Exchange Administration Center

Exchange 2013 provides a single unified management console that allows for ease of use and is optimized for management of on-premises, online, or hybrid deployments. The Exchange Administration Center (EAC)
in Exchange 2013 replaces the Exchange 2010 Exchange Management Console (EMC) and the Exchange Control Panel (ECP). Some of the EAC features include:

• List view: ECP was limited to displaying up to 500 objects and, if you wanted to view objects that weren’t listed in the details pane, you needed to use searching and filtering to find those specific objects. In Exchange 2013, the viewable limit from within the EAC list view is approximately 20,000 objects. In addition, paging has been added so that you can page to the results. You can also configure page size and export to a CSV file.
• Add/Remove columns to the Recipient list view: Ability to choose which columns to view, and save your custom list views.
• Secure the ECP virtual directory : Ability to partition access from the Internet and Intranets from within the ECP IIS virtual directory to allow or disallow management features. With this feature, you can permit or deny access to users trying to access the EAC from the Internet outside of your organizational environment, while still allowing access to an end-user’s Outlook Web App Options.
• Public Folder management: In Exchange 2010 and Exchange 2007, public folders were managed through the Public Folder administration console. Public folders are now in the EAC, and you don't need a separate tool to manage them.
• Notifications: In Exchange 2013, the EAC now has a Notification viewer so that you can view the status of long-running processes and, if you choose, receive notification via an email message when the process completes.

For more information, see Exchange Administration Center.

Exchange 2013 architecture

The Exchange 2013 Mailbox server includes all the traditional server components found in Exchange 2010: the Client Access protocols, Hub Transport service, Mailbox databases, and Unified Messaging. The Mailbox server handles all activity for a given mailbox. The Client Access server provides authentication, redirection, and proxy services. The Client Access server itself doesn't do any data rendering. The Client Access server is a thin and stateless server. There is never anything queued or stored on the Client Access server. The Client Access server offers all the usual client access protocols: HTTP, POP and IMAP, and SMTP.

With this new architecture, the Client Access server and the Mailbox server have become “loosely coupled”. All processing and activity for a specific mailbox occurs on the Mailbox server that houses the active database copy where the mailbox resides. All data rendering and data transformation is performed local to the active database copy, eliminating concerns of version compatibility between the Client Access server and the Mailbox server.

The Exchange 2013 architecture provides the following benefits:

• Version upgrade flexibility No more rigid upgrade requirements. A Client Access server can be upgraded independently and in any order in relation to the Mailbox server.
• Geo-flexibility Because all the processing and data transformation takes place on the Mailbox server, we're no longer constrained to having both a Client Access server and a Mailbox server in each site. You can now choose to have a  central Client Access site for all protocol traffic if you want.
• Session indifference With Exchange 2010, session affinity to the Client Access server role was required for several protocols. In Exchange 2013, the client access and mailbox components reside on the same Mailbox server. Because the Client Access server isn't doing any data rendering, we only require layer 4 load balancing. Layer 4 load balancing is protocol-unaware and balances traffic based on IP address and TCP/UDP port.
• Deployment simplicity With an Exchange 2010 site-resilient design, you needed up to eight different namespaces. With Exchange 2013, the minimum number of namespaces drops to two. If you’re coexisting with Exchange 2007, you still need to create a legacy hostname, but if you’re coexisting with Exchange 2010 or you’re installing a new Exchange 2013 organization, the minimum number of namespaces you need is two: one for client protocols and  one for Autodiscover. You may also need an SMTP namespace.

As a result of these architectural changes, there have been some changes to client connectivity.

• RPC is no longer a supported direct access protocol. This means that all Outlook connectivity must take place using RPC over HTTPS (also known as Outlook Anywhere). Benefits are
  • The most obvious benefit is that there is no need to have the RPC client access service on the Client Access server. This results in the reduction of two namespaces that would normally be required for
    a site-resilient solution. In addition, there is no longer any requirement to provide affinity for the RPC client access service.
  • Outlook clients no longer connect to a server FQDN as they have done in all previous versions of Exchange. Outlook uses AutoDiscover to create a new connection point comprised of mailbox GUID, @
    symbol, and UPN suffix. This simple change results in a near elimination of the unwelcome message of “Your administrator has made a change to your mailbox. Please restart.” Only Outlook 2007 and higher versions are supported with Exchange 2013.

