How to integrate AD RMS with Exchange 2010 SP2(Part 1)

Exchange 2010 provides some kind of security features like TLS in order to secure the communication in a network by a mean of encryption and Email encryption by using the S/MIME to encrypt the messages.

Unfortunately, the traditional features have some limitations. Besides, the company deals with critical data that may contain business information or financial reports… And users rely on their Mailboxes to send this data to each other. So, Exchange server provide a new feature known as IRM.

What’s IRM?

Information Right Management “IRM”, apply persistent protection  to messages and attachments ( MS office or enabled IRM applications) in Exchange server. With IRM you can :

• User can’t forward, modify, print, fax, save, or cut and paste the content of a message or an attachment.
• User can’t view an IRM protected message or attachment after a specified period.
• User can’t use a windows snipping tool to copy the content of an IRM protected message.

With IRM you can’t:

• Prevent users from using a third party tools to capture screen
• Prevent users from using imaging devices to photograph an IRM protected message.
• Prevent users from remembering and then typing the content of an IRM protected message.

IRM rely on Active Directory Right Management Server, a role in windows server 2008. In the next article, we will begin the deployment of IRM and we will start by implementing AD RMS.

High availability for Exchange 2010: CAS Array

With Exchange 2010, the client access server is now a major component responsible for managing all connection to the Mailbox servers. This component manage all internal and external client traffic. To improve the performance and the availability of the client access server in an Exchange server organization, we have to think about a high availability solution for this important role.

In fact, in order to make this role high available, we have to deal with CAS Array. It’s a group of CAS servers configured in Network load balancing scenario.

Besides, you can make a CAS Array with HNLB ( Hardware Network Load Balancer ) or WNLB ( Windows Network Load Balancer ). Moreover, Microsoft recommend that we have to use HNLB to configure CAS array. In fact, with WNLB we load balance only MAPI traffic. Further more, HNLB or another third party NLB is able to load balance MAPI, ActiveSync, autodiscover and availability service…

In this LAB, we have to configure WNLB to make a CAS Array.

1. First, we Install two CAS servers named ‘HUBCAS’ and ‘HUBCAS2’
2. Create a host record in the DNS for the name of your CAS Array
   • My A record FQDN is: CASArray.contoso.local
   • My A record @IP is : 192.168.125.10 (Virtual IP of CAS Array)
3. Install the WNLB feature in ‘HUBCAS’ server. You have to
   • Open the “server Manager”
   • Right Click “Features”, The click “Add new Features”
   • Select “Network load balancing”
   • Finish the installation process
4. From the “Administrative tools”
   • Open “Network load balancing”
   • Create a new cluster
   • Add you first member to the cluster.(‘HUBCAS’ server)
   • Set the priority of this member.
   • Set the IP address and the mask of the cluster 
   • The cluster IP address is configured. We have now to set the “Internet name of the cluster” and to set the cluster operation mode as “Multicast”
   • For “Port rules”, you can use the default settings.
5. Now, you have to go to the other partner, in our case “HUBCAS2”:
   • Install NLB feature
   • Add the second server to NLB cluster
   • Add the second member
6. The WNLB is configured. But, you have to redirect you MAPI client request to our CASArray. In fact, our resort is the famous PowerShell to achieve this goal:
   • Get-ClientAccessArray: To show if there are some CAS Array configured in your Exchange organization
   • You have to run this CMDLET to create the new client access server array: New-ClientAccessArray –fqdn “CASArray.contoso.local” –site “MainSite” –name “CASArray”
   • Our CAS Array is now configured as shown in the picture
   • Finally, you have to specify the CAS used to make a connection with a specific Mailbox Database. You have to run this CMDLET: Set-MailboxDatabase MBXDag –RPCclientAccessServer “CASArray.contoso.local”
7. Finally, we check our client configuration in outlook
    
   Good luck !
    

