pk.'s questions

I'm running a simple script to archive SMDR logs using Windows Server 2008 R2's Task Scheduler. The last line of the script is as follows --

dir c:\smdr -Filter *.txt | where-object {$_.basename -eq 'SMDR_Log'} | move-item -destination "c:\smdr\ARCHIVED\SMDR_log_$yesterdayString.txt"

The last cmdlet in the pipeline is renaming the file properly (inserting the date into the filename), but it doesn't move it to the ARCHIVED folder. If I run this command outside of Task Scheduler, everything works great. Permissions are fine on the destination folder.

I can think of a ton of ways to work around this, but I'd really like an explanation for why the file is renamed but stays in its current directory.

Exported Scheduled Task XML

<?xml version="1.0" encoding="UTF-16"?>
-<Task xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task" version="1.3">
-<RegistrationInfo>
<Date>2014-07-14T09:34:56.2252628</Date>
<Author>DOMAIN\taskadmin</Author>
<Description>Aggregates the individual daily call logs into one master log (.csv format)</Description>
</RegistrationInfo>
-<Triggers>
-<CalendarTrigger>
<StartBoundary>2014-07-15T00:00:01</StartBoundary>
<Enabled>true</Enabled>
-<ScheduleByDay>
<DaysInterval>1</DaysInterval>
</ScheduleByDay>
</CalendarTrigger>
</Triggers>
-<Principals>
-<Principal id="Author">
<UserId>DOMAIN\taskadmin</UserId>
<LogonType>S4U</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
-<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
-<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>P3D</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
-<Actions Context="Author">
-<Exec>
<Command>powershell.exe</Command>
<Arguments>-File "C:\scripts\powershell\AvayaCallLogMaintenance\Combine-SMDRLogs.ps1"</Arguments>
</Exec>
</Actions>
</Task>

UPDATE: I upgraded PowerShell from 2.0 to 4.0 and it seems to be working in my tests. I'll let it run overnight and if that ends up resolving it I'll write it up as an answer.

UPDATE 2: PowerShell 4.0 didn't resolve it. I've now broken up the move-item command into separate rename-item and then move-item commands. I'll let it run tonight and see what happens.

I have a DL380 G5 running Windows Server 2008 R2 that just had two update bundles applied to it and as a result I have several crucial components that no longer work. The update bundles that were applied were --

1. HP ProLiant Server Firmware 2014.04.0
2. HP Windows Server 2008 R2 x64 Software 2014.04.0

I can't really come up with a common thread to figure out which driver/firmware update would have caused this problem. I've tried rolling back or re-updating the drivers for some of the devices (i.e. HP NC373i) and it made no difference. I'll attach a grainy screenshot of a smattering of the components exhibiting the issues and would love to hear some of your suggestions for chasing this down.

UPDATE: This a vicious little issue but I think I may have found some info that'll help me solve it. I'll update this when I have a chance.

UPDATE 2: Although the issue I found (linked in the first UPDATE) was caused by something similar, this did not end up being my exact issue. All of the components listed in Device Manager with the yellow caution sign display the message "Windows cannot initialize the device driver for this hardware (Code 37)". No amount of uninstalling/reinstalling of drivers makes a bit of difference. I beginning to think that this hardware is literally trashed from these firmware updates. I'm quite desperate at this point, so feel free to throw any ideas my way.

UPDATE 3: This server appears to be trashed. I did a full motherboard swap figuring that I had a bad firmware flash or something and I see the exact same components exhibiting issues with the new board. I force applied the latest HP SPP drivers and there was no change. If no one else has any ideas, I guess I'm out of luck.

Note - I've actually already solved this, but I don't see any detailed write-ups online about this issue so I'll go ahead and ask the question and answer it myself.