The high availability model of the mailbox component has not changed significantly since Exchange 2010. The unit of high availability is still the database availability group (DAG). The DAG still uses Windows 2008
clustering. Continuous replication still supports both file mode and block modereplication. However, there have been some improvements. Failover times have been reduced as a result of transaction log code improvements and deeper checkpoint on the passive nodes. The Exchange Store service has been re-written in managed code (see the "Managed Store" section later in this topic). Now, each database runs under its own process, allowing for isolation of store issues to a single database.

            Managed Store

In Exchange 2013, the Managed Store is the name of the newly rewritten Information Store processes, Microsoft.Exchange.Store.Service.exe and Microsoft.Exchange.Store.Worker.exe. The new Managed Store is written in C# and tightly integrated with the Microsoft Exchange Replication service (MSExchangeRepl.exe) to provide higher availability through improved resiliency. In addition, the Managed Store has been architected to enable more granular management of resource consumption and faster root cause analysis through improved diagnostics.

The Managed Store works with the Microsoft Exchange Replication service to manage mailbox databases, which continues to use Extensible Storage Engine (ESE) as the database engine. Exchange
2013 includes significant changes to the mailbox database schema that provide many optimizations over previous versions of Exchange. In addition to these changes, the Microsoft Exchange Replication service is responsible for all service availability related to Mailbox servers. The architectural changes enable faster database failover and better physical disk failure handling.

The Managed Store is also integrated with the FAST search engine (the same search engine used by SharePoint 2013 Preview) to provide more robust indexing and searching.

 
            Certificate management

Managing digital certificates is one of the most important security-related tasks for your Exchange organization. Ensuring that certificates are appropriately configured is key to delivering a secure messaging infrastructure for the enterprise. In Exchange 2010, the Exchange Management Console was the primary method of managing certificates. In Exchange 2013, certificate management functionality is
provided in the Exchange Administration Center, the new Exchange 2013 administrator user interface.

The work in Exchange 2013 related to certificates focused around minimizing the number of certificates that an Administrator must manage, minimizing the interaction the Administrator must have with certificates, and allowing management of certificates from a central location. Benefits resulting from the changes in certificate management are:

• All certificate management is performed on the Client Access server. The Mailbox server has a self-signed certificate installed by default. The Client Access server automatically trusts the self-signed certificate on the Exchange 2013 Mailbox server, so clients will not receive warnings about a self-signed certificate not being trusted provided that the Exchange 2013 Client Access server has a non-self-signed certificate
  from either a Windows certificate authority (CA) or a trusted third party.
• In previous versions of Exchange, it was difficult to see when a digital certificate was nearing expiration. In Exchange 2013, the Notifications center will display warnings when a certificate stored on any Exchange 2013 Client Access servers is about to expire.

For more information, see Digital Certificates and SSL.

 
Messaging policy and compliance

Data loss prevention (DLP) is a new feature in Exchange 2013. DLP capabilities help you protect your sensitive data and inform users of internal compliance policies. DLP can also help to keep your organization safe
from users mistakenly sending sensitive information to unauthorized people. DLP helps you identify, monitor, and protect sensitive data through deep content analysis. Exchange 2013 offers built-in DLP policies based on regulatory standards such as personally identifiable information (PII) and payment card industry data security standards (PCI), and is extensible to support other policies important to your business. Additionally, the new PolicyTips in Outlook 2013 Preview inform users about policy violations before sensitive data is sent.

To learn more, see Data Loss Prevention.