Upgrading to Exchange 2010 SP2 : Best practices for Database Availability Group “DAG”

Database Availability Group or “DAG” is the high availability feature for the mailbox server role. DAG is a critical feature in an Exchange organization. It means that databases included in the DAG must be high available and no disconnection or unavailability is tolerated. Assuming that applying a new service pack will impact the availability of mailbox servers, we need to make some rules to achieve our aim and after that we make a strategy for the upgrade process:

1. We have to apply Service Pack only to passive node
2. If any software is monitoring our DAG , we have to put the DAG members in maintenance mode like in SCOM.

or you run the following PowerShell script if there is no SCOM monitoring : StartDagServerMaintenance.ps1

Now, in order to install the SP2, you have to proceed by:

1. Run the cmdlet : Get-DatabaseAvailabilityGroup – status | Format-List PrimaryActiveManager   As a result, you know which server is the active partner and the preferred one in the cluster configuration 
2. After that, you have to set another DAG partner to hold the active copy of the database. You have to run: Move-ActiveMailboxDatabase –Server <DAG Memeber>
3. Before applying The SP2, you have to block the Active Manager, this process responsible for detecting the state of a partner in the DAG, so that, you block the failover. In fact, when the Active partner fails, you cannot failover to the second one because, you are in process of installing the SP. You have to run : Set-MailboxServer –Identity <ServerName> –DatabaseCopyAutoActivationPolicy:Blocked

Now, It’s time to install the Exchange 2010 SP2 on the passive partner.

Good news, the installation in the passive partner succeeded without error. Now, we have to do this steps in the passive node:

1. Enable the failover for the passive partner by running : Set-MailboxServer –Identity <ServerName> –DatabaseCopyAutoActivationPolicy:Unrestricted
2. Disable the DAG maintenance by running the following script: StopDagServerMaintenance.ps1

Finally, you have to repeat all steps listed above for each DAG partner.

Good luck

Move-ActiveMailboxDatabase Failed

I have configured two server as partner in a DAG scenario. I tried to move a database from one server to the other. The passive database is healthy. The move request with the EMC or PowerShell command failed. This is a screenshot of the error :

By the way, the solution is so strange!!! I did the following :

1. Stop the database Copy
2. Resume the Database Copy
3. Move the mailbox succeeded ! Great but Strange :-)

Exchange 2010 SP2: IIS 6 WMI Compatibility is required

When you install the Service Pack 2 of Exchange 2010, you may encounter this error ‘The IIS 6 WMI Compatibility component is required’. In fact, when you upgrade your client access server role you  have to add this component. It’s a new prerequisites for CAS role.

Because I’m a PowerShell fun, this Cmdlet will solve the issue :

• Open Windows PowerShell
• Type : Import-Module ServerManager
• Type : Add-WindowsFeature Web-WMI

NB: You only encounter this error when you upgrade from Ex2010 SP1 to SP2. But, when you install Exchange 2010 SP2 for the first time in your organization, you only check the box ‘Automatically install Windows Server roles and features required for Exchange’ and Exchange 2010 install all prerequisites for you.

Exchange 2010 SP2 and Forefront Protection For Exchange 2010 (FPE 2010)

 

The Exchange 2010 service pack 2 is released, so you have to upgrade to this new SP. But, many companies have deployed Forefront for Exchange to make their messaging solution more secure against Spams and virus.

The problem: Is there any known issue that will be produced when upgrading to Exchange SP2 in an infrastructure that contains FPE 2010 ?

Answer: Until now, there’s no any announcement from Microsoft about that. But, in my test lab, I do the following:

1. Download and install the recent update of FPE2010 ( Download)
2. Install the SP2 of Exchange (Download)

I haven’t received any issues. It seems to be fine. Exchange 2010 SP2 and FPE 2010 seems to be compatible. But, we must wait for Microsoft to announce that.

Out Of Office and Distribution Group

Out Of Office is a very useful feature and it’s known as OOO. You can configure it easily in you MS Outlook. For Exchange administrator’s there are different kinds of recipients such as Distribution Group. In fact, with DG you can send one mail to a list of users or contacts. But, if the member’s of a specific DG are Out Of Office for a period, how we configure OOF for the DG?

With Exchange 2010 you can configure the distribution group to send OOO message. You have to go to the properties of the DG and check the box “Send Out Of Office message to the originator”

How this option works? let see this scenario:

Case: We have  5 members in a DG named TS. A user send an email to the TS DG. Three of the DG members have OOO enabled. The OOO option in the DG is enabled.

As a result: The sender will receive three OOO messages !!!

Conclusion: This option take effect if at least one of the DG member have OOO configured. The sender will receive OOO message from each member having OOO configured. The content of each OOO is the content configured by each member in the DG.