DKNUCKLES's questions

I am attempting to uninstall Exchange 2010 that exists at a DR site in which Double Take Availability was used to replicate the Exchange Database and logs in the event of a catastrophe. Long story short, this server is no longer necessary and I'd like to get rid of it to free up some space on the DR box.

Attempting to uninstall the server on the DR site fails at the Readiness Check with the following error.

Error: Uninstall cannot continue. Database 'Public Folder Database XXXXXXXXXX (servername)': The critical property 'PublicFolderHierarchy' is missing in the PublicFolderDatabase object 'Public Folder Database XXXXXXXXXX (servername)'

In investigating this error I've come across This Article however there is nothing matching the CN=ServerName discussed in my Configuration Container of ADSI.

I'm stumped on this one - any help would be appreciated.

I had a bizarre instance this morning and I'm hoping someone can help me shed some light as to what's happened.

A user complained about being locked out this morning. After resetting the password, we noticed that the account was almost instantaneously locked out again. We looked through the audit logs to discover the requests were coming from our Exchange server - something I had never really seen before.

We looked through the OWA logs to discover that there were no entries in there corresponding to that username. We disabled OWA, ActiveSync, MAPI, etc and the account continued to be locked out.

After looking through the event viewer logs on the Exchange server, we came across this entry.

Inbound authentication failed with error LogonDenied for Receive connector Default EMAILSERVER. The authentication mechanism is Login. The source IP address of the client who tried to authenticate to Microsoft Exchange is [XX.XX.XX.XX].

With nowhere left to turn, we black-hole'd the traffic from that IP address and the account lockouts ceased. This was a public IP address that resolved to a country where I would not expect to receive much mail from.

My questions are :

• How was this IP address attempting to authenticate? I can't see anything in my logs that would make any sense to me as to the vector which they tried to log in.
• How can I prevent this from happening in the future? This is Exchange 2010 SP3 and unfortunately Edge Transport is not a viable option at this point :(

I'm trying to configure Icinga to query the SMART status of the hard drives loaded into a storage array I'm configuring.

The issue I've run into is the response from the array when querying the OID of a drive is text, and not a number.

./check_snmp -H 10.0.10.17 -P 2c -C public -o .1.3.6.1.4.1.24681.1.2.11.1.7.1
SNMP OK - "GOOD" |

I'm used to working with numbers rather than strings when dealing with output of check_snmp. Does anyone know how I can create a critical or warning notification when anything other than the output GOOD is returned?

I need to provide read access to a user in Exchange 2010. No matter how many different variances of the PowerShell I use I get a "Could not expand the folder" error in Outlook, and "Your mailbox appears to be unavailable..." error in OWA.

The following are the commands I have tried without luck - can anyone see the error in my logic?

add-mailboxfolderpermission -identity <user> -user <user2> -accessrights reviewer

add-mailboxfolderpermission -identity <user:\inbox> -user <user2> -accessrights reviewer

add-mailboxpermission -identity <user> -user <user2> -accessrights ReadPermission

add-mailboxpermission -identity <user> -user <user2> -accessrights ReadPermission -inheritancetype SelfandChild

and finally

ForEach ($f in (Get-MailboxFolderStatistics <user> | Where {($_.folderpath -notlike "/Conversation Action Settings") -and ($_.folderpath -notlike "/Quick Step Settings") -and ($_.folderpath -notlike "/Recoverable Items") -and ($_.folderpath -notlike "/Deletions") -and ($_.folderpath -notlike "/Purges") -and ($_.folderpath -notlike "/Versions") -and ($_.Folderpath -notlike "/Top of Information Store")})) {$fname = "<user>:" + $f.FolderPath.Replace("/","\"); Add-MailboxFolderPermission $fname -User <user2> -AccessRights Reviewer}

Can anyone see where I've gone wrong? This needs to be done with PowerShell and can't be done by providing FullAccess rigths and then providing permissions on a per-folder basis.

One of my clients wanted a Hyper-V Exchange 2010 box to be moved to an ESXi box on a different subnet for several reasons. I ran the VMWare Converter from the Hyper V machine to the ESXi box and it all seems to have gone to plan.