            In-place archiving, retention, and eDiscovery

Exchange 2013 includes the following improvements to In-Place Archiving, Retention, and eDiscovery to help your organization meet its compliance needs:

• In-Place HoldIn-Place Hold allows you to:
  • Preserve the results of the query (query-based hold), which allows for scoped immutability across mailboxes.
  • Place a time-based hold to meet retention requirements (for example, retain all items in a mailbox for seven years, a scenario that required the use of Single Item Recovery/Deleted Item Retention
    in Exchange 2010).
  • Place a mailbox on indefinite hold (known as a litigation hold in Exchange 2010).
• In-Place eDiscovery In-Place eDiscovery allows you to search and preserve data across multiple data repositories. Exchange 2013 exposes the ability to perform In-Place eDiscovery search across Exchange,
  SharePoint 2013 Preview, and Lync 2013 Preview. You can use the eDiscovery Center in SharePoint 2013 Preview to perform In-Place eDiscovery search and hold. Query-based In-Place Hold allows you to preserve the results of the query, which allows for scoped immutability across mailboxes. If SharePoint 2013 Preview isn't available, a subset of the discovery functionality is available in the Exchange Administration Center (EAC). In addition, Discovery Managers can export mailbox content to a .pst file from the SharePoint 2013 Preview eDiscovery Console. Mailbox export request cmdlets are no longer required to export a mailbox to a .pst file.
• Keyword statistics Search statistics are offered on a per search term basis. This feature enables a Discovery Manager to quickly make intelligent decisions about how to further refine the search query
  to provide better results. eDiscovery search results are sorted by relevance.
• Search across primary and archive mailboxes in Outlook Web Access In Exchange 2013, users can search across their primary and archive mailboxes in Outlook Web App. Two separate searches are no
  longer necessary.
• Apply personal tags to default folders using Outlook Web App With Outlook Web App, users can apply Personal Tags to default folders such as Inbox and Deleted Items.

For more information, see Messaging Policy and Compliance.

 Transport rules

Transport rules in Exchange Server 2013 are a continuation of the features that were available in Exchange Server 2010. However, several improvements have been made to transport rules in Exchange 2013. The most important change is the support for data loss prevention (DLP). There are also new predicates and actions, enhanced monitoring, and a few architectural changes.

For detailed information, see What's New for Transport Rules.

 Mail flow

The transport pipeline in Exchange 2013 is now made up of several different services: the Front End Transport service on Client Access servers, the Hub Transport service on Mailbox servers, and the Mailbox Transport service on Mailbox servers. For more information, see MailFlow.

Mail routing in Exchange 2013 recognizes DAG boundaries as well as Active Directory site boundaries. Also, mail routing has been improved to queue messages more directly for internal recipients.

For more information, see Message Routing.

 
Recipients

The EAC includes auditing functionality so that you can run reports or export entries from the mailbox audit log and the administrator audit log. The mailbox audit log records whenever a mailbox is accessed by
someone other than the person who owns the mailbox. This can help you determine who has accessed a mailbox and what they have done. The administrator audit log records any action, based on a Windows PowerShell cmdlet, performed by an administrator. This can help you troubleshoot configuration issues or identify the cause of problems related to security or compliance. For more information,
see Auditing Reports.

Administrators can also use the EAC to track delivery information for email messages sent to or received by any user in your organization. You just select a mailbox, and then search for messages sent to
or received by a different user. You can narrow the search by searching for specific words in the subject line. The resulting delivery report tracks a message through the delivery process and specifies if the message was successfully delivered, pending delivery, or if it wasn't delivered.

For more information, see Track Messages with Delivery Reports.

 Sharing and collaboration

This section describes the sharing and collaboration enhancements in Exchange 2013.

 
            Public folders

Public folders in Exchange 2013 now take advantage of the existing high availability and storage technologies of the mailbox store. The public folder architecture uses specially designed mailboxes to store both the hierarchy and the public folder content. This new design also means that there is no longer a public folder database. Public folder replication now uses the continuous replication model. High availability for the hierarchy and content mailboxes is provided by the DAG. With this design, we're moving away from a multi-master replication model to a single-master replication model.

For more information about public folders, see Public Folders.

