Granikos Technology Blog

NoSpamProxy Azure Edition is the cloud based email security gateway of the successful NoSpamProxy family of products by Net at Work. The Azure edition of NoSpamProxy can easiliy be deployed using the Microsoft Azure Marketplace.

NoSpamProxy Azure easily connects an Office 365 tenant and offers an easy way to provide centralized email encryption and decryption with PGP and/or S/MIME for mailboxes hosted in Exchange Online. Additionally, NoSpamProxy Azure provides compliant anti-spam handling, an anti-malware component, and a large file portal.

The edition currently available in Microsoft Azure installs a NoSpamProxy single-server deployment. A single-server deployment combines the NoSpamProxy intranet role and the gateway role on a single server.

The NoSpamProxy Azure Edition is provided as BYOL (Bring Your Own License) deployment. In addition to the recurring fees for the Microsoft Azure VM you are required to buy a NoSpamProxy license. If you already own a NoSpamProxy Version 11 license, the license can be used for the NoSpamProxy Azure Edition as well.

Content

DeploymentOptions
Notes
Deployment
Links

Deployment Options

Due to the nature of a cloud service NoSpamProxy Azure can be operated in different scenarios in Microsoft Azure. By default the system is configured as a workgroup system without any Active Directory domain membership. The different operational scenarios for NoSpamProxy Azure depend on the existence of a Site-2-Site VPN between your Azure deployment and your on-premises IT infrastructure.

• Without Site-2-Site VPN to Microsoft Azure
   
  • An on-premises email server (e.g. Exchange Server or SmarterMail) utilizes NoSpamProxy Azure as an external relay for outgoing messages. Incoming messages are received by NoSpamProxy Azure and are forwarded to the on-premises email server via the internet.
     
  • Email addresses of internal recipients are maintained manually using plain text file. The file itself is imported automatically by NoSpamProxy Azure
    This is a viable option, if there aren't too many email addresses to maintain.
     
  • Good option for Office 365 customers running a cloud only deployment without any on-premises Active Directory users and mailboxes. The required import file can be created by exporting Office 365 recipients and email addresses.
     
  • RDP access to the Azure VM and NoSpamProxy Azure must be limited to an external IP address of the company network.
     
• With Site-2-Site VPN to Microsoft Azure
   
  • AN on-premises email server (e.g. Exchange Server or SmarterMail) utilizes NoSpamProxy Azure as an internal Relay for outgoing messages. Incoming messages are received by NoSpamProxy Azure and forwarded to the on-premises email servers using the Site-2-Site VPN.
     
  • Automated import of internal email recipients from a LDAP source (e.g. Active Directory)
    This option simplifies recipient maintenance, as recipients are automatically imported by NoSpamProxy Azure.
     
  • Perfect option for Office 365 customers maintaining user accounts on-premises and running Azure AD Connect or maybe even having a full Office 365 hybrid setup with centralized mail flow.
     
  • RDP access to the Azure VM and NoSpamProxy Azure restricted to internal company network(s).

Currently a direct connection to Azure AD is not supported, but it is planned for a future release.
 

Notes

• The Azure Service for NoSpamProxy Azure System requires a Reverse-DNS configuration, as any other public facing SMTP service. External SMTP servers must be able to perform a Reverse-DNS check successfully. A link on how to configure Reverse-DNS in Azure is listed in the Links section.
   
• The system name of the NoSpamProxy Azure VM should not follow internal IT naming conventions, as the name is publically resolvable. Otherwise you are going to expose your internal naming conventions.

Depending on the size of the Azure VM different throughputs can be reached in regards to emails per minute.

Tests have shown the following results for Standard A Virtual Machines:

Deployment

The following steps describe a simple deployment of NoSpamProxy Azure.

Go to Azure Marketplace and search for NoSpamProxy, select the NoSpamProxy Azure Edition.

Click Create to configure the NoSpamProxy Azure system.

