mfinni's questions

Got a head-scratcher here. Either I've found a Windows and/or VMware bug, or I've missed something stupendously simple. [Spoiler - it was stupendously simple.]

Our VMware environment is ESXI 5.5. We have a Windows 2012 R2 VM (named BOS-NETMON) that can no longer do SNMP queries of Cisco ASA devices (v2 or v3).

This machine runs SolarWinds Orion, and neither that nor standalone tools like Paessler SNMPTEST work. All other currently-monitored devices continue to respond to SNMP from this guest - we have Cisco IOS, Meraki, Exagrid, APC/Schneider - all fine. All other allowed protocols (SSH, HTTPS, ICMP) work when connecting to the ASAs from this guest.

The problem started when we switched the guest from the E1000e vNIC hardware to the VMXNet3. Prior to that, it worked fine for a couple of years.

• Running the ASDM Logging window, it doesn't even see the attempted SNMP connection from BOS-NETMON. EDIT - This was because I didn't have the right logging settings on the ASA.
• Running Wireshark on BOS-NETMON, it shows the SNMP queries going out, doesn't register responses from the ASAs.
  • I've tested SNMP from another VMXNet3 guest, it also fails to query SNMP against an ASA but works against non-ASA Cisco devices. EDIT - this doesn't appear to be true. Either I tested wrong, or it started working recently. Either way, another host with a VMXNet3 NIC can query SNMP against one of these ASAs.
• I've tested SNMP from a guest with the E1000e vNIC, and it successfully queries SNMP against an ASA.
• 4/5 of the target ASAs are not at the same site, so it shouldn't be an ARP issue - and if it were, the other non-SNMP protocols would be affected.

Further edit: I have ASDM debug info for a successful, and an unsuccessful, SNMP session. Next step will be a packet capture, I guess.

6   Mar 12 2018 16:30:26    302015  10.50.100.177   63809   10.10.99.10 161 Built inbound UDP connection 610885144 for Inside_Interface:10.50.100.177/63809 (10.50.100.177/63809) to identity:10.10.99.10/161 (10.10.99.10/161)

7   Mar 12 2018 16:30:26    710005  10.50.100.152   49588   10.10.99.10 161 UDP request discarded from 10.50.100.152/49588 to Inside_Interface:10.10.99.10/161

We're starting to use some SaaS providers, including Office365 Exchange Online, that allow bring-your-own-key or hold-your-own-key for encrypting data at rest. These are, to my understanding, simply one key per provider, not something per-user or per-item.

What are the things I need to consider for deciding how to manage the keys? If it's under 6 services, can I just print 2 copies of the keys and store them in different locations, plus a copy in our password management system? At what point does an organization start to consider a key management solution?

This information is available in the web management GUI, but I'd like to get this information for use in a Powershell script that will use those values, and I'd prefer to not have to figure out how to scrape the website if I don't have to. Does anyone know if there's a file on the Exagrid unit, or a command that can be run, that will expose this info? For each given share, I'd like to know the current dedupe ratio.

My desired end-result is to combine this with Veeam's dedupe numbers, so I can have a start-to-finish dedupe number for my backup jobs.

I'm working on retiring a failing NetApp cluster. It offers iCSCI, NFS, and CIFS volumes to the network. For CIFS, we're fairly under control there. It's a limited set of shares, and there's recent "last modified" filestamps in only a couple of locations.

However, how can I be sure that nothing else is using the storage - alternatively, how can I find what else is attached to it?

For iSCSI, the only initiators are our ESX farm, which no longer has any client disks on this device - there were some datastores and RDMs that have been migrated or turned off. But that does leave the possibility of something still using NFS from within a client.

Any thoughts?

We have a problem with Cisco Unity and Exchange 2010. We've done packet capture and have determined that EWS is not sending <t:ModifiedEvent> notifications to the Unity server for some users.

Is there a way of querying Exchange to list what EWS subscriptions it's pushing or streaming?

Ugh. We built a greenfield AD and Exchange 2010 environment a few months back for a large client. Outlook Anywhere isn't working. Outlook clients just never connect, doesn't seem to be an error or timeout.

This was a migration. Originally we had a cert mismatch for Outlook Anywhere so I'm fairly certain it never worked. We recently changed everyone's SMTP domain suffix to match the webmail URL's domain, so I expected that OA would start working. Now we have a snow day, lots of people at home, and it turns out it doesn't work. Looks like there's some sort of problem with proxied RPC connecting to OAB but I'm quite stumped as to how to fix this.

Autodiscover is good, OWA, ActiveSync, EWS all have been working for months.

We have 2 mailbox servers in a DAG, 1 mailbox server for public folders and journals, a 2-server CAS array. On the inside, we have NLB for the array. On the outside, we have a simply Netscaler LB VIP for the array that does nothing special, just a TCP 443 passthrough.

RCA shows this - it's always about 33 seconds so I assume there's a 30-second timeout here.

Attempting to ping RPC proxy webmail.5ssl.com. RPC Proxy was pinged successfully. Additional Details Elapsed Time: 201 ms.

Attempting to ping the MAPI Mail Store endpoint with identity: PFEXCAS.internal.domain.name.com:6001. The attempt to ping the endpoint failed. Additional Details An RPC error was thrown by the RPC Runtime process. Error 1818 CallCancelled

Elapsed Time: 33536 ms.

