vlannoob's questions

We have an onsite Exchange 2010 server on our domain and are experiencing a strange issue. About 90% of our incoming email from outside clients is coming in perfectly fine. Sending is 100% fine. But we have a small number of people at certain organisations who cannot email us or have issues doing so.

We also have anyone on an Outlook.com or Live.com or hotmail.com address also having issues sending mail to us. When they send to us they get an immediate bounceback error with the following in the headers:

Final-Recipient: rfc822;[email protected]
Action: failed
Status: 5.5.0
Diagnostic-Code: smtp;550-bay004-omc4s18.hotmail.com [65.54.190.220] is currently not permitted to
550-relay through this server. Perhaps you have not logged into the pop/imap
550-server in the last 30 minutes or do not have SMTP Authentication turned on
550 in your email client.

The strange thing is is that if the sender sends again two or three times it will go through and get to our server fine. Messages to that recipient and replies go through as per normal with no issues.

3 of our outside clients who mail us regularly experience similar issues. They are all State Government departments and when they send emails to our staff they are often delayed and can arrive anywhere from 30 minutes to almost 24 hours after being sent, but what is frustrating is that 50% of the time those emails get to us straight away as per normal?!?!

There seems to be no rhyme nor reason for the delay. At those times when we know mail should be getting to us our network is experiencing no issues at all, nor is our bandwith being hammered. Times are also totally random, so its not at a particular time of day. I have spoken, eventually, with their IT people and they just reply with a 'not a problem on our end, the emails get to other organisations straight away, its your problem' which is extremely helpful to me .....

An added wrinkle is that we use a 3rd party mail filtering service. So our MX records point to them. Mail is delivered there, cleaned and filtered, and then clean mail sent on to our Exchange 2010 Server. Our Exchange Server is set to ONLY accept incoming connections from their range of IP's. We've had absolutely no issues with this setup over the past 5 years until the last 6 months.

The only change we have made in the last year is moving hosting of our domains from one provider to our own VPS setup with cpanel/WHM - and I am kinda wondering if its a DNS issue, or a time out responding scenario trying to lookup our MX records... the provider of the VPS say its not their problem and have been less than helpful as well. Our 3rd Party mail service have been outstanding in their support, as usual, but cannot see any issues from their end down to us.

With the delayed email from certain government organisations I have trawled through the mail headers and can see where the sender sends the email at, lets say, 10.00am. It gets to their edge server at 10.01am. The next entry is the delivery to our 3rd party mail providers server at 2.23pm and then handed down to our Exchange server at 2.26pm for delivery at 2.27pm into the recipients mailbox. So its sitting on their Edge Server for hours before delivery, but their IT staff couldn't be bothered finding out why.

Normally I'd wash my hands of it but some of the emails that get to us require urgent action as they can be time sensitive. Any delays in response means that certain work being offered gets accepted by other organisations before we can respond.

I've just been forwarded another bounceback from an external sender :

Diagnostic information for administrators:
Generating server: server-15.bemta-7.messagelabs.com
[email protected]
domain.com
Remote Server returned '<domain.com #5.0.0 smtp; 550-mail1.bemta7.messagelabs.com [216.82.254.111] is currently not permitted to>'

Jsut a quick one. I am going to upgrade my 2 physical ESXi 5.0 servers to 5.1. I have vSphere 5 isntalled onto a VM (I run the Essentials Plus kit) from which I have been administering the vmware environment successfully. My ESXi 5.0 hosts are all patched and up to date and I am comfortable with using the update manager to stage and remidiate those host patches.....but I'm not 100% sure on the process of upgrading to 5.1 :)

After some reading I am assuming that I need to download the full 5.1 ESXi install and 'upgrade' my hosts by attaching that image file into Upgrade Manager - correct? I think thats how I've read it, but confirmation would be nice....as would a few pointers ;)

Also, my physical hosts are Dell R710's....when I installed ESXi 5.0 onto them I just used the standard ESXi 5.0 installer from vmWare - is ther ea 5.1 iso image from Dell for the R710 and should I be using that over the vmware 5.1 package??

