Consider the following scenario.

Mailboxes has been moved from Exchange 2003 to Exchange 2007 or Exchange 2010 servers.

The mailbox users notice that substring searches does not give back any result anymore.

Information

In Exchange 2003 and Exchange 2000, content indexing is disabled by default. Therefore, when searching in online mode in Exchange 2003 and Exchange 2000, you are using store search which supports substring searching.

If you enable content indexing in Exchange 2003 and Exchange 2000, you will be using content indexing, which does not support substring searching.

Exchange 2007 and Exchange 2010 mailbox databases have content indexing enabled by default.

Let me show you.

Content indexing disabled

This is an example when performing substring search within a mailbox located on a mailbox database where the
content indexing is disabled.

The mailbox contains the following three mails with subject.

Content Indexing disabled 20110121
Content Indexing disabled 20110121
Content Indexing disabled 20110121

When performing a substring search for  0110121 we get the following search result. 

Content indexing enabled

This is an example when performing substring search within a mailbox located on a mailbox database where the
content indexing is enabled

The mailbox contains the following three mails with subject.

Content Indexing enabled 20110121
Content Indexing enabled 20110122
Content Indexing enabled 20110123

Exchange 2007

How to Disable or Enable Exchange Search
https://technet.microsoft.com/en-us/library/aa996416(EXCHG.80).aspx

Important:

Disabling Exchange Search will impact the functionality and performance of the full-text searches that are performed by your users.

Exchange 2010

How to Disable or Enable Exchange Search
https://technet.microsoft.com/en-us/library/aa996416.aspx

Caution:

Disabling Exchange Search impacts the functionality and performance of the full-text searches that are performed by your users using Outlook in online mode, Outlook Live, or on Windows Mobile devices.
The Discovery feature in Exchange 2010 also relies on Exchange Search. If you disable Exchange Search for a mailbox database or for a Mailbox server, Discovery won't return any messages from the database or server. For more information, see Understanding Multi-Mailbox Search.

Exchange 2003 to Exchange 2010 Migration.
Outlook 2003 clients.

All mailboxes has been moved to Exchange 2010.

The Exchange 2003 servers has been uninstalled. Or unavailable.

When users starts to work with Shared Calendar shortcuts, They notice that sometimes they get an Outlook dialog box similar to:

 
The connection to the Microsoft Exchange server is unavailable. Outlook must be online or connected to complete this action

Notice!!  The above result could be random. If the user try again he/she could be successful in opening the calendar using the shortcut.

Additional information:

The shared calendar information is stored within an XML file that is located in different locations depending on operating system and configuration.

Windows XP

C:\Documents and Settings\%username%\Application Data\Microsoft\Outlook\<Profile Name>.xml

Windows Vista and Windows 7

C:\Users\%username%\AppData\Roaming\Microsoft\Outlook\<Profile Name>.xml

Within this file we have a section <sharedcalendars>

 
To resolve the connection issue using the shared folder shortcuts use the following steps:

1. Quit Outlook 2003.
2. Click Start , and then click Run .
3. Click Browse .
4. Click the file Outlook.exe , and then click Open .

Note By default, the Outlook.exe file is installed at the following location:

"C:\Program Files\Microsoft Office\Office11\Outlook.exe"

5. In the Open box of the Run dialog box, move the insertion point to the end of the path statement.
6. After the closing quotation mark, type a space, and then type /resetsharedfolders

The path statement in the Open box should look similar to the following example:

"C:\Program Files\Microsoft Office\Office11\Outlook.exe" /resetsharedfolders

7. Click OK .

When you start Outlook 2003, all the shared calendars that you added to Outlook 2003 will be deleted. You will have to add back the shared calendars that you want. IE rebuilding the Shared Calendar shortcuts again.

Consider the following scenario:

Outlook 2010 using Outlook Anywhere with Basic Authentication.

Connecting through ISA 2006 or TMG servers.

You have configured Account lockout threshold to a nonzero value.

If the user types the logon password incorrectly when authenticating through Outlook Anywhere.

The active directory user account may be locked out from the Windows domain.

Solution:

Description of the Outlook 2010 hotfix package (outlook-x-none.msp): February 22, 2011
https://support.microsoft.com/kb/2475877

Update Center for Microsoft Office, Office Servers, and Related Products
https://technet.microsoft.com/en-us/office/ee748587.aspx

Consider the following scenario:

Exchange 2007
Windows Server 2008 Service Pack 2

Outlook 2003 or Outlook 2007/2010 using Outlook Anywhere with Basic Authentication.

You have configured Account lockout threshold to a nonzero value.

For every bad password attempt made by Outlook Anywhere user.

