Just can't get enough of IT

This blog is about mostly anything in IT. But the primary focuses are Microsoft Technologies like Exchange, Office 365, Azure and Cloud Security.
On February 8, 2017
0 Comment


Recently a colleague of mine found an interesting issue with an Exchange Server 2013 organization setup.

The local service desk personnel wasn't able to select a target organizational unit (OU) when creating new mailboxes. The ECP dialogue just showed an empty window.


By default the ECP OU picker result set contains 500 entries only.

The OU picker does not query the Active Directory with -ResultSize Unlimited.


Microsot Knowledge Base article 3038717 provides the solution for this issue.

When querying the local Active Directory for the overall number of organization units using the following command, it turned out that the Active Directory contained more than 4.000 OUs.

(Get-OrganizationUnit -ResultSize Unlimited).Count

Use this cmdlet to determine the current number of organization units and define a reasonable number for querying Active Directory.

Add a new key node to the ECP web.config file on each of your Exchange 2013 servers.

	<!-- Provisioning Cache identification -->
	<add key="ProvisioningCacheIdentification" value="Ecp" />
	<add key="AccountTerminationEnabled" value="false" />
	<!-- Enable legacy logout page. To enable new signoff page delete the entry. (3) -->
	<add key="LogonSettings.SignOutKind" value="LegacyLogOff" />
	<!-- Allow the OU picker for New-Mailbox to retrieve 5000 organization units from AD, default = 500 -->
	<add key="GetListDefaultResultSize" value="5000" />

The ECP web.config file is located in

  • $exinstall\ClientAccess\ecp

Saving a modified web.config normally triggers an application pool restart. If required, use the following one-liner to restart the ECP application pool across all Exchange 2013 servers.

Get-ExchangeServer | ? { $_.AdminDisplayVersion -like '*15.*'} | % { Invoke-Command -ComputerName $_.Name -ScriptBlock {Restart-WebAppPool MSExchangeECPAppPool } }


It has not yet been verified, if the issue is present with Exchange Server 2016 as well. If so, just let us know.


Keep enjoying the oddities of Exchange Server.





Read More »

Exchange Server 2013Exchange Server 2016Description

This script helps to create ceritifcate requests (CSR) based on hostnames used for internal and external Urls of Exchange Server virtual directories.

The script queries Exchange Server 2013+ virtual directory hostnames to create a certificate request.

The request is created using an inf file template. You can prepare multiple template files to choose from. Template files are supposed to be stored in the same folder as the PowerShell script.

The resulting inf file used to create the certificate request is stored on the same directory as the PowerShell script. The script queries for the certificate's common name (CN).

If created, the certificate request is stored in the same directory as the PowerShell script. The content of the certificate request file is the CSR to be submitted to a Certificate Authority.

INF Template file

Copy the following content to a text file, name it Default-Template.inf and save it to the same directory as the Create-CertificateRequest.ps1 file. Aternatively, download the template as a zipped archive file.

Signature="$Windows NT$"

Subject = "CN=##COMMONNAME##" 

Exportable = TRUE ; TRUE = Private key is exportable
KeyLength = 2048 ; Valid key sizes: 1024, 2048, 4096, 8192, 16384
KeySpec = 1 ; Key Exchange – Required for encryption
KeyUsage = 0xA0 ; Digital Signature, Key Encipherment
MachineKeySet = True
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
RequestType = PKCS10 ; or CMC.
HashAlgorithm = sha256


%szOID_SUBJECT_ALT_NAME2% = "{text}##DNSSAN##"


# Create a new certificate request inf file used dedicated organizational information. The common name will be determined seperately.
.\Create-CertificateRequest.ps1 -ModernExchangeOnly -Country DE -State NW -City Hueckelhoven -Organisation Varuna -Department IT

# Create a new certificate request for Exchange 2013+ using the common name only. The common name will be determined seperately.
.\Create-CertificateRequest.ps1 -ModernExchangeOnly -CreateRequest

Version History

  • 1.0, Initial community release




Read More »


The Skype for Business client merges contact data from different sources when displaying the contact card. The merged data is used to perform name resolution when performing a user search. In a more complex deployment scenario where an email domain name is in shared use in two in Active Directory forests you might run into a situation where the Skype for Business client tries to use the wrong target address.

Such a scenario would look like as follows.

Forest A is used as a dedicated infrastructure for developers. When logged on to the development network the users should be able to skype with colleagues currently connected to the default office client network.

Forest B is the default office client network.

Clients logged on to forest A connect to the Skype for Business infrastructure in forest B as external clients. Forest A is used for user account authentication while forest B is used for Skype for Business connection and authentication. 

Forest A

Forest A runs an Exchange Server 2013 organization.

  • Active Directory domain:
  • SMTP domains:,

Forest B

Forest B runs an Exchange Server 2013 organization and a full Skype for Business 2015 server deployment.

  • Active Directory domains:
    • root.internal - Forest root, resource domain with Skype for Business 2015, Exchange 2013
    • - user domain, primary email domain
  • SMTP domain:

Both Active Directory forests to not have trust of any sort established.

Such a configuration would result in forest A users trying to contact a Skype for Business user using the wrong address. Instead of using the Skype for Business client of Jane (logged on to forest A) would try to contact As there is no endpoint defined for a connection could not be established. Therefore, no availability information is available and no call or chat connection could be established.


