Just can't get enough of IT

You might have the requirement to authenticate mobile devices and authorize user access to on-premises Exchange Server mailboxes using a multi-vendor strategy. This blog post focuses on the configuration of a Kemp LoadMaster located in an internal network segment. The Kemp LoadMaster ESP functionality is used to allow ActiveSync connections for members of a dedicated security group only.

This results in the following authentication and authorization endpoints:

• MobileIron access policies
• Kemp LoadMaster ESP security group membership validation
• Exchange Server ActiveSync client access allowance 
• Exchange Server mobile device policy

Overview

The following diagram shows a simplified overview for mobile devices connecting to an on-premises Exchange Server. The perimeter and internal network segments are omitted for simplification reasons.

1. A MobileIron managed device connects to MobileIron Sentry which validates access with MobileIron policies
2. If a MobileIron policy allows access the device connects to Kemp LoadMaster ESP
3. Kemp LoadMaster ESP configuration validates the security group membership of the authenticating user
4. If the user is a member of the security group, the device connects to Exchange Server
5. Exchange Server authenticates the user and checks, if the ActiveSync protocol is enabled and the device complies with Exchange Server MDM configuration

Kemp LoadMaster Virtual Service

The following screenshots illustrate a working setup for a virtual service load balancing mobile device connections from MobileIron Sentry to Exchange Server. It's assumed that you've already configured the following:

• SSO Domain settings for connecting to a domain controller to authenticate users

SSL Properties

The SSL Traffic is offloaded and re-encrypted as we need to authenticate the user with ESP. Ensure to select a Cipher Set that does not provide any weak or unsecure cipher suites. In this example I've selected the predefined set BestPractices.

ESP Options

Enable ESP to activate the ESP configuration section. The settings are as follows:

• Client Authentication Mode: Basic Authentication
  Be aware that this setting requires that MobileIron users are provisioned using DOMAIN\SamAccountName notation and not the UPN Name
• SSO Domain: An existing SSO Domain configuration for user authentication
• Allowed Virtual Hosts: The FQDN matching the Load Master virtual service IP address accessed by MobileIron Sentry to connect to Exchange Server
• Allowed Virtual Directories: Can be limited to /Microsoft-Server-ActiveSync otherwise leave the default /*
• Permitted Groups: The name of the Active Directory security group containing the allowed users
• Server Authentication Mode: Basic Authentication

Real Servers

In the Real Servers section you add all member servers of your Exchange Server DAG. Ensure to use the HTTPS protocol the health checks and ensure to query the /Microsoft-Server-ActiveSync/healthcheck.htm document.

Using this configuration you've added your Kemp LoadMaster as an additional authentication endpoint to secure mobile device access to Exchange Server mailboxes.

Enjoy!

Starting September 11th 2017 Microsoft Teams supports guest access for external users. 

Guest access for Microsoft Teams uses a separate guest license type that must be activated in the services & add-ons section of the Office 365 Admin portal. 

Office 365 Admin portal notification:

When we make this change, the ‘Pick the license you want to configure’ setting in ‘Settings > Services and Add-ins > Microsoft Teams’, will now have an option for ‘Guest’ with a default value of “off” for the ‘Turn Microsoft Teams on or off for your entire organization’ setting.

When you've not activated guest licenses, external user receive an odd error when trying to access your shared team.

Link

• Expand your collaboration with guest access in Microsoft Teams

Enjoy Office 365!

Description

This script removes Active Directory objects for HealthMailboxes or SystemMailboxes in the Microsoft Exchange System Objects (MESO) container that do not have a homeMDB attribute set.

It is highly recommended to run the script with -WhatIf parameter to check objects first.

Information about accounts deleted or supposed to be deleted are written to a log file.

Requirements

• This script utilizes the GlobalFunctions PowerShell module. This module needs to be installed first.
  Read more here: https://www.granikos.eu/en/justcantgetenough/PostId/210/globalfunctions-shared-powershell-library
• Delete permission to MESO container objects in Active Directory

Examples

# EXAMPLE 
# Perform a WhatIf run in preparation to removing SystemMailboxes having an empty database attribute
.\Remove-OrphanedMailboxAccounts.ps1 -SystemMailbox -WhatIf
    
# EXAMPLE 
# Remove HealthMailbox(es) having an empty database attribute
.\Remove-OrphanedMailboxAccounts.ps1 -HealthMailbox

