de-DEen-GB
 
MVP - Most Valuable Professional
rss

Just can't get enough of IT

This blog is about mostly anything in IT. But the primary focuses are Microsoft Technologies like Exchange, Office 365, Azure and Cloud Security.

Exchange Server 2007Exchange Server 2010Description

The Category List Manager is a C# Visual Studio Solution that allows you to connect to a source mailbox which is either hosted on an on-premises Exchange Server or in Exchange Online using Exchange Web Services (EWS).

You can use AutoDiscover or a static Url to connect to the Exchange Server or Office 365. By default the solution uses the credentials of the user executing the program. These credentials are referred to as default credentials. You can use the Settings form to set dedicated credentials of an user with appropriate access rights to the mailbox(es).

Diagram of the Master Category List Manager

The program helps you to

  • Export the master category list from a mailbox to a Xml file
  • Import a master category list Xml file to into a mailbox
  • Copy a master category list from a source mailbox to a target mailbox

The supported target mailbox types are:

  • User Mailbox
  • Shared Mailbox
  • Microsoft Teams Mailbox

The GUI comes with an easy-to-use UI. The execuable works a command line tool as well and can be used for automation purposes.

Use CategoryManager.exe -help to get the most recent command line help information.

 

Example Screenshot

Master Category List Manager - Example Screenshot

 

Presentation

Watch the presentation held at the Exchange User Group Berlin Meetup on May 31st 2018.

 

Version History

  • 1.0, Initial community release

 

Links

 

Additional Credits

Additional credits go to Henning Krause

 

Follow

Read More »

Exchange Server extends the Active Directory schema during the PrepareSchema step during setup. The steps PrepareAD, PrepareDomain, or PrepareAlLDomains create Active Directory containers and objects that are crucially important for a stable operation of Exchange Server.

There are different Active Directory objects that are used to determine, if Active Directory has a proper Exchange Server configuration up and running.

Forest level

At Active Directory forest level the following attributes are used to determine the Exchange Server release:

  • rangeUpper attribute of the ms-Exch-Schema-Version-Pt schema object 
  • msExchProductId attribute of the Exchange organization object in the configuration partition
  • objectVersion attribute of the Exchange organization object in the configuration partition
  • objectVersion of the Microsoft Exchange System Objects (MESO) container 

Domain level

At Active Directory domain level the following attribute is used to determine the Exchange Server release:

  • objectVersion of the Microsoft Exchange System Objects (MESO) container 

 

I have written a PowerShell script to fetch all required information for all domains in an Active Directory forest. The script simplifies the process of gathering the data.
Read more about the script here.

 

Schema versions

Exchange

Forest (rangeUpper)

Forest (objectVersion)

Domain (objectVersion)

Exchange Server 2000

2000 RTM

4397

N/A

4406

2000 SP3

4406

N/A

4406

Exchange Server 2003

2003 RTM

6870

6903

6936

2003 SP2

6870

6903

6936

Exchange Server 2007

2007 RTM

10637

10666

10628

2007 SP1

11116

11221

11221

2007 SP2

14622

11222

11221

2007 SP3

14625

11222

11221

Exchange Server 2010

2010 RTM

14622

12640

12639

2010 SP1

14726

13214

13040

2010 SP2

14732

14247

13040

2010 SP3

14734

14322

13040

Exchange Server 2013

2013 RTM

15137

15449

13236

2013 CU1

15254

15614

13236

2013 CU2

15281

15688

13236

2013 CU3

15283

15763

13236

2013 SP1

15292

15844

13236

2013 CU5

15300

15870

13236

2013 CU6

15303

15965

13236

2013 CU7-CU9*

15312

15965

13236

2013 CU10-CU20*

15312

16130

13236

Exchange Server 2016

2016 Preview

15317

16041

13236

2016 RTM

15317

16210

13236

2016 CU1

15323

16211

13236

2016 CU2

15325

16212

13236

2016 CU3

15326

16212

13236

2016 CU4-CU5*

15326

16213

13236

2016 CU6

15330

16213

13236

2016 CU7-CU9*

15332

16213

13236

 

*Note
It is recommended to always run the Active Directory preparation using Setup.exe /PrepareAD before applying an new cumulative update. Even though that the schema version might not have changed from the previous version preparing Active Directory applies any updates or changes to the default RBAC configuration.

 

Links

 

Enjoy Exchange Server!

Read More »

Exchange Server 2010Exchange Server 2013Exchange Server 2016PowerShellDescription

This script reads the Exchange schema version from the Active Directory schema partition.

The Exchange organization name is fetched from Active Directory automatically.
  
