There are 5 methods to alleviate this behavior. 1. Change the “sync Window”. The sync window is the number of days of mail that is configured to be stored on the device. If we reduce the size ( sync fewer days ) of this window and the item that has the issue is no longer in the sync window, there will be no issue. 2. Change the device syncing method from “push” to “fetch”. 3. Move the affected item to another folder and/or delete old items in an effort to get the affected item out of the sync window. It will require Microsoft support intervention to track down the specific item, but hopefully cleaning up the inbox will result in success. 4. Delete the affected item, this will also require Microsoft support to identify the specific item.

Here is a help desk template one of my customers asked me to create. I thought I would share it for all.

When a client first calls in with this issue, you have the choice of reducing the sync window or changing the sync method. How you proceed should be discussed with the affected client. Changing to fetch mode eliminates the issue, but the device will only update on a 15 minute schedule.
1. Change to “fetch” mode:
 a. Open “settings” on the IOS device and select “mail, contact, and calendars”
 b. Select “fetch new data” and move the slider on the “Push” line to off.
 c. Scroll down and make sure the schedule checked is “Every 15 minutes”.

2. Change the sync window to 1 day while also cleaning up the inbox.
 a. Open “settings” on the IOS device and select “mail, contact, and calendars”
 b. Select the affected email account
 c. Scroll down and select “Mail Days to Sync” and check “1 Day”. If the items causing the issue was from today, they will have to wait 24 hours to see if this resolved the issue. They will need to manually update the mailbox for that 1 day. After 24 hours, the item should be out of the sync windows of 1 day and should update automatically thereafter. You can gradually increase the sync windows as time goes by keeping the affected item out of the sync window.  

3. If option 2 fails and 24 hours later we still have the issue, we need to perform a more invasive and complex procedure (this is not usually required).
 a. Remote into the affected user’s desktop that has Outlook installed.
 b. Download MFCMAPI from https://mfcmapi.codeplex.com/ and extract the file to the desktop (does not require installation).
 c. Log into Outlook, and change “Account Setting” to online mode.
 d. Remove the account from the mobile device.
 e. Log into the user’s OWA, go to settings, and remove the affected device from the mobile device list.
 f. Execute MFCMAPI and open the user’s mailbox:
  A. Open Mailbox with MFCMAPI while Outlook profile is set to online mode. Run this from the clients desktop.
  B. Session --> Logon -->Root Container
  C. Remove all folders that start with Airsync
 g. Change the sync window on the device to 1 day ( see action item 1).
 h. Re-create the device partnership.

4. If option 1 is unacceptable and option 2 and 3 fail. Open a case with Microsoft to find the affected item and remove it from the mailbox.

There are some other things that can be done on an org wide level to reduce the frequency of this happening (though it is not a common issue).
1. Follow calendar best practices as discussed here: https://support.office.microsoft.com/en-us/article/Best-practices-when-using-the-Outlook-Calendar-d93f72d3-2361-4e0d-8d6a-5c4939c17f39?CorrelationId=87beb498-f681-4e70-a137-b0b002d76d02&ui=en-US&rs=en-US&ad=US . Pay SPECIAL ATTENTION to having zero events with a never ending date. This is the most coming reason why changing the sync window to 1 day fails because a never ending event always needs to be sync’d.
2. Limit the number of items stored in the mailbox. Although this is fairly rare, Having 10’s of thousands of items in the inbox with a large sync window, increases the chance of having an issue.
3. Reduce the sync window size as a best practice.

As always, make sure you have a current backup of your Active Directory before attempting this procedure.

Utilize ADModify to perform bulk update of user's Display Name to the format of Last Name, First Name.

Process to perform this:

• Download ADModify from: https://admodify.codeplex.com/

• Extract ADModify binaries from the ZIP file.

• Locate ADModify.exe and double click on it.

• Click Modify Attributes

• On the next screen, select the following

  • Under Domain List, click the dropdown box and select your domain.

Example: DC=domain,DC=com

• Under Domain Controller List, click the dropdown box and select a domain controller from the list.  It is best to select a domain controller that is the closest to the machine where you are executing ADModify.

• For Show Only, make sure that only Users is selected.  Deselect everything else.

• Click the green button

• This will return the domain.  Double-click on the domain object.  In this Example that is FineartSchool

• This will expand the domain and show the Organizational Unit structure

• Navigate to the Organizational Unit where the users that you wish to update reside.

• You can double click on the Organizational Units to expand them.

  • In this example, I want to modify users located in the OU OU 1

• Once you have the proper Organizational Unit selected, click on Add To List->

  • If there are users in sub OUs for the OU that you selected, also check Traverse Subcontainers

  • This will add all users that are located in the selected organizational unit to the list on the right side.