 
            Site mailboxes

Email and documents are traditionally kept in two unique and separate data repositories. Most teams would normally collaborate using both mediums. The challenge is that both email and documents are accessed using different clients, which usually results in a reduction in user productivity and a degraded user experience.The site mailbox is a new concept in Exchange 2013 that attempts to solve these problems. Site mailboxes improve collaboration and user productivity by allowing access to both documents in a SharePoint site and email messages in an Exchange mailbox, using the same client interface. A site mailbox is
functionally comprised of SharePoint site membership (owners and members), shared storage through an Exchange mailbox for email messages and a SharePoint site for documents, and a management interface that addresses provisioning and lifecycle needs.

For more information, see Site Mailboxes.

Integration with SharePoint and Lync

Exchange 2013 offers greater integration with SharePoint 2013 Preview and Lync 2013 Preview. Benefits of this enhanced integration include:

• Users collaborate more effectively by using site mailboxes.
• Lync Server 2013 Preview can archive content in Exchange 2013 and use Exchange 2013 as a contact store.
• Discovery Managers can perform In-Place eDiscovery and Hold searches across SharePoint 2013 Preview, Exchange 2013, and Lync 2013 Preview data.
• Oauth authentication allows partner applications to authenticate as a service or impersonate users where required.

 
Clients and mobile devices

The Outlook Web App user interface is new and optimized for tablets and smartphones as well as desktop and laptop computers. New features include apps for Outlook, which allow users and administrators to extend the capabilities of Outlook Web App, Contact linking, the ability for users to add contacts from their LinkedIn accounts, and updates to the look and features of the calendar.

For more information, see What's New for Outlook Web App in Exchange 2013.

 
Unified Messaging

Unified Messaging in Exchange 2013 contains essentially the same voice mail features included in Exchange 2010. However, some new and enhanced features and functionality have been added to those existing features. More importantly, architectural changes in Exchange 2013 Unified Messaging resulted in components, services, and functionality that were included with the Unified Messaging server role in Exchange 2010 to be divided between the Exchange 2013 Client Access and Mailbox server roles.

For more details, see What's New for Unified Messaging in Exchange 2013.

Batch moves

Exchange 2013 introduces the concept of batch moves. The new move architecture is built on top of MRS (Mailbox Replication service) moves with enhanced management capability. The new batch move architecture in Exchange 2013 features the following enhancements:

• Ability to move multiple mailboxes in large batches.
• Email notification during move with reporting.
• Automatic retry and automatic prioritization of moves.
• Primary and personal archive mailboxes can be moved together or separately.
• Option for manual move request finalization, which allows you to review a move before you complete it.
• Periodic incremental syncs to migrate the changes.

High availability and site resilience

Exchange 2013 continues to make use of the database availability group (DAG) platform introduced in Exchange 2010 for both high availability and site resilience. Exchange 2013 also includes enhancements to
the DAG platform that improve manageability and reduce costs. These features include:

• Managed availability.
• Managed Store.
• Automatic configuration and management of DAG networks.
• Management via the Exchange Administration Center.
• Enhancements to DAG-related cmdlets to introduce new scenarios.

For more information, see High Availability and Site Resilience.

Exchange workload management

An Exchange workload is an Exchange server feature, protocol, or service that has been explicitly defined for the purposes of Exchange system resource management. Each Exchange workload consumes system
resources such as CPU, mailbox database operations, or Active Directory requests to execute user requests or run background work. Examples of Exchange workloads include Outlook Web App, Exchange ActiveSync, mailbox migration, and mailbox assistants.

There are two ways to manage Exchange workloads: by monitoring the health of system resources or by controlling how resources are consumed by individual users (sometimes called user throttling in Exchange
2010). Managing workloads based on the health of system resources is new in Exchange 2013. Controlling how resources are consumed by individual users was possible in Exchange 2010, and this capability has been expanded for Exchange 2013.

For more information about both of these features, see Exchange Workload Management.

A Mail Storm occurs when Exchange cannot process the mail it has queued fast enough to also deal with the incoming load. The queues will show from thousands of messages destined for various or single recipients. You may see all, or any combination of following queues backed up: Submission, Local or Remote Delivery Queues. The basic, overall symptom is that while you do see some mail processing, you will also see these queues continue to grow. You can think of this as a situation where more load is put on a Exchange Server than it's suppose to handle, i.e. an overloaded Exchange Server .

