Just can't get enough of IT

Exchange Server extends the Active Directory schema during the PrepareSchema step during setup. The steps PrepareAD, PrepareDomain, or PrepareAlLDomains create Active Directory containers and objects that are crucially important for a stable operation of Exchange Server.

There are different Active Directory objects that are used to determine, if Active Directory has a proper Exchange Server configuration up and running.

Forest level

At Active Directory forest level the following attributes are used to determine the Exchange Server release:

• rangeUpper attribute of the ms-Exch-Schema-Version-Pt schema object 
• msExchProductId attribute of the Exchange organization object in the configuration partition
• objectVersion attribute of the Exchange organization object in the configuration partition
• objectVersion of the Microsoft Exchange System Objects (MESO) container 

Domain level

At Active Directory domain level the following attribute is used to determine the Exchange Server release:

• objectVersion of the Microsoft Exchange System Objects (MESO) container 

Schema versions

Links

• Script to gather Exchange schema information across all domains in an Active Directory forest

Enjoy Exchange Server!

Description

This script reads the Exchange schema version from the Active Directory schema partition.

The Exchange organization name is fetched from Active Directory automatically.
  
The script fetches at forest level:

• objectVersion of MESO Container
• rangeUpper of ms-Exch-Schema-Version-Pt 
• msExchProductId of Exchange Organization container
• objectVersion of Exchange Organization container

The script fetches at domain level:

• objectVersion of MESO Container

Examples

Code Samples

# Fetch all version information in the Active Directory forest
.\Get-ExchangeServerVersionInfo.ps1

Sample Output:

PS D:\Scripts> .\Get-ExchangeServerVersionInfo.ps1

Exchange Server Schema and Object Information for forest [VARUNA.ROOT]
Exchange Organization Name        : VARUNA-GROUP
Active Directory Schema rangeUpper: 15332

Working on VARUNA.ROOT
MESO Container objectVersion           : 13236
Exchange Configuration msExchProductId : 15.01.1466.003
Exchange Configuration objectVersion   : 16213

Working on VARUNAGROUP.DE
MESO Container objectVersion           : 13236

Version History

• 1.0, Initial community release

Links

• Download and follow at Github: https://github.com/Apoc70/Get-ExchangeServerVersionInfo
• Download and like at TechNet Gallery: https://gallery.technet.microsoft.com/Get-Exchange-Schema-73d3e629

Follow

• Twitter @stensitzki
• LinkedIn
• Xing

Enjoy Exchange Server!

You might have the requirement to authenticate mobile devices and authorize user access to on-premises Exchange Server mailboxes using a multi-vendor strategy. This blog post focuses on the configuration of a Kemp LoadMaster located in an internal network segment. The Kemp LoadMaster ESP functionality is used to allow ActiveSync connections for members of a dedicated security group only.

This results in the following authentication and authorization endpoints:

• MobileIron access policies
• Kemp LoadMaster ESP security group membership validation
• Exchange Server ActiveSync client access allowance 
• Exchange Server mobile device policy

Overview

The following diagram shows a simplified overview for mobile devices connecting to an on-premises Exchange Server. The perimeter and internal network segments are omitted for simplification reasons.

1. A MobileIron managed device connects to MobileIron Sentry which validates access with MobileIron policies
2. If a MobileIron policy allows access the device connects to Kemp LoadMaster ESP
3. Kemp LoadMaster ESP configuration validates the security group membership of the authenticating user
4. If the user is a member of the security group, the device connects to Exchange Server
5. Exchange Server authenticates the user and checks, if the ActiveSync protocol is enabled and the device complies with Exchange Server MDM configuration

Kemp LoadMaster Virtual Service

The following screenshots illustrate a working setup for a virtual service load balancing mobile device connections from MobileIron Sentry to Exchange Server. It's assumed that you've already configured the following:

• SSO Domain settings for connecting to a domain controller to authenticate users

SSL Properties

The SSL Traffic is offloaded and re-encrypted as we need to authenticate the user with ESP. Ensure to select a Cipher Set that does not provide any weak or unsecure cipher suites. In this example I've selected the predefined set BestPractices.

ESP Options

Enable ESP to activate the ESP configuration section. The settings are as follows:

• Client Authentication Mode: Basic Authentication
  Be aware that this setting requires that MobileIron users are provisioned using DOMAIN\SamAccountName notation and not the UPN Name
• SSO Domain: An existing SSO Domain configuration for user authentication
• Allowed Virtual Hosts: The FQDN matching the Load Master virtual service IP address accessed by MobileIron Sentry to connect to Exchange Server
• Allowed Virtual Directories: Can be limited to /Microsoft-Server-ActiveSync otherwise leave the default /*
• Permitted Groups: The name of the Active Directory security group containing the allowed users
• Server Authentication Mode: Basic Authentication

Real Servers

In the Real Servers section you add all member servers of your Exchange Server DAG. Ensure to use the HTTPS protocol the health checks and ensure to query the /Microsoft-Server-ActiveSync/healthcheck.htm document.

Using this configuration you've added your Kemp LoadMaster as an additional authentication endpoint to secure mobile device access to Exchange Server mailboxes.

Enjoy!

SharePoint Conference North America is just 4 weeks away! Now is a great time to register and make your plans to BE THERE in Las Vegas.

See the schedule, available now, with over 160 sessions to immerse yourself each day on what you need to know about SharePoint, OneDrive, Yammer, Microsoft Teams, and Office 365. Check out The Road to @SPConf, which reveals the inside scoop about SharePoint Conference North America and what you can expect with the return of the SharePoint community.

Register today | Don't miss the conference

Links

• SharePoint Conference North America - Schedule
• Register for SharePoint Conference North America

Description

When migrating to new version of Exchange Servers you must move your internal SMTP relay endpoints. This can be a challeging tasks as application owners mostly ignore your requests for such changes. 

You can use the information provided in the receive connector log files to identify remote clients (MTAs / MTUs) connecting to the legacy infrastructure. The assumption is that protocol logging is enabled. You can easily active protocol logging across all receive connector fo a single server using the following EMS PowerShell one-liner:

Get-ReceiveConnector -Server EX01 | Set-ReceiveConnector -ProtocolLoggingLevel Verbose

The scripts searches the log files for the connection's EHLO response which containes the remote name or remote IP-address of the system connecting to the receive connector.

You can either search

• Legacy Exchange Servers (aka Exchange Server 2010)
• Modern Exchane Servers 
  • Frontend Transport
    or
  • Backend Transport (aka Hub Transport)

For more information read the readme.md file at Github.

Note

You need to adjust the log file path to suit your IT infrastructure. A next releas will contain a more automatic solution.

Examples

# Search legacy Exchange servers SMTP receive log files for the last 4 days and save search results in a single CSV file

.\Get-RemoteSmtpServers.ps1 -Servers SRV01,SRV02 -LegacyExchange -AddDays -4 -ToCsv

Version History

• 1.0, Initial community release 
• 1.1, Fixed Issue #2

Links

• Download and follow at Github: https://github.com/Apoc70/Get-RemoteSmtpServers
• Download and like at TechNet Gallery: https://gallery.technet.microsoft.com/Fetch-remote-SMTP-servers-9e72f1a3

Follow

• Twitter @stensitzki
• LinkedIn
• Xing