Configure the required parameters as needed

• Name
  System name which is added to Azure DNS and externally resolvable.
• VM disk type
  When selecting SSD as VM disk type, you must choose an Azure VM supporting SSD in a following step.
• User name, Password
  User name of the local administrator account
  As the Azure VM is accessible via RDP from the internet by default, you should use a non-trivial user name and password.
• Subscription
  Azure subscription to add the Azure resources to.
• Resource group
  Resource group for the new Azure resources. The example creates a new resource group.
• Location
  Azure region for the new resource group.

Select an appropriate virtual machine type. NoSpamProxy Azure doesn't have extraordinary system requirements for processor and memory. SQL Server 2014 Express is downloaded and installed as part of the standard setup of NoSpamProxy. Even SQL Server 2014 Express can be run on a standard VM..

All other settings remain unchanged for this simple deployment. You can adjust the settings, if required for your individual deployment. Especially if you want to utilize exisiting resources.

• Storage Account
  Storage for Azure VM VHD files
• Virtual Network
  Azure virtual network for the new Azure VM
• Subnet
  Azure virtual network subnet
• Public IP Address
  External IP address
• Network Security Group
  Network firewall configuration

Verify the technical summary and click OK to add the configured system to your shopping cart.

Verify the selected Azure service offering and the configured virtual machine. Click Purchase to buy the selected subscription. The deployment is a so called BYOL Deployment and requires a valid NoSpamProxy trial license or an existing full license. After the NoSpamProxy setup as been completed in the virtual machine you will be redirected to a web page to request a trial license.

Connect to the newly deployed virtual machine using Remote Desktop. After first log on NoSpamProxy setup will start automatically as part of an scheduled task. The scheduled task will execute the following steps:

• Configure the preinstalled SQL Server Express Edition
• Download and setup of the most current release of NoSpamProxy
• Redirect to the NoSpamProxy Azure web page to request a trial license
• Removal of the scheduled task

Do not close or interrupt the Windows PowerShell window.

After the setup has finished the public web page of NoSpamProxy Azure Edition will be opened in Internet Explorer. After initial setup of the operating system Internet Explorer runs in secure mode. Therefore, a security warning is displayed. Just add the web page to the list of exclusions and request your personal NoSpamProxy trial license.

The program setup adds new security groups and adds the logged on account to these security groups. It is required to log off and log on again to reflect the new group memberships. This is mandatory to sucessfully manage NoSpamProxy.

After log on start the NoSpamProxy Configuration MMC to import the license.

The NoSpamProxy Configuration MMC displays the NoSpamProxy version.

After initial import of the license you can start configuring NoSpamProxy to suit your needs.

Links

• NoSpamProxy Azure
• NoSpamProxy Protection
• Blogartikel: Gateway based email encryption with Office 365
• Microsoft Azure Trial
• Microsoft Azure Reverse DNS
• Microsoft Azure Reverse DNS mit der CLI

Wie fängt man am sinnvollsten mit der Nutzung von Microsoft Azure an? Wie nähert man sich diesem Thema überhaupt?

Bevor man mit der Nutzung von Microsoft Azure beginnen kann, muss man die wichtigsten Eigenschaften von Microsoft Azure kennenlernen. Einer der wichtigsten Unterschiede ist, dass es sich bei Microsoft Azure um eine Plattform handelt und nicht um ein packetiertes Produkt wie Office 365.

Mit Hilfe der nachfolgenden Links legen Sie die Basis für ein umfassendes Verständnis von Microsoft Azure. Cloudangebote sind einer schnellen Weiterentwicklung unterworfen, daher sind die meisten Informationen nach der Veröffentlichung anfangs nur in Englisch verfügbar.

