A blog about windows

Understanding Safety Net

Mayank Sharma5 — Mon, 17 Jul 2017 15:29:36 GMT

Lets keep it simple: "Exchange safety net takes over where the shadow redundancy has left." Once the message is deivered to the mailbox AND before is is successfully replicated to the passive mailbox database copies- it is stored in a queue that is associated with the transport service on mailbox server. This queue is called Safety net and is an advancement of Transport Dumpster of exchange 2010. By default the safety net holds a copy of a successfully delivered message for 2 days. Safety net does not require a DAG, like shadow redundancy; safety net stores the successfully delivered message to other mailbox server in same active directory if DAG is not a part. Safety net itself is not a single point of failure. if the primary shadow redundancy fails; the shadow copy will take over and the messages are redelivered from the shadow subnet. you can configure thus behavior by changing this commandlet: set-transportConfig.

How does it work?

Shadow redundancy keeps a redundant copy of the message while the message is in transit. Safety Net keeps a redundant copy of a message after the message is successfully processed. So, Safety Net begins where shadow redundancy ends. concepts in shadow redundancy, including the transport high availability boundary, primary messages, primary servers, shadow messages and shadow servers also apply to Safety Net. The Primary Safety Net exists on the Mailbox server that held the primary message before the message was successfully processed by the Transport service. This could mean the message was delivered to the Mailbox Transport Delivery service on the destination Mailbox server. Or, the message could have been relayed through the Mailbox server in an Active Directory site that's designated as a hub site on the way to the destination DAG or Active Directory site. After the primary server processes the primary message, the message is moved from the active delivery queue into the Primary Safety Net on the same server. The Shadow Safety Net exists on the Mailbox server that held the shadow message. After the shadow server determines the primary server has successfully processed the primary message, the shadow server moves the shadow message from the shadow queue into the Shadow Safety Net on the same server. Although it may seem obvious, the existence of the Shadow Safety Net requires shadow redundancy to be enabled (it's is enabled by default).

Understanding Shadow redundancy

Mayank Sharma5 — Thu, 13 Jul 2017 16:29:25 GMT

Shadow redundancy is a mechanism thorough which the exchange 2016 ensures that message dint get lost during the transmission and that the exchange maintains the redundant copies of the message before it is passed to the next hop. This is done by keeping the message on another mailbox server. There are couple of points to consider while discussing the redundant storage 1. The Shadow redundancy work when the message is in transit and not when it is delivered. 2. The boundary for which the shadow redundancy works depends upon weather you have a DAG or not. Obviously two mailbox servers are needed for shadow redundancy to work. If DAG is in place- the mailbox server will contact mailbox server in the DAG for holding the other mailbox server. If the DAG spans scross multiple sites- the remote site is preferred. this can be modified with powershell. If DAGs are not in picture then the boundary is the active directory site and services. 3. The copy is stored as long as the mail is in the boundaries. As long as the mail goes out- the shadow copy will be maintained.

How it happens:

When the incoming message arrives, as long as shadow redundancy is enabled, the Mailbox server that receives the message makes a redundant copy of the message on another Mailbox server within the transport high availability boundary before acknowledging receipt of the message back to the sending server. Very important commandlet to understand is "Set-TransportConfig" That allows many connection stuff. During this entire process- the primary and secondary servers always maintain the heartbeat connection. When the message is delivered to the mailbox or when it leaves the boundary- the primary server updates the diascard status and thus updates the secondary server that the message has successfully been delivered. Once this happens- the secondary server moves the message to the safety net.

If the outage happens:

Set-TransportConfig has a setting called as ShadowHeartbeatFrequency. It decides how much time should the shadow server takes before opening a connection to the primary server and taking over the roles and responsibilities. ShadowResubmitTimeSpan decides for how long the secondary server will process the message. After that the server will take over the primary copy.

Disabling the user in mailbox exchange 2016.