I run a service that authenticates as SMTPRelayUser that started failing ADFS authentication about 95% of the time. Inexplicably, this user would very occasionally succeed in authenticating and send all the mail that had queued up over time. In the ADFS Event Viewer logs, I was seeing two errors -- Event 300 and Event 413. Event ID 300 offered up no useful information, but 413 notified me of a strange exception.

Microsoft.IdentityServer.Service.AccountPolicy.ADAccountLookupException: Exception of type 'Microsoft.IdentityServer.Service.AccountPolicy.ADAccountLookupException' was thrown.

What's going on?

Using this official documentation as a guide, I would expect the SamAccountName property to sync from my on-premise AD to Office 365. I think that it used to do exactly that, but now it seems that it doesn't so much sync the attribute as it does create an entirely new, unlinked value and store it in Office 365. This has caused some minor issues for me (broken scripts, annoying permissions management, etc.) and may be part of a more major issue regarding ADFS authentication.

On-Premise

PS C:\Windows\system32> Get-ADUser jdoe -Properties SamAccountName | fl SamAccountName

SamAccountName : jdoe

Office 365 Sync'ed Objects

PS C:\Windows\system32> Get-Mailbox jdoe | fl SamAccountName

SamAccountName : $1A7H20-K1LCOJFFBHGS

I understand how to work around this issue in my scripts -- there exists the ImmutableId property which can be mapped back to the on-premise GUID. As far as the issue I'm having with ADFS, I'm less certain how to proceed and if this is causing my issues. At this point I really would just like some verification that I'm not crazy and that this used to be sync'ed at some point in the past and that Office 365 broke it relatively recently. I also think that MS documentation should perhaps be updated to exclude SamAccountName from the list of synchronized properties on the page I linked.

I'm setting up an ADFS farm in Windows Azure and I need to export the settings of my old farm to import to the new farm. The official documentation on TechNet tells me to use scripts that are located in the media/server_en-us/support/adfs folder of the Windows Server 2012 R2 installation disc. Considering this VM instance was one of the stock images in Azure, I don't have access to the contents of the Windows Server 2012 R2 installation disc. I have no access to one on-premise either. I'd rather not search for, download, and use an unofficial instance of these PowerShell scripts since they are likely non-trivial and it would be a serious security concern to setup a new ADFS environment with them.

What are my options and why would Microsoft not have made these generally available as a download?

UPDATE: Please vote for this suggestion if you feel Microsoft should provide us with the installation media in Windows Azure. http://feedback.windowsazure.com/forums/34192--general-feedback/suggestions/5714393-make-installation-media-available-mount-an-iso

I have zen.spamhaus.org configured as an IP Block List Provider on my Exchange 2010 SP2 server. I noticed that several IPs that should have had their connections terminated were still allowed to send mail. I used the Test-IPBlockListProvider in PowerShell and came up with some results that I can't make sense of.

[PS] C:\Windows\system32>Test-IPBlockListProvider -Identity "Zen Spamhaus" -IPAddress 41.72.17.178

RunspaceId     : de0ada31-2415-4ea8-a8af-cf07947dddce
Provider       : Zen Spamhaus
ProviderResult : {}
Matched        : False

This same IP address shows a definite match when queried directly from Spamhaus' site -- Spamhaus Lookup for 41.72.17.178. What could be the reason for the discrepancy? It doesn't seem to be a timing thing.

