STEP 1:

Verify public folder replication

Exchange 2010 Public Folder Replication Report V2 (updated) https://gallery.technet.microsoft.com/Exchange-2010-Public-66d3939e

.\Get-PublicFolderReplicationReportV2.ps1 -AsHTML -FileName C:\PFReplReport.html

STEP 2:

Fix anything yellow when you run:

Get-MailPublicFolder -Resultsize Unlimited

Fix Aliases:

New version of fix-alias.ps1

https://johanveldhuis.nl/nieuwe-versie-van-fix-alias-ps1/

STEP 3:

Clean up names too…

Forward slash or backslash:

Get-PublicFolderStatistics -ResultSize Unlimited | Where {($_.Name -like "*\*") -or ($_.Name -like "*/*") } | Format-List Name, FolderPath

https://technet.microsoft.com/en-us/library/dn912663(v=exchg.160).aspx#Anchor_2https://technet.microsoft.com/en-us/library/dn912663(v=exchg.160).aspx

STEP 4:

Removing Unresolved SIDs in Exchange 2010

https://blogs.technet.microsoft.com/bill_long/2011/10/23/removing-unresolved-sids-in-exchange-2010/

First of all, confirm that .NET 4.6 is unsupported on your version of Exchange: Exchange Supportability Matrix

Check if you have .NET 4.6 installed on your Exchange Server

Exchange Server Performance Health Checker Script

https://gallery.technet.microsoft.com/Exchange-2013-Performance-23bcca58

1. Open Exchange Management Shell (EMS) on the newest version of Exchange in your environment
2. You may need to adjust your Exchange Management Shell execution policy Get-ExecutionPolicy If it is not set to unrestricted, temporarily set it to unrestricted. Set-ExecutionPolicy unrestricted
3. Copy the above script into your Exchange scripts directory
   1. Easiest way to do this is to type this in your EMS and paste the file in the directory: explorer $exscripts
4. Go to the script directory in EMS cd $exscripts
5. Run the Exchange Server Performance Health Checker Script against your Exchange Servers
   1. For Exchange 2013 servers: Get-ExchangeServer | ?{$_.AdminDisplayVersion -Match "^Version 15"} | %{.\HealthChecker.ps1 -Server $_.Name}
   2. For Exchange 2016 servers: Get-ExchangeServer | ?{$_.AdminDisplayVersion -Match "^Version 15.1"} | %{.\HealthChecker.ps1 -Server $_.Name}
6. Review the results to see if .NET version 4.6 is installed in your environment

If .NET is currently installed on your Exchange Server, go through these steps. Otherwise, skip to the next section to prevent it from being installed

1. If the server has already automatically updated to 4.6.1 and has not rebooted yet, do so now to allow the installation to complete
2. Stop all running services related to Exchange.
   1. You can run the following cmdlet from Exchange Management Shell to accomplish this:  (Test-ServiceHealth).ServicesRunning | %{Stop-Service $_ -Force}
3. Go to add/remove programs, select view installed updates, and find the entry for KB3102467.
4. Uninstall the update.
5. Reboot when prompted.
6. Check the version of the .NET Framework and verify that it is showing 4.5.2.  If it shows a version prior to 4.5.2 go to windows update, check for updates, and install .NET 4.5.2 via the KB2934520 update.  Do NOT select 4.6.1/KB3102467.  Reboot when prompted.  If it shows 4.5.2 proceed to step 5.
   1. Open a command prompt and type: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full" /v version
7. Stop services using the command from step 2.
8. Run a repair of .NET 4.5.2 by downloading the offline installer, running setup, and choosing the repair option.
9. Reboot when setup is complete.
10. Apply the February security updates for .NET 4.5.2 by going to Windows update, checking for updates, and installing KB3122654 and KB3127226.  Do NOT select KB3102467.
11. Reboot after installation.
12. After reboot verify that the .NET Framework version is 4.5.2 and that security updates KB3122654 and KB3127226 are installed.
13. Follow the steps below to block future automatic installations of .NET 4.6.1.

Prevent .NET 4.6 from being installed on your Exchange Server

1. Back up the registry.
2. Start Registry Editor. To do this, click Start, type regedit in the Start Search box, and then press Enter.
3. Locate and click the following subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP
4. After you select this subkey, point to New on the Edit menu, and then click Key.
5. Type WU, and then press Enter.
6. Right-click WU, point to New, and then click DWORD Value.
7. Type BlockNetFramework461, and then press Enter.
8. Right-click BlockNetFramework461, and then click Modify.
9. In the Value data box, type 1, and then click OK.
10. On the File menu, click Exit to exit Registry Editor.

1. Download the script and put it in the C:\Program Files\Microsoft\Exchange Server\Scripts directory (or whichever drive you have Exchange installed on)

 http://gallery.technet.microsoft.com/scriptcenter/7c04b866-f83d-4b34-98ec-f944811dd48d

Example: User6 is the second owner for Distribution Group Test2007DL

When you decide to upgrade those Distribution Groups to Exchange 2013, it looks at the ManagedBy parameter...which can have multiple users/owners.
(You may need to add additional -and $_.User -notlike filters for additional accounts that will not be managing your distribution groups.)

