SBS 2008 - Exchange Virtual Directory Authentication Settings

SBS 2008 - Exchange Virtual Directory Authentication Settings



IIS >SBS Web Application 

SBS Web Application Should have annonymous and no SSL
1) Autodiscover: Basic and Integrated authentication SSLOptional 
2) EWS : Integrated authentication NO SSL 
3) Exadmin : Basic and Integrated authentication NO SSL 
4) Exchange : Basic and Integrated authentication SSL optional 
5) Exchweb : Basic and Integrated authentication NO SSL 
6) Microsoft-Server-ActiveSync: Basic authentication SSLOptional 
7) OAB : Integrated authentication NO SSL 
8) OWA : Basic authentication SSL Optional 
9) Public : Basic and Integrated authentication SSL Optional

DFS Troubleshooting

Great article about troubleshooting random DFS connection problems.

Link

Outlook 2007 keeps asking for User Name and Password

SBS 2008 - Exchange 2007 - Outlook 2007

This one took me a while to figure out.  After pushing out patches to the clients and server, Outlook started asking for the User Name and Password over and over again.  Outlook would still function even if the login was canceled.  There were no errors in the event viewer on the server or the client.

Turns out one of the patches installed on the server changed some of the security settings in IIS on a few of the exchange virtual directories.

Here is what fixed it for me.

From IIS Manager check the following virtual directories (Autodiscover, EWS, Exchange, Exchweb, OAB, owa) and make sure that if the Require SSL check box is checked then make sure that Client Certificates is set to Accept or Require instead of Ignore.

Event 2436 Errors on SBS 2008

http://blogs.technet.com/b/sbs/archive/2009/05/07/event-2436-for-sharepoint-services-3-search.aspx

HDMI Cables for cheap

What's the difference between a $150.00 Monster HDMI cable, and a plan generic $7.99 HDMI cable?   There is absolutely zero difference in performance.    It's funny how much company's like Monster can get away with charging.

Save your money and buy the cheap cable.  

Check out MonoPrice.com for some of the best prices on the internet for cables.

Dropbox Alternatives

PowerFolder

Team Drive

iFolder

Manually Remove VMware Tools

To uninstall VMware tools from a system the computer MUST be running on VMware.  This can cause  problems in the case of trying to restore a backup that was running on VMware to a physical computer or a different virtual environment.    

Below is an article on how to manually remove VMware tools.

Details

This article addresses these situations:

• You are unable to upgrade the existing installation of VMware Tools because the previous installation fails to be removed
• The uninstall feature of VMware Tools fails to complete
• You cannot uninstall VMware Tools
• You need to remove VMware Tools
• You need to manually uninstall VMware Tools

Solution

This issue may occur because the previous version is not removed.

 

Note: This article refers to Windows 2003 and below for the registry locationHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\uninstall. The registry location for Windows 2008 and later is HKLM\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools.

 

To manually remove VMware Tools:

1. Start the virtual machine and log on as the Administrator.
2. Run the VMware Cleanup utility. For more information, see  Cleaning Up After Incomplete Uninstallation on a Windows Host (1308) . 
3. Restart the virtual machine from the guest operating system.
4. Log in as the Administrator.
5. Open the Windows Registry editor. Click Start > Run, type regedit, and press Enter.
6. Browse toHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\uninstall. Search for the branch with a key named DisplayName and has a value of VMware Tools. Delete the branch associated with that entry. Do not delete the entire uninstall branch.
7. Browse to HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products. Search for the branch with the key named ProductName and has a value of VMware Tools. Delete the branch associated with that entry.
8. Browse to HKEY_CLASSES_ROOT\Installer\Products. Search for the branch with the key namedProductName and has a value of VMware Tools. Delete the branch associated with that entry.
9. Browse to HKEY_LOCAL_MACHINE\Software\VMware.Delete the branch called VMware Tools.
10. Ensure the folder located in %ProgramFiles%\VMware\VMware Tools is deleted.
11. Install the new version of VMware Tools.

DistributedCOM Event ID: 10009 (Server 2008)

One of my servers kept reporting an event id 10009 Error over and over again.  The below link and instructions fixed the problem for me.  

Author's site

Check the firewall settings and enable the firewall exception rule

To check the firewall settings and enable the firewall exception rule:

1. Click Start, and then click Run.
2. Type wf.msc, and then click OK. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
3. In the console tree, click Inbound rules.
4. In the list of firewall exception rules, look for COM+ Network Access (DCOM In).
5. If the firewall exception rule is not enabled, in the details pane click Enable rule, and then scroll horizontally to confirm that the protocol is TCP and the LocalPort is 135. Close Windows Firewall with Advanced Security
6. 