• If you wish to update every user that was returned, click Select All.

• If you wish to only update specific users, Shift Click or CTRL Click the users that you wish to update.

• Click Next>>>

• On the next screen, remain on the General tab

• In the middle section of the General Tab, check the checkbox for Display Name

• Above the Display Name field, you will see blue highlighted text LastName, FirstName.

  • Click on the blue LastName, FirstName text.

  • This will populate the Display Name field with %'sn'%, %'givenName'%

• Once you are ready, click Go!

• The pop up will indicate how many were changed, how many failed and how many were already set to the desired setting.

• Click OK

• Wait for Active Directory Directory Replication to complete.

• You can check to see if the Display Name has been updated by going to the Recipient Configuration\Mailbox node in Exchange Management Console

• Double click on a user.  On the General tab, at the very top the name should now be in the LastName, FirstName format.

Exchange 2013 Malware Engine Updates Troubleshooting

Anti-malware FAQ

Download engine and definition updates

How to manually update scan engines in Microsoft Forefront Protection for Exchange Server or Microsoft Forefront Protection for SharePoint

All had good information, but I found the procedures to be a little less than clear and ended up pulling parts of procedures out of them and putting them together. I also found some of the procedures overly complicated. Since I had to put instructions together for a customer anyway, I thought I would post them here.

1. Go to any computer that you know you can get to the update site at https://forefrontdl.microsoft.com/server/scanengineupdate. Attempting to connect to this site in a browser should render a 403 forbidden, that's ok, it confirms the path is accessible and that's all we need.

2. Grab the update script from https://support.microsoft.com/kb/2292741and save it to a local folder. For my purposes, I used c:\script. 

3. Open File Explorer and create the following folder: c:\ScanEngineUpdates

4. Open Windows Powershell, cd to the folder you saved the script to. In my case c:\script , and  Run :

.\Update-Engines.ps1 -EngineDirPath C:\ScanEngineUpdates\ -UpdatePathUrl https://forefrontdl.microsoft.com/server/scanengineupdate/ -Engines Microsoft -Platforms amd64, x86

If you have any trouble executing the script due to restrictions, you can run: set-executionpolicy -unrestricted to allow it. Be sure to set it back to default when you are done: set-executionpolicy -default .

This will download the files with the right folder structure needed to C:\ScanEngineUpdates\

5. Copy the folder structure and files you just created to a server that you can create a share on that is accessible to your Exchange 2013 server. I did a right click and copied the c:\ScanEngineUpdates folder then pasted to c:\ on my file server. Create a share to this folder. For my purposes, I named the share "ScanEngineUpdates".

6. Now you need to make a decision, is this a permanent arrangement where you will manually download the updates or is it temporary? If it is permanent, you need to run the following command in the Exchange Management Shell for all your mailbox servers to set the primary URL for engine updates:

Set-MalwareFilteringServer <serverName> –PrimaryUpdatePath \\<Server>\<ResourceName>

For my purposes, I ran Set-MalwareFilteringServer wingtip-e2k13 –PrimaryUpdatePath \\WINGTIP-E2K13\ScanEngineUpdates.

If this is temporary, we don't want to change the primary. Instead we want to change the secondary. Run this:

Set-MalwareFilteringServer <serverName> –SecondaryUpdatePath \\<Server>\<ResourceName>

I ran: Set-MalwareFilteringServer wingtip-e2k13 –SecondaryUpdatePath \\WINGTIP-E2K13\ScanEngineUpdates.

7. Open Exchange Management Shell and run:

Start-EngineUpdate

If you have any trouble running Start-EngineUpdate, execute this first: Add-PSSnapin -Name Microsoft.Forefront.Filtering.Management.PowerShell

8. If you updated the PrimaryUpdatePath, you should see an application event log entry for Event ID 6024 showing the path being checked. Shortly thereafter, you will see an Event ID 6031 Stating the update was successful.  If you chose to update the SecondaryUpdatePath, wait for the primary to fail as indicated by an Event ID: 6027  and the secondary will be checked as indicated by a Event ID: 6030 which should show your shared resource as the path being checked. This should be followed by an Event ID: 6031 stating the engine update process has successfully downloaded updates for Microsoft. Another indicator you were successful, would be to execute in the Exchange Management Shell: Get-EngineUpdateInformation . This should display the expected updated version and date updated information.

By the way, welcome to my blog post number 1, I will post more of these soon as I already have post # 2 almost ready to go. Comments are always welcome.