Now, both CAS servers are indeed listening on TCP 6001. PFEXCAS is the name of the NLB VIP.

This works for ports 6001, 6002, 6004, so that's good

rpcping -t ncacn_http -s pfexcas.internal.domain.name.com -o RpcProxy=pfexcas.internal.domain.name.com -P " , , " -I " , , " -H 1 -u 10 -a connect -F 3 -v 3 -e 6004

This does not, it gives a 1722

rpcping -t ncacn_http -s pfexcas.internal.domain.name.com -o RpcProxy=webmail.5ssl.com -P " , , " -I " , , " -H 1 -u 10 -a connect -F 3 -v 3 -e 6004

Test-OutlookConnectivity -Protocol:Http -verbose works just fine on both servers, including the GetNewDSA and RFRI::GetReferral for the Address Book, those fail in our next test.

This is Ex2010, so HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\RpcProxy\ValidPorts_AutoConfig_Exchange has been checked and looks correct on both CAS servers

PFEXCAS:6001-6004;PFEXCAS.internal.domain.name:6001-6004;PFEXCAS01:6001-6004;PFEXCAS01.internal.domain.name:6001-6004;PFEXCAS02:6001-6004;PFEXCAS02.internal.domain.name:6001-6004;PFEXMB01:6001-6004;PFEXMB01.internal.domain.name:6001-6004;PFEXMB02:6001-6004;PFEXMB02.internal.domain.name:6001-6004;PFEXMB03:6001-6004;PFEXMB03.internal.domain.name:6001-6004

Running Test-OutlookConnectivity -RpcProxyTestType:Internal -RpcTestType:Server -verbose gives us this (results same/similar when run on either CAS server. So there's something wrong with RPC proxying to the address book but hell if I can figure out what. Everything else in the environment seems to be working just fine, and this setup was configured quite closely to the original environment which had working OA.

VERBOSE: [19:08:13.652 GMT] Test-OutlookConnectivity : Target Client Access server = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:13.652 GMT] Test-OutlookConnectivity : Using connection parameters : 
'internal.domain.name.com\extest_23e99fa922cb4: RpcProxy/RPC-over-HTTP, [PFEXCAS01.internal.domain.name.com/Basic]'
VERBOSE: [19:08:13.652 GMT] Test-OutlookConnectivity : Pinging RpcProxy at the following URL: 
https://PFEXCAS01.internal.domain.name.com/rpc/RpcProxy.dll.

ClientAccessServer   ServiceEndpoint                               Scenario                            Result  Latency
                                                                                                                  (MS)
------------------   ---------------                               --------                            ------  -------
PFEXCAS01.FVE.AD.... PFEXCAS01.internal.domain.name.com                     RpcProxy::VerifyRpcProxy.           Success   46.80
VERBOSE: [19:08:13.698 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:13.698 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:13.698 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:13.698 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:13.698 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:13.698 GMT] Test-OutlookConnectivity : Using connection parameters : 
'internal.domain.name.com\extest_23e99fa922cb4: Rfri/RPC-over-HTTP, [PFEXCAS01.internal.domain.name.com/Basic], 
[PFEXCAS01.internal.domain.name.com/Negotiate]'
VERBOSE: [19:08:13.714 GMT] Test-OutlookConnectivity : Mailbox = 'internal.domain.name.com\extest_23e99fa922cb4', Owner = 
'/o=FIVESTAR/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=extest_23e99fa922cb46cb'
VERBOSE: [19:08:13.714 GMT] Test-OutlookConnectivity : Address Book Operation = 'GetNewDSA', Input = 'userLegacyDN', 
Input Value = '/o=FIVESTAR/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=extest_23e99fa922cb46cb'
VERBOSE: [19:08:21.342 GMT] Test-OutlookConnectivity : Microsoft.Exchange.Rpc.ServerUnavailableException: Error 0x6ba 
(The RPC server is unavailable) from cli_RfrGetNewDSA 

EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:21.342

EEInfo: Generating component: 2

EEInfo: Status: 0x000006BA

EEInfo: Detection location: 1710

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 1

EEInfo:    prm[0]: Long val: 0 (0x00000000)



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:21.342

EEInfo: Generating component: 13

EEInfo: Status: 0x000006BA

EEInfo: Detection location: 1352

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 1

EEInfo:    prm[0]: Long val: -1073606646 (0xC002100A)



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:21.342

EEInfo: Generating component: 14

EEInfo: Status: 0xC002100A

EEInfo: Detection location: 1380

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 2

EEInfo:    prm[0]: Long val: 12175 (0x00002F8F)

EEInfo:    prm[1]: Unicode string: /rpc/rpcproxy.dll?PFEXCAS01.internal.domain.name.com:6002



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:21.342

EEInfo: Generating component: 14

EEInfo: Status: 0x00010000

EEInfo: Detection location: 1385

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 2

EEInfo:    prm[0]: Long val: 16 (0x00000010)