Right mouse click and enable the rule

Then to get the server to be able to query the name/model of the remote server enable the WMI in the inbound firewall rules as well.

 

Once you do that your server will report into the console and provide the hardware information on the Network/Computers tab.

Need to find a routers default password?

Check out http://www.routerpasswords.com/.  The site has a huge database of default user names and passwords for routers.

VMware Snap Shots Explained

Video Link

Set Folder Redirection For BES 5.0

To set up folder redirection from the BlackBerry Administration Service for BlackBerry Enterprise Server 5.0, complete the following steps:

1. Log into the BlackBerry Administration Service web console.
2. Expand User under BlackBerry Solution Management.
3. Click Manage Users.
4. Search for the user and click on the user's display name.
5. Click Default configuration under the Messaging Configuration section of the User Information tab of the user view.
6. Click the email tab.
7. Click Edit user.
8. Select Selected folders under the Redirection settings.
9. Select the folders that need to be redirected.
10. Click Continue to user information edit.
11. Click Save all.

BlackBerry Enterprise Server Resource Kit

Extra tools for managing your BES server.

Link

Importing n2k file in Outlook 2010

Link

Video Conferencing Equipment

Link

Importing certificates from IE8

How to make IE8 trust a self-signed certificate in 20 steps.

1. Browse to the site whose certificate you want to trust.
2. When told "There is a problem with this website's security certificate.", choose "Continue to this website (not recommended)."
3. Select Tools->Internet Options.
4. Select Security->Trusted sites->Sites.
5. Confirm the URL matches, and click "Add" then "Close".
6. Close the "Internet Options" dialog box with either "OK" or "Cancel".
7. Refresh the current page.
8. When told "There is a problem with this website's security certificate.", choose "Continue to this website (not recommended)."
9. Click on "Certificate Error" at the right of the address bar and select "View certificates".
10. Click on "Install Certificate...", then in the wizard, click "Next".
11. On the next page select "Place all certificates in the following store".
12. Click "Browse", select "Trusted Root Certification Authorities", and click "OK".
13. Back in the wizard, click "Next", the "Finish".
14. If you get a "Security Warning" message box, click "Yes".
15. Dismiss the message box with "OK".
16. Select Tools->Internet Options.
17. Select Security->Trusted sites->Sites.
18. Select the URL you just added, click "Remove", then "Close".
19. Now shut down all running instances of IE, and start up IE again.
20. The site's certificate should now be trusted.

Link to original  article 

Rate My Network Diagram

Site that has hundreds of network diagrams.   Great place to see examples of how people document their networks.

Rate My Network Diagram

Alternatives to Visio

Network Notepad

yWorks

Gliffy

Add additional domains to exchange 2003

Link

SBS 2003 multiple email domains relay error

Copy from a thread  here

The issue was that the Directory service to metabase service (DS2MB) wasn't able to update the metabase with the new Recipient Policy (or any SMTP changes, for that matter).  I found this after upping the diagnostic logging on ALL services.  I found Event ID 1040 for source MSExchangeMU, and proceeded to debug.  I started looking for "Metabase 5.7.1" in Google Groups and came up with: 

http://groups.google.com/group/microsoft.public.windows.server.sbs/browse_thread/thread/15e831409481765a/8af1d59e381aaa1d?lnk=st&q=5.7.1+metabase&rnum=2&utoken=axmcE0YAAACAT_kPml7nPanGq5_khmjXgP-tS31hakRaUqJOki041qG2zFZkc34ScLXYq7vPwUPqy7LpN0kInhmnPrax4xrQTloHJX-orWmzzl4LCDoLUA

The Microsoft tech's (Nathan) suggestion to delete specific keys then have the Microsoft Exchange System Attendant rebuild the metabase upon restarting the service worked. 

Thank you very much for your help! 


Step-by-step Fix: 
http://www.eventid.net/display.asp?eventid=1040&eventno=3972&source=MSExchangeMU&phase=1 (see Error code 80070003) 

An explanation of the DS2MB service is explained here: 
http://www.microsoft.com/technet/prodtechnol/exchange/guides/E2k3TransnRouting/1b311041-2443-472b-8e9f-e26b2090ba78.mspx
 

Blackberry Enterprise Server Express Notes

Install links and notes for an upcoming installation .

Step-by-step powerpoint like presentation that goes over all the requirements of setting up BESE.

Send As Issue

Install guide for installing SBS 2003

Useful Exchange Powershell Commands

I'm starting this post as a place to add useful powershell scripts for exchange.

[Insert useful script here]

Backup Exec System Recovery - Backups randomly fail

The official fix from Symantec for Backup Exec System Recovery randomly filing backups is to restart the "Backup Exec System Recovery" service before every backup.....    