Mayank Sharma5 — Sun, 09 Jul 2017 22:33:05 GMT

Each Microsoft Exchange in exchange 2016 mailbox consists of an Active Directory user account and the mailbox data stored in the Exchange mailbox database. All configuration data for a mailbox is stored in the Exchange attributes of the Active Directory user object. The mailbox database contains the mail data that's in the mailbox associated with the user account. The following figure shows the components of a mailbox. Disabled and deleted mailboxes are retained in the mailbox database until the deleted mailbox retention period expires, which is 30 days by default. After the retention period expires, the mailbox is permanently deleted (also called purged). If a mailbox is deleted using the Remove-Mailbox cmdlet, it’s also retained for the duration of the retention period. To disable a mailbox type the following command:

disable-mailbox -identity "Susan Sanders"

To get the status of all the mailbox that are either disabled or soft deleted type the follwing command

Get-MailboxStatistics -Database "Mailbox Server" | Where { $_.DisconnectReason -eq "SoftDeleted" -or $_.DisconnectReason -eq "Disabled" } | Format-List LegacyDN, DisplayName, MailboxGUID, DisconnectReason

Take a look at at the Mailbox guid and run the following command to mount the mailbox server of the user to a new user temporary.

New-MailboxRestoreRequest -SourceDatabase "Mailbox Server01" -SourceStoreMailbox "12d7196b-1ac6-49e3-b5b3-58909866da05" -TargetMailbox temporary

Setup Azure PowerShell on a device

Mayank Sharma5 — Mon, 03 Jul 2017 11:21:03 GMT

This is for my own reference, Wish Microsoft have created a document for this.. (sigh!)

Install the AzureRM module "Install-Module AzureRM"
Set execution policy to remote signed or unrestricted, what is acceptable. End goal is you should be able to run scripts. Set-ExecutionPolicy Unrestricted
Import the Module: Import-Module AzureRM
Login to your account, Login-AzureRmAccount will give a popup for the Azure account, Login you are good to go.

Cheers, Mayank

Exchange 2016- The Custom attribute.

Mayank Sharma5 — Fri, 30 Jun 2017 06:00:23 GMT

This is going to be an extremely short post about custom attribute before we move to the distribution group. A custom attribute is an attribute that you add to the mailbox that suits your need. Do you remember the schema extension that many Microsoft products do like SCCM? Typically when you install SCCM it extends the schema of Active directory so that SCCM can save some of its custom work inside active directory which the people have not thought off before defining the the active directory. Lets take an example- Consider in a school; all the students are divided into houses for an sports activity named as Green, Yellow, Blue and Red. A house contains students from all the classes. So if someone wants to send an email to a particular house say green, its sort of a challenging tasks because students keep on moving out from school and there are mid year admissions as well so manually maintaining a distribution list would be somewhat tedious. So what we do is to define a custom attribute to that all the mailbox. I have a set of 15 attributes that i can define with exchange. So lets say we will use attribute 3 and set it as the house name.

Set-Mailbox -Identity "susan sanders" -CustomAttribute3 "Yellow"

I can confirm that this is indeed working by running the following command:

[PS] C:\Windows\system32>Set-Mailbox -Identity "susan sanders" -CustomAttribute3 "Yellow" WARNING: The command completed successfully but no settings of 'mayanks.ga/Users/Susan Sanders' have been modified. [PS] C:\Windows\system32>Get-Mailbox -Identity "susan sanders" |fl CustomAttribute3 CustomAttribute3 : Yellow

Imagine how useful it is, next time if anyone wants to send an email to everyone in yellow team, they can just send an email to distribution group by using a criteria. You can create a dynamic group.

New-DynamicDistributionGroup -Name "The Yellow Group" -IncludedRecipients "MailboxUsers,MailContacts" -ConditionalCustomAttribute3 "Yellow"

Do remember attributes are case insensitive, i.e. 'Yellow', 'yellow' and 'yElloW' are all the same. If you want to confirm that all the intended users are added in the group, there are couple of happy go lucky commandlets available for this..

$Yellow = Get-DynamicDistributionGroup "Yellow Group" Get-Recipient -RecipientPreviewFilter $yellow.RecipientFilter

output will be something like this: Name RecipientType ---- ------------- Susan Sanders UserMailbox Thank you for reading and until next time! Cheers, Mayank

Exchange Server 2016- Part 4- Recovering a deleted item from a mailbox.

Mayank Sharma5 — Fri, 30 Jun 2017 03:37:32 GMT

This is a rather small just to illustrate how you can recover an email meant for the user who has deleted it from him email and not only that- the intelligent human being has also emptied his deleted item from the mailbox. This is typical for Susie who is an old accountant who is still not computer friendly and who like the current POTOUS wants to make America great again by the burning the coal and heating up the earth! Anyways being an IT Admin your job is to make sure you recover an email for her as she is a very important person in your organisation. So to being with- you need first configure it for Susan. the following command on Exchange management Shell will make recovery of a single item possible. Do remember the argument RetainDeletedItemsFor is not manadatory however you would want to set up for how many days the email wil

