Looking back to our “Configure the Availability Service for Cross-Forest Topologies”, the setup of Cross Forest Availability only has a few moving parts.

The first is to make sure that AutoDiscover is working properly as AutoDiscover is used to lookup where to send the availability requests for the user during a free/busy lookup.

Next in the list is to decide how you want to share free busy and whether or not you want to setup a Trust between forests. You can setup Cross Forest Availability in an untrusted environment, but this customer had chosen to set up a Trust between the two forests.

The customer I was visiting had setup two trusts between the Forests. The first was a two-way, Transitive Forest Trust and the other was a two-way External Trust.

The next item would be to add an AD Permission to each CAS to setup token serialization that will be used so that the CAS can pass credentials back and forth during lookups – that’s done with this command:

Our final task is to create an availability address space. This is a simple Exchange Management Shell one-liner to tell the client access servers to go get availability for anyone with that specific email address via https at the location specified in the command. To create the Availability Address Space, use the command below.

The customer I was at had already had all of this in place. They had created their Trusts, they had granted the AD Permission, and they had created the Availability Address Space as well as creating contact entries in their forest for the users in the target forest. No dice on the availability.

Troubleshooting steps included verifying all of the items in place, and we found there were several trusts in place. As mentioned earlier, there was a 2-way Forest Trust and an External Trust. During this engagement, I came to find out that an external trust will not work with Cross Forest Availability. Based on how other AD related features work, my explanation is that the External Trust will be used first since it’s technically a lower level, or more restrictive. When Exchange goes to communicate via the trust and pass credentials, it will pass those credentials via the Trust and if an External Trust is in place, it will try to use the External Trust, and will then fail miserably. This was validated via turning up diagnostic logging on MSExchange Availability to Expert level. During the availability request when the External Trust was in place, below is the error that was recorded.

Once we removed the external trust that was in place, the availability service started working as expected and the customer was receiving availability information from the remote forest just fine at that point.

So, the moral of the story here is to never, ever, ever (like, ever!) use External Trusts while working with Cross Forest Availability.

Special thanks to the following folks to assistance in understanding various pieces of information to write this:
Rob McGinnis, Jeff Dykstra, Bill Ziemer, Chad Solarz, and Dan Smith

I recently performed an engagement for a customer where we stood up an Exchange Server 2010 server in a lab environment and installed Forefront Endpoint Protection 2010 on the server.  After installing FEP, we then needed to configured the antivirus exclusions per TechNet guidance.  In doing so, it was a little tedious as the TechNet guidance is great at listing each exclusion necessary, but not great at listing them in an easy way that can be cut and paste.

For current versions of Microsoft Exchange server, you can find the proper antivirus exclusions at these locations on TechNet:

Exchange Server 2003

Exchange Server 2007

Exchange Server 2010

While having these links is AWESOME for helping engineers to configure the product, it’s a little time consuming to go through and setup these exclusions as they are listed from the TechNet articles.  The intention of this blog is to make life easier for the administrator configuring antivirus exclusions for Exchange Server, so what I have done below is take the Antivirus exclusions for Exchange Server 2010 and put them into a friendly manner for cut and paste.

One quick note about the exclusions is that I have also included the processes and executables as well.  I can’t stress how important it is to exclude the processes when setting up your antivirus exclusions for Exchange.  If you have not done so, or do not plan to exclude Exchange related processes, I would ask that you reconsider as it is extremely beneficial for the health of the system.  You do not want file system antivirus to scan in memory processes because it can and will quarantine certain items.

I am not going to list any file paths below because the various TechNet articles above list those file paths very well, and also provide a means to discover those file paths easily via the Exchange Management Shell / PowerShell or other means.  Do not overlook adding the file paths to your list of exclusions!  I am only going to list the individual files and extensions below in the cut and paste friendly manner for those running Exchange Server 2010.

Processes to be Excluded:

Cdb.exe
Microsoft.Exchange.Search.Exsearch.exe
Cidaemon.exe
Microsoft.Exchange.Servicehost.exe
Clussvc.exe
MSExchangeADTopologyService.exe
Dsamain.exe
MSExchangeFDS.exe
EdgeCredentialSvc.exe
MSExchangeMailboxAssistants.exe
EdgeTransport.exe
MSExchangeMailboxReplication.exe
ExFBA.exe
MSExchangeMailSubmission.exe
GalGrammarGenerator.exe
MSExchangeRepl.exe
Inetinfo.exe
MSExchangeTransport.exe
Mad.exe
MSExchangeTransportLogSearch.exe
Microsoft.Exchange.AddressBook.Service.exe
MSExchangeThrottling.exe
Microsoft.Exchange.AntispamUpdateSvc.exe
Msftefd.exe
Microsoft.Exchange.ContentFilter.Wrapper.exe
Msftesql.exe
Microsoft.Exchange.EdgeSyncSvc.exe
OleConverter.exe
Microsoft.Exchange.Imap4.exe
Powershell.exe
Microsoft.Exchange.Imap4service.exe
SESWorker.exe
Microsoft.Exchange.Infoworker.Assistants.exe
SpeechService.exe
Microsoft.Exchange.Monitoring.exe
Store.exe
Microsoft.Exchange.Pop3.exe
TranscodingService.exe
Microsoft.Exchange.Pop3service.exe
UmService.exe
Microsoft.Exchange.ProtectedServiceHost.exe
UmWorkerProcess.exe
Microsoft.Exchange.RPCClientAccess.Service.exe
W3wp.exe

If you are also running Forefront Security for Exchange, you should also exclude the following processes:

And one last note – for all those companies out there that don’t run file level Antivirus on your Exchange Servers, please reconsider!  I dread the day that a virus will come along and ruin your day, and a whole lot of PFE’s days as well.

As a PFE, I provide both reactive assistance to Microsoft Premier customers for CritSits and other reactive based assistance.  I also provide Proactive Assistance to our customers in the form of Exchange Risk Assessments (ExRAP), Workshop related training (Admin & Operations, High Availability, Disaster Recovery, etc…) and other proactive assistance which can include deployment and documentation review, assistance with deployment issues and other custom proactive assistance that our customers require.

I also dabble in other technologies outside of Exchange (but mostly related to Exchange), including TMG and ISA, Forefront Endpoint Protection, Forefront Protection for Exchange, BPOS & Office 365, and Hyper-V.

In my free time, I enjoy General Aviation where I am a private pilot.  I also enjoy  PC and Xbox gaming and playing the guitar.  I have also gotten into personal fitness relatively recently where I have completed P90X and I now run regularly.