When the box booted up I changed the network configuration to reflect the new subnet information, checked DNS to ensure the change was propagated, etc. I have noticed that my test e-mails from OWA do not send, but rather sit in the draft folder. Incoming e-mails also come as duplicates, but at least they reach the recipient.

The send connector looks correct (Type: SMTP, Address: *, Cost: 1, network : Use DNS Records to route mail automatically, and the source server is the local exchange server). The test-servicehealth cmdlet shows that there are all required services are running. Nothing of any use shows up in the Event Viewer.

Does anyone have any ideas on how to resolve an issue like this?

EDIT : Running the test-mailflow cmdlet produces a failure, however it doesn't seem to indicate why that might be.

Building on a previous question I had asked re: a VM freezing at the end of the backup, one of the solutions Veeam has offered is to make sure that there are no other snapshots that exist of that vm. After looking into it, I've found the following snapshot (presumably from a borked backup job)

I would like to delete this snapshot in hopes of resolving my issue, however I need to ensure that the machine isn't negatively affected by this. Reading the VMWare documentation on the issue it states :

Deleting a snapshot leaves the current state of the virtual machine or any other snapshot untouched. Deleting a snapshot consolidates the changes between snapshots and previous disk states and writes to the parent disk all data from the delta disk that contains the information about the deleted snapshot. When you delete the base parent snapshot, all changes merge with the base virtual machine disk.

Below is a picture of the datastore of the virtual machine (Datastore is DAS). If I schedule downtime for this server and shut it off during the process, can I safely delete this snapshot without any negative ramifications on the machine? I need to ensure that the state of the machine stays exactly how it is.

EDIT : For anyone interested this snapshot was successfully deleted last night without turning the machine off. It took about an hour and a half to consolidate the snapshot. After the snapshot was deleted, both snapshots mentioned by Jeff Hengesbach are no longer there.

I have a virtual machine that I'm backup up using Veeam Backup & Replication 6.5. The software is working well, but one issue I'm having is that at the end of the backup (99%) the machine will freeze from anywhere from 2 - 5 minutes. This makes backing up servers in the middle of the day next to impossible because of the workflow disruption it causes.

The reason I'm not contacting Veeam in this regard is because I had just switched to Veeam, where before it was Acronis vmProtect however it did not always do this. The same thing happened, only with that backup software I could see "Removing Snapshot" in the tasks pane of vSphere. I assume the removal of the snapshot is what causes the problem in Veeam as well.

During this freezing it halts all features of the server and I get an error when attempting to access the console stating Error Connecting to the MKS: Error Connecting to the /bin/vmx process. Research of that line points to corruption of the vmx file, however I don't think that's the case as that message is only present during the end of a backup.

I have another virtual guest being backed up with Veeam B&R on the same host and it does not present the problems outlined above.

Does anyone know what the issue here might be?

EDIT : Storage system for local backups is a Drobo i800 connected via iSCSI. Storage for offsites is a NAS box on a RAID 1

EDIT 2 : vSphere version is 5.0 and VMWare Tools is installed. Guest OS is Server 2008 R2 64 Bit, and if I connect to the console before snapshot removal begins the screen will go black and the /bin/vmx message shows up in the top of the screen after about a 20 second delay of seeing only black on the console screen.

I have a very bizarre set of circumstances. One of my staff received an e-mail addressed to me from a consultant, however this consultant would have no idea who this staff is or their e-mail address. I also received the e-mail, however it's quite concerning to me that something like this might happen.

Points worth noting

• The anti-spam logs do NOT show my colleague getting the mail, but show me getting the mail.
• The Exchange Tracking Logs show both of us getting it (they are bizarre though - more on that below)
• This is a lone exchange server that serves CAS, HT and MB roles
• Server is up-to-date with updates and service packs
• Spam filtering is done with Exchange Server Toolbox V4
• There are no delegate permissions or forwarding rules on either of our accounts

Below is the scrubbed message tracking log - the peculiar thing is that I am the correct recipient, however that e-mail arrives one minute after the incorrect. You'll also note that the two Client IP's, Client Hostnames, Server hostnames and return paths are completely different - as if they've come from two different people.