Set-Mailbox -Identity "Susan Sanders" -SingleItemRecoveryEnabled $true -RetainDeletedItemsFor 30

Now Susan sent and email to Mayank and Mike a about leaves and then deleted it. Now if i want to recover the email, all I have to do is to make sure first that I need to have rights to search Susan's mailbox. Please ensure that you are a member of the "Discovery Management" under the exchange Management center.. Now running this command will restore it on Mayank's email

Search-Mailbox "susan sanders" -SearchQuery "leaves" -TargetMailbox "mayank" -TargetFolder "inbox" -LogLevel Full

This will sent an email to the mailbox of the user Mayank. Thank you for reading this, will come up with another blog soon. Mayank

Exchange Server 2016- Part 3 common tasks on mailbox server

Mayank Sharma5 — Wed, 28 Jun 2017 06:17:53 GMT

In part 2 of this blog Here we have installed and configured the exchange mailbox and have opened the exchange messaging center. Needless to say that this is important to do the tasks from the Messanging shell because there lies all the power of exchange! So here are the couple of extremely basic things that you'd like to do with your exchange. Creating a new user. When a new user joins a company; the first thing is that he is handed over an email address. Well- here is what we are going to do just now. In the examples below a chap called Mike Rogers will get his email screwed up by us. Lets start by creating an email for him. The following command on exchange management shell will create a mailbox for Mike Rogers.

New-Mailbox -Name "Mike Rogers" -UserPrincipalName Mike@mayanks.ga -Password (ConvertTo-SecureString -String 'Hcl@123' -AsPlainText -Force) -FirstName Mike -LastName Rogers

To confirm that that user account has indeed been created- we will use the following command.

Get-Mailbox -Identity "Mike Rogers" | Format-List Name,DisplayName,Alias,PrimarySmtpAddress,Database

This is what I see when I run this command, Take a look at the Database name. We are going to speak a lot about it in coming blogs however if it is not clear to you already- please note, the user mailbox will be hosted on the databases. There can be 10 databases hosting 1000 users or just one database hosting 1000 user mailboxes. We will keep this discussion in abeyance until we do our basic tasks first. Enabling email support for an existing user. So what happens when you already have an active directory user before you installed exchange on it. Its actually pretty simple to enable email access for him. the following command will enable the email access to the user. Lets create an email for the corrupt ex-president of United states Francis Underwood.

Enable-Mailbox -Identity frank@mayanks.ga -Database "Mailbox Database 1895211678"

See how easy it is. Now if Mr Underwood wants to manipulate things.. like he do; he would like to send an email as someone else as well, hiding his own identity. In the boring world of the IT- lets say a company A has recently been acquired by the company B. Company A originally has an emails configured like a@A.com and for company B it was b@B.com. Now all the users will be using @B.com domain. You now want to make sure that the users of company A keep getting the emails from their original email address. So you will add an alternate email address to the mailbox.

Set-Mailbox "Francis Underwood" -EmailAddresses @{add="Frank@president.us"}

Now any email that will be sent to frank@president.us will be forwarded to the mailbox of Francis underwood in addition to the any email sent on frank.mayanks.ga! Keep in mind- the Francis could not identify if the email was sent to him from @president.us. once he logs in the web login in outlook as frank@mayanks.ga. Since I want to keep Frank in check, I can check the email address of Frank by running the following command:

Get-Mailbox "Francis Underwood" | fl EmailAddresses

Now if Francis wants to see all the emails sent to Poor Mike Rogers like Peter Russo- he can run the following command so that all the emails of Mike will be forwarded to Franks account.

Set-Mailbox -Identity "Mike Rogers" -DeliverToMailboxAndForward $false -ForwardingSMTPAddress "Frank@mayanks.ga"

Take a look at this: DeliverToMailboxAndForward is set to false- meaning all emails will be sent to frank without even Mike's knowledge. Since I am the director of the show- I will decide who will do what. So I can know whos email is being seen by whom and how to turn in back to how it was.

Get-Mailbox | Where {$_.ForwardingAddress -ne $null} | Set-Mailbox -ForwardingAddress $null -DeliverToMailboxAndForward $false

Lastly how to make sure that no one outside can make any contact with Poor chap Mike? its easy..

Set-Mailbox -Identity "Robin Wood" -RequireSenderAuthenticationEnabled $true

when RequireSenderAuthenticationEnabled is set to $true Mike can only receive the email only in your organization. I hope you'd found this blog useful, in Next blog- we will discuss some other interesting aspects of mailbox servers. Cheers! Mayank

Exchange Server 2016 Installation- part 2.