Here is the configuration for the IPBlockListProvider in Exchange 2010 --

[PS] C:\Windows\system32>Get-IPBlockListProvider "Zen Spamhaus" | fl

RunspaceId        : de0ada31-2415-4ea8-a8af-cf07947dddce
RejectionResponse : Your e-mail server's IP address matched the ZEN blocklist maintained by www.spamhaus.org.  Please have your administrator visit http://www.spamhaus.org/lookup.lasso if you feel your inclusion on this list is in error.
LookupDomain      : zen.spamhaus.org
Enabled           : True
AnyMatch          : True
BitmaskMatch      :
IPAddressesMatch  : {}
Priority          : 1
AdminDisplayName  :
ExchangeVersion   : 0.1 (8.0.535.0)
Name              : Zen Spamhaus
DistinguishedName : CN=Zen Spamhaus,CN=IPBlockListProviderConfig,CN=Message Hygiene,CN=Transport Settings,CN=DOMAIN,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Domain,DC=local
Identity          : Zen Spamhaus
Guid              : 36260444-a4d4-4088-8f30-7f428b4ff4e4
ObjectCategory    : domain.local/Configuration/Schema/ms-Exch-Message-Hygiene-IP-Block-List-Provider
ObjectClass       : {top, msExchMessageHygieneIPBlockListProvider}
WhenChanged       : 7/30/2012 4:12:34 PM
WhenCreated       : 2/15/2010 9:43:37 AM
WhenChangedUTC    : 7/30/2012 9:12:34 PM
WhenCreatedUTC    : 2/15/2010 3:43:37 PM
OrganizationId    :
OriginatingServer : dc.domain.local
IsValid           : True

It seems that OutVariable is broken when using the Exchange 2010 cmdlets. Is it just my server or is this the case for everyone? I observed the following --

get-mailbox jdoe -OutVariable asdf | out-null
$asdf.getType()

You cannot call a method on a null-valued expression.
At line:1 char:14
+ $asdf.getType <<<< ()
    + CategoryInfo          : InvalidOperation: (getType:String) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

In the example above, $asdf is never created and get-mailbox jdoe absolutely returns something.

get-childitem -OutVariable asdf | out-null
$asdf.getType()
[PS] C:\temp>$asdf.getType()

IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     True     ArrayList                                System.Object

In this example, $asdf is created as expected since get-childitem is not an Exchange 2010 cmdlet.

Is it possible to log the Managed Folder Assistant's activity in regards to retention policies in Exchange 2010 SP2? I would like to take a closer look at a mailbox that is being skipped over when I issue the Start-ManagedFolderAssistant jdoe cmdlet. I have many other mailboxes where this works fine and they're configured identically.

I've created a central repository for Powershell modules, but I'm having trouble loading one in particular. The NTFSSecurity module is failing to import with the following message.

PS Z:\> Import-Module NTFSSecurity
Add-Type : Could not load file or assembly 'file://\\fs\PowerShellModules\NTFSSecurity\Security2.dll' or one of its
dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
At \\fs\PowerShellModules\NTFSSecurity\NTFSSecurity.Init.ps1:141 char:1
+ Add-Type -Path $PSScriptRoot\Security2.dll
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Add-Type], FileLoadException
    + FullyQualifiedErrorId : System.IO.FileLoadException,Microsoft.PowerShell.Commands.AddTypeCommand

Add-Type : Could not load file or assembly 'file://\\fs\PowerShellModules\NTFSSecurity\PrivilegeControl.dll' or one
of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
At \\fs\PowerShellModules\NTFSSecurity\NTFSSecurity.Init.ps1:142 char:1
+ Add-Type -Path $PSScriptRoot\PrivilegeControl.dll -ReferencedAssemblies $PSScrip ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Add-Type], FileLoadException
    + FullyQualifiedErrorId : System.IO.FileLoadException,Microsoft.PowerShell.Commands.AddTypeCommand

Add-Type : Could not load file or assembly 'file://\\fs\PowerShellModules\NTFSSecurity\ProcessPrivileges.dll' or one
of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
At \\fs\PowerShellModules\NTFSSecurity\NTFSSecurity.Init.ps1:143 char:1
+ Add-Type -Path $PSScriptRoot\ProcessPrivileges.dll
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Add-Type], FileLoadException
    + FullyQualifiedErrorId : System.IO.FileLoadException,Microsoft.PowerShell.Commands.AddTypeCommand

Types added
NTFSSecurity Module loaded
Import-Module : Unable to find type [Security2.IdentityReference2]: make sure that the assembly containing this type
is loaded.
At line:1 char:1
+ Import-Module NTFSSecurity
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Security2.IdentityReference2:TypeName) [Import-Module], RuntimeExcept
   ion
    + FullyQualifiedErrorId : TypeNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

I'm running Windows Managment Foundation 3.0 Beta, which includes PowerShell 3.0. I have a feeling that the new security measures introduced in .NET 4.0 are playing a part in this, but running Powershell.exe with the -version 2.0 switch doesn't fix anything either. I have modified my powershell.exe.config files in both the system32 and SysWOW64 folders to the following.

