Lalit Bisht Blogs https://docs.microsoft.com/archive/blogs/lalitbisht/feed.xml MICROSOFT Tue, 17 Jul 2018 17:06:06 GMT en-US hourly 1 OWA/ECP Breaks if "Microsoft Exchange Server Auth Certificate" is Expired https://docs.microsoft.com/archive/blogs/lalitbisht/owaecp-breaks-if-microsoft-exchange-server-auth-certificate-is-expired Tue, 17 Jul 2018 22:36:05 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=325 If the "Microsoft Exchange Server Auth Certificate" certificate isn't present on Exchange servers in the organization, follow these steps to create and deploy a new OAuth certificate to the Exchange server:

  1. Create a new OAuth certificate by running the following command:

    New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate" -DomainName "contoso.com"

    Note Change the value of the DomainName parameter in the example (contoso.com) to the SMTP domain that's used in your organization.

  2. Set the created certificate to be used for server authentication by running the following commands:

    Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromStep1> -NewCertificateEffectiveDate (Get-Date) Set-AuthConfig –PublishCertificate Set-AuthConfig -ClearPreviousCertificate

  3. Restart the Microsoft Exchange Service Host Service.

  4. Either run the IISReset command to restart IIS or run the following commands (in elevated mode) to recycle OWA and ECP Application pools:

    Restart-WebAppPool MSExchangeOWAAppPool Restart-WebAppPool MSExchangeECPAppPool

    Note In some environments, it may take an hour for the OAuth certificate to be published.