Timestamp   ClientIp    ClientHostname  ServerIp    ServerHostname  SourceContext   EventId InternalMessageId   MessageId   TotalBytes  RecipientCount  MessageSubject  Sender  ReturnPath
07/09/2013 11:40    2.2.2.2 different.sending.server.com    10.0.0.7    postmaster  08D04A67B764B4DB;2013-07-09T15:40:26.336Z;0 RECEIVE 253201  <6FC8422858D3E0419323DB54F887D2CC390F0BF9@mbx023-w1-ca-10.exch023.domain.local> 8882    1   RE: Server Down?    [email protected]   [email protected]
07/09/2013 11:40        myserver        MYSERVER    08D04A67B764B4E9;2013-07-09T15:40:54.377Z;0 DELIVER 253201  <6FC8422858D3E0419323DB54F887D2CC390F0BF9@mbx023-w1-ca-10.exch023.domain.local> 9212    1   RE: Server Down?    [email protected]   [email protected]
07/09/2013 11:41    1.1.1.1 correct.sending.server.com  10.0.0.7    postmaster  08D04A67B764B4E2;2013-07-09T15:40:42.088Z;0 RECEIVE 253207  <6FC8422858D3E0419323DB54F887D2CC390F0BF9@mbx023-w1-ca-10.exch023.domain.local> 9437    1   RE: Server Down?    [email protected]   [email protected]
07/09/2013 11:41        myserver        MYSERVER    08D04A67B764B4EF;2013-07-09T15:41:18.790Z;0 DELIVER 253207  <6FC8422858D3E0419323DB54F887D2CC390F0BF9@mbx023-w1-ca-10.exch023.domain.local> 9767    1   RE: Server Down?    [email protected]   [email protected]

Does anyone know what might cause this??

EDIT : Sanitized logs of e-mail sent to my colleague

X-Process: ESTProcessDone
Received: from hub023-ca-3.exch023.serverdata.net (1.1.1.1) by
myserver.mydomain.com (10.0.0.7) with Microsoft SMTP Server (TLS) id
14.3.123.3; Tue, 9 Jul 2013 11:40:42 -0400
Received: from MBX023-W1-CA-10.exch023.domain.local ([10.254.8.60]) by
HUB023-CA-3.exch023.domain.local ([10.254.8.36]) with mapi id 14.03.0123.003;
Tue, 9 Jul 2013 08:40:41 -0700
From: sender <[email protected]>
To: Me <[email protected]>
Subject: RE: Server Down?
Thread-Topic: Server Down?
Thread-Index: Ac58tY3CMo8EMLUTR3OVT6VTqv9MowAApWDwAACb9EA=
Date: Tue, 9 Jul 2013 15:40:41 +0000
Message-ID: <6FC8422858D3E0419323DB54F887D2CC390F0BF9@mbx023-w1-ca-10.exch023.domain.local>
References: <6FC8422858D3E0419323DB54F887D2CC390F0B9B@mbx023-w1-ca-10.exch023.domain.local>
<[email protected]>
In-Reply-To: <[email protected]>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [3.3.3.3]
Content-Type: multipart/alternative;
                boundary="_000_6FC8422858D3E0419323DB54F887D2CC390F0BF9mbx023w1ca10exc_"
MIME-Version: 1.0
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: myserver.mydomain.com
X-MS-Exchange-Organization-AuthAs: Anonymous

EDIT 2 :

After reviewing the anti-spam logs it looks as though my colleague had an e-mail arrive to her at the exact time the incorrect one was delivered to her. The aforementioned e-mail is from the same person / IP address that shows up in "different.sending.server" and "2.2.2.2" Client IP Address.

My colleague never received the e-mail listed above but instead received the one addressed to me.

I've been trying to install Exchange 2010 SP3 for the past 5 hours and it appears as though the job is stuck on the "Mailbox Role" portion.

The server holds the CAS, HT and ET roles and had SP2 installed previously (no update rollups). The .edb file is about 310 GB on a VMWare box with 24 GB of RAM on a RAID 10 so it should be plenty fast.