Mayank Sharma5 — Wed, 28 Jun 2017 04:23:08 GMT

The mailbox server. We are now going to install the exchange mailbox server role. Do keep in mind what mailbox is used for. Microsoft documentation says the following is the role of a mailbox server

Mailbox servers contain the transport services that are used to route mail. For more information, see Mail flow and the transport pipeline
Mailbox servers contain mailbox databases that process, render, and store data.
Mailbox servers contain the client access services that accept client connections for all protocols.

Just keep this in mind: the actual mail is stored in a database that is stored on the mailbox server so if in the entire infrastructure- your mailbox server gets formatted (chees!) there is no way you can recover your emails. Now as this is one heck of a critical piece- Microsoft has provisioned redundancy for it. It is called DAG. A DAG is the clustered host of machine which will share the responsibilities of sharing the mailbox databases so that even if one server goes down- we can fall back to the other functional host. This is not much to do apart from following the wizard, this technet article explains what you should do, only thing to keep in mind which is not written in this is to run UcmaRuntimeSetup.exe on the exchange mailbox which this link has not mentioned so far. https://technet.microsoft.com/EN-US/library/bb124778(v=exchg.160).aspx There are couple of "gotchas" here- first, when you install the related features by the wizard- you will see that the wizard has failed complaining that some features are still missing. Well- its actually installed and you just have to reboot the machine to take this to effect. So just reboot the machine and then start the wizard again. Now once the exchange gets installed, first thing we have to is to log inside exchange to see how things look like. the management tool for exchange is called exchange messaging center. This is a web based console used for managing and maintaining the Exchange. Though it is a very good tool to begin with for the rookies- it is best to familiarise yourself with the Grand dady of the Messaging center. It is called Exchange management Shell. EMS as it is called is the Powershell shell for managing exchange. There are many things that you cannot do with the Messaging center but can achieve with the Exchange messaging services. So to be an expert in exchange- you know what you have to do! A quick tip- to open Exchange messaging center- you have to use https://localhost/ecp on the local host. On a member server; you will have to use: https://NameofServer/ecp. In my case the name of my mailbox server is exchange2016 so the URL for accessing the messaging center is https://exchange2016.mayanks.ga/ecp. Please note my domain is mayanks.ga- this is a publically registered domain for free. (checkout www.freenom.com for registering a free domain name for yourself!) Well- once the exchange mailbox server is installed; believe it on or not- you have a basic exchange 2016 up and running! you can create new users with email enabled and can enable email services for the existing users. We will move in to the next blog for the general housekeeping tasks to begin with.

How to delete all the printers for all the users.

Mayank Sharma5 — Mon, 31 Oct 2016 01:21:30 GMT

This was the scenario on which i was working the other day, all the users had mapped printers in their organizations manually over the period of time until it become too chaotic to be managed. So when we decided to map the printers finally with the GPO but the need arise to clean up all the other stale printers that user has mapped. So this is something we pushed with the users as logon script. this deleted all the printers for the users, Additionally we did a gpupdate in our script to make sure the user also get the printer we have mapped from the GPO. $Printers=Get-Printer |Select-Object -Property name $PrinterName=$Printers.name foreach($i in $PrinterName) { remove-printer -name $i }

Connecting vnet to vnet in Azure.

Mayank Sharma5 — Thu, 27 Oct 2016 22:29:33 GMT

for a note to self:

Create two vnet resource group call it vnet01 and vnet02. Vnet
On vnet01 create a new virtual network, device the IP range as 10.1.0.0/16
Create a default subnet in it mark it like 10.1.0.0/24
Create a GatewaySubnet and mark it 10.1.2.0/29 it can only reside between /16 and /29. It is important to keep in mind that the IP ranges of default subnet and GatewaySubnet must not be overlapping.
Create a public IP resource in vnet01.
Create a Virtual network gateway in vnet01, point it to the public IP resource you created in step 5.
Do the same process for vnet02.
Create a virtual network and give it an IP 192.168.0.0/16 and give default subnet an IP of 192.168.1.0/24 and GatewaySubnet 192.168.2.0/29
create a public IP resource.
create a virtual network gateway.
we now need to create the connection, search in marketplace "Connection" Make sure it is set to vnet to vnet, in the PSK- called as ore shared key type the key that will be shared by the machine click on create and make sure you have checked bidirectional connectivity checkbox on.