There are numerous things that can cause a Mail Storm. Here is a quick list of some of the more prevalent ones:

-A Spam attack or Open Relay within your Organization: Spammers aren’t nice people. If you unwittingly leave an Open Relay that is discovered you can expect hundreds of thousands of spam messages to be bounced off your servers. Also, always make sure your Spam definitions are up to date on whatever type of prevention system you are using.

-A looping message: A misconfigured Outlook Rule, Contact or Transport configuration is often the cause. A quick look at the actual messages in the queue usually determines if this is the case.

-A Public Folder Replication Storm: In an Organization with a large number of Public Folders, if a new Public Folder Store is brought up with replicas added then data is going to be sent via email.

-An unknown internal application sending mass amounts of mail: Even in some of the best IT departments I have worked with, sometimes an eager developer can configure an application that starts flooding the Exchange Server.

I recently released a script that would help administrators to identify Mail Storms. The script parses the Message Tracking Logs files for the last 30 minutes from all requested HT Servers and then generates a count for
messages with the same Subject Line/Sender information. If the message count is above the defined threshold number (configured in the script) message details are sent as part of a report to the Admins.

Hope this help…

StormScript.ps1

In our case my customer had 3 Roles installed on each of the nodes in the DAG (MAILBOX , CAS, HUB). The customer did not want to physically move the nodes so we decided to assign the individual IP addresses to the new AD-SITE .

Move Exchange 2010 Servers to a Separate Site

 As a first step the Hub Transport Service was disabled on all of them so no email is being routed through any of them.  In that case, moving servers to a separate AD site requires servers being shut down before the AD changes take place.

Changes Required on the AD Side 

The only changes that need to be made in AD to accommodate the Exchange 2010 servers is separate AD site and the association of the Exchange 2010 server IP addresses to the AD site where the nodes are being moved.

Steps to move Exchange 2010 servers to the new AD Site. 

1. Open the AD Sites & Services console and select the Subnets folder.
2. Right click the Subnets folder and select New Subnet.  Add the individual IP addresses of the Exchange 2010 servers with a /32 prefix.  Assign the IP addresses to the RTL AD site.
3. Add the individual IP addresses of the Exchange 2010 DAG with a /32 prefix.  Assign the IP addresses to the new AD site.
4. Add the Exchange 2010 DAG IP Addresses  with a /32 prefix and assign to the new AD Site.

1. Select the OK button after each IP address has been entered.  Repeat the step 2 for each Exchange 2010 server IP address.
2. Confirm the IP addresses have been entered correctly and are associated with the new AD site.

Power on the Exchange 2010 Servers 

When the AD changes are complete and the servers are assigned to the designated subnet, start the E2010 servers and you would need to follow those steps:

• Configure site affinity for Autodiscover for the site to which you moved the Client Access server
• Get-ClientAccessserver –id “servername” | Set-ClientAcessServer –AutoDiscoverSiteScope “New SiteName”

Repeat above step for the all E2010 server that you are moving to the new AD Site. 

Great you are all done :) Enjoy the moment for a JOB WELL DONE... Until next time HAVE FUN !!!!

i would like to Thank my friend (Si Ch) for sharing data on this Article.

My Blog today is to go through steps on how to remove these Storm messages from the Exchange 2007 Transport queues. I assume you have identified the message causing the Storm as this can be easily identified by viewing messages in the affected Exchange 2007 Transport server Queue using Queue Viewer.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Prevent Storm Emails from getting into Exchange

Once you have identified the Storm message detail like Subject-line the first thing you need to do is to stop/prevent these messages from getting into Exchange. This is done by creating a New Transport Rule. Refer to the TechNet Article on how to create a new Transport Rule: https://technet.microsoft.com/en-us/library/bb125138(EXCHG.80).aspx

Identify the affected Exchange 2007 HUB Transport servers that have large Queues.

I will assume the Exchange 2007 Transport Servers have resource monitoring enabled.  We recommend you have Resouce Monitoring enabled. The most common event is 15004 in Application Log on the HUB Transport server which is related to VersionBucket (A list of changes that are made to the message queue database that is kept in memory until those changes can be committed to a transaction log). Once the server starts getting these events depending on the resource utilization level certain SMTP functionalities are temporarily disabled.