All of the previous roles went quite fast but the Mailbox role has been about halfway through for 4 1/2 hours now. Occasionally the progress bar will flicker but it hasn't made any progress in that time.

Is this normal behavior? I'm not sure if the job is stuck or if Exchange is actually processing things. If the job is stuck is there any way to safely abort the installation?

I've created network segments with my MikroTik RB1100 including 3 client LANs, a phone LAN, a trusted network (servers, printers, etc) and a DMZ. These are not VLAN's per-se as there is no tagging done, these are separate LANs on different physical ports on the RB1100.

Previously everything was on the same network (the trusted network) with the exception of the phones which were previously a POTS. To increase security I decided to segment the network, however I'm getting all sorts of weird issues now.

Some of the aforementioned issues are

• Some users (not all) have issues accessing files on network drives
• Users experiencing issues printing to communal printers
• Sometimes users need to try to access network files multiple times before the file will open.

Has anyone seen this happen? There is no firewall (yet) between any client LANs and trusted LANs with the exception of Windows Firewall, though the profile for that shouldn't have changed.

Additional note

• Client LANs are 10.0.10.0/24 - 10.0.12.0/24 (Configured eth 4-6)
• Trusted 10.0.0.0/24 (configured eth1 with eth2 and 3 as slaves)
• Phones - 10.1.0.0/24 (configured eth7 with 8,9,10 as slaves)

The routing table shows all as accessible, and users can access most of the files, but some are proving troublesome. Files on the Server 2008 box are easier to access than those on a server 2003. I don't think it's a networking issue but rather a firewalling issue.

Does anyone know if it's possible to configure a vCenter 5 alarm to monitor the loss of PSU redundancy of a host? I'm looking through the options to configure alarms and the Power State alarms on the Host portion only seem to monitor whether the host is powered on, powered off or in Standby mode.

Am I looking in the wrong place or is this even possible?

I've inherited an attempted Exchange 2010 implementation from a colleague that apparently failed. I've almost managed to bring it back from the dead, but the Hub Transport role fails to install with the following error

[10/06/2012 02:30:44.0119] [2] Beginning processing Set-LocalPermissions -Feature:'Bridgehead'
[10/06/2012 02:30:44.0166] [2] [ERROR] Unexpected Error
[10/06/2012 02:30:44.0166] [2] [ERROR] The registry key "SOFTWARE\Microsoft\ExchangeServer\v14\Transport" does not exist under "HKEY_LOCAL_MACHINE".
[10/06/2012 02:30:44.0182] [2] Ending processing Set-LocalPermissions
[10/06/2012 02:30:44.0182] [1] The following 1 error(s) occurred during task execution:
[10/06/2012 02:30:44.0182] [1] 0.  ErrorRecord: The registry key "SOFTWARE\Microsoft\ExchangeServer\v14\Transport" does not exist under "HKEY_LOCAL_MACHINE".
[10/06/2012 02:30:44.0182] [1] 0.  ErrorRecord: System.ArgumentException: The registry key "SOFTWARE\Microsoft\ExchangeServer\v14\Transport" does not exist under "HKEY_LOCAL_MACHINE".
   at Microsoft.Exchange.Management.Deployment.SetLocalPermissions.GetTargetRegistryKey(XmlNode targetNode)
   at Microsoft.Exchange.Management.Deployment.SetLocalPermissions.ChangePermissions[TTarget,TSecurity,TAccessRule,TRights](XmlNode targetNode, Dictionary`2 rightsDictionary, GetTarget`1 getTarget, GetOrginalPermissionsOnTarget`2 getOrginalPermissionsOnTarget, SetPermissionsOnTarget`2 setPermissionsOnTarget, CreateAccessRule`2 createAccessRule, AddAccessRule`2 addAccessRule, RemoveAccessRuleAll`1 removeAccessRuleAll)
   at Microsoft.Exchange.Management.Deployment.SetLocalPermissions.SetPermissionsOnCurrentLevel[TTarget,TSecurity,TAccessRule,TRights](XmlNode permissionSetNode, String targetType, Dictionary`2 rightsDictionary, GetTarget`1 getTarget, GetOrginalPermissionsOnTarget`2 getOrginalPermissionsOnTarget, SetPermissionsOnTarget`2 setPermissionsOnTarget, CreateAccessRule`2 createAccessRule, AddAccessRule`2 addAccessRule, RemoveAccessRuleAll`1 removeAccessRuleAll)
   at Microsoft.Exchange.Management.Deployment.SetLocalPermissions.SetPermissionsOnCurrentLevel(XmlNode permissionSetNode)
   at Microsoft.Exchange.Management.Deployment.SetLocalPermissions.SetFeaturePermissions(String feature)
   at Microsoft.Exchange.Management.Deployment.SetLocalPermissions.InternalProcessRecord()
[10/06/2012 02:30:44.0197] [1] [ERROR] The following error was generated when "$error.Clear(); 
    Set-LocalPermissions -Feature:"Bridgehead"