EEInfo:    prm[1]: Binary Buffer: 
<junk>



   at ThrowRpcException(Int32 rpcStatus, String message)

   at Microsoft.Exchange.Rpc.RpcClientBase.ThrowRpcExceptionWithEEInfo(Int32 rpcStatus, String routineName)

   at Microsoft.Exchange.Rpc.Rfri.RfriRpcClient.GetNewDSA(String userDN, String& server)

   at Microsoft.Exchange.Monitoring.RfriClientWrapper.<>c__DisplayClass7.<GetNewDSA>b__6()

   at Microsoft.Exchange.Monitoring.OutlookConnectivityContext.RpcExceptionWrapper(Func`1 protectedCall)
VERBOSE: [19:08:21.342 GMT] Test-OutlookConnectivity : AddressBook operation failed.  Operation = 'GetReferral', Error 
= 'The Address Book Referral operation failed. Operation = '<GetNewDSA>b__6', returnValue = '1722', server = 
'PFEXCAS01.internal.domain.name.com', user = '/o=FIVESTAR/ou=Exchange Administrative Group 
(FYDIBOHF23SPDLT)/cn=Recipients/cn=extest_23e99fa922cb46cb', .'
PFEXCAS01.FVE.AD.... PFEXCAS01.internal.domain.name.com                     RFRI::GetReferral.                  Failure   -1.00
VERBOSE: [19:08:21.342 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:21.342 GMT] Test-OutlookConnectivity : Using connection parameters : 
'internal.domain.name.com\extest_23e99fa922cb4: Nspi/RPC-over-HTTP, [PFEXCAS01.internal.domain.name.com/Basic], 
[PFEXCAS01.internal.domain.name.com/Negotiate]'
VERBOSE: [19:08:21.342 GMT] Test-OutlookConnectivity : Address Book Operation = 'Bind'
VERBOSE: [19:08:28.971 GMT] Test-OutlookConnectivity : Microsoft.Exchange.Rpc.ServerUnavailableException: Error 0x6ba 
(The RPC server is unavailable) from cli_NspiBind 

EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:28.955

EEInfo: Generating component: 2

EEInfo: Status: 0x000006BA

EEInfo: Detection location: 1710

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 1

EEInfo:    prm[0]: Long val: 0 (0x00000000)



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:28.955

EEInfo: Generating component: 13

EEInfo: Status: 0x000006BA

EEInfo: Detection location: 1352

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 1

EEInfo:    prm[0]: Long val: -1073606646 (0xC002100A)



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:28.955

EEInfo: Generating component: 14

EEInfo: Status: 0xC002100A

EEInfo: Detection location: 1380

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 2

EEInfo:    prm[0]: Long val: 12175 (0x00002F8F)

EEInfo:    prm[1]: Unicode string: /rpc/rpcproxy.dll?PFEXCAS01.internal.domain.name.com:6004



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:28.955

EEInfo: Generating component: 14

EEInfo: Status: 0x00010000

EEInfo: Detection location: 1385

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 2

EEInfo:    prm[0]: Long val: 16 (0x00000010)

EEInfo:    prm[1]: Binary Buffer: 
<junk>



   at ThrowRpcException(Int32 rpcStatus, String message)

   at Microsoft.Exchange.Rpc.RpcClientBase.ThrowRpcExceptionWithEEInfo(Int32 rpcStatus, String routineName)

   at Microsoft.Exchange.Rpc.Nspi.NspiRpcClient.Bind(UInt32 flags, IntPtr stat, IntPtr guid)

   at Microsoft.Exchange.Monitoring.NspiClientWrapper.<Bind>b__4()

   at Microsoft.Exchange.Monitoring.OutlookConnectivityContext.RpcExceptionWrapper(Func`1 protectedCall)
VERBOSE: [19:08:28.971 GMT] Test-OutlookConnectivity : Address Book operation failed. Details: The NSPI operation 
failed. Operation = '<Bind>b__4', ReturnValue = '1722', Server = 'PFEXCAS01.internal.domain.name.com', User = 
'/o=FIVESTAR/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=extest_23e99fa922cb46cb', ..
PFEXCAS01.FVE.AD.... PFEXCAS01.internal.domain.name.com                     NSPI::GetProfileDetails.            Failure   -1.00
VERBOSE: [19:08:28.971 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:28.971 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:28.971 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:28.971 GMT] Test-OutlookConnectivity : Using connection parameters : 
'internal.domain.name.com\extest_23e99fa922cb4: Mailbox/RPC-over-HTTP, [PFEXCAS01.internal.domain.name.com/Basic], 
[PFEXCAS01.internal.domain.name.com/Negotiate]'
VERBOSE: [19:08:28.971 GMT] Test-OutlookConnectivity : Mailbox Operation: 'EcDoConnectEx', Target mailbox: 
'/o=FIVESTAR/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=extest_23e99fa922cb46cb'
VERBOSE: [19:08:28.986 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:28.986 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:36.599 GMT] Test-OutlookConnectivity : Microsoft.Exchange.Rpc.ServerUnavailableException: Error 0x6ba 
(The RPC server is unavailable) from EcDoConnectEx 

EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:36.599

EEInfo: Generating component: 13

EEInfo: Status: 0x000006BA

EEInfo: Detection location: 1352

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 1

EEInfo:    prm[0]: Long val: -1073606646 (0xC002100A)



