsoft Exchange Server 2007 SP3..........8.3.0083.006
June 2010
Microsoft Exchange Server 2010................14.00.0639.021
October 2009
Microsoft Exchange Server 2010 SP1..........14.01.0218.015
August 2010


Tarpitting in Exchange 2007 (Tarpit SMTP Receive Connectors)

In Exchange 2003 you needed to set the tarpit for exchange manually, but in Exchange 2007 you don't have to. It defaults to a 5 second tarpit on all receive connectors. Since tarpits reduce spam, it may be a good idea to increase it in Exchange 2007. My personal preference is 10 seconds.

Syntax:
Get-ReceiveConnector | Select Name,TarpitInterval
You can also pipe it to all your connectors at the same time using this command:
Get-ReceiveConnector | Set-ReceiveConnector -tarpitinterval 00:00:10

Allowing Application Server, Copier, or Standard Server to Relay off Exchange 2007

So you want to send anonymous emails using that backup software, do scan to email on your copier, or have that miscellaneous application send emails without authentication on your file server... Its quite easy and secure if setup properly. Many small businesses enable anonymous access on the default SMTP receive connector... DO NOT DO THIS! Its extremely dangerous and you open yourself up to a lot of spam.

To enable the anonymous emails from specific devices, they must be assigned a static IP. Write down all the IPs of the devices, servers, etc... that you want to enable this functionality.

Creating a specific SMTP Receive Connector

1. Open Exchange Management Console on Hub Transport Server
2. Tree: Server Configuration -> Hub Transport | Select New Receive Connector (on Right Pane)
3. Name the Connector (CRM Application, Copy Machines, Internal Anon Email Relay, etc...)
   
4. Leave Local Network Settings at default (all)
5. For Remote Network Settings, you will put in your static IP ranges or singles here.
   
6. Finish making connector: Next -> Finish

Now, Edit the new connector to make it a relay

1. Right click Connector, Select Properties
2. Go to Permission Groups Tab, Select Exchange Servers
   
3. Go to Authentication Tab, Select TLS and External Secured
   
4. Hit Apply, OK and your finished!

Please Note: This assigns the connector with the following privileges
MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Authoritative-Domain}
MS Exchange\Externally Secured Servers {ms-Exch-Bypass-Anti-Spam}
MS Exchange\Externally Secured Servers {ms-Exch-Bypass-Message-Size-Limit}
MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Exch50}
MS Exchange\Externally Secured Servers {ms-Exch-Accept-Headers-Routing}
MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Submit}
MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Any-Recipient}
MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Authentication-Flag}
MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Any-Sender}