" was run: "The registry key "SOFTWARE\Microsoft\ExchangeServer\v14\Transport" does not exist under "HKEY_LOCAL_MACHINE".".
[10/06/2012 02:30:44.0197] [1] [ERROR] The registry key "SOFTWARE\Microsoft\ExchangeServer\v14\Transport" does not exist under "HKEY_LOCAL_MACHINE".
[10/06/2012 02:30:44.0197] [1] [ERROR-REFERENCE] Id=BridgeheadLocalPermissionsComponent___2e2dbc2a97cb4429bc2074edc50bedbd Component=EXCHANGE14:\Current\Release\Shared\Datacenter\Setup
[10/06/2012 02:30:44.0197] [1] Setup is stopping now because of one or more critical errors.
[10/06/2012 02:30:44.0197] [1] Finished executing component tasks.
[10/06/2012 02:30:44.0244] [1] Ending processing Install-BridgeheadRole

I've been unable to find any documentation on how to resolve this issue. Any help would be appreciated.

I am looking to migrate a vCenter 5.0 virtual appliance to another machine with DAS. Is it possible to do this without vMotion and without breaking anything?

If so, could one follow a similar process to migrating a VM without a vCenter server as outlined here?

EDIT : This methodology worked well, however there was an issue with the machine detecting the NIC card after the migration. This was caused by the fact the MAC address of the NIC had changed. VMWare has this issue documented at the following site : http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2012451

Once the change was applied the system started up without issue.

As far as I can tell, this question doesn't already exist here but if it does then I apologize.

As of January 1st our company name has changed and, as such, our e-mail addresses have changed. The switch has gone off well with the exception of a few weird "5.1.1 User Unknown" errors that some external senders are getting when they attempt to send e-mails to us.

I've spoken to an external consultant to get their take on it and they seem to think the recipients have stale DNS records. The MX records to our server has existed on our external DNS for over a month - the new domain was set as our "Primary" domain on January 1st.

I've managed to get a couple of the error reports from the recipients and they look like this. Any help would be appreciated with this matter

The following recipient(s) cannot be reached:
      'User Name' on 13/01/2012 11:07 AM
            550 5.1.1 <[email protected]>... User unknown

EDIT : The domain listed above is the "new domain". E-mails sent to the old domain still send without issue. I can also verify that the policy has been set to that user and that the new e-mail address exists within their "E-Mail Addresses" tab.

EDIT 2 : The receiving mail server is running VamSoft ORF for anti-spam. Neither Vamsoft ORF logs or exchange logs show any sign of the e-mails getting to our domain, however when they use the old domain they go through without issue.

I have (what I assume) will be a relatively simple question.

I have an old file server that I've decommissioned and replaced. I would like to re-use the hardware from the old file server at our satellite office for offsite backup storage. Because I'm paranoid I would like to keep the data on these disks (despite the fact it's all been migrated and we have backups of the server). To that end, I would like to take the 3 hard drives out (server was running a RAID 5) and put 3 new ones in and install the OS and configure from scratch.