• Was ist Microsoft Azure?
• Take a 3–minute tour of Microsoft Azure?
• Read the Microsoft Azure Fundamentals Document (Deutsche Version)
• Lesen Sie die Übersicht der Azure Produkte oder nutzen Sie die Interaktive Azure Übersicht

Die Anzahl der zur Verfügung stehen Dienste ist am Anfang sehr überwältigend. Um den größtmöglichen Nutzen aus den einzelnen Dienstangeboten zu ziehen ist wichtig, die gewünschten Dienste ausführlich kennenzulernen. Dies benötigt Zeit. Diese sollten Sie sich nehmen.

Ein Clouddienst wie Microsoft Azure kann nur dann erfolgrich genutzt werden, wenn man sich dem Thema Vertrauen und Sicherheit stellt. Microsoft bietet hierzu ausführliche Informationen im Microsoft Azure Trust Center. Wie Microsoft Kundendaten in der Cloud schützt wird sehr anschaulich in diesem Video gezeigt.

Microsoft Azure ist nicht der einzige Anbieter von Clouddiensten. Für einen Vergleich mit Amazon AWS stehen folgende Informationsquellen zur Verfügung:

• Microsoft Azure vs. Amazon Web Services (AWS)
• Microsoft Azure vs. Amazon Web Services Mapping
• Microsoft Azure for AWS Professionals Video Series

Fallbeispiele für eine erfolgreiche Nutzung von Azure helfen Ihnen, einer Nutzung von Clouddiensten das erforderliche Vertrauen entgegen zu bringen.

• Kundenreferenzen (DE) für Microsoft Azure

Starten Sie noch heute mit Microsoft Azure

• Erstellung eines Microsoft Azure Testkontos mit €170 Guthaben
• Übersicht der kostenfreien Dienste in Microsoft Azure
• Microsoft Azure Optionen für MSDN-Abonnenten

Viel Spaß und Erfolg mit Microsoft Azure.

Die nachfolgenden Links dienen als Link-Liste für das Troubleshooting und Planung von On-Premises Exchange Installationen und Exchange Hybrid Umgebungen. Ebenso finden sich Links für die Installationsvoraussetzungen von Exchange und anderer Tools in der Übersicht.

Exchange Server

PowerShell Referenz

• Exchange PowerShell auf Microsoft Docs

Troubleshooting

• SSL Server Test 
• SSL/TLS Server Test 
• ROCA Vulnerability Test Suite
• MX Toolbox
• Remote Connectivity Analyzer
• Exchange Server 2013, 2016, and 2019 Build Numbers (with Cumulative Updates)
• Log Parser Studio Report Collection - Troubleshooting Exchange 2013 Performance
• How can you download a hotfix without contacting Microsoft?

Planung

• Exchange Server-Unterstützbarkeitsmatrix
• Exchange Server build numbers and release dates
• Exchange-Processor Query Tool: PowerShell Edition
• Processor Query Tool v1.1
• Outlook license requirements for Exchange features
• Modern public folder deployment best practices
• UN/LOCODE
• UN/LOCODE (DE)

Installation

• Exchange Server 2016 Installationsvoraussetzungen
  • Microsoft .NET Framework 4.5.2 (Offline-Installer)
  • Microsoft .NET Framework 4.6.1 (Offline Installer) (CU2 - CU7)
    • Hotfix-Rollup 3146715 für.NET Framework 4.6 und 4.6.1 in Windows (Windows Server 2012R2)
  • How to temporarily block installation of the .NET Framework 4.7 
  • Microsoft .NET Framework 4.7.1 (Offline Installer) (Exchange Server 2016 CU8 oder neuer)
  • Microsoft .NET Framework 4.7.2 (Offline-Installer) 
  • Microsoft .NET Framework 4.8 (Offline-Installer) 
  • Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit
    • Exchange Server 2019 ISO beinhaltet einen angepassten UCMA-Installer
• Exchange Server 2019 Installationsvoraussetzungen
  • Visual C++ Redistributable Packages for Visual Studio 2013
  • Microsoft .NET Framework 4.7.2 (Offline-Installer) 
  • Microsoft .NET Framework 4.8 (Offline-Installer) 
  • Microsoft Unified Communications Managed API 
    • Bestandteil des Exchange Server 2019 Installationsmediums

