Just can't get enough of IT

Description

The script can be used to assign an application account (e.g. CRM, ERP) send-as permission to user mailboxes to send emails AS the user and not as the application.

This script loops through a membership list of an Active Directory security group. A single mailbox (CRM/ERP service account mailbox) is added to each mailbox (CRM/ERP user mailbox) of the security group members to provide send-as permission. 

The script has been developed as a solution to enable proper functionality with Dynamics NAV 2016.

Examples

# Assign Send-As permission to crmapplication@varunagroup.de for all members 
# of 'CRM-FrontLine' security group. The mailboxes as hosted On-Premises!
    
.\Set-SendAsPermission.ps1 -SendAsGroup 'CRM-FrontLine' -SendAsUserUpn 'crmapplication@varunagroup.de'

# Assign Send-As permission to ax@granikoslabs.eu for all members of 'AX-Sales' 
# security group. All mailboxes are hosted in Exchange Online!
    
.\Set-SendAsPermission.ps1 -SendAsGroup 'AX-Sales' -SendAsUserUpn 'ax@granikoslabs.eu' -ExchangeOnline

Requirements

• Exchange Server 2016 or newer
• Exchange Online PowerShell connection
• Exchange Online PowerShell Module to connect w/ MFA  
• Utilizes GlobalFunctions PowerShell Module

Version History

• 1.0, Initial community release

Links

• Download and follow at Github: https://github.com/Apoc70/Set-SendAsPermission

Follow

• Twitter @stensitzki
• LinkedIn
• Xing

The Excel workbook Public-Folder-Migration-Actionplan-EN.xlsx spreadsheet is supposed to support you during a migration of Legacy Public Folders (Exchange Server 2010) to Modern Public Folders in Exchange Online.

The workbook consists of three spreadsheets:

• Overview
  The spreadsheet "Overview" is used to define the names of the source and target platform. Additionally, you can define the names of the persons or groups responsible for the on-premises and cloud infrastructure. Those names are used in the second spreadsheet. You can define a start date for the migration project. There is no additonal calculation taking place. The date is just referenced in the second spreadsheet. It's up to your creativity to add automatic calculations. Finally, a summary for each available task status (Open, In Progress, Finished) is provided.
   
• Public Folder Migration
  The spreadsheet "Public Folder Migration" contains the top down action plan for migration Legacy Public Folders to Modern Public Folders in Exchange Online. The required tasks are grouped and each task can be assigned and the status can be tracked. 
   
• Lookup
  This spreadsheet is used to provided the task status lookup values.

If you encounter any issues while preparing for migration or during migration of public folder, I recommend to check the Exchange Server Techcommunity Forum.

Links

• Current Release of the Action Plan DE/EN
• GitHub Repository 
• Techcommunity Forum Exchange Server

Enjoy Exchange Public Folders!

Problem

You have an Exchange Server 2016 organization and plan to upgrade to Cumulative Update 10. You log on to an  Exchange Server, activate DAG maintenance and prepare the Server Component States for installing the new Cumulative Update. 

You open an elevated PowerShell Session and start the Setup using

./Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms

Out of a sudden the Exchange Server CU Setup fails while executing setup step Stopping Services with an error:

Microsoft Exchange Server 2016 Cumulative Update 10 Unattended Setup

Copying Files...
File copy complete. Setup will now collect additional information needed for installation.

Languages
Management tools
Mailbox role: Transport service
Mailbox role: Client Access service
Mailbox role: Unified Messaging service
Mailbox role: Mailbox service
Mailbox role: Front End Transport service
Mailbox role: Client Access Front End service

Performing Microsoft Exchange Server Prerequisite Check

    Configuring Prerequisites                                                                         COMPLETED
    Prerequisite Analysis                                                                             COMPLETED

Configuring Microsoft Exchange Server

    Preparing Setup                                                                                   COMPLETED
    Stopping Services                                                                                 FAILED

The following error was generated when "$error.Clear();
 & $RoleBinPath\ServiceControl.ps1 -Operation:DisableServices
-Roles:($RoleRoles.Replace('Role','').Split(',')) -SetupScriptsDirectory:$RoleBinPath; &
$RoleBinPath\ServiceControl.ps1 -Operation:Stop -Roles:($RoleRoles.Replace('Role','').Split(','))
-IsDatacenter:([bool]$RoleIsDatacenter)
 " was run: "Microsoft.PowerShell.Commands.ProcessCommandException: Cannot stop
process "fms (2496)" because of the following error: Access is denied ---> System.ComponentModel.Win32Exception: Access
is denied
 at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited)
 at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited)
 at System.Diagnostics.Process.get_HasExited()
 at Microsoft.PowerShell.Commands.StopProcessCommand.ProcessRecord()
 ---
End of inner exception stack trace ---".

The Exchange Server setup operation didn't complete. More details can be found in ExchangeSetup.log located in the
<SystemDrive>:\ExchangeSetupLogs folder.

Why would an error like Access Denied happen while executing the Setup.exe as a member of the local Administrators security group from within an elevated PowerShell session?

Issue

The PowerShell code executed as part of the CU Setup sets the startup type of Exchange and some Windows services to Disabled. This ensures that in the case of a server reboot an automatic start of the service will not interfere partially executed the setup. After setting the startup type to Disabled the services are stopped. 

The services are controlled by the ServiceControl.ps1 script which is located on the Exchange Server installation media in \Setup\ServerRoles\Common\.

The function StopServices stops services using the Stop-Service cmdlet. Due to some timing issues some services are stopped by killing the running processes using Stop-Process -Force.

The services stopped by stopping the running process are:

• FMS
• MSExchangeServiceHost
• MSExchangeTransport
• MSExchangeInferenceService
• MSExchangeDagMgmt

Executing the Stop-Process cmdlet results in the Access Denied error.

Solution

The issue is related to fact that the user account logged on the server and executing the Exchange Server Cumulatice Update does not have the local User Rights Assignment to Debug Programs.

By default the right to debug programs is assigned to the local Adminstrators security group. In secured Active Directory infrastructures the user rights assignments and local security groups are often managed using Group Policy Objects (GPO). The GPOs manage the names of local security groups, group memberships and even user rights assignments.

• To avoid the error described above you must ensure that the group of Exchange Administrators that install Exchange Server Cumulative Updates has the user rights assignment to debug programs.

The client encountering the issue described above hasn't had any issues installing Cumulative Updates for Exchange Server 2013 in the past. So this is solution is related to the setup of Exchange Server 2016 Cumulative Updates on Windows Server 2016 only. If you have any information regarding Exchange Server 2013, let me know using the comments section below.

Enjoy Exchange Server!

It happend again.

A new .Net Framework version has been released via the Windows Update distribution channel and the Exchange Server Team has decided to skip support for the new release.

You're only option is to block the automatic installation by the local Windows Update Agent using a registry.

The follow BlockNetFramework472.reg file simplifies setting the registry key.

Links

• Do Not Install .NET Framework 4.7.2 on Exchange Servers
• How to temporarily block the installation of .NET Framework 4.7.2

As always... Enjoy Exchange Server

The PowerShell script New-RoomMailbox has been updated and release v1.2 has been published to GitHub and TechNet Gallery.

The script now creates a third mail-enabled security group to limit the set of users which are allowed to book the resource. The group itself is created (prepared) only, but not assigned to the room resource.

Additionally, the default language (locale) is configured. This prohibits the "Set locale" - dialogue when accessing the room mailbox using Outlook on the Web. 

Read more here: https://www.granikos.eu/en/justcantgetenough/PostId/337/create-a-new-room-mailbox-with-security-groups

Enjoy Exchange.