]]> ReadReceipt on Active Sync Device https://docs.microsoft.com/archive/blogs/lalitbisht/readreceipt-on-active-sync-device Tue, 10 Jul 2018 03:35:57 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=285 Get-CASMailbox <User> | fl ActiveSyncSuppressReadReceipt ActiveSyncSuppressReadReceipt : False You can set it $Ture and it will change following option in Outlook Web Access as well. Set-CASMailbox <User> -ActiveSyncSuppressReadReceipt $True    ]]> Unable to see Free Busy through Exchange Federation https://docs.microsoft.com/archive/blogs/lalitbisht/unable-to-see-free-busy-through-exchange-federation Sat, 16 Dec 2017 06:31:47 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=275 [PS] C:\>Test-FederationTrust RunspaceId : 49c3c312-1a26-4cd8-a14d-59d736458f76 Id         : FederationTrustConfiguration Type       : Success Message    : FederationTrust object in ActiveDirectory is valid.  RunspaceId : 49c3c312-1a26-4cd8-a14d-59d736458f76 Id         : FederationMetadata Type       : Error Message    : Unable to retrieve federation metadata from the security token service.  RunspaceId : 49c3c312-1a26-4cd8-a14d-59d736458f76 Id         : StsCertificate Type       : Success Message    : Valid certificate referenced by property TokenIssuerCertificate in the FederationTrust object.  RunspaceId : 49c3c312-1a26-4cd8-a14d-59d736458f76 Id         : StsPreviousCertificate Type       : Success Message    : Valid certificate referenced by property TokenIssuerPrevCertificate in the FederationTrust object.  RunspaceId : 49c3c312-1a26-4cd8-a14d-59d736458f76 Id         : OrganizationCertificate Type       : Success Message    : Valid certificate referenced by property OrgPrivCertificate in the FederationTrust object.  RunspaceId : 49c3c312-1a26-4cd8-a14d-59d736458f76 Id         : TokenRequest Type       : Error Message    : Failed to request delegation token. Resolution: You need to make sure Exchange On-Prem servers are able to reach MFG i.e there is no as such restrictions. You need to check if any stale InternetWebProxy attribute is configured at the Exchange servers level.]]> Probe Exception: 'System.Net.Sockets.SocketException (0x80004005): No connection could be made because the target machine actively refused it 127.0.0.1:587 on Exchange Servers https://docs.microsoft.com/archive/blogs/lalitbisht/probe-exception-system-net-sockets-socketexception-0x80004005-no-connection-could-be-made-because-the-target-machine-actively-refused-it-127-0-0-1587-on-exchange-servers Thu, 24 Aug 2017 19:10:10 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=266 Log Name: Microsoft-Exchange-ManagedAvailability/Monitoring Source: Microsoft-Exchange-ManagedAvailability Date:  Event ID: 4 Task Category: Monitoring Level: Error Keywords: User: SYSTEM Computer:  Description: The client submission probe failed 3 times over 15 minutes. No connection could be made because the target machine actively refused it 127.0.0.1:587 Probe Exception: 'System.Net.Sockets.SocketException (0x80004005): No connection could be made because the target machine actively refused it 127.0.0.1:587 at System.Net.Sockets.TcpClient..ctor(String hostname, Int32 port) at Microsoft.Forefront.Monitoring.ActiveMonitoring.Smtp.Probes.SimpleSmtpClient.Connect(String server, Int32 port, Boolean disconnectIfConnected) at Microsoft.Forefront.Monitoring.ActiveMonitoring.Smtp.Probes.SmtpConnectionProbe.MeasureLatency(String reason, ActionWithReturn`1 cmd) at Microsoft.Forefront.Monitoring.ActiveMonitoring.Smtp.Probes.SmtpConnectionProbe.MeasureLatency(String reason, ActionWithReturn`1 cmd, ConnectionLostPoint connectionLostPoint) at Microsoft.Forefront.Monitoring.ActiveMonitoring.Smtp.Probes.SmtpConnectionProbe.TestConnection() at Microsoft.Forefront.Monitoring.ActiveMonitoring.Smtp.Probes.SmtpConnectionProbe.DoWork(CancellationToken cancellationToken) at Microsoft.Office.Datacenter.WorkerTaskFramework.WorkItem.Execute(CancellationToken joinedToken) at Microsoft.Office.Datacenter.WorkerTaskFramework.WorkItem.<>c__DisplayClass2.<StartExecuting>b__0() at System.Threading.Tasks.Task.Execute()' Failure Context: 'No connection could be made because the target machine actively refused it 127.0.0.1:587' Execution Context: '' Probe Result Name: 'OnPremisesSmtpClientSubmission' Probe Result Type: 'Failed' Monitor Total Value: '3' Monitor Total Sample Count: '3' Monitor Total Failed Count: '0' Monitor Poisoned Count: '0' Monitor First Alert Observed Time: It happens if "Client Frontend <server>" receive connector does not have (All Available IPv4) in the "Network adapter bindings" instead it is set as server local IP address. So you can change it to (All Available IPv4) on port 587 then you should be able to telnet 127.0.0.1 on 587 locally on the server.]]> When clicking new message in Outlook Web Access, Nothing happens. https://docs.microsoft.com/archive/blogs/lalitbisht/when-clicking-new-message-in-outlook-web-access-nothing-happens Fri, 18 Aug 2017 21:45:00 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=216 Resolution:- It happens due to some contents in the Signature which is causing it so you can remove/modify the signature from OWA, save it and test once more.  ]]> Exchange 2010 SP3 RU16 update fails with error code 2771 https://docs.microsoft.com/archive/blogs/lalitbisht/206 Sun, 02 Jul 2017 01:50:02 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=206 Exchange 2010 SP3 RU16 update fails with following error. Log Name: Application Source: MsiInstaller Date: ******* Event ID: 10005 Task Category: None Level: Error Keywords: Classic User: ******* Computer: ******* Description: Product: Microsoft Exchange Server -- The installer encountered an unexpected error while installing this package. This may indicate a problem with this package. The error code is 2771. The arguments are: AdminTools,  You can use "Exchange2010-KB3184730-x64-en.msp /lxv <Path for logs>" to generate the Log files and you get following errors. Couldn't find local patch 'C:\Windows\Installer\9001dd74.msp'. Looking for it at its source. Resolving Patch source. User policy value 'SearchOrder' is 'nmu' SOURCEMGMT: Media enabled only if package is safe. SOURCEMGMT: Looking for sourcelist for product {6663F722-25A2-490B-9B3E-3B1638C33987} SOURCEMGMT: Adding {6663F722-25A2-490B-9B3E-3B1638C33987}; to potential sourcelist list (pcode;disk;relpath). SOURCEMGMT: Now checking product {6663F722-25A2-490B-9B3E-3B1638C33987} SOURCEMGMT: Media is enabled for product. SOURCEMGMT: Attempting to use LastUsedSource from source list. Cause:- Set up was failing while looking for old RUs installer/Cache files. Resolution:- Download the required RUs at required path as per the Logs. Example: download the RU14 setup file at C:\RU14 Start the upgrade and it should work if no other issues.]]