Exchange Top Level Security Permissions

In order to see the top level inherited security permissions in Exchange you have to add the following reg key and restart ESM (Exchange 2003):

Hkey_Current_User/ Software/ Microsoft/ Exchange/ ExAdmin

Create a new Dword Value of "ShowSecurityPage" and give it a value of 1.

Now restart ESM and you will see the security tab at the Exchange org levele

Exchange 2007 File Share Witness Multi-subnet clustering

If you are placing the file share witness at the same site as your active Exchange 2007 server, when you have a primary site failure Exchange will not be able to start at the DR site. This is because it will only have 1 of 3 votes as both the quorum and the active are down.

You will have to run a /fq (net start clussvc /fq) to force the quorum to start at the secondary site.

Check this one out:
http://blogs.technet.com/timmcmic/archive/2009/04/26/file-share-witness-fsw-placement-and-the-cluster-group.aspx

Migrating user from Exchange 2003 to 2007 BES

Most people that I talk to suggest to restart BES services if you migrate a user between Exchange servers. I have found that all you have to do is run handheldcleanup -u. It works for me every time. Try it.

Windows 2008, Exchange 2007 CCR Cluster multi-subnet

To decrease the fail-over time of a multi-subnet CCR cluster running Exchange 2007, decrease the TTL of the DNS record. When a fail-over occurs in a multi-subnet environment, the DNS record must change to the new IP. To make this happen faster, run the below command.

The default is 20 minutes, plus the 10 minutes it takes for the cluster to even change the record, plus the amount of time a client caches the record. This can lead to long fail-over times.

To change the TTL to 5 minutes run: Cluster.exe res /priv HostRecordTTL=300

Exchange 2007 cannot uninstall Exchange Tools

If you cant uninstall the Exchange tools because the option is grayed out, run this command:

MsiExec.exe /X{24B2C164-DE66-44FE-B468-A46D9D5E6B31}

Windows 2008 CCR Cluster, Exchange 2007 error

Microsoft.Exchange.Cluster.ReplayService (7012) Log Verifier e0a 31573001: An attempt to open the device name "\\source\share$" containing "\\source\share$\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).

If you get this error in your Windows 2008 CCR cluster on Exchange 2007, you can ignore it, for now. It should be fixed in future releases. Check this link:

http://blogs.technet.com/timmcmic/archive/2008/12/21/windows-2008-exchange-2007-sp1-ese-522-errors-on-ccr-passive-or-scr-target-machine.aspx

iPhone, Exchange 2003, OWA, ISA 2006

I just got done setting up OWA with ISA 2006 for iPhone test users. One thing that I ran into, which I have seen in the past, is an issue when you have an ISA server with only one leg, purely in the DMZ.

With OWA if you don't want users to have to type in /Exchange when connecting to the Exchange server you have to basically create a redirect rule that comes into effect when a user just types in the root of the OWA server. That rule then forwards them to /Exchange. Simple, but a PIA if you are trying to figure it out.

Here is how to do it: http://www.messagingtalk.org/exchange-2007-owa-url-redirection-using-isa-2006

Backup and Recovery Setup

I recently designed and implemented a backup/recover solution for a small hedge fund. They were using Veritas Backup Exec, a Quantum P50 DLT (or something). Brick level backups were being done on the Exchange server and everything was being backed up over the LAN.

As everybody does, our backup and restore times were not meeting SLAs. I performed an analysis and ended up bringing in EMC Networker, Data Domain, EMC Replication Manager, Kroll On-track and ESX Ranger.

This solution allowed me to backup large data sets on the SAN using Replication Manager, it allowed for fast backups and restores with the ability to store around 50 TB of data on 4 TB of disk using Data Domain and the EMC Networker software, although harder to learn, is enterprise class.

Backing up virtual machines is cake. ESX Ranger snaps them off and puts them on Data Domain.

All Data Domain is replicated to our DR site.

No more slow brick level backups of Exchange. By using Replication Manager to clone to the backup server, we backup the Exchange database files in their interity. Replication Manager also truncates the logs when the backup completes.

What if we want to restore one mailbox? Using Kroll Ontrack we can look into the EDB files, choose the mailbox we want to restore and restore it to a PST.

SLAs are met, restores are quick and now I sit back on move on to the next project.