<?xml version="1.0"?>
<configuration>
    <startup useLegacyV2RuntimeActivationPolicy="true">
        <supportedRuntime version="v4.0.30319"/>
        <supportedRuntime version="v2.0.50727"/>
    </startup>
    <runtime>
        <loadfromremotesources enabled="true"/>
    </runtime>
</configuration>

The files are not "blocked", I've checked each one individually (as well as run Unblock-File on the directory). Permissions from the server end are fine, I've verified that I have access to everything. What have I not checked?

I'm unable to access the oab.xml file on my Exchange 2010 CAS. I've recreated the OAB virtual directory and it didn't make a difference. Using "Effective Permissions", I've verified that I have rights to view oab.xml, but any attempt to download it remotely (from Outlook 2010 or IE 9) is refused by IIS. Here are the pertinent log entries --

2012-04-20 18:38:41 12.3.4.56 HEAD /OAB/2c34c9f5-5521-4c8c-b684-538df815052a/oab.xml - 80 - 12.3.4.78 Microsoft+BITS/7.5 401 2 5 203
2012-04-20 18:38:44 12.3.4.56 HEAD /OAB/2c34c9f5-5521-4c8c-b684-538df815052a/oab.xml - 80 - 12.3.4.78 Microsoft+BITS/7.5 401 2 5 31
2012-04-20 18:38:44 12.3.4.56 HEAD /OAB/2c34c9f5-5521-4c8c-b684-538df815052a/oab.xml - 80 domain\jdoe 12.3.4.78 Microsoft+BITS/7.5 403 1 64 31
2012-04-20 18:38:46 12.3.4.56 HEAD /OAB/2c34c9f5-5521-4c8c-b684-538df815052a/oab.xml - 443 - 12.3.4.78 Microsoft+BITS/7.5 401 2 5 203
2012-04-20 18:38:48 12.3.4.56 HEAD /OAB/2c34c9f5-5521-4c8c-b684-538df815052a/oab.xml - 443 - 12.3.4.78 Microsoft+BITS/7.5 401 2 5 31
2012-04-20 18:38:48 12.3.4.56 HEAD /OAB/2c34c9f5-5521-4c8c-b684-538df815052a/oab.xml - 443 - 12.3.4.78 Microsoft+BITS/7.5 401 1 2148074254 0
2012-04-20 18:38:48 12.3.4.56 HEAD /OAB/2c34c9f5-5521-4c8c-b684-538df815052a/oab.xml - 443 domain\jdoe 12.3.4.78 Microsoft+BITS/7.5 403 1 5 218

Does anyone have any ideas?

I'm having difficulty running Exchange 2010 cmdlets through remote PowerShell sessions.

I start my local PowerShell session as Administrator and issue the following commands --

PS C:\Windows\system32> $mailcred = Get-Credential
PS C:\Windows\system32> $mailSession = New-PSSession -ComputerName MAILSRV -Credential $mailcred
PS C:\Windows\system32> Enter-PSSession $mailSession
[MAILSRV]: PS C:\Users\jdoe\Documents> Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
[MAILSRV]: PS C:\Users\jdoe\Documents> hostname
MAILSRV
[MAILSRV]: PS C:\Users\jdoe\Documents> Get-ExchangeServer
Value cannot be null.    
Parameter name: serverSettings
    + CategoryInfo          : 
    + FullyQualifiedErrorId : System.ArgumentNullException,Microsoft.Exchange.Management.SystemConfigurationTasks.GetExchangeServer

[MAILSRV]: PS C:\Users\jdoe\Documents> get-mailbox
Value cannot be null.    
Parameter name: serverSettings
    + CategoryInfo          : 
    + FullyQualifiedErrorId : System.ArgumentNullException,Microsoft.Exchange.Management.RecipientTasks.GetMailbox

As you can see, none of the Exchange cmdlets are working. What could be the issue?