Migration

• Exchange Resource Forest and Office 365 – Part I 

Windows Server

• Windows Admin Center - Übersicht
• Windows Admin Center - Download 

Securing Active Directory

• Best Practices for Securing Active Directory
  • Events to Monitor

Office 365

Allgemein

• Service Trust Portal
• URLs und IP-Adressbereiche von Office 365
• Exchange Online Protection IP Addresses
• Table of Language Culture Names, Codes, and ISO Values
• Azure AD Connect: Version Release History
• Azure AD Connect prerequisites and hardware requirements
• Download Microsoft Azure Active Directory Connect
• Microsoft Online Services Sign-In Assistant for IT Professionals RTW
• Office 365 Datacenter Map
• ADFS Open Source Tools 
• Microsoft Teams IT Architecture and Telephony Solutions Posters (PDF/Visio)
• Microsoft Cloud IT Architecture Resources (PDF/Visio)

Planung

• Office 365 Network Performance Tool
• Network planning and performance tuning for Office 365
• Office 365 Network Connectivity Principles
• Network Assessment Tool Plus
• Office 365 ROI Calculator
• Verfügbarkeit Tenant-Name

Troubleshooting

• Remote Connectivity Analyzer
• Support- und Wiederherstellungs-Assistenten für Office 365
• Create DNS records at Strato for Office 365 

Administration

• Manage who can create Office 365 Groups
• Azure AD Connect Network and Name Resolution Prerequisites Test

Microsoft Teams

Links zu Microsoft Teams finden Sie immer aktuell unter dem Tag Microsoft Teams: https://www.granikos.eu/de/Blog/Tag/microsoft-teams

OneDrive for Business

• OneDrive for Business – Fixing credential issues

Azure

• Azure Portal
• Azure 101
• Azure Account Portal
• Azure Rights Management Administration Tool
• Azure Architecture Center
• Azure Active Directory Module
• Interactive Azure Platform Overview
• Operations Management Suite (OMS) SDK

Skype for Business

• bounSky

SQL Server

• Download des aktuellsten SQL Server 2014 CU - Service Pack 2 Branch
• Download des aktuellsten SQL Server 2014 CU - Service Pack 3 Branch
• Download des aktuellsten SQL Server 2016 CU - Service Pack 2 Branch
• Download der aktuellen Version des SQL Server Management Studios (SSMS)

Allgemein

• Microsoft .NET Framework Repair Tool

Das Exchange Blog Cumulative Update für Oktober 2016 (CU1016) fasst interessante Themen rund um Exchange Server und Office 365 (Exchange Online), Azure und Skype for Business (aka Lync) des Monats Oktober 2016 zusammen.

Exchange Server

• EWS Basics Accessing and using Shared mailboxes
  http://gsexdev.blogspot.com/2016/10/ews-basics-accessing-and-using-shared.html
• Migration to Modern Public Folders – Notes from the Field
  https://blogs.technet.microsoft.com/exchange/2016/10/10/migration-to-modern-public-folders-notes-from-the-field/
• The Hybrid Mesh
  https://blogs.technet.microsoft.com/exchange/2016/10/17/the-hybrid-mesh/
• Using EWS to upload / set user photos in Exchange Online and 2016
  http://gsexdev.blogspot.de/2016/10/using-ews-to-upload-set-user-photos-in.html
• Speed up remote PowerShell connection to Exchange
  https://blogs.technet.microsoft.com/heyscriptingguy/2016/10/17/speed-up-remote-powershell-connection-to-exchange/
• Windows Updates on Domain Controllers cause Exchange login issues
  https://exchangemaster.wordpress.com/2016/10/19/windows-updates-on-domain-controllers-cause-exchange-login-issues/
• Active Directory Forest Functional Levels for Exchange Server 2016
  https://blogs.technet.microsoft.com/exchange/2016/10/27/active-directory-forest-functional-levels-for-exchange-server-2016/