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:36.599

EEInfo: Generating component: 14

EEInfo: Status: 0xC002100A

EEInfo: Detection location: 1380

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 2

EEInfo:    prm[0]: Long val: 12175 (0x00002F8F)

EEInfo:    prm[1]: Unicode string: /rpc/rpcproxy.dll?PFEXCAS01.internal.domain.name.com:6001



EEInfo: ComputerName: n/a

EEInfo: ProcessID: 4520

EEInfo: Generation Time: 2015-01-27 19:08:36.599

EEInfo: Generating component: 14

EEInfo: Status: 0x00010000

EEInfo: Detection location: 1385

EEInfo: Flags: 0

EEInfo: NumberOfParameters: 2

EEInfo:    prm[0]: Long val: 16 (0x00000010)

EEInfo:    prm[1]: Binary Buffer: 
<junk>



   at ThrowRpcException(Int32 rpcStatus, String message)

   at Microsoft.Exchange.Rpc.RpcClientBase.ThrowRpcExceptionWithEEInfo(Int32 rpcStatus, String routineName)

   at Microsoft.Exchange.Rpc.ExchangeClient.ExchangeRpcClient.EcDoConnect_Wrapped(Boolean isEx, Void** pcxh, Byte* 
szUserDN, UInt32 ulFlags, UInt32 ulConMod, UInt32 cbLimit, UInt32 ulCpid, UInt32 ulLcidString, UInt32 ulLcidSort, 
UInt32 ulIcxrLink, UInt16 usFCanConvertCodePages, UInt32* pcmsPollsMax, UInt32* pcRetry, UInt32* pcmsRetryDelay, 
UInt16* picxr, Byte** pszDNPrefix, Byte** pszDisplayName, UInt16* rgwClientVersion, UInt16* rgwServerVersion, UInt16* 
rgwBestVersion, UInt32* pulTimeStamp, Byte* rgbAuxIn, UInt32 cbAuxIn, Byte* rgbAuxOut, UInt32* pcbAuxOut)

   at Microsoft.Exchange.Rpc.ExchangeClient.ExchangeRpcClient.EcDoConnect_Internal(Boolean isEx, IntPtr& contextHandle,
 String userDn, Int32 flags, Int32 sizeLimit, Int32 conMod, Int32 cpid, Int32 lcidString, Int32 lcidSort, Int32 
sessionIdLink, Boolean canConvertCodePages, TimeSpan& pollsMax, Int32& retryCount, TimeSpan& retryDelay, String& 
dnPrefix, String& displayName, Int16[] clientVersion, Int16[]& serverVersion, Int16[]& bestVersion, Int32& timeStamp, 
Byte[] auxIn, Boolean compressAuxIn, Boolean xorMagicAuxIn, Byte[]& auxOut, Int32 maxSizeAuxOut, Boolean& 
wasCompressedAuxOut, Boolean& wasXorMagicAuxOut)

   at Microsoft.Exchange.Rpc.ExchangeClient.ExchangeRpcClient.EcDoConnectEx(IntPtr& contextHandle, String userDn, Int32
 flags, Int32 sizeLimit, Int32 conMod, Int32 cpid, Int32 lcidString, Int32 lcidSort, Int32 sessionIdLink, Boolean 
canConvertCodePages, TimeSpan& pollsMax, Int32& retryCount, TimeSpan& retryDelay, String& dnPrefix, String& 
displayName, Int16[] clientVersion, Int16[]& serverVersion, Int16[]& bestVersion, Int32& timeStamp, Byte[] auxIn, 
Boolean compressAuxIn, Boolean xorMagicAuxIn, Byte[]& auxOut, Int32 maxSizeAuxOut, Boolean& wasCompressedAuxOut, 
Boolean& wasXorMagicAuxOut)

   at Microsoft.Exchange.Monitoring.MailboxTask.<>c__DisplayClassb.<Connect>b__a()

   at Microsoft.Exchange.Monitoring.OutlookConnectivityContext.RpcExceptionWrapper(Func`1 protectedCall)
VERBOSE: [19:08:36.599 GMT] Test-OutlookConnectivity : EcDoConnectEx Result: '1722'
VERBOSE: [19:08:36.599 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
PFEXCAS01.FVE.AD.... PFEXCAS01.internal.domain.name.com                     Mailbox::Connect.                   Failure   -1.00
VERBOSE: [19:08:36.615 GMT] Test-OutlookConnectivity : RPC Endpoint = 'PFEXCAS01.internal.domain.name.com'
VERBOSE: [19:08:36.615 GMT] Test-OutlookConnectivity : This step was skipped. This may have been caused by the failure 
in a previous scenario. Operation = 'MailboxTask::Logon'.
PFEXCAS01.FVE.AD.... PFEXCAS01.internal.domain.name.com                     Mailbox::Logon.                     Skipped   -1.00
VERBOSE: [19:08:36.615 GMT] Test-OutlookConnectivity : Admin Audit Log: Entered Handler:OnComplete.
VERBOSE: [19:08:36.615 GMT] Test-OutlookConnectivity : Ending processing &

My client is in the process of being divested from a parent company, and users have already been migrated to a new AD forest and Exchange org. On the parent company, they want autoreplies for the divested users (easy enough), but they want them to always fire for every received message.