Any tips and advice is, as per usual, greatly appreciated ;)

Cheers :)

I'm playing around with customizing Office 2010 installs on my network, normally I just do a full manual install, but as the environment grows and the lazier I get its becoming a pain to do it manually every time. I've read up and downloaded the Office 2010 OCT tool and it looks relatively straight forward - with one exception - the Outlook Profile.

I can 'get around it' by just leaving it all as default (or not enabling offline use) but I'd like to customise it slightly so that its all setup no matter who logs onto the PC. The only issue I have, and my question is:

In the OCT - Outlook section What do you enter into the Path and Filename for the OST file and the Offline Address book seetings under Enable Offline Use section?

I'm sweet with everything else - just that one section, and I think if I bugger that one it will kill the whole Outlook Profile?? It would need to go into each users unique filepath for their profile correct? I have a fair idea of what should be there but I'm struggling with the correct syntax.

I know this is a stupid question....but its late in the day and my brain is fried ;)

As usual - any and all help/assistance is appreciated ;)

I have a 'request' from one of the 'big guys' that has me scratching my head a bit. He is one of our Executives that also is a board member of several other organistations, so he floats around between 4 different unrelated companies, each with their own domains, Exchange setup etc. He has domain accounts in each organisation. He has an iPad with multiple Exchange accounts so he can see all his calendars which works Ok for him - Apple calendaring bugs/flaws aside.

What he wants is the ability for 'reception staff' at each organisation to 'see' all his calendars as they are booking things for him in their respective organisations calendars without it conflicting with bookings made in his calendars by other organisations......you with me??

So for example: Company A books a meeting into his Comapny A calendar at 9am Monday and Company B books him a meeting in his Company B Calendar at 9:15am Monday on the other side of town and of course Company C has him booked in all day Monday on their Company C calendar. He gets all those on his iPad but he would like either a 'global' calendar all can see and book into or the ability for receptionists at Company's A,B and C to see all the Calendars to avoid these kind of conflicts.

I told him to 'go away' straight off the bat, I don't control anything to do with the other companies or know their infrastructure. And quite frankly I don't want any part of it...but he's whining and he's high enough up the food chain that I can't ignore him forever.

I'm open to suggestions. Is there any third party software/services that can facilitiate this kind of setup? I really don't want to be creating users in my AD structure to people not ion our organisation so they can get access to his calendar and I am sure there sysadmins feel the same.

As usual - any advice is greatly appreciated ;)

I have enabled Jumbo Frames (9000) in ESXi for all my vmNICs, vmKernels, vSwitches, iSCSI Bindings etc - basically anywhere in ESXi where it has an MTU settings I have put 9000 in it. The ports on the switches (Dell PowerConnects) are all set for Jumbo Frames. I have a Dell MD3200i with 2 controllers, each with 4 ports for iSCSI. Each of these ports is set to Jumbo Frames (9000) as well.

So now the questions:

1. Do I need to log into each Windows Server VM I am running and delve into the NIC properties and manually set it to Jumbo Frames in the NIC properties in the device Manager as well?
2. Whats the best way of testing that Jumbo Frames are indeed working as intended?

I have setup a small Sharepoint 2010 deployment and it is working fine, for now. I have run through one of the more popular step by step guides to mail enable the install and what I have is internal and external mail going to my mail enabled list hitting my Exchange 2010 server (on another Win2k8R2 box) and sitting in the submissions queue with a Loop Detected error and they progres no further.

Everything appears OK as per the guide. I have setup an SMTP role on the Sharepoint box, as per the guide. I have setup a new Send Conenctor on the Exchange 2010 server, as per the guide.

Any ideas on troubleshooting here?