The Skype for Business client uses merged data pulled from the Skype for Business address and from the local (Forest A) Active Directory (GAL). This results in a connection attempt to

Forest A object attributes

  • proxyAddresses:
  • proxyAddresses:
  • msExchShadowProxyAddresses:
  • msExchShadowProxyAddresses:
  • msExchShadowProxyAddresses:
  • msRTCSIP-UserEnabled: TRUE
  • msRTCSIP-PrimaryUserAddress:

Forest B object attributes

  • proxyAddresses:
  • proxyAddresses:
  • msRTCSP-InternetAccessEnabled: TRUE
  • msRTCSIP-UserEnabled: TRUE
  • msRTCSIP-PrimaryUserAddress:


  • Create a new text file named ocapi_test.config.xml using notepad
  • Add the following Xml text
<?xml version="1.0"?> 
  • Save the file in same directory as Lync.exe
  • Terminate the Skype for Business client
  • Delete all files from the users SIP folder
    • e.g. C:\Users\JDOE\AppData\Local\Microsoft\Office\16.0\Lync\
  • Restart the Skype for Business client


Enjoy Skype for Business





Read More »

Exchange Server 2007Exchange Server 2010Exchange Server 2013Exchange Server 2016Description

The script gathers a lot of Exchange organizational configuration data for documentation purposes.

The data is stored in separate log files. The log files are stored in a separate subfolder located under the script directory.

An exisiting subfolder will be deleted automatically.

Optionally, the log files can automatically be zipped. The zipped archive can be sent by email as an attachment.


When the script runs, a progress bar informs about the current step being executed.

Script progress bar

All files are stored in a dedicated subfolder (default name: ExchangeOrgInfo)

Example of exported files

The hash table $infoSources defines the following

  • Types of Exchange configuration data to be gathered
  • Output type for each configuration data entity
  • Optional paramaters for each configuration data entity
  • Attribute name for object sorting within an entity
  • The order of the data to be gathered (long running tasks are at the end)



# Gather all data using MYCOMPANY as a prefix
.\Get-ExchangeOrganizationDetails.ps1 -Prefix MYCOMPANY

# Gather all data using MYCOMPANY as a prefix and save all files as a compressed archive
.\Get-ExchangeOrganizationDetails.ps1 -Prefix MYCOMPANY -Zip

Version History

  • 1.0, Initial community release
  • 1.1, Updated and some PowerShell hygiene






Read More »
On January 11, 2017
0 Comment

Exchange Server 2013 Exchange Server 2016When you delete a mailbox or an Active Directory account, the soft-deleted or disconnected mailbox won't show up in the list of disconnected mailboxes immediately. The mailbox status is updated as part of a mailbox store maintenance task.

When you query a mailbox database for disconnected mailboxes you will find a mailbox having the DisconnectReason and DisconnectDate attribute empty.

# Query the mailbox using the original user display name 
Get-MailboxDatabase | Get-MailboxStatistics | Where { $_.DisplayName -eq "LASTNAME, FIRSTNAME" } | fl DisconnectReason,DisconnectDate,MailboxGuid,Database
# Use wildcards if the correct display name is unknown 
Get-MailboxDatabase | Get-MailboxStatistics | Where { $_.DisplayName -like "*LASTNAME*" } | fl DisconnectReason,DisconnectDate,MailboxGuid,Database
DisconnectReason :
DisconnectDate   :
MailboxGuid      : a04a8aab-c360-406b-a194-8c290d56668b
Database         : MBXDB34

You can find disonnected mailboxes by

  • DisplayName
  • MailboxGuid
  • LegacyExchangeDN


The following PowerShell cmdlet updates the mailbox state of a single mailbox using the MailboxGuid as an identifier.

Update-StoreMailboxState -Database MBXDB34 -Identity a04a8aab-c360-406b-a194-8c290d56668b


After updating the mailbox state the DisconnectReason and DisconnectDate attributes are properly set.

Get-MailboxDatabase | Get-MailboxStatistics | Where { $_.DisplayName -eq "LASTNAME, FIRSTNAME" } | fl DisconnectReason,DisconnectDate,MailboxGuid,Database
DisconnectReason : Disabled
DisconnectDate   : 01.01.2017 15:02:59
MailboxGuid      : a04a8aab-c360-406b-a194-8c290d56668b
Database         : MBXDB34


The disconnected mailbox is now visible in Exchange Administrative Center (EAC) and can be reconnected using EAC or Exchange Management Shell.

By default a disconnected mailbox is supposed to be connected it's original account having a matching LegacyExchangeDN attribute. Connecting the mailbox to a different Active Directory account requires the use of the AllowLegacyDNMismatch parameter.

# Connect a mailbox to the original AD account having a matching LegacyExchangeDN
Connect-Mailbox -Database MBXDB34 -Identity "Doe, John"

# Connect a mailbox to a different AD account 
Connect-Mailbox -Database MBXDB34 -Identity "Doe, John" -User "Jane Doe" -AllowLegacyDNMismatch

Examples for room and shared mailboxes are described in the Connect-Mailbox documentation.





Read More »