de-DEen-GB
 
MVP - Most Valuable Professional
rss

Just can't get enough of IT

This blog is about mostly anything in IT. But the primary focuses are Microsoft Technologies like Exchange, Office 365, Azure and Cloud Security.

Problem

You have an Exchange Server 2016 organization and plan to upgrade to Cumulative Update 10. You log on to an  Exchange Server, activate DAG maintenance and prepare the Server Component States for installing the new Cumulative Update. 

You open an elevated PowerShell Session and start the Setup using

./Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms

Out of a sudden the Exchange Server CU Setup fails while executing setup step Stopping Services with an error:

Microsoft Exchange Server 2016 Cumulative Update 10 Unattended Setup

Copying Files...
File copy complete. Setup will now collect additional information needed for installation.

Languages
Management tools
Mailbox role: Transport service
Mailbox role: Client Access service
Mailbox role: Unified Messaging service
Mailbox role: Mailbox service
Mailbox role: Front End Transport service
Mailbox role: Client Access Front End service

Performing Microsoft Exchange Server Prerequisite Check

    Configuring Prerequisites                                                                         COMPLETED
    Prerequisite Analysis                                                                             COMPLETED

Configuring Microsoft Exchange Server

    Preparing Setup                                                                                   COMPLETED
    Stopping Services                                                                                 FAILED

The following error was generated when "$error.Clear();
 & $RoleBinPath\ServiceControl.ps1 -Operation:DisableServices
-Roles:($RoleRoles.Replace('Role','').Split(',')) -SetupScriptsDirectory:$RoleBinPath; &
$RoleBinPath\ServiceControl.ps1 -Operation:Stop -Roles:($RoleRoles.Replace('Role','').Split(','))
-IsDatacenter:([bool]$RoleIsDatacenter)
 " was run: "Microsoft.PowerShell.Commands.ProcessCommandException: Cannot stop
process "fms (2496)" because of the following error: Access is denied ---> System.ComponentModel.Win32Exception: Access
is denied
 at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited)
 at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited)
 at System.Diagnostics.Process.get_HasExited()
 at Microsoft.PowerShell.Commands.StopProcessCommand.ProcessRecord()
 ---
End of inner exception stack trace ---".

The Exchange Server setup operation didn't complete. More details can be found in ExchangeSetup.log located in the
<SystemDrive>:\ExchangeSetupLogs folder.

Why would an error like Access Denied happen while executing the Setup.exe as a member of the local Administrators security group from within an elevated PowerShell session?

 

Issue

The PowerShell code executed as part of the CU Setup sets the startup type of Exchange and some Windows services to Disabled. This ensures that in the case of a server reboot an automatic start of the service will not interfere partially executed the setup. After setting the startup type to Disabled the services are stopped. 

The services are controlled by the ServiceControl.ps1 script which is located on the Exchange Server installation media in \Setup\ServerRoles\Common\.

The function StopServices stops services using the Stop-Service cmdlet. Due to some timing issues some services are stopped by killing the running processes using Stop-Process -Force.

The services stopped by stopping the running process are:

  • FMS
  • MSExchangeServiceHost
  • MSExchangeTransport
  • MSExchangeInferenceService
  • MSExchangeDagMgmt

Executing the Stop-Process cmdlet results in the Access Denied error.

Solution

The issue is related to fact that the user account logged on the server and executing the Exchange Server Cumulatice Update does not have the local User Rights Assignment to Debug Programs.

By default the right to debug programs is assigned to the local Adminstrators security group. In secured Active Directory infrastructures the user rights assignments and local security groups are often managed using Group Policy Objects (GPO). The GPOs manage the names of local security groups, group memberships and even user rights assignments.

  • To avoid the error described above you must ensure that the group of Exchange Administrators that install Exchange Server Cumulative Updates has the user rights assignment to debug programs.

The client encountering the issue described above hasn't had any issues installing Cumulative Updates for Exchange Server 2013 in the past. So this is solution is related to the setup of Exchange Server 2016 Cumulative Updates on Windows Server 2016 only. If you have any information regarding Exchange Server 2013, let me know using the comments section below.

 

Enjoy Exchange Server!

 

Read More »

It happend again.

A new .Net Framework version has been released via the Windows Update distribution channel and the Exchange Server Team has decided to skip support for the new release.

You're only option is to block the automatic installation by the local Windows Update Agent using a registry.

The follow BlockNetFramework472.reg file simplifies setting the registry key.

 

Links

As always... Enjoy Exchange Server

Read More »

Exchange Server 2013Exchange Server 2016The PowerShell script New-RoomMailbox has been updated and release v1.2 has been published to GitHub and TechNet Gallery.