Script to restart service.

net stop "Backup Exec System Recovery"
taskkill /IM VProSvc.exe /F
taskkill /IM vprotray.exe /F
net start "Backup Exec System Recovery"

MailHop Backup MX

MailHop Backup MX is a mail redundancy service. If your primary mail server experiences an outage, MailHop Backup MX will receive the mail for your domain and hold it for up to ten days, automatically retrying delivery until your mail server returns to service.

The great thing about this service is that it only cost $39.95 a year.

Turn your web cam into a CCTV System

Dorgem is an open source program that turns your web cam into a CCTV system.  It can send video/pictures to your local hard drive or to an FTP site.  Supports unlimited camera's, has motion detection, and has a built in web server.

The project has been discontinued but you can still download the software here 

Track your laptop or PC if it's stolen

The open source project Prey allows you to install software on your computer to track it in the case that it gets stolen.

The Software allows you to see what the person is doing on your pc, take pictures from the webcam, and use geolocation to track down the location of the computer.

Nice little free open source program.

Alternatives to Microsoft Offline Files

Microsoft's built in Offline Files can have problems sometimes and will not sync some types of files.

Here are two alternative programs

Microsoft SyncToy

SyncBack

Tweaking performance for a File Server

Here is two links for helping improve performance on a File Server under heavy load

Link 1
Link 2

Dual Factor Authentication using your phone

PhoneFactor makes a product that uses your phone instead of a key fob for tokenless dual factory authentication.     In my opinion this is a much better and cheaper way to manage secure authentication than having to purchase and maintain key fobs that can easily get lost.

PhoneFactor can work in three different ways to authenticate.

1.  Phone Call:   Calls your phone and enter your pin number.

2.  Text message:  Text your phone and reply with pin number.

3.  Voiceprint:  Calls your phone and authenticate by speaking your passphrase

The best part is this product is FREE for companies with up to 25 users.

They also offer a Standard and Enterprise version that integrates with products like Outlook Web Access, Citrix, Terminal Services, and RADIUS applications.

mRemote -- Multi-tab remote connections manager

mRemote

Install OS X Snow Leopard on VirtualBox 3.2

Link

Visio Networking Stencils Sites

VisioCafe

-  Huge selection of stencils for vendors like Aruba Networks, Dell, EMC, IBM, and more.

Blog with a bunch of VMware stencils

http://visiotoolbox.com/2010/add-ins.aspx

Dell Stencils

Free P2V software

Quest has a free P2V (Physical to Virtual) converter product called vConverter.  vConverter can convert your physical machines to VMware, Microsoft, or Citrix XenServer.

Tool Bag

When it comes to IT and working on computers and servers you never know what your going to run into. It's always good to be prepared with a good set of tools to handle a variety of problems.

Here is a list of some of my most used tools from my software tool kit.

WinDirStat - A quick way to tell what files are filling up your hard drive. A must have for cleaning up full hard drives

SpinRite Boot CD - Hard Disk recovery tool

CCLeaner - Tool for cleaning up temp files on your computer


GParted Live - Resize partitions


Knoppix 5.11 - Live linux boot CD with a ton of tools.


UBCD for Windows - Run windows xp from a CD. Has a ton of tools


Offline NT Password & Registry Editor - Boot CD that can change local account passwords


Kon-Boot - Log into any local or domain account on a pc without a password. Very cool tool.


Acronis True Image with Universal Restore - Disk Imaging tool


HDClone Pro - Hard Drive cloning tool


Malwarebytes - Anti-Virus/Malware


VIPRE Rescue - Anti-Virus/Malware


JKDefrag-3.36/MyDefrag-4.0 - Hard Drive Defrag program


Sysinternals - An sysadmin's best friend


Putty - Telnet/SSH Client

nmap - Security/Port scanner

Superscan 3.0 - fast little port scanner. A quick way to tell whats on the network.

Wireshark - sniffer

Microsoft Network Monitor 3.4 - Microsofts updated packet sniffer. Much improved!

Lua BugLight - For finding out where a program hangs when it's run under restricted mode.

NEWT - A very fast network inventory tool.

Belarc Advisor - Another pc inventory tool.

DBAN - Securely wipes hard drives to DOD standards

Blue Screen View - Scans mini dumps to help translate blue screen of death crashes.

Virtual Box - Run Virtual Machines. I use it to run everything from Windows 95 to Windows 7, and Ubuntu. What's best is it has 3D support for windows and Linux so it's functional and pretty.

Postini links

Purchase additional licenses

https://www.google.com/a/cpanel/DomainName

Postini Login

https://login.postini.com/

Good Posini Reseller

http://www.excelmicro.com/

Documentation - Postini System Administration Guide

https://www.postini.com/webdocs/admin_ee_cu/administration.pdf

Documentation – End User Message Center

http://www.postini.com/webdocs/mc/quick_start/mc_qs_ee_en.pdf

Postini Best Practices

http://www.postini.com/admindoc/bp_roadmap.html

IP Range

The following are the IP ranges for the email protection service systems. Note, for system 20 customers, both sets of IP ranges are applicable.

