How to allow anonymous relay for internal use

I get this question a lot from customers and colleges.

What they want to be able to do is to allow anonymous relay of mail from, say, a multi-function printer to a user’s mailbox, using the printers scan to email function.

This used to be easy in Exchange 2003, you would go the relay server allow list, add the IP address of the MFP and away you would go.

In Exchange 2007 it is a little bit harder

The primary thing that we need to make sure we do here is to make sure that we do not allow relaying from external users.

Here is how to get it all rolling

1) Open the Exchange Management Console (you can do it through the shell but I’ll go through the GUI for now)

2) Expand Server Configuration

3) Select Hub Transport

4) Select the server that needs to allow anonymous relay (this will need to be done on all of your HT server’s that will act as an internal relay)

5) In the action pane click New Receive Connector

6) Give the new connector a meaningful name, I recommend “Internal Relay <Servername>

7) Ensure that Intended use is set to Custom

8) Click Next

9) Click the red X to remove the IP range that the wizard auto adds

10) Click Add

11) Type in the IP address of the server

12) Click OK

13) Click Next

14) Again remove the auto added address

15) Click Add

16) Add the address of all objects that need to relay. You can also use slash notation to include a subnet range

17) Click OK

18) Click Next

19) Click New

20) This will finish off the wizard. You will now have the newly named receive connector

21) Double click on this connector

22) Click on the Authentication Tab

23) Un check any selected items

24) Select Externally Secured and TLS

25) Click Permission Groups tab

26) Un check any selected items

27) Check the Exchange servers box

28) Click OK

29) Test as needed

Now to achieve the same results with the Exchange management shell we would execute the following command

New-ReceiveConnector -Name "Internal Relay <SERVERNAME>" -Custom -Server “Server Name” -AuthMechanism ExternalAuthoritative -Bindings 192.168.1.2:25 -PermissionGroups Exchangeservers -RemoteIPRanges 192.168.1.0/24

How to protect a server with DPM 2007 behind an ISA 2006 firewall

I ran into this issue while at a site that used ISA to route traffic between VLANS

http://support.microsoft.com/kb/929102/en-us

 

To configure a firewall rule that lets you deploy the Data Protection Manager agent to an ISA Server computer, follow these steps:

1. Start the ISA Server Management Microsoft Management Console (MMC) snap-in.
   
2. Expand Arrays if you have an array configured, expand the ISA Server computer, and then click Firewall Policy.
   
3. On the View menu, click Show System Policy Rules.
   
4. Disable the Allow remote management from selected computers using MMC system policy rule. To do this, follow these steps:
   
   1. Double-click Allow remote management from selected computers using MMC.
      
   2. In the System Policy Editor dialog box, click to clear the Enable check box, and then click OK.
      
   3. Click Apply to update the firewall configuration, and then click OK.
      
5. Remove strict remote procedure call (RPC) compliance from System Policy rule 22. To do this, follow these steps:
   
6. Double-click the Allow RPC from ISA server to trusted servers system policy rule.
   
   1. In the System Policy Editor dialog box, click to clear the Enforce strict RPC compliance check box, and then click OK.
      
   2. Click Apply to update the firewall configuration, and then click OK.
      
7. On the View menu, click Show System Policy Rules to hide System Policy rules.
   
8. Click the Tasks tab in the right pane, and then click Create New Access Rule.
   
   Note If you are running ISA Server 2004, Enterprise Edition, click Create Array Access Rule.
   
9. In the New Access Rule Wizard, type a descriptive name in the Name box. For example, type DPM.
   
10. Click Next, click Allow, click Next, click All outbound traffic in the This rule applies to list, and then click Next.
    
11. On the Access Rule Sources page, click Add.
    
12. In the Add Network Entities dialog box, click Computer on the New menu, type the name of the Data Protection Manager 2006 server in the Name box, type the IP address of the Data Protection Manager 2006 server in the Computer IP Address box, and then click OK.
    
13. In the Add Network Entities dialog box, expand Computers, click the new computer entry that you created, and then click Add.
    
    Note If you want to manage the ISA Server computer by using Remote Desktop Protocol or by using the ISA Server Management MMC snap-in from another computer, you can add those other computers to this rule. To do this, follow steps 10 through 12 for each computer that you want to add.
    
    Expand Networks, click Local Host, click Add, and then click Close.
    
    At a minimum, the This rule applies to traffic from these sources box should contain the Data Protection Manager 2006 computer entry and the Local Host entry.
    
14. Click Next, and then click Add.
    
15. In the Add Network Entities dialog box, expand Computers, click the Data Protection Manager 2006 computer entry, click Add, expand Networks, click Local Host, click Add, and then click Close. The Data Protection Manager 2006 computer entry and the Local Host entry are listed in the This rule applies to traffic sent to these destinations box.
    
16. Click Next, leave the default All Users entry in the This rule applies to requests from the following user sets box, click Next, and then click Finish.
    
17. Right-click the new rule, and then click Move Up to move this rule to the top of the rules list in the firewall policy rules. This configuration causes the rule to be matched before other rules are applied to traffic that is sent to or received from the Data Protection Manager 2006 server.
    
18. Right-click the new rule, and then click Properties.
    
19. In the RuleName Properties dialog box, click the Protocols tab, click Filtering, and then click Configure RPC Protocol.
    
20. In the Configure RPC Protocol policy dialog box, click to clear the Enforce strict RPC compliance check box, and then click OK two times.
    