Office 365 & Exchange Online

• [STICKY] Office 365-Trust Center
  http://bit.ly/Office365TrustCenter
• [STICKY] Office 365 URLs and IP address ranges
  http://bit.ly/Office365URLsIPaddresses
• Tip: a few useful PowerShell scripts for Exchange and Office 365 Admins
  https://blogs.technet.microsoft.com/exchange/2016/10/06/tip-a-few-useful-powershell-scripts-for-exchange-and-office-365-admins/
• AADConnect Password Reset Date Sync Issues
  http://c7solutions.com/2016/10/aadconnect-password-reset-date-sync-issues
• Managing Focused Inbox in Office 365 and Outlook
  https://blogs.technet.microsoft.com/exchange/2016/10/14/managing-focused-inbox-in-office-365-and-outlook/
• Enterprise administrator content set for Microsoft Office 365
  https://blogs.technet.microsoft.com/solutions_advisory_board/2016/10/25/enterprise-administrator-content-set-for-microsoft-office-365/
• Breaking the AADConnect link – an Alumni example
  http://www.wapshere.com/missmiis/breaking-the-aadconnect-link-an-alumni-example

Skype for Business, Lync Server & Communication

• An SfB DCOM error with a difference
  https://greiginsydney.com/an-sfb-dcom-error-with-a-difference/
• So you say you hate the Lync 2011 Mac client?
  https://johnacook.wordpress.com/2016/10/02/so-you-say-hate-the-lync-2011-mac-client/
• Lync 2013 / SfB 2015 Client Security Update – October 2016
  https://greiginsydney.com/lync-2013-sfb-2015-client-security-update-october-2016/

Microsoft Azure

• [STICKY] Microsoft Azure Trust Center
  http://azure.microsoft.com/en-us/support/trust-center
• Step-By-Step: Creating a DNS zone in Azure
  https://blogs.technet.microsoft.com/canitpro/2016/10/06/step-by-step-creating-a-dns-zone-in-azure/
• Step-By-Step: Creating a DNS zone in Azure
  https://blogs.technet.microsoft.com/canitpro/2016/10/06/step-by-step-creating-a-dns-zone-in-azure/
• Identity Management in Retail Industry with AzureAD
  https://blogs.technet.microsoft.com/enterprisemobility/2016/10/10/identity-management-in-retail-industry-with-azuread/
• AzureAD Domain Services is now GA! Lift and shift to the cloud just got WAY easier!
  https://blogs.technet.microsoft.com/enterprisemobility/2016/10/12/azuread-domain-services-is-now-ga-lift-and-shift-to-the-cloud-just-got-way-easier/
• IPv6 for Azure VMs
  https://blogs.technet.microsoft.com/solutions_advisory_board/2016/10/13/ipv6-for-azure-vms/
• Sync Error Reports in AzureAD Connect Health are now in Public Preview
  https://blogs.technet.microsoft.com/enterprisemobility/2016/10/25/sync-error-reports-in-azure-ad-connect-health-are-now-in-public-preview/