Example log file

2017-02-10 10:18: 11488      - Info     - Script started
2017-02-10 10:18: 11488      - Info     - WhatIf Preference: True
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | 10 objects found
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailboxd32b165a6adf45518c8498fba3c7c93a,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailbox6b66930902d8430e831df7b086bfd49b,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailbox6bf99bdc31474217a6fdc4cd83260e88,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailboxd4410bf131b34907b6a96a7e65263db1,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailbox98f334580dbf457ca2a6d1a19fdf49d1,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailboxc16704bf98c94f5e8453c7955d7897b5,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailboxa64fe085bdff46a786d68782c5070bf1,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailbox6c56f94506974a1183c6b71eebb63406,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailbox9b6666d46aa746e3848f3240e418d731,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Cleaning HealthMailboxes | Delete CN=HealthMailboxb2bd3d4725b249bab81eeed35666de0f,CN=Monitoring Mailboxes,CN=Microsoft Exchange System Objects,DC=granikoslabs,DC=de
2017-02-10 10:18: 11488      - Info     - Script finished

Version History

• 1.0, Initial community release

Links

• Download and follow at Github: https://github.com/Apoc70/Remove-OrphanedMailboxAccounts
• Download and like at TechNet Gallery: https://gallery.technet.microsoft.com/Remove-orphaned-HealthMailb-9f33ccbe

Follow

• Twitter @stensitzki
• LinkedIn
• Xing

The following PowerShell snippet helps to create room lists for the Room Finder functionality in Outlook or Outllok on the Web.

This snippet creates a new room list named All Video Conference Rooms. The display name is shown in the Room Finder combo box. The room list members are a mixture of physical rooms (where you actually go to) and virtual rooms which you just dial into.

# General Properties
$DisplayName = 'All Video Conference Rooms'
$Name = 'DEP_IT_AllVideoConfRooms'
$Alias = 'IT_AllVideoConfRooms'
$Notes = 'Room List for Outlook Roomfinder | All Video Conference Rooms'
$OU = 'MCSMLABS.de/Exchange/Groups/RoomLists'
$EmailAddress = 'ITAllVideoConfRooms@mcsmemail.de'

# Romm List Members 
$Members = @('Conference Room 1','Conference Rooms 2','Virtual Dial-In Room 4711')
 
# Create Distribution Group as Room List 
New-DistributionGroup -DisplayName $DisplayName -Name $Name -Alias $Alias -Notes $Notes -Type Distribution -OrganizationalUnit $OU -PrimarySmtpAddress $EmailAddress -Members $Members -RoomList

Use this snippet to start developing your own Exchange PowerShall code for creating and managing rooms and room lists.

If you want to create new rooms and security groups for managing full-access and send-as permissions, use my PowerShell script Create a new Room Mailbox with Security Groups.

Enjoy Exchange!

Description

This script removes/disables HealthMailboxes that show an inconsistent error when querying monitoring mailboxes using

Get-Mailbox -Monitoring

and receiving a warning like

"WARNING: The object DOMAINNAME/Microsoft Exchange System Objects/Monitoring Mailboxes/Health_Mailbox_GUID has been corrupted,

Examples

# Remove the HealthMailbox(es) having an empty database attribute

.\Fix-HealthMailboxes.ps1 -Remove   

Version History

• 1.0, Initial community release
• 1.1, Some PowerShell hygiene

Links

• Download and follow at Github: https://github.com/Apoc70/Fix-HealthMailboxes
• Download and like at TechNet Gallery: https://gallery.technet.microsoft.com/Find-and-remove-corrupt-42c8bfc2

Follow

• Twitter @stensitzki
• LinkedIn
• Xing

Michael Hall of MCS has published on excellent Excel tool to simplify the migration of on-premise Exchange mailboxes to Office 365.

The script does support not special characters in display names as it is intended to work with ASCII files.

The textfile type used by Excel VBA code has been changed from 437 to 65001.

When you want to use the attached Excel file you are required to create an UTF-8 export when collecting mailbox data. The required PowerShell code is as follows:

$mbx=Get-Mailbox -resultsize unlimited; $mbx | foreach-object {$UPN = $_.UserPrincipalName; $EmailAddress = $_.PrimarySmtpAddress;$OU = $_.OrganizationalUnit; $Type = $_.RecipientTypeDetails; $_ | Get-MailboxStatistics | select @{Name="UPN";expression={$UPN}},@{Name="EmailAddress";expression={$EmailAddress}},@{Name="Type";expression={$Type}},@{Name="OU";expression={$OU}},DisplayName,@{Name="TotalItemSize(MB)";expression={$_.TotalItemSize.Value.ToMB()}},LastLogonTime}|Export-csv .\Mailboxes_Output.csv -notype	-Encoding UTF8

Then just follow the instructions provided in Michaels blog post.

Links

• Original Blog Post
• TechNet Gallery Post
• Modified Excel Spreadsheet at Github

Download

• Office365_Hybrid_Migration_Management_1.2 - UTF8.zip

Unsure, if you should migrate to Office 365? You want to know more about security of cloud applications and services? Your Exchange Server infrastructure requires an upgrade? Contact me via email: thomas@mcsmemail.de