In Exchange 2010 and the OWA GUI, it states that the OOO/autoreply will be sent once for each sender. This is not configurable, AFAICT. Management wants the configured autoreply to fire every time. Is this something that I can force?

Alternatively, I considered creating a simple inbox rule to fire on every message that is received after "x" date (today), with the action to have the server reply with an appropriate message. However, this rule is only visible/configurable in Outlook, not OWA.

Thus I can't have my users (already migrated, thus Outlook is using the new domain) set this in Outlook in the old domain - not without walking them through trying to make new profiles manually connected to the old Exchange org. No thanks.

Also, the New-InboxRule cmdlet does not appear to be able to configure the "reply" action, unless I'm missing something, so I can't do this in a PowerShell script.

Any ideas on other ways to solve this problem? A custom bounce Transport rule looks likely to be ignored by senders - since the custom message is buried in the 5.7.1 error code, and it does not resemble normal OOO messages.

/ Bah humbug. Just found this one. Unless things have changed, I'm likely out of luck. Exchange out of office, sending an OoO reply for every email

So, we're doing a big cross-forest Exchange (2010->2010) migration, using Quest. It is not working correctly for mailboxes that have custom Managed Folders, which my client uses instead of retention policies.

Quest will bring over the "Managed Folders" hierarchy to the target mailbox, but not as system managed folders - easy to confirm in OWA, the system ones have a little green-n-white badge on them. Exchange also creates an empty "Managed Folders" hierarchy, so the user has two sets of folders named "Managed Folders" - one with all their content, but no retention policy so it all gets expired, and one with no content, but the correct policy.

Not awesome. We're working with Quest tech support right now, but they're leaning towards "not our problem" currently. Any ideas?

We have already tried this : removed the MF Mailbox policy from a target mailbox entirely (confirming by showing that there are no longer any "Managed Folders" at all), and then do another sync. User now has a "Managed Folders" hierarchy. Apply the MF Mailbox policy. Exchange creates an empty "Managed Folders1" hierarchy. Same problem, slightly different flavor.

/Edit to clarify - this only happens if we do the Quest Sync-n-Switch method. If we process the mailbox using the RUC (Resource Update) method, the Managed Folders are not duplicated.

I have a client that is divesting a business unit into a new AD forest, Exchange org, etc.

We're using Quest tools to migrate users and mailboxes. However, I have to build the new infrastructure to match the old one.

In the old one, we're using Managed Folder Mailbox Policies to limit (or allow) retention. They started with Exchange 2007 and never upgraded to Retention Policies; oh well.

So, in the old environment, when you use a 2007 server to define a new Managed Content Setting, you can pick "Email" from the dropdown for MessageClass. This is a display name; the actual MessageClass values are thus:

MessageClass : IPM.Note;IPM.Note.AS/400 Move Notification Form v1.0;IPM.Note.Delayed;IPM.Note.Exchange.ActiveSync.Report;IPM.Note.JournalReport.Msg;IPM.Note.JournalReport.Tnef;IPM.Note.Microsoft.Missed.Voice;IPM.Note.Rules.OofTemplate.Microsoft;IPM.Note.Rules.ReplyTemplate.Microsoft;IPM.Note.Secure.Sign;IPM.Note.SMIME;IPM.Note.SMIME.MultipartSigned;IPM.Note.StorageQuotaWarning;IPM.Note.StorageQuotaWarning.Warning;IPM.Notification.Meeting.Forward;IPM.Outlook.Recall;IPM.Recall.Report.Success;IPM.Schedule.Meeting.*;REPORT.IPM.Note.NDR

If I take that and try to mangle it into a new cmdlet for Ex2010 in my new environment here's what I get

New-ManagedContentSettings -Name "Delete Messages older then 90 days" -FolderName "Entire Mailbox" -RetentionEnabled $True -AgeLimitForRetention 90 -TriggerForRetention WhenDelivered -RetentionAction DeleteAndAllowRecovery -MessageClass "IPM.Note","IPM.Note.AS/400MoveNotificationFormv1.0","IPM.Note.Delayed","IPM.Note.Exchange.ActiveSync.Report","IPM.Note.JournalReport.Msg","IPM.Note.JournalReport.Tnef","IPM.Note.Microsoft.Missed.Voice","IPM.Note.Rules.OofTemplate.Microsoft","IPM.Note.Rules.ReplyTemplate.Microsoft","IPM.Note.Secure.Sign","IPM.Note.SMIME","IPM.Note.SMIME.MultipartSigned","IPM.Note.StorageQuotaWarning","IPM.Note.StorageQuotaWarning.Warning","IPM.Notification.Meeting.Forward","IPM.Outlook.Recall","IPM.Recall.Report.Success","IPM.Schedule.Meeting.*","REPORT.IPM.Note.NDR"  -whatif

Invoke-Command : Cannot bind parameter 'MessageClass' to the target. Exception setting "MessageClass": "The length of t he property is too long. The maximum length is 255 and the length of the value provided is 518." At C:\Users\MFinnigan.sa\AppData\Roaming\Microsoft\Exchange\RemotePowerShell\pfexcas02.fve.ad.5ssl.com\pfexcas02.fve.ad .5ssl.com.psm1:28204 char:29 + $scriptCmd = { & <<<< $script:InvokeCommand ` + CategoryInfo : WriteError: (:) [New-ManagedContentSettings], ParameterBindingException + FullyQualifiedErrorId : ParameterBindingFailed,Microsoft.Exchange.Management.SystemConfigurationTasks.NewManaged ContentSettings

So, the config object can store all that mess, but I can't fit it in through the cmdlet to create the object. Lovely.