The bad password attempts are incremented twice.

The issue occurs because the authentication module that supports Basic authentication tries to log on two times for each unsuccessful logon. The basic authentication module first treats the logon credentials as having the Unicode encoding. When Windows rejects those credentials, the basic authentication module tries again by treating the credentials as having ASCII encoding. This causes two logon failures for each unsuccessful logon.

Solution:

FIX: You receive the error message "HTTP Error 401.1 - Unauthorized" sooner than expected when you try to log on to an IIS 7.0 Web site by using invalid credentials
https://support.microsoft.com/default.aspx?scid=kb;EN-US;981280

I have had two cases the last couple a weeks were the question was.

Since migrating from Exchange 2003 to Exchange 2010 we notice a change in the way hidden recipients are treated.

In Exchange 2003 we were able to see hidden recipients as members of distribution groups or security groups.

In Exchange 2010 the hidden recipients are not showed at all.

Exchange 2003 Scenario.

Consider the following setup.

An Exchange 2003 Universal Distribution group named:  All Cloud Users

 

The All Cloud Users group have a few members.

The group Cloud Administrators is configured to be Hidden. And have one member added to it.

Ok, so from an Outlook point of view.

I press the + to expand the group All Cloud Users

Notice that we are able to see the hidden group Cloud Administrators.

Exchange 2010 Scenario.

Same scenario as Exchange 2003.

But from an Outlook point of view we see a different result.

I press the + to expand the group All Cloud Users

The group Cloud Administrators is not visible anymore.

Conclusion.

Ideally hidden recipient objects should not be visible to the end users. Since the Administrator or Company policy have decided to hide the group. If we’ll let hidden recipients show, then actually we are exposing them in public and proving a way through which end users are able to use them.

Hidden recipient types are treated as Hidden in Exchange 2010.

The following message is shown when Activating the LabDatabase1 on the second Node.
In this case node EX2.

The Move-ActiveMailboxDatabase indicates that database “LabDatabase1” on server EX2.repro.com
has issues with the Content index catalog files.

I connected to EX2 and started Exchange Powershell window.

I ran the following command:

Get-MailboxDatabaseCopyStatus –Server EX2 | fl Name,*Index*

ContentIndexState : failed
ContentIndexErrorMessage : Catalog needs a reset for database {GUID}

I ran the following command to suspend LabDatabase1 on server EX2

Suspend-MailboxDatabaseCopy – Identity LabDatabase1\EX2

When LabDatabase1 is in suspended mode on server EX2. I connected to server EX1

On server EX1, i started an Exchange Powershell window.

I went to the scripts folder “c:\Program files\Exchange Server\V14\Scripts\”
In the \Scripts folder i ran the following script file.  ResetSearchIndex.ps1 –force LabDatabase1

ResetSearchIndex.ps1 does the following

1. MSExchangeSearchService on EX1 is stopped
2. It deletes the Catalog for LabDatabase1
3. MSExchangeSearch Service is Started

Upon restart of the MSExchangeSearch Service the Catalog {GUID} folder for LabDatabase1 is recreated.


On server EX1 i ran the following command to update the CatalogOnly for node EX2

Update-MailboxDatabaseCopy -Identity LabDatabase1\EX2 -SourceServer EX1 -CatalogOnly

To check the the ContentIndexState for LabDatabase1 on server EX2 i ran the following command

Get-MailboxDatabaseCopyStatus –Server EX2 | fl Name,*Index*

Additional information.

Reseed the Search Catalog
https://technet.microsoft.com/en-us/library/ee633475.aspx

This step by step guide will help you configure a profile.

Download the following version of Microsoft Exchange Server MAPI Client and Collaboration Data Objects 1.2.1
https://www.microsoft.com/downloads/en/details.aspx?familyid=E17E7F31-079A-43A9-BFF2-0A110307611E&displaylang=en

Download the latest version of MFCMAPI 32Bit
https://mfcmapi.codeplex.com/

Install Microsoft Exchange Server MAPI Client and Collaboration Data Objects 1.2.1 on a Exchange 2010 server or Exchange 2007 server

( Note! You may need to reboot the computer after )

Download MFCMapi to the same computer you installed Exchange Server MAPI Client and Collaboration Data Objects 1.2.1

Then follow these steps.