The script now creates a third mail-enabled security group to limit the set of users which are allowed to book the resource. The group itself is created (prepared) only, but not assigned to the room resource.

Additionally, the default language (locale) is configured. This prohibits the "Set locale" - dialogue when accessing the room mailbox using Outlook on the Web. 

Read more here: https://www.granikos.eu/en/justcantgetenough/PostId/337/create-a-new-room-mailbox-with-security-groups

Enjoy Exchange.

Read More »

Exchange Server 2007Exchange Server 2010Description

The Category List Manager is a C# Visual Studio Solution that allows you to connect to a source mailbox which is either hosted on an on-premises Exchange Server or in Exchange Online using Exchange Web Services (EWS).

You can use AutoDiscover or a static Url to connect to the Exchange Server or Office 365. By default the solution uses the credentials of the user executing the program. These credentials are referred to as default credentials. You can use the Settings form to set dedicated credentials of an user with appropriate access rights to the mailbox(es).

Diagram of the Master Category List Manager

The program helps you to

  • Export the master category list from a mailbox to a Xml file
  • Import a master category list Xml file to into a mailbox
  • Copy a master category list from a source mailbox to a target mailbox

The supported target mailbox types are:

  • User Mailbox
  • Shared Mailbox
  • Microsoft Teams Mailbox

The GUI comes with an easy-to-use UI. The execuable works a command line tool as well and can be used for automation purposes.

Use CategoryManager.exe -help to get the most recent command line help information.

 

Example Screenshot

Master Category List Manager - Example Screenshot

 

Presentation

Watch the presentation held at the Exchange User Group Berlin Meetup on May 31st 2018.

 

Version History

  • 1.0, Initial community release

 

Links

 

Additional Credits

Additional credits go to Henning Krause

 

Follow

 

 

Read More »

Exchange Server extends the Active Directory schema during the PrepareSchema step during setup. The steps PrepareAD, PrepareDomain, or PrepareAlLDomains create Active Directory containers and objects that are crucially important for a stable operation of Exchange Server.

There are different Active Directory objects that are used to determine, if Active Directory has a proper Exchange Server configuration up and running.

Forest level

At Active Directory forest level the following attributes are used to determine the Exchange Server release:

  • rangeUpper attribute of the ms-Exch-Schema-Version-Pt schema object 
  • msExchProductId attribute of the Exchange organization object in the configuration partition
  • objectVersion attribute of the Exchange organization object in the configuration partition
  • objectVersion of the Microsoft Exchange System Objects (MESO) container 

Domain level

At Active Directory domain level the following attribute is used to determine the Exchange Server release:

  • objectVersion of the Microsoft Exchange System Objects (MESO) container 

 

I have written a PowerShell script to fetch all required information for all domains in an Active Directory forest. The script simplifies the process of gathering the data.
Read more about the script here.

 

Schema versions

Exchange

Forest (rangeUpper)

Forest (objectVersion)

Domain (objectVersion)

Exchange Server 2000

2000 RTM

4397

N/A

4406

2000 SP3

4406

N/A

4406

Exchange Server 2003

2003 RTM

6870

6903

6936

2003 SP2

6870

6903

6936

Exchange Server 2007

2007 RTM

10637

10666

10628

2007 SP1

11116

11221

11221

2007 SP2

14622

11222

11221

2007 SP3

14625

11222

11221

Exchange Server 2010

2010 RTM

14622

12640

12639

2010 SP1

14726

13214

13040

2010 SP2

14732

14247

13040

2010 SP3

14734

14322

13040

Exchange Server 2013

2013 RTM

15137

15449

13236

2013 CU1

15254

15614

13236

2013 CU2

15281

15688

13236

2013 CU3

15283

15763

13236

2013 SP1

15292

15844

13236

2013 CU5

15300

15870

13236

2013 CU6

15303

15965

13236

2013 CU7-CU9*

15312

15965

13236

2013 CU10-CU20*

15312

16130

13236

Exchange Server 2016

2016 Preview

15317

16041

13236

2016 RTM

15317

16210

13236

2016 CU1

15323

16211

13236

2016 CU2

15325

16212

13236

2016 CU3

15326

16212

13236

2016 CU4-CU5*

15326

16213

13236

2016 CU6

15330

16213

13236

2016 CU7-CU9*

15332

16213

13236

 

*Note
It is recommended to always run the Active Directory preparation using Setup.exe /PrepareAD before applying an new cumulative update. Even though that the schema version might not have changed from the previous version preparing Active Directory applies any updates or changes to the default RBAC configuration.

 

Links

 

Enjoy Exchange Server!

Read More »