Guidance, Tuning and Known Issues for the Exchange 2010 Management Pack for System Center Operations Manager 2007

Guidance, Tuning and Known Issues for the Exchange 2010 Management Pack for System Center Operations Manager 2007: This article is intended to give some best practice guidance along with workarounds to known issues involving the Exchange 2010 Management Pack (MP) running on System Center Operations Manager 2007 (SCOM). Please look through this document before calling for support or posting to the forums as the issue may be covered below. If you find that these issues are particularly troublesome or find additional issues that you want fixed please call into Microsoft Support and raise a Request For Hotfix with the Exchange group.

Finding Users Who Have Send-As or Full Access Permissions to Mailboxes

From Pat Richards' blog... How to find users who have Send-As or FullAccess rights to other users' mailboxes, via PowerShell

http://www.ucblogs.net/blogs/exchange/archive/2011/08/15/one-liners_3A00_-Finding-users-who-have-Send_2D00_As-or-Full-Access-permissions-to-mailboxes.aspx

How To Retrieve or Set Maximum Send/Receive Size For Mail Contacts

Set the maximum message size for a specific mail contact or group of mail contacts

Get-MailContact -resultsize unlimited | where {$_.externalemailaddress -like "SMTP:CAN????@stores.pvt"} | Set-MailContact -MaxReceiveSize 65KB -MaxSendSize 65KB -ForceUpgrade

Retrieve specific mail contacts and report on their maximum send and receive message size 

Get-MailContact -resultsize unlimited | where {$_.externalemailaddress -like "SMTP:CAN????@stores.pvt"} | ft name, externalemailaddress, maxsendsize, maxreceivesize

Exchange 2010 Site Resilient DAGs and Majority Node Set Clustering – Part 1

Exchange 2010 Site Resilient DAGs and Majority Node Set Clustering – Part 1

Which Mailboxes Don't Have a ManagedFolderMailboxPolicy

Get-DistributionGroupMember "Email Archiving Group" | Get-Mailbox | where {$_.ManagedFolderMailboxPolicy -eq $null}

This how I monitor for mailboxes that have not been prepared properly for Enterprise Vault. The "Email Archiving Group" is used by EV for provisioning.

Interim Update notes

I installed the Exchange Server 2010 Service Pack 1 Update Rollup 4 Interim Update (KB2575734) this afternoon on all of our Exchange 2010 servers, and I have a couple of thoughts to share.

Regarding ANY Exchange patching:

• Our Exchange 2010 servers are running the Microsoft Forefront Protection for Exchange anti-virus software. This software integrates with Exchange and creates dependencies with the Transport and Information Store services. You MUST disable Forefront prior to installing ANY Exchange patches, so it won’t interfere with the patch installer’s ability to stop or start Exchange services as needed, and then re-enable Forefront after patching. Run the FSCUTILITY command line utility with either the “/disable” or “/enable” switch to perform those tasks. That command will remove/restore the service dependencies. 

Regarding the interim update:

• This Interim Update fixes a bug that was recently discovered in Exchange Server 2010 SP1 Update Rollup 4 (http://blogs.technet.com/b/exchange/archive/2011/07/13/exchange-2010-sp1-ru4-removed-from-download-center.aspx), which can cause subfolders and messages to disappear when a folder is copied from one location to another within the Outlook client (all versions). The bug does not affect OWA or ActiveSync clients. The deleted files can be recovered from the dumpster, but most Outlook clients do not have the dumpster enabled for any folder except the Deleted Items folder.
• This Interim Update can only be applied to the same Exchange Server 2010 version and/or Rollup target for which it was intended.
• Only one Interim Update can be run on a server at a time. You must remove any other Exchange Server 2010 Interim Update before installing this Interim Update. If you require multiple Interim Update fixes, these Interim Update fixes must be in a single Interim Update package and need to be requested.
• The Strong Name tool (sn.exe) must be present to configure the system to skip strong name verification before installing the Interim Update package.
• Strong named signing verification must not be enabled if an Interim Update is present on the server or some services may crash on startup.
• This Interim Update package must be removed before installing any Exchange Server 2010 official rollup or alternate IU release.

Steps to apply the Interim Update:

1.            Run sn.exe -Vr * to disable strong name verification.

2.            Run sn.exe -Vl to verify that strong name verification is disabled.

3.            Run the MSP file to install the Interim Update on the system.

Steps to remove the Interim Update (these steps will not occur until the next update rollup or service pack is ready to be installed):

1.            Uninstall Interim Update for Exchange Server 2010 (KB2575734) from Add/Remove programs.

2.            Run sn.exe -Vu * to enable strong name verification.

3.            Run sn.exe –Vl to verify that strong name verification is enabled.

Mailflow Cutover to Exchange 2010 SP1 (take 1)

Things were looking good. We started the change at 5pm. Out network guy modified the mail flow on the load balancers, then we tested OWA and ActiveSync pointing to both the 2007 and 2010 servers. Modified the external URLs on all the servers and CAS services, swapping the "owa" and "legacy" names as needed. Ran into a strange problem with proxying to our remote sites, but my consultant quickly located an article describing the fix, which worked like a charm. Everything seemed to be working as expected, so we called it a night.

Unrelated to the change, I was awakened at 4am because internet mail had stopped working. First thing I checked was the Forefront services, and found them stopped. Couldn't restart them because the WinHTTP Autodiscover service is disabled. On both servers. Set the startup to Manual, then restarted the Transport service, which brought up everything agin, restoring mail flow.


By the time I got into the office at 7am, reports had started trickling in, complaints that some phones weren't able to connect to Exchange. More investigation revealed a common thread - they were all Android phones. Still have to collect more data, because some Androids are working, while others are not. Shortly after, some Mac clients reported being unable to connect. Seems to be those with older Entourage clients. My own Outlook 2011 client works fine, and supposed the Entourage 2008 client with EWS support will also work. The desktop group is on the job, trying to identify which Macs are having issues, and getting them upgraded.


The phones will be a problem. How do you talk several hundred computer-illiterate people through upgrading their phones to a compatible OS version. And to make matters worse, one of our first upgraded phones still won't connect to 2010 and proxy to a 2007 mailbox. It will connect to either 2007 or 2010 directly, but attempting to proxy from a 2010 CAS to a 2007 mailbox won't work.


Tomorrow I'll pull a report of the ActiveSync client information, in order to identify potential upgrade candidates, so we can come up with a plan to move forward.