We have users that connect to a terminal server, TS1, from a variety of desktop clients. We also have a domain password policy that expires passwords after a certain amount of time. If a user's password expires over the weekend and they log in to the terminal server, one of two things happen --

1. If they're using the Windows Remote Desktop Client, they are prompted to change their password to a new one and allowed to log into the server.
2. If they connect using the Remote Desktop Connection for Mac client, their password is rejected and they are not given the opportunity to change their password, effectively locking them out until Monday morning if they don't have access to a Windows PC.

I don't have a Mac to test this behavior out myself, so I have to take their word for it. What could explain the difference in behavior?

I'm troubleshooting an Outlook Anywhere issue with a new Exchange 2010 server. The server in question, MS2010, is behind a SonicWALL NSA 2400 device and works wonderfully except for Outlook Anywhere. Outlook Anywhere works internally and I've verified (through Ctrl+Right-Click -> Connection Status) that I'm able to connect to MS2010 over HTTPS.

When trying to connect to the server using HTTPS from outside the firewall, I'm unable to do so. A Wireshark trace shows 30 or so successful HTTPS packet transmissions, and then it fails with 3 straight transmissions to a destination port of 135. I have no idea why my computer is attempting to access anything on port 135 since I've setup my profile to use HTTPS on both slow and fast connections.

I'm 99% certain that the firewall is configured correctly. I run Outlook Web Access (also HTTPS) on the same server and there are no issues with access.

EDIT: AutoDiscover correct

EDIT: My Autodiscover settings are correct (as far as I can tell). My server passes the Outlook Anywhere and Autodiscover tests at https://www.testexchangeconnectivity.com/.

I've been using the RPCPing utility to troubleshoot and have come across the following results:

Internally

>rpcping -t ncacn_http -s mail.mydomain.com -o RpcProxy=mail.mydomain.com -P "pk,mydomain,*" -I "pk,mydomain,*" -H 1 -u 10 -a connect -F 3 -v 3 -E -R none
RPCPing v2.12. Copyright (C) Microsoft Corporation, 2002
OS Version is: 6.1, Service Pack 1

RPCPinging proxy server mail.mydomain.com with Echo Request Packet
Sending ping to server
Response from server received: 200
Pinging successfully completed in 93 ms

Externally

>rpcping -t ncacn_http -s mail.mydomain.com -o RpcProxy=mail.mydomain.com -P "pk,mydomain,*" -I "pk,mydomain,*" -H 1 -u 10 -a connect -F 3 -v 3 -E -R none
RPCPing v6.0. Copyright (C) Microsoft Corporation, 2002-2006
 Enter password for RPC/HTTP proxy:

 RPCPing set Activity ID:  {fc8411ba-2987-4175-b37b-801dc69d5ff9}
 RPCPinging proxy server mail.mydomain.com with Echo Request Packet
 Setting autologon policy to high
 WinHttpSetCredentials for target server called
 Error 87 : The parameter is incorrect.
 returned in WinHttpSetCredentials
 Ping failed

What should I be checking in order to troubleshoot my Outlook Anywhere issues? I'm using Windows 7 SP1 for internal and external access.