> EdgeSync service cannot connect to this subscription because of error "The LDAP server is unavailable" https://docs.microsoft.com/archive/blogs/lalitbisht/195 Sun, 02 Jul 2017 01:05:05 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=195 EdgeSynchronization in the Exchange 2010 environment but having issues with edge sync and getting following events on the HUB servers. Log Name:      Application Source:        MSExchange EdgeSync Date:          ******** Event ID:      1024 Task Category: Topology Level:         Error Keywords:      Classic User:          N/A Computer:      ********** Description: Failed to connect to the Edge Transport server ADAM instance with exception The LDAP server is unavailable..  This could be caused by a failure to resolve the Edge Transport server name <> in DNS, a failure trying to connect to port 50636 on <>, network connectivity issues, an invalid certificate, or an expired subscription.  Verify your network and server configuration. When you run Test-EdgeSynchronization, you get following error also. RunspaceId                  : <> SyncStatus                  : Failed UtcNow                      : <> Name                        : <> LeaseHolder                 : LeaseType                   : None FailureDetail               : EdgeSync service cannot connect to this subscription because of error "The LDAP server isunavailable.". LeaseExpiryUtc              : <> LastSynchronizedUtc         : <> TransportServerStatus       : Skipped TransportConfigStatus       : Skipped AcceptedDomainStatus        : Skipped RemoteDomainStatus          : Skipped SendConnectorStatus         : Skipped MessageClassificationStatus : Skipped RecipientStatus             : Skipped CredentialRecords           : Number of credentials 0 CookieRecords               : Number of cookies Solution: Make sure TLS 1.0 is not disabled through registry on the EDGE servers, if it is then remove the TLS 1.0 registry to enable it and reboot the edge server. Note: This is one of the cause other than blocked ports, duplicate Certificates ,DNS etc.]]> Exchange Server 2016 and Office Online Server Process Flow https://docs.microsoft.com/archive/blogs/lalitbisht/exchange-server-2016-and-office-online-server-process-flow Tue, 20 Jun 2017 20:57:46 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=185
  • Exchange uses discovery URL to ask Office Online Server which files types it can view and edit.
  • Office Online Server returns table of supported file types.
  • User opens mail with attachment that matches one of the file types Office Online Server supports and OWA requests document URLs for supported types.
  • Exchange builds URL with Auth token, app URL, and Attachment ID and returns it to OWA.
  • User clicks attachment within OWA and spawns an iFrame on client to load the URL returned by Exchange.
  • Office Online Server retrieves document content from Exchange.
  • Office Online Server renders content in web client (e.g., Word Web App).
    • Logs to Troubleshoot:
    • Event Viewer logs on both Office Online Server and Exchange.
    • Component Logging file on Exchange Servers.
    • Client side traces -> F12 or Fiddler.
    • ULS Logs located on OOS Server. C:\ProgramData\Microsoft\OfficeWebApps\Data\Logs\ULS
    ]]>         Cannot enable UM for users https://docs.microsoft.com/archive/blogs/lalitbisht/cannot-enable-um-for-users Sun, 04 Jun 2017 01:02:01 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=175 Enable-UMMailbox -Identity <> -UMMailboxPolicy <> -Extensions <> -PinExpired:$true -SipResourceIdentifier <> Exception: Mailbox <> couldn't be initialized for Unified Messaging: There was an error accessing the mailbox using EWS. The requested operation failed with ResponseCode "ErrorInternalServerError". Details : An internal server error occurred. The operation failed. + CategoryInfo          : NotSpecified: (:) [Enable-UMMailbox], RecipientTaskException Additionally you get following error while accessing the affected user's mailbox through OWA. A problem occurred while you were trying to use your mailbox. X-ClientId: <> X-OWA-Error: SDServerErr;Microsoft.Exchange.Data.Storage.StoragePermanentException X-OWA-Version: <> X-FEServer: <> X-BEServer: <> Date: <> This happens due to corruption in the Search of user's mailbox so we need to follow below steps to resolve it. >Need to configure affected user’s Outlook profile in ONLINE mode. >Run the MFCMAPI Tool and navigate to Session->logon. >Select affected user's ONLINE profile. >Right Click on the user and click on Open Store. >Expand Root Mailbox->Finder. >Permanently delete all folders starting with string Search*. >Log Out from MFCMAPI. Note:- Deleting search folders will remove all search queries from user's mailbox.]]> Mailflow issue from Exchange On-Prem to Office 365 https://docs.microsoft.com/archive/blogs/lalitbisht/mailflow-issue-from-exchange-on-prem-to-office-365 Sat, 03 Jun 2017 21:14:21 GMT https://blogs.technet.microsoft.com/lalitbisht/?p=165 Send Connector/Receive Connector which has TlsCertificateName attribute configured and EOP is doing certificate validation for Inbound/Outbound SMTP connections. You might see any of the following errors in the queue/Protocol Logs. --> 454 4.7.5 The certificate specified in TlsCertificateName of the SendConnector could not be found. --> TLS negotiation failed with error NoCredentials. --> "421 4.4.1 Connection timed out." Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts It may be because of the following issues: --> You changed the third party SMTP certificate but didn't update the TlsCertificateName attribute on the connectors. --> Third party certificate is not assigned to the SMTP services. --> Status of that third party certificate shows "INVALID" or "RevocationCheckFailure". Please perform the following steps to resolve the issue. --> Update the TLSCertificateName attribute on the Office 365 SendConnector. $Cert = Get-ExchangeCertificate -Thumbprint <New Exchange Certificate> $TLSCert = (‘<I>’+$cert.issuer+'<S>’+$cert.subject) Set-SendConnector -Identity <Office 365 send Connector> -TLSCertificateName $TLSCert -->Update the TLSCertificateName attribute on the Exchange On-Premises(Hybrid) Receive Connector which is receiving email from Office 365. $Cert = Get-ExchangeCertificate -Thumbprint <New Exchange Certificate> $TLSCert = (‘<I>’+$cert.issuer+'<S>’+$cert.subject) Set-ReceiveConnector -Identity <Office 365 to On-Prem> -TLSCertificateName $TLSCert -->Make sure required certificate is assigned to the SMTP service and certificate Status shows VALID.]]>