Event log entry for an increase in any resource utilization level
Event Type: Error
Event Source: MSExchangeTransport
Event Category: Resource Manager
Event ID: 15004
Description: Resource pressure increased from Previous Utilization Level to Current Utilization Level.

Refer to TechNet on BackPressure Details : https://technet.microsoft.com/en-us/library/bb201658(EXCHG.80).aspx

Pause ‘Microsoft Exchange Transport’ Service

Once you have identified all the affected Exchange 2007 Transport servers logon to these Transport servers and quickly PAUSE the ‘MSExchangeTransport’ Service.

Disable Resource Monitoring in EdgeTransport Config file

We would then disable ResouceMonitoring on the affected HUB Transport Servers. Reason to make sure we are able to process all mails after cleanup and relay them out without any issue. Identify the Exchange 2007 Install directory and Browse to the following location e.g. d:\Exchsrvr\bin and open EdgeTransport.exe.Config file

Identify the Line with the following text  <add key=“EnableResourceMonitoring” value=”true” />

Change the value from true to false as shown below.

Restart the MsExchangeTransport Service and Pause it immediately.

Confirm the Submission Queue and the Active remote Queue is processing messages by monitoring these counters in Perfmon

Procedure to cleanup Queues on Transport server

This are the steps you should follow to clean all queues (Submission, Local/Remote Delivery Queues) filled with messages. I will take 80,000 messages as a batch when performing queue cleanup.

• ·         Confirm the MsExchangeTransport service is PAUSED state and the EdgeTransport.exe.Config file is updated.
• ·         Open EMS and execute cmd
  • o   'Get-queue | Suspend-queue'  #(THIS WILL SUSPEND ALL QUEUES ON THIS SERVER)
• ·         Under EMC go to the Transport server and Resume 'Submission' and allow about 80000 messages to flow to build up in different queue (For example:  Queue ID “Server1\123456”). Once “Server1\123456” reaches 80000 suspend Submission queue again.
• ·         COUNT GENIUNE MESSAGES ARE IN THE QUEUE
  • o   Open EMS and execute cmd
  • o   'get-message -queue Server1\123456 -resultsize unlimited | where {$_.Subject -notlike "*undeliverable*"} | measure-object'   
• ·         SUSPEND ALL UNDELIVERABLE MESSAGES IN THIS PARTICULAR QUEUE
  • o   Open EMS and execute cmd
  • o   'get-message -queue Server1\123456 -resultsize unlimited | where {$_.Subject -notlike "*undeliverable*"} | Suspend-Message'  
• ·         EXPORT ALL GENIUNE MESSAGES (Creating EML format Messages in case you need to replay)
  • o   Open EMS and execute cmd
  • o   'get-message -queue Server1\123456 -resultsize unlimited | where {$_.Subject -notlike "*undeliverable*"} | export-message -path e:\Export1'  
• ·         DELETE ALL UNDELIVERABLE MESSAGES OFF QUEUE
  • o   Open EMS and execute cmd
  • o   'get-message -queue Server1\123456-resultsize unlimited | where {$_.Subject -like "*undeliverable*"} | remove-message -withNDR $false'  
• ·         Open EMS and execute
  • o   'get-queue' to ensure undeliverable messages are deleted.

{Follow above steps until all messages off submission queue are drained and Every time you export the messages, specify a new Export Folder like Export1/2/3/4}

Perform the above cleanup steps on all affected servers.

Enable Resource Monitoring in EdgeTransport Config file

Now that you have cleaned up queues on all the affected servers it is time to enable the Resource Monitoring on all Tranpsort servers where you had disabled it. Browse to the Exchange Install Directory location e.g. d:\Exchsrvr\bin and open EdgeTransport.exe.Config file

Identify the Line with the following text  <add key=“EnableResourceMonitoring” value=”false” />

Change the value from false to true.

Save the file and restart the MsExchangeTransport Service and confirm the service is running.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Hope this helps and I will follow-up with an Exchange 2010 Procedure.