EDIT: Autodiscover.xml content

<?xml version="1.0"?>
<Autodiscover xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
    <Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
        <User>
            <DisplayName>John Doe</DisplayName>
            <LegacyDN>/o=MYDOMAIN/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=pk</LegacyDN>
            <DeploymentId>d35170cc-f3a7-42c5-9427-1f554a469126</DeploymentId>
        </User>
        <Account>
            <AccountType>email</AccountType>
            <Action>settings</Action>
            <Protocol>
                <Type>EXCH</Type>
                <Server>MS2010.MYDOMAIN.local</Server>
                <ServerDN>/o=MYDOMAIN/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=MS2010</ServerDN>
                <ServerVersion>738180DA</ServerVersion>
                <MdbDN>/o=MYDOMAIN/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=MS2010/cn=Microsoft Private MDB</MdbDN>
                <ASUrl>https://MS2010.MYDOMAIN.local/EWS/Exchange.asmx</ASUrl>
                <OOFUrl>https://MS2010.MYDOMAIN.local/EWS/Exchange.asmx</OOFUrl>
                <OABUrl>http://MS2010.MYDOMAIN.local/OAB/2c34c9f5-5521-4c8c-b684-538df815052a/</OABUrl>
                <UMUrl>https://MS2010.MYDOMAIN.local/EWS/UM2007Legacy.asmx</UMUrl>
                <Port>0</Port>
                <DirectoryPort>0</DirectoryPort>
                <ReferralPort>0</ReferralPort>
                <PublicFolderServer>MS2007.MYDOMAIN.local</PublicFolderServer>
                <AD>dc1.MYDOMAIN.local</AD>
                <EwsUrl>https://MS2010.MYDOMAIN.local/EWS/Exchange.asmx</EwsUrl>
                <EcpUrl>https://MS2010.MYDOMAIN.local/ecp/</EcpUrl>
                <EcpUrl-um>?p=customize/voicemail.aspx&amp;exsvurl=1</EcpUrl-um>
                <EcpUrl-aggr>?p=personalsettings/EmailSubscriptions.slab&amp;exsvurl=1</EcpUrl-aggr>
                <EcpUrl-mt>PersonalSettings/DeliveryReport.aspx?exsvurl=1&amp;IsOWA=&lt;IsOWA&gt;&amp;MsgID=&lt;MsgID&gt;&amp;Mbx=&lt;Mbx&gt;</EcpUrl-mt>
                <EcpUrl-ret>?p=organize/retentionpolicytags.slab&amp;exsvurl=1</EcpUrl-ret>
                <EcpUrl-sms>?p=sms/textmessaging.slab&amp;exsvurl=1</EcpUrl-sms>
            </Protocol>
            <Protocol>
                <Type>EXPR</Type>
                <Server>mail.mycompany.com</Server>
                <ASUrl>https://mail.mycompany.com/ews/exchange.asmx</ASUrl>
                <OOFUrl>https://mail.mycompany.com/ews/exchange.asmx</OOFUrl>
                <OABUrl>https://mail.mycompany.com/OAB/2c34c9f5-5521-4c8c-b684-538df815052a/</OABUrl>
                <UMUrl>https://mail.mycompany.com/ews/UM2007Legacy.asmx</UMUrl>
                <Port>0</Port>
                <DirectoryPort>0</DirectoryPort>
                <ReferralPort>0</ReferralPort>
                <SSL>On</SSL>
                <AuthPackage>Basic</AuthPackage>
                <CertPrincipalName>msstd:mail.mycompany.com</CertPrincipalName>
                <EwsUrl>https://mail.mycompany.com/ews/exchange.asmx</EwsUrl>
                <EcpUrl>https://mail.mycompany.com/owa/</EcpUrl>
                <EcpUrl-um>?p=customize/voicemail.aspx&amp;exsvurl=1</EcpUrl-um>
                <EcpUrl-aggr>?p=personalsettings/EmailSubscriptions.slab&amp;exsvurl=1</EcpUrl-aggr>
                <EcpUrl-mt>PersonalSettings/DeliveryReport.aspx?exsvurl=1&amp;IsOWA=&lt;IsOWA&gt;&amp;MsgID=&lt;MsgID&gt;&amp;Mbx=&lt;Mbx&gt;</EcpUrl-mt>
                <EcpUrl-ret>?p=organize/retentionpolicytags.slab&amp;exsvurl=1</EcpUrl-ret>
                <EcpUrl-sms>?p=sms/textmessaging.slab&amp;exsvurl=1</EcpUrl-sms>
            </Protocol>
            <Protocol>
                <Type>WEB</Type>
                <Port>0</Port>
                <DirectoryPort>0</DirectoryPort>
                <ReferralPort>0</ReferralPort>
                <Internal>
                    <OWAUrl AuthenticationMethod="Basic, Fba">https://MS2010.MYDOMAIN.local/owa/</OWAUrl>
                    <Protocol>
                        <Type>EXCH</Type>
                        <ASUrl>https://MS2010.MYDOMAIN.local/EWS/Exchange.asmx</ASUrl>
                    </Protocol>
                </Internal>
                <External>
                    <OWAUrl AuthenticationMethod="Fba">https://mail.mycompany.com/owa/</OWAUrl>
                    <Protocol>
                        <Type>EXPR</Type>
                        <ASUrl>https://mail.mycompany.com/ews/exchange.asmx</ASUrl>
                    </Protocol>
                </External>
            </Protocol>
        </Account>
    </Response>
</Autodiscover>