The script fetches at forest level:

  • objectVersion of MESO Container
  • rangeUpper of ms-Exch-Schema-Version-Pt 
  • msExchProductId of Exchange Organization container
  • objectVersion of Exchange Organization container

The script fetches at domain level:

  • objectVersion of MESO Container

 

Examples

Code Samples

# Fetch all version information in the Active Directory forest
.\Get-ExchangeServerVersionInfo.ps1

Sample Output:

PS D:\Scripts> .\Get-ExchangeServerVersionInfo.ps1

Exchange Server Schema and Object Information for forest [VARUNA.ROOT]
Exchange Organization Name        : VARUNA-GROUP
Active Directory Schema rangeUpper: 15332

Working on VARUNA.ROOT
MESO Container objectVersion           : 13236
Exchange Configuration msExchProductId : 15.01.1466.003
Exchange Configuration objectVersion   : 16213

Working on VARUNAGROUP.DE
MESO Container objectVersion           : 13236

Version History

  • 1.0, Initial community release

Links

Follow

 

Enjoy Exchange Server!

Read More »

You might have the requirement to authenticate mobile devices and authorize user access to on-premises Exchange Server mailboxes using a multi-vendor strategy. This blog post focuses on the configuration of a Kemp LoadMaster located in an internal network segment. The Kemp LoadMaster ESP functionality is used to allow ActiveSync connections for members of a dedicated security group only.

This results in the following authentication and authorization endpoints:

  • MobileIron access policies
  • Kemp LoadMaster ESP security group membership validation
  • Exchange Server ActiveSync client access allowance 
  • Exchange Server mobile device policy

 

Overview

The following diagram shows a simplified overview for mobile devices connecting to an on-premises Exchange Server. The perimeter and internal network segments are omitted for simplification reasons.

Mobile Device Connect to Exchange Server using Sentry and LoadMaster

  1. A MobileIron managed device connects to MobileIron Sentry which validates access with MobileIron policies
  2. If a MobileIron policy allows access the device connects to Kemp LoadMaster ESP
  3. Kemp LoadMaster ESP configuration validates the security group membership of the authenticating user
  4. If the user is a member of the security group, the device connects to Exchange Server
  5. Exchange Server authenticates the user and checks, if the ActiveSync protocol is enabled and the device complies with Exchange Server MDM configuration

 

Kemp LoadMaster Virtual Service

The following screenshots illustrate a working setup for a virtual service load balancing mobile device connections from MobileIron Sentry to Exchange Server. It's assumed that you've already configured the following:

  • SSO Domain settings for connecting to a domain controller to authenticate users

 

SSL Properties

The SSL Traffic is offloaded and re-encrypted as we need to authenticate the user with ESP. Ensure to select a Cipher Set that does not provide any weak or unsecure cipher suites. In this example I've selected the predefined set BestPractices.

Kemp Virtual Service | SSL Properties

 

ESP Options

Enable ESP to activate the ESP configuration section. The settings are as follows:

  • Client Authentication Mode: Basic Authentication
    Be aware that this setting requires that MobileIron users are provisioned using DOMAIN\SamAccountName notation and not the UPN Name
  • SSO Domain: An existing SSO Domain configuration for user authentication
  • Allowed Virtual Hosts: The FQDN matching the Load Master virtual service IP address accessed by MobileIron Sentry to connect to Exchange Server
  • Allowed Virtual Directories: Can be limited to /Microsoft-Server-ActiveSync otherwise leave the default /*
  • Permitted Groups: The name of the Active Directory security group containing the allowed users
  • Server Authentication Mode: Basic Authentication

 

Kemp Virtual Service | ESP Options

 

Real Servers

In the Real Servers section you add all member servers of your Exchange Server DAG. Ensure to use the HTTPS protocol the health checks and ensure to query the /Microsoft-Server-ActiveSync/healthcheck.htm document.

Kemp Virtual Service | Real Servers

 

Using this configuration you've added your Kemp LoadMaster as an additional authentication endpoint to secure mobile device access to Exchange Server mailboxes.

Enjoy!

Read More »
On April 26, 2018
229 Views

SharePoint Conference North America

SharePoint Conference North America is just 4 weeks away! Now is a great time to register and make your plans to BE THERE in Las Vegas.

See the schedule, available now, with over 160 sessions to immerse yourself each day on what you need to know about SharePoint, OneDrive, Yammer, Microsoft Teams, and Office 365. Check out The Road to @SPConf, which reveals the inside scoop about SharePoint Conference North America and what you can expect with the return of the SharePoint community.

Register today | Don't miss the conference

 

Links

 

 

Read More »