This script exports all mailbox folder permissions for mailboxes of the type UserMailbox. This is useful for documentation purposes prior to migration.
The permissions are exported to a local CSV file.
The script is intended to run from within an active Exchange Server 2013/2016/2019 Management Shell session.
Gather mailbox folder permission data for a large number of mailboxes takes some time.
# Export mailbox permissions to export.csv .\Get-MailboxPermissionsReport-ps1 -CsvFileName export.csv
The script is based on Mr. Tony Redmonds blog post http://thoughtsofanidlemind.com/2014/09/05/reporting-delegate-access-to-exchange-mailboxes/
WIth Exchange Server 2013 CU11 and Exchange 2016 CU1 the Exchange Product Group introduced a new feature named Mailbox Anchoring.
The workaround provided by Veritas in KB article 107463 recommends to set a new registry key for the NetBackup process responsible for running PowerShell queries.
There is no guarantee that this workaround will fix your backup issuesd with Exchange Server 2013 CU11 or Exchange Server 2016 CU1. It seems that the only workaround is by creating a new service account for NetBackup service due to rights assignments being removed during Exchange Server CU setup.
Steps required:
Enjoy classic backup with Exchange Server 2013 and Exchange Server 2016.
When you encounter a situation where the transport queues are filling up or you just want to get messages out of a transport queue for further usage, you have to export the messages to the file system.
With Exchange 2007 you could easily utilize the Export-Message cmdlet to export suspended messages from a transport queue:
Get-Message -Queue MYSERVER\29489 | ?{$_.Status -eq "Suspended"} | Export-Message -Path D:\MessageExport
With Exchange Server 2010 or newer the Path attribute had been removed from the Export-Message cmdlet. The cmdlet now returns a binary object that needs to be assembled to a readable text message.
You can only export suspended messages, as the transport service might take precedence on non suspended messages. You can either suspend the queue or suspend single messages. The following example for Exchange Server 2010 or newer suspends the messages, but not the queue itself.
Identify the queue holding messages to be exported
Beispiel: Auflistung der Warteschlage auf Server MCMEP01
Get-Queue -Server MCMEP01 Identity DeliveryType Status MessageCount Velocity RiskLevel OutboundIPPool NextHopDomain -------- ------------ ------ ------------ -------- --------- -------------- ------------- MCMEP01\18 SmtpDeliv... Ready 0 0 Normal 0 MXEDB19 MCMEP01\23 SmtpDeliv... Ready 0 0 Normal 0 MXEDB08 MCMEP01\24 SmtpDeliv... Ready 0 0 Normal 0 MXEDB01 MCMEP01\25 SmartHost... Ready 3 0 Normal 0 [10.10.11.1] MCMEP01\53 SmtpDeliv... Ready 0 0 Normal 0 MXEDB03 MCMEP01\Submission Undefined Ready 512 0 Normal 0 Submission MCMEP01\Shadow\3 ShadowRed... Ready 2 0 Normal 0 MCMEP04.mcsmemail.de MCMEP01\Shadow\4 ShadowRed... Ready 2 0 Normal 0 MCMEP03.mcsmemail.de MCMEP01\Shadow\5 ShadowRed... Ready 3 0 Normal 0 MCMEP02.mcsmemail.de MCMEP01\Shadow\6 ShadowRed... Ready 2 0 Normal 0 MCMEP07.mcsmemail.de MCMEP01\Shadow\15 ShadowRed... Ready 1 0 Normal 0 MCMEP08.mcsmemail.de
Suspend all Messages in Queue MCMEP01\Submission
Get-Queue MCMEP01\Submission | Get-Message ResultSize Unlimited | Suspend-Message
Fetch all messages to an array and export all messages to the local file system. You can either export all messages by just enumerating the messages or by using the message subject as the file name. Using the message subject posed the risk that the subject might contain a character that is not allowed for file names.