We have an existing installation of GFI MailArchiver 5 with several databases of archives (perhaps 100-150GB). The goal is to export each user's archived e-mail and then import it into Exchange 2010 SP1 Personal Archives. GFI has a tool to do this, but it's very rudimentary and has severe, frankly unworkable, limitations. It only allows me to query based on the e-mail headers. Due to the fact that we have multiple aliases that may show in multiple headers (To:, Cc:), not to mention the fact that this won't cover a user's membership in a distribution group at a given point in time, this tool will not suffice.

Another option is for me extract the e-mails from the GFI databases without using the tool, but this would require me to write my own tool to reconstruct them and I really would rather not go down that path.

I feel very stuck on this issue. Has anyone here done a similar migration? How can this best be handled?

When using PowerShell, why can I not use the overloaded ToString() methods for the TimeSpan structure?

$ts = New-TimeSpan -Days 5
$ts.ToString("g")
Cannot find an overload for "ToString" and the argument count: "1".
At line:1 char:13
+ $ts.ToString <<<< ("g")
    + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodCountCouldNotFindBest

Is there a workaround?

I have trying to analyze records from the Windows Security log and having a bit of difficulty getting specific values out of some of the logon/logoff events. Let's take a look at a specific example - here's the XML of one of the log entries.

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/>
        <EventID>4634</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12545</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8020000000000000</Keywords>
        <TimeCreated SystemTime='2011-08-16T17:15:38.702857400Z'/>
        <EventRecordID>107947</EventRecordID>
        <Correlation/>
        <Execution ProcessID='680' ThreadID='972'/>
        <Channel>Security</Channel>
        <Computer>SRV1.DOMAIN.LOCAL</Computer><Security/>
    </System>
    <EventData>
        <Data Name='TargetUserSid'>S-1-5-21-963414502-3093649508-813756320-3274</Data>
        <Data Name='TargetUserName'>billgates</Data>
        <Data Name='TargetDomainName'>MYDOMAIN</Data>
        <Data Name='TargetLogonId'>0x1c01acc</Data>
        <Data Name='LogonType'>10</Data>
    </EventData>
</Event>

How would I, for instance, go about extracting the 0x1c01acc stored in the Data node with the Name attribute equal to 'TargetLogonId'?

I have a Windows Server 2003 machine using Microsoft iSCSI Initiator that connects to a Fujitsu DX80. I've added a target that uses mutual CHAP and works wonderfully until I reboot. I have set the target to be persistent and bound the volume properly, but upon reboot it fails to successfully mount the drive. I see a few events in the System log that are of particular interest.