21. Click Apply to update the firewall policy, and then click OK.
    

Ignore step 4
Disable the Allow remote management from selected computers using MMC system policy rule. To do this, follow these steps:
Double-click Allow remote management from selected computers using MMC.
In the System Policy Editor dialog box, click to clear the Enable check box, and then click OK.
Restart the DPM services on the Protected Server and they should come up in the console

 

Exchange 2007 Web services display “Service Unavailable” after 32-bit .net 1.1 is installed

This happened to me after installing GFI Mail Security on an Exchange 2007 box with HT/CAS/MB roles on it.

Event logs were
Event Type: ErrorEvent Source: W3SVC-WPEvent Category: NoneEvent ID: 2268Date: 28/01/2009Time: 11:46:53 PMUser: N/AComputer: XXXDescription:Could not load all ISAPI filters for site/service. Therefore startup aborted.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: ErrorEvent Source: W3SVC-WPEvent Category: NoneEvent ID: 2274Date: 28/01/2009Time: 11:46:53 PMUser: N/AComputer: XXXDescription:ISAPI Filter 'C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll' could not be loaded due to a configuration problem. The current configuration only supports loading images built for a AMD64 processor architecture. The data field contains the error number. To learn more about this issue, including how to troubleshooting this kind of processor architecture mismatch error, see http://go.microsoft.com/fwlink/?LinkId=29349.
The fix is to force IIS to use 64 bit ASP.Net. To do this do the following
Click Start, click Run, type cmd, and then click OK.
Type the following command to disable the 32-bit mode:
cscript %SYSTEMDRIVE%\inetpub\adminscripts\adsutil.vbs SET W3SVC/AppPools/Enable32bitAppOnWin64 0
Type the following command to install the version of ASP.NET 2.0 and to install the script maps at the IIS root and under:
%SYSTEMROOT%\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe -i
Make sure that the status of ASP.NET version 2.0.50727 is set to Allowed in the Web service extension list in Internet Information Services Manager.
Note The build version of ASP.NET 2.0 may differ depending on what the currently released build version is. These steps are for build version 2.0.50727.
A restart of the IIS services is not needed after this
Alternate fix is
You can also manually modify the Enable32BitAppOnWin64 flag in the following file C:\Windows\system32\inetsrv\metabase.xml. Change it to TRUE or FALSE depending on whether you need 32 bit ASP or 64 bit ASP running. Must do a net stop iisadmin first before editing this then do a iisreset after editing.

Exchange 2007 Information Store will not start with event log 5000 and 1121

Information Store service will not start and is giving these two errors in the event log?
This could be the problem.
The default address policy has not been given the correct policy number in AD.
This causes Exchange to believe that there is no default address policy.
Here is the fix

Install ADSI Edit.
Launch ADSI Edit. To do this, click Start, click Run, type adsiedit.msc in the text box, and then click OK.
Locate the E-mail Address Policies attribute by going to the following location: CN= E-mail Address Policies\CN= Recipient Policies\CN=\CN= Microsoft Exchange\CN= Services\CN= Configuration\DC=\DC=com.
Right-click the E-mail Address Policies name, and then select Properties.
Find the msExchPolicyOrder attribute, and then click Edit.
Set the value of the msExchPolicyOrder attribute to 2147483647.
Click OK, and then close ADSI Edit.
Restart the Exchange Mailbox server.

Users Not appearing the GAL after being imported through the use of a script

This applies to specifically after a Exchange 2003 to 2007 migration where the mailbox manager rules were not deleted prior to Exchange 2003 being decomissioned.

This is one that has had me stumped for a while.
The issue is as follows
After adding users in bulk to AD from a script or any other way than through ADUC and then mail-enabling them in EMC they do not appear in the GAL or All Users.
The problem is that the msExchHideFromAddressLists is set to FALSE. If this attribute is set to the user will appear in the GAL.
This is however not the issue.
The problem lies with the Default Address policy.

The solution is as follows
Create a new address policy in the EMC and make sure that is has the following settings

Applies to all recipients
The Addresses are
@externaldomainname.com.au
@internaldomain.local

In ADSI Edit navigate to
CN=Recipient Policies,CN=Org,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=Local
Right click on the name of the policy that you just created
Change the attribute
msExchPolicyOrder to 2147483647

Restart all Exchange services

Open the EMS and type the following

Get-user –resultsize unlimited set-mailbox –applymanadoryproperties

Open OWA and verify that all users are now in the GAL

Free/Busy Information not available – and it’s not the servers fault.....entirely

I was out at a client site yesterday that I hadn't seen for a while.

They had called me out because Free/Busy wasn't showing in Outlook and there were no issue for OAL/OAB in the event logs.

I was also told that they had some public folder database issues last week which resulted in the Public Folders having to be completely restored.

After about 20 minutes of wading through logs after increasing the logging level for OAL and updating the OAB there were no errors.

On the client devices downloading the address book on the client did not result in any errors. Now these are Outlook 2007 so my mind was not made up that it was Public Folder as Web Distribution was enabled on the OAB in Exchange.

After continued head bashing I found that Outlook doesn't always look at the public folders for Free/Busy.

Now to force Outlook to behave properly you have to hack the registry.

HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Options\Calendar
Value Type: DWORD
Value Name: UseLegacyFB
Values: 0 or not set (default behaviour which is to use the Availability Service) or 1 (use Public Folder based Free/Busy information)

After making this change on a few test PC's it worked like a charm.

 

Have fun and be nice to each other J

 

Matt

Exchange 2007 SP1 Update 9 released

http://msexchangeteam.com/archive/2009/07/17/451835.aspx

I will be testing the patch tomorrow in the lab and if all goes well. I will be installing it onto production systems in the next few days.

I usually like to let an update settle for a few days in the lab before unleashing it on a production environment.

The note at the bottom of the post from the Exchange team did get me thinking a little in regards to Exchange 2007 SP2 and what it will bring to the table in terms of updates and features.

 

Have fun and be nice to each other J

 

Matt