Cloud Themen & Cloud Sicherheit

• [STICKY] Microsoft Security TechCenter
  http://technet.microsoft.com/de-DE/security/dd252948
• IT's Latest Challenge: Innovation and Transformation
  https://blogs.technet.microsoft.com/canitpro/2016/10/04/its-latest-challenge-innovation-and-transformation/
• Keeping Adobe Flash Player
  http://blogs.microsoft.com/microsoftsecure/2016/10/03/keeping-adobe-flash-player/
• Lessons from the NIST Cybersecurity Framework
  http://blogs.microsoft.com/microsoftsecure/2016/10/05/lessons-from-the-nist-cybersecurity-framework/
• Microsoft and ISO help customers moving to the cloud with procurement guidance
  http://blogs.microsoft.com/on-the-issues/2016/10/10/microsoft-iso-help-customers-moving-cloud-procurement-guidance
• “Contoso in the Microsoft Cloud” poster describes how a global organization is adopting the Microsoft cloud
  https://blogs.technet.microsoft.com/solutions_advisory_board/2016/10/10/contoso-in-the-microsoft-cloud-poster-describes-how-a-global-organization-is-adopting-the-microsoft-cloud/
• Understanding the geography of malware
  http://blogs.microsoft.com/microsoftsecure/2016/10/12/understanding-the-geography-of-malware/
• Step-By-Step: Excluding Users or Usergroups from Group Policy
  https://blogs.technet.microsoft.com/canitpro/2016/10/12/step-by-step-excluding-users-or-usergroups-from-group-policy/
• Attackers using Trojans more than other malware categories
  http://blogs.microsoft.com/microsoftsecure/2016/10/17/attackers-using-trojans-more-than-other-malware-categories/
• New Microsoft Cloud Mobility and Security poster compares MDM and conditional access capabilities across products
  https://blogs.technet.microsoft.com/solutions_advisory_board/2016/10/17/new-microsoft-cloud-mobility-and-security-poster-compares-mdm-and-conditional-access-capabilities-across-products/
• Microsoft Update Catalog site updated
  https://blogs.technet.microsoft.com/windowsitpro/2016/10/18/microsoft-update-catalog-site-updated/
• Top Five Security Threats Facing Your Business and How to Respond
  http://blogs.microsoft.com/microsoftsecure/2016/10/18/top-five-security-threats-facing-your-business-and-how-to-respond/
• Security Intelligence Report: Discover the top cybersecurity threats by country
  http://blogs.microsoft.com/microsoftsecure/2016/10/24/security-intelligence-report-discover-the-top-cybersecurity-threats-by-country/

Knowledge Base & TechNet

• Outlook Skype for Business "Contacts" folder doesn't sync with Skype for Business contacts
  https://support.microsoft.com/en-us/kb/3193240
• Fix for Office 365 Integration issue with Windows Server 2012 R2 Essentials has been released
  https://blogs.technet.microsoft.com/sbs/2016/10/25/fix-for-office-365-integration-issue-with-windows-server-2012-r2-essentials-has-been-released/

Replay

• August 2013: Wondering why mscorsvw.exe has high CPU usage? You can speed it up
  https://blogs.msdn.microsoft.com/dotnet/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up/
• Juli 2014: Legacy Public Folder remnants in Exchange 2013 cause "The Microsoft Exchange Administrator has made a change…" prompt
  https://exchangemaster.wordpress.com/2014/07/11/legacy-public-folder-remnants-in-exchange-2013-cause-the-microsoft-exchange-administrator-has-made-a-change-prompt/
• August 2013: Managing failed mailbox move requests
  https://blogs.technet.microsoft.com/mikehall/2013/08/06/managing-failed-mailbox-move-requests/

Podcast Empfehlungen

• Exchange Exposed
  http://bit.ly/ExchangeExposedPodcast

Tools

• Mailscape 365 - Exchange Online Monitoring und Reporting
• Mailscape - Exchange Monitoring und Reporting
• Uniscope - Lync Monitoring und Reporting
• Compass - Active Directory Monitoring und Reporting
• ForeSite - SharePoint Monitoring und Reporting

Gerne unterstützen wir Sie bei der Planung und Durchführung Ihrer Exchange Server Implementierung oder Migration.

Sie denken über einen vollständigen Wechsel zu Office 365 oder eine Hybrid-Konfiguration mit Office 365 nach? Wir beraten Sie umfassend und ausführlich über die Möglichkeiten der Office 365 Plattform.

Sie möchten mehr über Exchange Server 2016 erfahren? Gerne erläutern wir Ihnen die technischen Änderungen und Chancen für Ihr Unternehmen in einem persönlichen Workshop.

Weitere Informationen zu unseren Dienstleistungen finden Sie auf unserer Website (https://www.granikos.eu) oder Sie kontaktieren direkt unser Vertriebsteam: info@granikos.eu