$array = @(Get-Message -Queue MCMEP01\Submission -ResultSize Unlimited | ?{$_.Status -eq "Suspened"}) $array | ForEach-Object {$m++;Export-Message $_.Identity | AssembleMessage -Path ("E:\Export\"+$m+".eml")} $array | ForEach-Object {$m++;$filename="E:\Export\"+$m+"_"+$_.subject+".eml"; Export-Message $_.identity | AssembleMessage -path $filename}
The messages exported to the local file system can now be copied to the Exchange Transport Replay folder, which exists on each Exchange Server having an Exchange 2010 Hub Transport role or Exchange 2013/2016 Mailbox role.
After successful export of all suspended messages you want to delete the suspended messages from the queue. Ensure to use -WithNDR $false as otherwise all senders will receive a Non Delivery Report (NDR).
Get-Queue MCMEP01\Submission | Get-Message -ResultSize Unlimited | ?{$_.Status -eq "Suspened"} | Remove-Message -WithNDR $false
Messages saved to the Replay folder will be picked up the transport service. When a messages is picked up, the file extension changes to .TMP. You will not be able to delete a file at this point as the file is locked by the transport service. After a message file has been processed successfully, the file is deleted by the transport service. If there is any issue with the message file the file extension will change to .BAD.
Lastly I've encountered an interesting PowerShell error after upgrading several servers running Exchange Server 2013 CU9 to Exchange Server 2013 CU11.
After a successful upgrade, the Exchange PowerShell script to redistribute the DAG databases failed with an error.
.\RedistributeActiveDatabases.ps1 -DagName DAG01 -BalanceDbsByActivationPreference -Confirm:$false
Cannot process argument transformation on parameter 'Identity'. Cannot convert value "MAILBOXDB01" to type "Microsoft.Exchange.Configuration.Tasks.DatabaseCopyIdParameter". Error: "Cannot convert hashtable to an object of the following type: Microsoft.Exchange.Configuration.Tasks.DatabaseCopyIdParameter. Hashtable-to-Object conversion is not supported in restricted language mode or a Data section." + CategoryInfo : InvalidData: (:) [Get-MailboxDatabaseCopyStatus], ParameterBindin...mationException + FullyQualifiedErrorId : ParameterArgumentTransformationError,Get-MailboxDatabaseCopyStatus + PSComputerName : SERVER01.mcsmemail.de
The interesting part to note is conversion is not supported in restricted language mode
The supported language mode is configured in the application settings of the PowerShell virtual directory of the Exchange Back End website.
The application settings after Exchange Server 2013 CU11 update:
Running PSLanguageMode with value RestrictedLanguage is the default setting. You should change this setting only, if you encounter PowerShell issues.
Double-click PSLanguageMode and change the value to FullLanguage.
Currently I have not validation why a clean Exchange 2013 CU11 setup does not show this behaviour. A plain Exchange 2013 CU11 setup executes the script without any issues.
The Outlook on the web S/MIME implementation supports a variation of encryption algorithms like
When you want to configure the OWAEncryptionAlgorithms or OWASigningAlgorithms attributes to support more than one algorithm, you have to follow a certain format. The attribute itself is stored as String and not being validated when using Set-SMimeConfig. Beware of this when you configure S/MIME settings and the S/MIME Plugin is not available in your Outlook on the web client.
TechNet states clearly:
“If the encryption algorithm or minimum key length is not available on a client, Outlook on the web does not allow encryption.”
The string to used when configuring the OWAEncryptionAlgorithms for AES256 and AES128 is "6610;660E"
Set-SmimeConfig –OWAEncryptionAlgorithms "6610;660E"
When not using quotation marks, you will receive an error message. But the cmdlet will accept a comma separated list. A comma separated list results in the follow Get-SMimeConfig output
Set-SmimeConfig –OWAEncryptionAlgorithms 6610,660E … OWAEncryptionAlgorithms : 660E 6610 …
This setting results in S/MIME not being available in Outlook on the web.
To successfully apply S/MIME configuration changes, restart the application or restart the Exchange server.
Get-ExchangeServer | ? { $_.AdminDisplayVersion -like '*15.*'} | % { Invoke-Command -ComputerName $_.Name -ScriptBlock {Restart-WebAppPool MSExchangeOWAAppPool} }