I have an issue with a recently migrated SBS 2011 server. All appears to be running fine but I noticed it running slow and saw that it was running at 100% CPU. Taking a look, it's mainly two services using it all up:

Store.exe and MSExchangeMailboxAssistant.exe

Both are fluctuating constantly between 20-50% CPU. I have just rebooted the server and it's still behaving like this. I've tried stopping and restarting services etc with no luck at all.

The server has 16Gb of RAM and about 90gb of free hd space. Before the reboot store.exe was using just under 8gb of RAM, which is as expected, and total ram usage was around 80% - as expected.

The Server sits at a client with about 15 users. Mailboxes for 10 of these people are capped at 2Gb. Several users do have very large mailboxes (10gb) due to a large number of CAD files, plans, drawings etc.

Any ideas on what could be causing the high CPU usage?

Quick and easy one for the return after Easter;)

I upgraded a clients domain a few months ago from a 2003DC to a 2008R2 Domain. All went OK, few issues we solved along the way but all good now. During the upgrade procedure I completed the necessary adprep /domainprep and /forestprep commands and never bothered withthe /RODC commands because the client had no need for this...so guess what? Yep, a few months alter and they open up a new small office and want to bung in a server down there.

So, my question is, is it OK to run the adprep /rodc commands now on the new 2008R2 DC to ensure the RODC server deploys successfully? The one and only 2003DC was successfully decommisioned some time ago and is gone forever.

Any asistance is greatly appreciated as usual ;)

I have an Exchange 2010 setup with a number of Resource Rooms setup as per the guides floating around. All is working well and as expected. I ahve set it up so no conflcits are allowed, we have no delegates at all, and all requests are accepted as long as they meet the basic guidleines.

I've just had a user today want to make multiple bookings for their 'group' in a few calendars but they keep being rejected because the user doing the bookings has already made other bookings for that date/time in other rooms - so they get the 'Declined: Conflict' message as you would expect. So the user is in conflcit - not the resource room.

So what I need I guess is a way to allow a person to make mutliple bookings in different rooms without causing a conflict. But I still want the rooms not being able to be double booked.

Is this possible??

Or, is there a way to book a room without having a person attached to it?? So its jsut a room booking, shows up in the Calendar but the person who made the booking doesn't show up in the attendees.

Any thoughts and suggestions are appreciated.

As a quick followup to a prior question - I now have two standalone domains in a two way trust relationship - but not Transitive. I am able to add users from either domain to shares on the other. Sweet. What I would now like to do, the final thing, is to allow users from Domain B to use Exchange on Domain A using login credentials from Domain B - if possible.

I just tried to create a User Mailbox in Exchange 2010 on Domain A and all the options when browsing for users only show Domain A and its OU's. I see now way to locate Domain B.

Any thoughts or options??

I wa sthinking about creating the users in Domain A but I am missing the link on how I could associate these acocunts with their Domain B accounts...I am only talking about 3 users from Domain B at this time.

As usual - any help or pointers is appreciated ;)

I want to add a new 2008R2 VM to my network. This will be a separate domain controller for a separate VLAN'ed off office. This VLAN (20) is all squared away on the switches. I have an office with 3 PCs in it and a printer. The PCs are all getting their IPs from our main DHCP server atm for testing purposes (all VLAN20 IPs) and they can communicate between each other, the printer has a static IP in the correct VLAN range and all the PCs can hit it just fine.

Now, I want to add a new VM, more to the point a DC for that network so its in its own domain. I've run up a new VM but as soon as I assign it an IP in that range it will not communicate even as far as the switch it plugs into - my main L3 switch. I think my problem is that the ports on the switch that my physical Dell R710 uses for my VMs, lets call them ports 7, 8, 9 and 10, are all set as UNTAGGED and VLAN10 - as this is my main IP range for my existing 5 VMs my main netowrk uses. These same ports are TAGGED for a number of VLANs that are allowed to access those servers and they all work fine. If I set my new server to use that same range it works fine - my issues start as soon as I set the server to a manual IP in the VLAN20 range. Routing, membership, etc, is setup fine across the switches... I am pretty sure it has more to do with the fact that those ports mentioned above are in the VLAN10 UNTAGGED range which is why that server is not going out through them??