Assuming the hard drives are clearly labelled as drive 0, 1, 2, can they safely be transferred into another server with a different RAID card running RAID 5 (with the drives installed in the same order they were on the old server)? In short, is that data safe?

I'll preface this question with the fact I know about This question but unfortunately it was no help to me as "don't run the database over the network" is just not an option.

Last week we migrated our file server from Server 2000 to a Server 2008 R2 Standard x64 Virtual Machine. We have a database that provides contact information for stakeholders and business partners. This is a proprietary database written in house by our database analyst. Since we migrated the server, this database has been running much slower than normal.

That said, I've been looking for the cause for the past week as this is an important database for us. We are moving toward using another system, but I'd like this issue resolved with this sooner rather than later.

Relevant Information

• Linked tables have been re-linked to reflect their new UNC address and the database compacted

• There is currently no anti-virus running on the server

• All client anti-viruses are set to not scan network drives

• We have made an antivirus exception for msaccess.exe for testing purposes with no luck

• I tried dropping the firewall on the file server with no luck

• I haven't noticed any issues with file access (in fact, most of my employees have said they've noticed an increase)

I would love to hear any suggestions as to why people would think that Server 2008 R2 is slowing down the database.

This may prove to be a stupid question, but I've scoured in internet and found nothing to that gives me a concrete answer.

I'm curious as to potential consequences of a file server being rebooted or crashing when users have files open. Now common sense would tell me that as long as they aren't being saved or written to as the reboot happens, corruption is unlikely. I have been forced to reboot my server a couple times when users had files open (in both read and read/write mode) but never heard of any complaints from users saying they had lost files or they had issues. I mean if a file server goes down and a file is open, that (theoretically) means that they won't be able to save to the network share until the machine comes back online, right?

My question is then, is it safe to reboot a server if files are open by end users?

We are in the process of decommissioning our old file server in a much-needed upgrade. It goes without saying that this needs to be as seamless as possible, as to affect the end-users as little as possible. We're upgrading from Server 2000 to Server 2008.

I've been working with consultant on this in an effort to make this smooth, however he's a busy man and I've spotted some holes in his work. He's suggested we use Robocopy to copy all the files from the old server to the new one, then the day before we make the new server live to run the command again to copy any files that had changed since the original copy.

We've done the first copy and the first major glitch is that none of the permissions have been carried over. This isn't the end of the world and considering we're copying almost a TB of data I'm sure it would be quicker for me manually re-do the permissions as opposed to re-copying everything over with the correct switch. Rather than depend on my consultant I figured I'd try to take matters into my own hands.

Here's the command he's recommended (executed from the new file server).

Robocopy \\oldserver\Data E:\DATA /MIR /FFT /Z /XA:H /W:5

Is there an easier way to copy all of this data (while maintaining permissions) before we go live?

I'm sure this is a dumb question, but I can't for the life of me figure out what the heck is going on. I've looked around and I've seen similar questions of this nature, but nothing exactly matching my issue.

I'm looking to replace my current file/print server. In place of the old one would be a 64 bit Windows Server 2008 R2 Standard SP1. I have added the 64 bit drivers to the server, but it's my understanding that I need to push 32 bit drivers to my clients (as they're all 32 bit machines).

So I go into the Printer Properties and select the Sharing tab. I click the "Additional Drivers" button and attempt to select x86. I then point to the 32 bit drivers for the printer in question and hit okay. Then I'm asked to provide a path to the I386 folder (which I do) but every time I click "OK"it keeps asking for that folder again. I end up in an endless loop of trying to show the system where the folder is.

Can someone provide me with some guidance about what I'm doing wrong? Any guidance is appreciated.

Nothing is "for sure" yet but there is a good chance my company will be changing it's name in the future.

Our IT requirements are relatively modest - Exchange server, IIS, MSSQL, etc.

My question is, what kind of considerations need to be made before changing a company name in the world of IT? Obviously our domain name will be changing, which means some work in Exchange but can anybody think of any thing else?

I feel as though this is almost too simple. The reason I'm asking is because if anything is beyond my skill level we'll need to contract out an IT consultant which would require me to accommodate for that in future budgets.