Early on in the boot process I see this

Event Type: Error
Event Source: dmboot
Description: dmboot: Failed to start volume Volume51 (M:)

Later on, I see this a couple of times

Event Type: Error
Event Source: iScsiPrt
Description: Initiator Service failed to respond in time to a request to encrypt or decrypt data.

Lastly, and probably most importantly, I see this

Event Type: Error Event Source: MSiSCSI Description: Timeout waiting for iSCSI persistently bound volumes. If there are any services or applications that use information stored on these volumes then they may not start or may report errors.

Armed with the knowledge of that last event, I tried to tweak the timeouts to be a bit longer. I modified the VolumeRetryCount to 720 and the VolumePostDiscoveryTimer to 90000. These had no effect on the outcome other than extending what is already a very slow boot process.

I've read this article, KB870964, but it doesn't apply to my situation since I'm not even getting to the point where I could be expecting a network share to map.

Any ideas?

EDIT: I've tried it without any CHAP authentication and it still doesn't work.

I'm experiencing issues receiving TLS encrypted e-mail from a specific domain. We entered into an agreement to use a 256-bit cipher and apparently our Exchange 2007 server on Windows Server 2003 isn't offering that up as an option, thus everything is getting rejected for only offering 128-bit encryption.

Rather than have them change things on their end, I'd like to resolve it on ours. I found a hotfix that allows me to add 256-bit AES ciphers to the list of available ciphers. I installed the hotfix, but it did not resolve my issue.

After reading this article, I'm suspecting that our Exchange 2007 server's cipher order is offering up 128-bit encryption first, and then the remote server is RSET'ing the connection when we do so. I'd like to verify that our server is offering up the 256-bit encryption option first.

The Computer Configuration | Administrative Templates | Network | SSL Configuration Settings | SSL Cipher Suite Order key doesn't exist on my Windows Server 2003 Exchange box, so I can't modify it.

Does ANYONE have any clue about how to go about resolving this issue?

Can someone cleanly delineate the following services/roles for me? I'm lost in the MS TechNet explanations.

• Terminal Services Web Access
• Terminal Services Gateway
• Terminal Services Remote App

What are the pros/cons of each, especially from a security standpoint? If I just connect to a remote server over port 3389 using my Remote Desktop Client, what is Microsoft-speak for that? Does it fit into any of the above categorizations? Is the main draw of TS Web Access versus a direct connection using RDC over 3389 just that one can use TLS encryption while the other uses RC4?

I'm trying to reset permissions on user directories and having a bit of trouble with the last step of my script. My script basically takes ownership of the entire user directory, resets the permissions on all files and folders for the directory, explicitly grants the permissions I need, stops all inheritance of permissions from parent folders, sets the rightful owner (specified user) for all files and folders, and then removes the permission I gave to myself so that I could operate on the files. I need this last step to remove myself from ALL files and subfolders, but at the moment it just removes me from the %userDir% and leaves all the inherited permissions below. This is an apparent shortcoming in ICACLS. Does anyone know of any other way to accomplish this?

set /p userDir=Enter the login of the user's directory you're modifying permissions for. (i.e. jDoe)
TAKEOWN /f "E:\Home Directories\%userDir%" /r /d y
ICACLS "E:\Home Directories\%userDir%" /reset /T
ICACLS "E:\Home Directories\%userDir%" /grant:r "MYDOMAIN\%userDir%":(OI)(CI)F /grant:r "SYSTEM":(OI)(CI)F /grant:r "MYDOMAIN\%username%":(OI)(CI)F
ICACLS "E:\Home Directories\%userDir%" /inheritance:r
ICACLS "E:\Home Directories\%userDir%" /setowner "MYDOMAIN\%userDir%" /T
ICACLS "E:\Home Directories\%userDir%" /remove "MYDOMAIN\%username%"