On a whim I went to the console of that server through the VM Client and went into properties of the NIC on that VM and set it in advanced to VLANID 20 with no success.

Anything I am missing or could you suggest to get this up and running as I intend?

Our business has opened a new business unit on our premises that is suppsoed to be a seperate entity. However, a couple of our users will be 'seconded' to the new entity. What I would like to do is run up a new Windows Server 2008 Domain Controller in a virtual machine and establish their own domain in the business name. I need our existing domain to trust the new domain and allow those couple of users access into the new domain. However, I do not need users in the new domain to access the main domain.

Its not really a 'child' domain; it's not a totally seperate domain (so not child.domain.local but rather domain2.local). It will share the same network (I'll put it on its own VLAN) and it will use the same resources such as internet connectivity, firewall, routers and the exisitng Exchange 2010 infrastructure etc.

Is it simply a matter of running up the VM, establishing network connectivity and then doing a DCPROMO and running through the wizard to create the new domain in an exisitng forest and away we go?

I just want to double check and make sure my thinking is right before I go ahead. Anything I need to watchout for or plan for that I am missing?

Still have an ongoing replication issue on my network. Long story short:

Existing 2003 Domain (2003 Level). Added a new 2008R2 server. Did the usual Adprep/forestprep steps as required. Transferred FSMO roles etc.

Had some initial issues creating Sysvol and Netlogon shares. Rectified with assistance from here running the Burflags reset workaround.

Now, strangely, I have the following issues:

In AD Users and CLients on the 2008DC I have all the users....but nothing in any of the other OU's. Nothing in Computers, Builtin, Domain Controllers etc but on my 2003DC they are all there. So its not pulling the info out of 2003DC and putting it into the 2008DC.

But, if a create a user on the 2008DC it will successfully replicate back to the 2003DC AND if I create a user ont he 2003DC it will replicate successfully back to the 2008DC.

Any ideas?? I'd like to kill off the 2003DC but can't till I get this working 100%.

Also, ont he 2008DC, and this may be related. I get repeated Event 6's and 13's - to do with failing to auto-enroll - RPC server unavailable. Again, any help is apprciated.

Rolling out a Server2008R2 box with SQL2008R2 on it to trial some new payroll software. I have ShadowProtect virtual licences for my VM's and this box will get one.

My question is: What is the best practice for backing up this SQL database? Will the ShadowProtect software allow me to restore just the DB or will it be a case of recovering the whole server? I know I can backup the DB manually via the SQL Managment studio if needed, but is there a way to automate this step if needed. I'm guessing some kind of script which goes into the Shadow Protect nightly backup that dismounts the DB, backs it up to a file and then remounts the DB??

OK, stupid question for the day ;)

How do I setup a 2008R2DC to be the domain time server? I have the link to the MS KB article and I have the link to the pool.ntp.org site with a whole bunch of addresses I am supposed to use...but for the life of me its not penetrating my skull.

Can someone break it down for me in far more simpler terms ;)

I even downloaded the 'Fix it for me' tool from MS in that KB article - the external one, and tried cutting and pasting the top two server x.pool.ntp.org links into the fix it for me wizard and it didn't work. I am positive I am just overlooking one small crucial detail to make it sync in ;)

As always, any and all help is greatly appreciated ;)

Just a short query: I have a Dell Md3200i setup to serve LUNs to my 2 physical hosts and I'm running vSphere/ESXi v5 with a number of VM's. Is it normal behavior for ALL VM's and LUN's to run off the one controller all the time? At the moment everything is running through Controller1.

I setup 2- 6 drive RAID10 arrays and wanted 1 array running via Controller0 and the other array via Controller1 to get a bit of load balancing going. But when I set 'Ownership' like that in the MD Manager it seems to migrate itself back to the one controller.