Any ideas?

I'm making a new Ex2010 environment. Yes, the client knows about Exchange 2013.

I have a Netscaler up-front for access from outside, but it's only in the DMZ, not available from the inside. I can configure the Netscaler to handle SSL Offload, but can I still also use SSL on the inside afterwards? I know to make SSL Offload work, I have to disable the requirement for SSL on all the IIS sites and VirDirs, etc. But there's a few steps where you go into web.config (for EWS and Autodiscover) and mangle the files to replace https with http.

I would prefer to continue using HTTPS for any connections that aren't coming from the Netscaler. Is that possible, or is this an only-one-or-the-other situation, from the POV of the Exchange CAS servers?

... Or, does this even matter much? All internal Outlook connections will be MAPI, if the clients fail over to Outlook Anywhere they'll be hitting the Netscaler anyway. Except for maybe autodiscover. Hm.

We have an Exchange 2010 environment and an OCS 2007 R2 server. Our policy is to delete all non-calendar and non-contact items after 90 days. The "Conversation History" folder is not affected by this however. Using my mailbox as an example, my "ManagedFolderMailboxPolicy" is "Regular Mailbox". Our Managed Content Settings are thus:

Get-ManagedContentSettings | ? { $_.managedfoldername -eq "Entire Mailbox" -or $_.managedfoldername -eq "inbox" -and $_.name -notlike "Unity 30 days"  }

Name                      MessageClass              ManagedFolderName
----                      ------------              -----------------
Delete Messages older ... IPM.Note;IPM.Note.AS/4... Entire Mailbox
Delete Items older the... *                         Inbox

So, as you see, IPM.Note is right there, applied to Entire Mailbox. But the messages in Conversation History are not deleting. I did notice that we didn't have a ManagedFolder, of type DefaultFolder, for ConversationHistory, so I added it, but that hasn't caused saved IMs older than 90 days to be removed from my mailbox.

So, we had an issue today where less than a dozen users have been getting timeout errors in OWA. "! Server Busy The server is busy and respond to your request. Please try again later."

They're all external, thus coming through our TMG and hitting only one of our two CAS servers for the site where their mailboxes live. There's around 5000 mailboxes total at this site, but most users are hitting the CAS array internally and thus are evenly split between the two.

Upon inspection, the IIS logs show >200 instances of "overbudget". Example below.

Looks like the problem is "Max Effective Time In CAS" , and Perfmon does show this often creeping above 100%, during the time I was running Perfmon. We collect performance data via Solarwinds, but this isn't one of the counters so I don't have a history. Our last 7 days of IIS logging show that we generally see single-digits-per-day of "overbudget", however.

Thing is, I see essentially nothing on what to do about reducing "effective time spent in CAS" - other than removing/changing my throttling policy. Nothing else really jumps out at me for performance on this server. CPU and RAM are fine - it's a dual-proc VM, averaging ~27% CPU on each proc. 12 GB RAM, 3 GB cached, 3 GB available, 50 MB free. Other than getting proper load-balancing, so as to spread out the load, what can I actually do to diagnose and fix this issue that is stemming from this counter?

2014-05-09 15:41:54 10.70.39.170 GET /owa/ &ex=E303&OverBudget(Normal/CAS),Owner:Sid~domain\username~OWA~false [Conn:2,HangingConn:0,AD:18000/18000/0%,CAS:90000/-2602/155%,AB:18000/18000/0%,RPC:90000/89768/1%,FC:1000/0,Policy:DefaultThrottlingPolicy_aaadc777-4ff8-4a5e-97cc-2ec1e383cb7b,Norm] &v=14.3.174.1&mbx=SERVER01.company.local&sessionId=e842baf430514576aabf3ef6f372494c&prfltncy=1&prfrpccnt=0&prfrpcltncy=0&prfldpcnt=0&prfldpltncy=0&prfavlcnt=0&prfavlltncy=0&End+Budget>> Conn:2,HangingConn:0,AD:18000/18000/0%,CAS:90000/-2602/155%,AB:18000/18000/0%,RPC:90000/89768/1%,FC:1000/0,Policy:DefaultThrottlingPolicy_aaadc777-4ff8-4a5e-97cc-2ec1e383cb7b, Norm 443 company.local\ Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_9_2)+AppleWebKit/537.75.14+(KHTML,+like+Gecko)+Version/7.0.3+Safari/537.75.14 200 0 0 202

We're in the latter days of a 2007 -> 2010 migration for a fairly large org - about 12 Exchange servers total. The users mailboxes have (almost) all been moved to 2010, mailflow is (almost) entirely on 2010.