Launch MFCMapi.exe and press OK

Select Profile > Add Services to MAPISVC.INF

Add a tick box to Exchange > Press OK

Select Profile > Launch Profile Wizard

Press OK

Press Next

Press Next

Type your Exchange 2010 CAS server name in Microsoft Exchange server

Press Next

Press Finish

Select Profile > Show Profiles

Double click on the Microsoft Exchange Settings

  Double click on the Microsoft Exchange Server

Locate the entry that has the “cb:16lpb: 13DBB0C8AA05101A9BB000AA002FC45A,” in the PR_Provider_UID

In the Pane below locate the Property Name “PR_PROFILE_CONNECT_FLAGS” and double click on it to modify it. Change the value to “ 0x8000” to change the Smart View to read “Flags: CONNECT_IGNORE_NO_PF” and then press OK

Then locate the "PR_PROFILE_UI_STATE" and double click it and modify the value as "0x4000" in order to set flag as "Flags: EDK_PROFILEUISTATE_ENCRYPTNETWORK" and then press OK.

Close all the MFCMAPI windows. ( Except Default start window )

Select Session > Logon and Display Store Table

Press OK

Select MDB > Get Mailbox Table

In the Server name type in the name of the Mailbox server that you want to connect to and click OK.

(Note: If connecting to DAG type in the Mailbox server that has the active copy. )

Double click on System Mailbox entry.

We have successfully opened the System Mailbox.

I have seen this is some cases.

If incorrect version of Microsoft Exchange Server MAPI Client and Collaboration Data Objects is used. The following Error might appear when accessing mailboxes on Exchange 2010 using MFCMapi.exe

MAPI_E_FAILONEPROVIDER

Additional information.

"MAPI_E_FAILONEPROVIDER" error message when you try to connect to a mailbox on an Exchange Server 2010 server from an Exchange Server 2003 server
https://support.microsoft.com/kb/983555

We have Students and Teachers located on the same Exchange 2010 server.

Default calendar permissions is set to Free / Busy time

A request has come from the teachers department,

All teachers would like to have Reviewer permissions to each others calendar folders.

Now

What is already prepared in this Exchange environment is that all Teachers have their CustomAttribute1 set to Teacher

And a Mail Universal Security Group already exists with the primary SMTP address Teachers@repro.com

To achieve the teachers request. All we need to do is to run the following powershell command.

Most people do not need to use message tracking in their everyday work and therefore it’s hard to really get hands-on practice.

I have collected a few samples that might help you in your Message tracking adventure.

Then we could use Excel to work with the data we just exported.

How to Search Message Tracking Logs
https://technet.microsoft.com/en-us/library/bb124926(EXCHG.80).aspx

Managing Message Tracking
https://technet.microsoft.com/en-us/library/bb124375(EXCHG.80).aspx

Working with Command Output
https://technet.microsoft.com/en-us/library/bb123533(EXCHG.80).aspx

More information:

Process Tracking Log tool for Exchange Server 2007
https://msexchangeteam.com/archive/2008/02/07/448082.aspx

Hmm how hard can it be … Right?

Isn't is as easy as opening ADUC and changing the Group type from Distribution to Security?

Actually this not as straightforward as you might think. There is one step in this procedure that

can be easy to miss, resulting in a failure to apply the new Security group to an Exchange object.

If you want to skip the explanation, jump directly to the Solution section at the bottom of this blog entry.

Explanation

Allow me to demonstrate the problem.

So we have a group named Sales with the Recipient Type Details Mail Universal Distribution Group.

Now since we do not have any option within the Exchange Management Console or Powershell, to
change the Group type from Distribution to Security we need to use Active Directory users and computers.

We open ADUC and take properties of  the Group Sales, then we change the Group type from Distribution to Security.

Checking back in EMC we can see that the Recipient Type Details has been updated.
We have a Mail Universal Security Group instead of a Mail Universal Distribution Group.

Now, let’s use this group to set permissions.

Start Outlook and add the group Sales with permissions to my Calendar folder.

     

Add the Sales group to the Calendar folder and press ok.

 
One or more users cannot be added to the folder access list. Non-Local users cannot be given rights on this server.

Did you notice the Deny circle sign on the sales group?

You may receive an error message in Outlook 2007 when you try to set permissions for a distribution group on a mailbox folder in Exchange Server 2007
https://support.microsoft.com/kb/941318

Workaround suggested by KB:

To work around this issue, create security groups instead of distribution groups. Then, set folder permissions or set delegate permissions for the security groups.

Didn't we just change the Group type from Distribution to Security?

Let’s demonstrate another problem we would have with this Sales group.

Let’s say we want to add this Sales group with permission to a Public Folder using ExFolders.

For those of you that do not know Exfolders, information about this tool is provided here.

Exchange, meet ExFolders
https://msexchangeteam.com/archive/2009/12/04/453399.aspx

So we start ExFolders.

We select my Public Folder named Support

Right click and select Folder permissions.