If you want to review the owners of a single Distribution Group (Test2007DL):

$owners = Get-ADPermission "CN=Test2007DL,CN=Users,DC=contoso,DC=com" | ?{$_.User -notlike "*Exchange*" -and $_.User -notlike "S-*" -and $_.User -notlike "*Organization*" -and $_.User -notlike "NT*" -and $_.User -notlike "*Domain Admins*" -and $_.User -notlike "*Enterprise Admins" -and $_.User -notlike "BUILTIN*” -and $_.User –notlike "*Delegated Setup*”} | $owners

If you want to update a single Distribution Group (Test2007DL):

$owners = Get-ADPermission "CN=Test2007DL,CN=Users,DC=contoso,DC=com" | ?{$_.User -notlike "*Exchange*" -and $_.User -notlike "S-*" -and $_.User -notlike "*Organization*" -and $_.User -notlike "NT*" -and $_.User -notlike "*Domain Admins*" -and $_.User -notlike "*Enterprise Admins" -and $_.User -notlike "BUILTIN*” -and $_.User –notlike "*Delegated Setup*”}  | %{$_.user.tostring()};Set-DistributionGroup Test2007DL -BypassSecurityGroupManagerCheck -ManagedBy $owners

If you want to update all Distribution Groups and move those additional owners to the ManagedBy parameter you can run the following command:

 ForEach ($DL in (Get-DistributionGroup -ResultSize Unlimited)) { $owners = Get-ADPermission $DL.identity | ?{$_.User -notlike "*Exchange*" -and $_.User -notlike "S-*" -and $_.User -notlike "*Organization*" -and $_.User -notlike "NT*" -and $_.User -notlike "*Domain Admins*" -and $_.User -notlike "*Enterprise Admins" -and $_.User -notlike "BUILTIN*” -and $_.User –notlike "*Delegated Setup*”}  | %{$_.user.tostring()};Set-DistributionGroup $DL -BypassSecurityGroupManagerCheck -ManagedBy $owners }

This command will run through ALL of your Distribution Groups, upgrade them to Exchange 2013 and update the ManagedBy parameter with all of the owners.

** Remember to test in a lab before you run this command.

 Note: After upgrading your distribution groups, you will no longer be able to manage your Distribution Groups using legacy Exchange tools.

This assumes that you assigned the MyDistributionGroups Management Role to the mailbox(es) or use the information in the article below (applies to E2013 also) to not allow the users the ability to create new distribution groups or remove distribution groups that they own.

How to Manage Groups that I already own in Exchange 2010?
http://blogs.technet.com/b/exchange/archive/2009/11/18/how-to-manage-groups-that-i-already-own-in-exchange-2010.aspx

Test-EdgeSynchronization
 http://technet.microsoft.com/en-us/library/aa996925(v=exchg.141).aspx

You may receive an error when trying to run this command of: This command can only be run on Hub Transport servers.

The solution to this error is to connect your EMS to a Hub Role - which may be easier said than done.

Even if you log on locally to your Hub role and open Exchange 2010 EMS, you may have a good chance of connecting to a CAS role.

1. Look at the top left of your EMS window. It should say: Machine: <Exchange Server you are connected to>. Make sure this is a Hub Role.
2. If not, you have to run the command: Connect-ExchangeServer -ServerFqdn <Hub Transport Server> -AllowClobber
1. Remember to put the -AllowClobber parameter. Otherwise, it will not work (though will appear to be connected to the Hub Role)
   The Connect-ExchangeServer function does not change the target Exchange server in Exchange Server 2010
   http://support.microsoft.com/kb/2489938

BELOW: Even though I was logged on locally to my Hub Role, the EMS was connected to my CAS Role. The command did not work. If I did not include the -AllowClobber, the command still did not work.

1. Create a new Computer Account in Active Directory User and Computers (ADUC) called CASARRAY-ASANote:ASA stands for Alternative Service Account
2. Distribute the newly created account to all CAS Array members using a script. Open the Exchange Management ShellWithin the Exchange Management Shell change to c:\Program Files\Microsoft\Exchange Server\V14\Scripts

Tip: Use the existing variable to switch fast to the scripts folder by running the following command in the Exchange Management Shell:

cd $exscripts

Note: outlook is the name of the CAS Array (Get-ClientAccessArray | FL Name)

3. Set the SPNs for the Alternate Service Account (ASA):

• http Use this SPN for Exchange Web Services, Offline Address Book downloads, and the Autodiscover service.
• exchangeMDB Use this SPN for RPC Client Access service.
• exchangeRFR Use this SPN for the Address Book service.
• exchangeAB Use this SPN for the Address Book service.

a.      Open cmd and run: (outlook.contoso.com is the CAS Array fqdn contoso is the domain where CASARRAY-ASA was created)

b.      Verify that all SPNS are set correctly, run

setspn –L contoso\CASARRAY-ASA$ or setspn –L outlook.contoso.com

1. Copying ASA Credential to new Servers added to the CAS ARRAY:

.\RollAlternateServiceAccountPassword.ps1 -CopyFrom ServerA -ToSpecificServers ServerB –Verbose

2. Schedules a once-a-month automated password roll scheduled task called “Exchange-RollAsa”. It will update the ASA credential for all Client Access servers in the entire forest with a new, script-generated password. The scheduled task is created, but the script is not run. When the scheduled task is run, the script runs in unattended mode

.\RollAlternateServiceAccountPassword.ps1 -CreateScheduledTask "Exchange-RollAsa" -ToEntireForest -GenerateNewPasswordFor 'contoso\computerAccount$'

1. To convert the OAB virtual directory to a web application, execute the ConvertOABVDir.ps1 script on each CAS member.  The script will also create a new application pool for the OAB virtual directory. Script location: http://gallery.technet.microsoft.com/scriptcenter/525fb1dc-b612-4998-a2d1-55f32a6c35ac

Before converting the OAB to a virtual directory:

After converting the OAB to a virtual directory (notice the icon change for OAB and MSExchangeOabAppPool):