I've made replicas of all the Public Folders from the 2007 servers to a new 2010 server, just for public folder mailboxes. Replication was done over a week ago, and there's a handful of folders that won't complete replicating. We have ~500 public folders, and there's 6 remaining who's item count is far less than it's supposed to be. (I compared the output line-by-line of Get-PublicFolderStatistics against the 2007 and 2010 servers)

I've turned up 9001 Replication logging on the 2010 server to Expert. I do see a lot of this message during a replication run, but I also see a lot of successes : An incoming replication message was processed. The error:

Error -2147221233 reading property 0x67480014 on object type tbtReplication from database "2010PublicFolders". This appears to be harmless however. I'm not seeing any other errors on the 2010 server.

Any guesses, or next steps? To reiterate, I've got ~500 folders successfully replicated, but 6 that have a fraction of what they should.

Today, I added a single item to one of these PF on 2007, ran Update-PublicFolder "\MIS\MIS Contacts\Vendors" -server 2007Server and watched it replicate - the event viewer on each side shows the outgoing and incoming replication message. The only errors are the tbtReplication error listed above that is documented to be a false alarm.

The item count for this folder (using get-publicfolderstatistics) on 2007 is now 334, and on 2010 it's 1. So... it's updating some of the content but not all? Just new content? Not sure where to go next from here.

(As an aside, there are a few dozen folders that have an item count on 2010 that is 1 less than on 2007. Is that noise, or does it indicate another potential problem?)

We have a web proxy running as a service. It's a straight-up EXE, within it is a packaged java application.

Sometimes, we get this in the log file the application generates, and the proxy stops working.

26-11-2013 09:42:48,661 [ServerThread] ERROR pe - Unable to start server java.net.SocketException: Unrecognized Windows Sockets error: 0: JVM_Bind at java.net.PlainSocketImpl.socketBind(Native Method) at java.net.PlainSocketImpl.bind(PlainSocketImpl.java:365) at java.net.ServerSocket.bind(ServerSocket.java:319) at java.net.ServerSocket.(ServerSocket.java:185) at java.net.ServerSocket.(ServerSocket.java:141) at pe.a(Unknown Source) at oe.run(Unknown Source)

But the EXE happily keeps running. Is there any general way of making the EXE fail when this Java failure occurs, so that the Windows native ability to restart failed services kicks in? Obviously, if the software vendor has to build this in, there's no way you, gentle reader, would know the answer. I'm just wondering if there's a Java flag that I'm not aware of.

It looks like it was built with procrun, I think. I'm saying that based on running strings.exe on the connector.exe file.

I know that a more complete solution would be log-file monitoring, with alerting and possible automated remediation. That's not something that I can do today however.

Windows CMD shell - any easy way of redirecting the command itself into the output? If I do net localgroup administrators > %computername%-admins.txt, I'd like the output file to contain the net statement as well.

No powershell available to me; pure CMD/COMMAND only.

This is for an audit; the auditors want to see what command generated the output. I'm trying to avoid screenshots or enormous copy-paste from CMD windows.

So, this may be a misunderstanding on my part of how netsh is supposed to work. If I am logged onto server A (or apparently any other server), I can run netsh interface ip dump and get what I want (which is at heart, a list of all DNS servers for all interfaces for all machines in my domain.) See "Local" below.

If I do it from another (apparently, any other) machine in the domain via netsh -r A interface ip dump, it doesn't actually give me any of the interfaces or their info. (See "Remote" below.) Same thing happens in interactive mode, as well.

Thoughts? I've done some googling, with no description of this problem at all. I haven't found any machines that this works properly on.

Local:

# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip

# Interface IP Configuration for "Team BE"
set address name="Team BE" source=static addr=xxxx mask=255.255.224.0
set address name="Team BE" gateway=xxxx  gwmetric=0
set dns name="Team BE" source=static addr=xxxx  register=PRIMARY
add dns name="Team BE" addr=xxxx index=2
set wins name="Team BE" source=static addr=none

popd
# End of interface IP configuration

Remote:

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled

popd
# End of IPv4 configuration

We have a huge logfile being written by a vendor's application. Let's assume the vendor won't do anything that we ask. Is there any way of rotating that logfile? We're looking at about 300 MB an hour being written - I'd much rather chunk that into 10 MB pieces, and let anything older than a day or over 1000 files fall off a cliff.

(I know I know, possible duplicate of How do you rotate apache logs on windows without interrupting service?)

Aha - the Chomp log was dead, but searching for "chomp logrotate" brought me to its new site. I'll give it a try tomorrow and reply if I like it. I'd still like to hear about software anyone else is using that works for this.

We've got several processes that move files across servers - SFTP, FTP, SCP; Windows, Linux, AIX; there is a workflow component (usually require a control file with filenames and hash values to move a batch of related files). The action is often initiated on our servers to get the files, so we need to make sure they're done being written.

We have some homegrown scripts to do this, but they don't always work properly, and troubleshooting, maintenance, and log review is not easy this way. There's a lot of servers, and our scripts don't have central logging or a dashboard/console/etc.

We're looking into commercial products to do this. Has anyone used MQ File Transfer Edition? Another team in our company is using Aspera, does anyone have any thoughts on that, or other favored products?

I have no idea what our budget is for this, yet. Just trying to get a handle on the product space from the perspective of other admins.

/edit - In my situation, we're moving 2-file payloads (one binary, one metadata) of scanned images from different sources to different destinations. We wait until a 3rd control file is written with the checksums - when the move is complete, the control file is deleted.