Press Add and type Sales

Press Search

we get the Selected user ‘CN=Sales,CN=Users,DN=repro,DC=com’
( Well it’s a group but the UI does not update this )

When we press OK to add this Sales group to the ACL we get the following result.

  
An Error occured. Exception: Cannot use Sales as security principal Parameter name: securityPrincipal

Hmm. OK let’s check the SecurityPrincipal  on the group Sales

The RecipientTypeDetails shows MailUniversalSecurityGroup, which is correct! But still we are unable to use this group.

Conclusion

So, just using ADUC to change the group type is not enough.

I found the following information provided by the Romanian Exchange team.

Automatic Conversion of UDG in USG in Exchange 2007
https://blogs.technet.com/b/ehlro/archive/2010/05/11/automatic-converison-of-udg-in-usg-in-exchange-2007.aspx

So i brought up Exchange powershell again on my Exchange 2010 server.

Running the following command:  Set-DistributionGroup –identity Sales

Members can’t remove themselves from security groups. Please set the group to Closed for requests to leave.

Set-Distributiongroup–identity Sales –MemberDepartRestriction Closed

After running the above powershell command, I am able to use this Sales group in Outlook and Exfolders to assign proper permission to Exchange objects without any issues.

Solution

Exchange 2010

Open ADUC and change the Group Type for your group from Distribution to Security.

Start Exchange Powershell and run the following command:  

Set-Distributiongroup–identity <DistributionGroupIdParameter> –MemberDepartRestriction Closed

Exchange 2007

Open ADUC and change the Group Type for your group from Distribution to Security.

Start Exchange Powershell and run the following command:  

Set-Distributiongroup–identity <DistributionGroupIdParameter>

Environment:

Exchange 2010
Windows 2008

Outlook 2007 Service pack 2

 
Issue:

A mailbox enabled user have the following permissions on a Room mailbox.

- Full Access Permission

- Send As Permission

When this user tries to give another user delegate permissions to the room mailbox it fails with the bellow Outlook Dialog box.

" The Delegates settings were not saved correctly. Cannot activate send-on-behalf-of-list. You do not have sufficient permission to perform this operation on this object "

Resolution:

- [ Create a new ManagementRole named  "GrantSendOnBehalf" ]
--------------------------------------------------------------------------
New-ManagementRole -Name "GrantSendOnBehalf" -Parent "Mail Recipients"

- [ Remove all cmd lets except " Set-Mailbox " - " Get-Mailbox " ]
------------------------------------------------------------------------
Get-ManagementRoleEntry "GrantSendOnBehalf\*" | where {($_.Name –notlike “Set-Mailbox”) –and ($_.Name –notlike “Get-Mailbox”)} | Remove-ManagementRoleEntry

- [ Reduce the Parameters that Set-Mailbox can execute on role GrantSendOnBehalf ]
-----------------------------------------------------------------------------------------------
Set-ManagementRoleentry "GrantSendOnBehalf\Set-Mailbox" -Parameters GrantSendOnBehalfTo, Identity

- [ Verify that the correct CMD lets are available ]
-------------------------------------------------------
Get-ManagementRoleEntry "GrantSendOnBehalf\*"

- [Greate a USG Group named "Delegate GrantSendOnBehalf Mailboxes" and add Role " ]
---------------------------------------------------------------------------------------------------
New-RoleGroup -Name "Delegate GrantSendOnBehalf Mailboxes" -Roles "GrantSendOnBehalf"

More information:

Role Based Access Control (RBAC) is the new permissions model in Microsoft Exchange Server 2010. With RBAC, you don't need to modify and manage access control lists (ACLs), which was done in Exchange Server 2007.
ACLs created several challenges in Exchange 2007, such as modifying ACLs without causing unintended consequences, maintaining ACL modifications through upgrades, and troubleshooting problems that occurred due to using ACLs in a nonstandard way.

RBAC enables you to control, at both broad and granular levels, what administrators and end-users can do.

 
RBAC also enables you to more closely align the roles you assign users and administrators to the actual roles they hold within your organization.
In Exchange 2007, the server permissions model applied only to the administrators
who managed the Exchange 2007 infrastructure. In Exchange 2010, RBAC now controls both the administrative tasks that can be performed and the extent to which users can now administer their own mailbox and distribution groups.

RBAC has two primary ways of assigning permissions to users in your organization, depending on whether the user is an administrator or specialist user, or an end-user: management role groups and management role assignment policies.
Each method associates users with the permissions they need to perform their jobs. A third, more advanced method, direct user role assignment, can also be used.

Understanding Role Based Access Control
https://technet.microsoft.com/en-us/library/dd298183.aspx