When I check the VM's MPIO modes in ESXi they all have 4 paths back to Controller1 as Active and 4 paths back to Controller0 as Standby.

I have played around pulling one controller out and it seems to all re-route itself to the other Controller. So it seems like its all via one controller at a time but just wanting to make sure I didn't screw something up in the setup ;)

Is this expected behavior??

I have a number of Dell PowerConnect switches. I've successfully setup various 'trunks' and vLANs and all working sweet. But one thing annoys me. I can't seem to 'manage' my switches from my laptop as I am on a particular subnet (vLAN12 10.0.12.x) and my switches are all setup to be managed on the 10.0.1.x and its not routable. I need to go down and plug my laptop physically into each switch - which is a pain in the arse.

Any ideas or thoughts?? .... Other than I'm an idiot ;)

I'm playing around with splitting up my existing flat LAN into a couple of separate VLANs. I seem to have everything working and routing as I want but I am having issues with internet connectivity. Quick rundown of the LAN:

1x PowerConnect 6248 (Layer 3)
4x 5448's (Layer 2)

Existing LAN (now vLAN99) 192.168.0.x/24
SnapGear SG580 Firewall is the Main Gateway on this vLAN 192.168.0.251

New vLANs:

10.0.10.x/24 - gateway 10.0.10.254 - virtual interface set on 6248
10.0.11.x/24 - gateway 10.0.11.254 - virtual interface set on 6248
10.0.12.x/24 - gateway 10.0.12.254 - virtual interface set on 6248

I have 4 port trunks (LAG + LACP) from each 5448 to the 6248 - Each 'trunk' is tagged on each VLAN I need to route down through, all the ports in each LAG are set to 'Trunk' mode. All existing servers and workstations were set to vLAN99 and it all worked perfect, no matter which switch you are plugged into. Great start. I setup IP-Helper on the 6248 and pointed it at our DC. I also setup 3 new DHCP scopes to match the new subnets. I can set ports on any switch to be vLAN10, or vLAN11 or vLAN12 and they get the correct IP assigned to them. I can see the new leases. The PC's hit the servers fine, mapped drives, print etc - awesome

But they don't get the internet!

They can resolve IP's fine. I can drop to cmd prompt, ping any web address and its resolving the IP it needs to go to - no responses though. They can ping their respective gateway (the virtual interface on the 6248), they can ping the SnapGear firewall at 192.168.0.251. I can get onto the Snapgear and ping back to the subnets Gateway fine. Something just isn't quite right and its driving me nuts!

Also, just to clarify it in my mind. TAGGED and UNTAGGED ports. From all my reading you TAG ports you want multiple vLANs to access.

So my Trunks (LAGs) are TAGGED in each vLAN I need to access those trunks.

The servers need their ports set to 'general' and TAGGED for each vLAN you want to access those ports and UNTAGGED for its native vLAN?? ie my DC is in vLAN99 so in that vLAN its UNTAGGED but in vLAN12 its TAGGED so that PC's in vLAN12 can access it?? This is how it is currently set and my laptop in vLAN12 can hit the server and access DHCP, shares etc fine - just no net access.

I have my Firewall in vLAN99 and UNTAGGED on that vLAN but TAGGED in vLAN10, vLAN11 and vLAN12.

All my PC's are set to 'Access' regardless of which vLAN they are in, and whatever vLAN they are in they are set to 'UNTAGGED' ie all PC's in vLAN12 are set to UNTAGGED.

Any help or ideas are greatly appreciated ;)

When I do a tracert from any PC on the affected vLANs I get 'Destination Hot unreachable from 10.0.x.254' which is the Virtual Interface on the 6248 for that subnet. Yet I can access the rest of the Internal network fine and ping the SG580 firewall. On the SG580 I have routes defined to get back to the 6248 and the SG580 can ping hte correct Interface on the 6248.

I just get a suspicious feeling its got something to do with the way I've TAGGED and UNTAGGED the ports....