The sources are primarily a handful of Windows file servers, or Windows SFTP servers, that receive these files from scanning processes. We also have sources that are FTP or SFTP servers that receive the same payloads from external parties. The destination is a set of AIX servers that ingest the images into an archive, so the files don't remain in the destination either. Robustness is definitely our major concern.

We move a few GB every day, I guess. (Without centralized logging, I can't give a better number.) The binary files probably average around 100 MB, the metadata quite a bit smaller.

Short story : We have a need for a rock-solid reliable file mover process. We have source directories that are often being written to that we need to move files from. The files come in pairs - a big binary, and a small XML index. We get a CTL file that defines these file bundles. There is a process that operates on the files once they are in the destination directory; that gets rid of them when it's done. Would rsync do the best job, or do we need to get more complex? Long story as follows :

We have multiple sources to pull from : one set of directories are on a Windows machine (that does have Cygwin and an SSH daemon), and a whole pile of directories are on a set of SFTP servers (Most of these are also Windows.) Our destinations are a list of directories on AIX servers.

We used to use a very reliable Perl script on the Windows/Cygwin machine when it was our only source. However, we're working on getting rid of that machine, and there are other sources now, the SFTP servers, that we cannot presently run our own scripts on.

For security reasons, we can't run the copy jobs on our AIX servers - they have no access to the source servers. We currently have a homegrown Java program on a Linux machine that uses SFTP to pull from the various new SFTP source directories, copies to a local tmp directory, verifies that everything is present, then copies that to the AIX machines, and then deletes the files from the source. However, we're finding any number of bugs or poorly-handled error checking. None of us are Java experts, so fixing/improving this may be difficult.

Concerns for us are:

• With a remote source (SFTP), will rsync leave alone any file still being written? Some of these files are large.
• From reading the docs, it seems like rysnc will be very good about not removing the source until the destination is reliably written. Does anyone have experience confirming or disproving this?
• Additional info We will be concerned about the ingestion process that operates on the files once they are in the destination directory. We don't want it operating on files while we are in the process of copying them; it waits until the small XML index file is present. Our current copy job are supposed to copy the XML file last.
• Sometimes the network has problems, sometimes the SFTP source servers crap out on us. Sometimes we typo the config files and a destination directory doesn't exist. We never want to lose a file due to this sort of error.
• We need good logs

If you were presented with this, would you just script up some rsync? Or would you build or buy a tool, and if so, what would it be (or what technologies would it use?) I (and others on my team) are decent with Perl.

Edit - I'm starting to look into Perl's Template-Toolkit. It seems to fit the bill nicely for the problem described below. Has anyone played with it? Any (detailed) advice?

I asked a question about config management, and haven't seen a reply. It's possible my question was too vague, so let's get down to brass tacks. Here's the process we follow when onboarding a new customer instance into our hosted application : how would you manage this? I'm leaning towards a Perl script to populate templates to generate shell scripts, config files, XML config files, etc. Looking briefly at CFengine and Chef, it seems like they're not going to reduce the amount of work, because I'd still have to manually specify all of the changes/edits within the tool. Doesn't seem to be much of a gain over touching the config files directly.

1. We add a stanza to the main config file for the core (3rd-party) application. This stanza has values that
   • defines the instance (customer) name
   • the TCP listener port for this instance (not one currently used)
   • the DB2 database name (serial numeric identifier, already exists, they get prestaged for us by the DBAs)
   • three sub-config files, by name - they need to be created from 3 templates and be named after the instance
2. The sub-config files define:
   • The filepath for the DB2 volumes
   • The filepath for the storage of objects
   • The filepath for just one of the DB2 volumes (yes, redundant to the first item.
3. We run some application commands, start the instance
4. We do some LDAP thingies (make an OU for the instance, etc.)
5. We add a stanza to the config file for our security listener that acts as a passthrough to LDAP
   • instance name
   • LDAP OU
   • TCP port for instance
   • DB2 database name
6. We restart the security listener (off-hours), change the main config file from item 1, stop and restart the instance. It is now authenticating via LDAP.
7. We add the stop and start commands for this instance to the HA failover scripts.
8. We import an XML config file into the instance that defines things for the actual application for the customer - user names, groups, permissions, and business rules. The XML is supplied by the implementation team.

Now, we configure the dataloading application

6. We add a stanza to the existing top-level config file that points to a new customer-level config file. The new customer-level config file includes:
   • the instance (customer) name
   • the DB2 database name
   • arbitrary number of sub-config files, by name
7. Each of the sub-config files defines:
   • filepaths to the directories for ingestion, feedback, backup, and failure
   • those filepaths have a common path to a customer-specific folder, and then one folder for each sub-config file
8. Each of those filepaths needs to be created
9. We need to add this customer instance to our monitoring scripts that confirm the proper processes are running and can be logged into. Of course, those monitoring config files include the instance name, the TCP port, the DB2 database name, etc.
10. There's also a reporting application that needs to be configured for the new instance. You get the idea.
11. There's also XML that is loaded into WAS by the middleware team. We give them the values for them to plug into the XML - they could very easily hand us the template and we could give them back completed XML.