System	IP Range	CIDR Range	IP/Subnet Mask Pair
5, 6, 7, 8, 20	64.18.0.0 - 64.18.15.255	64.18.0.0/20	64.18.0.0 mask 255.255.240.0
9	74.125.148.0 - 74.125.151.255	74.125.148.0/22	74.125.148.0 mask 255.255.252.0
20, 200, 201	207.126.144.0 - 207.126.159.255	207.126.144.0/20	207.126.144.0 mask 255.255.240.0

To determine the system for your account:

Your system number is shown the URL when you log in to the Administration Console or Message Center. The system number is prefaced by “ac-s” or “mc-s”, for example:

URL displayed for an account on System 8 when logged in to the Administration Console:

https://ac-s8.postini.com/exec/adminstart?

URL displayed for an account on System 200 when logged in to the Message Center:

https://mc-s200.postini.com/app/msgctr/junk_quarantine

Offline File Synchronization -- ACCESS DENIED

I have two laptops that will not sync users offline files or will randomly fail syncing with Access Denied as the only error message.

Problem turned out to be caused by the Dell Embassy Wave Systems suite. In particular the WavXDocMgr program was causing the problem.

A quick way to test if this is your problem is to kill WavXDocMgr in Windows Task Manager.

Ended up just disabling it in msconfig.

BlueScreenView

BlueScreenView is a cool tool to help you decipher Windows Blue Screen / crash information.

Description

BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, the date/time of the crash, the basic crash information displayed in the blue screen (Bug Check Code and 4 parameters), and the details of the driver or module that possibly caused the crash (filename, product name, file description, and file version).
For each crash displayed in the upper pane, you can view the details of the device drivers loaded during the crash in the lower pane. BlueScreenView also mark the drivers that their addresses found in the crash stack, so you can easily locate the suspected drivers that possibly caused the crash.

Outlook distorts pictures used in signatures

Outlook compresses JPEG images that are inserted into the signature file and can make your nice crisp logo look really fuzzy.

There are two way around this.

1. You can convert your JPEG to GIF. Outlook does not try to compress GIF files.

2. You can host your image on a server and link to the file.

Photography stuff

If you're in to photography and like HDR stuff this is a really good HDR tutorial.

Link

Here are a few links to some software for creating panoramic photographs from multiple pictures.

Hugin -- It free, allows a ton of tweaking

PTGui -- A very good piece of software but not free.

Microsoft ICE -- Not as much control as the above programs but its free and very easy to use.

AutoStitch -- I have not tested it yet but have heard good things about it.

How to encrypt backups on SBS 2008

Link

Link

Convert nearly any video to DVD

DVD Flick is a free little program that can convert and burn about 60 different video formats to DVD

Dropbox

Dropbox is an easy way to store, synchronize, and share files online. The free account gives you 2GB of storage, and you can pay for more if you need it.

What makes it cool is how easy it is. Create an account on their website, download and install the application on your computer. Dropbox will install a folder on your pc and you're all set. Want something backed up just copy it to the Dropbox folder. You can access the files in the Dropbox folder from anywhere just by logging into the Dropbox website.

Free PDF Viewer / Editor

Free PDF Viewer with basic editing.

PDF-XChange

Disabling IP v6 can crash a SBS 2008 server. Who new?

A few months ago I setup a SBS 2008 server for a client. As I was going through my setup checklist I unchecked IP v6 on the adapter. My thought was disable anything that's not being used on the server. Last night we had some strong storms run though and they got their power knocked out long enough for the the UPS's to shut the servers down. When the server came back up exchange crashed.

Long story short apparently SBS 2008 will crash if you disable IP v6 on the adapter...

Here is a link to the official MS SBS blog site that details the problem and how to properly disable IP v6.

Free Video Capture Software

Want to record a Youtube video that's playing on your pc, or create a how to video on how to open a web browser for your grandma? Check out CamStudio. It's a free open source program.


http://camstudio.org/

Magic Jack installed as a service

I've just ordered the Magic Jack. If it works it will save me about $500.00 a year in land line bills. I'm going to try testing it on my Server 2008 R2 box when it comes in. Since I'll be installing in on my server I want to run Magic Jack as a service so I don't have to keep a user session running 24/7. Here are some links to accomplish this. I'll be testing them out as soon as the Jack comes in.

Link1
Link2

Point-to-Point Wireless equipment

For about $100.00 setup a point-to-point wireless network at 150+ Mbps and up to 15Km line of site range.

Ubiquiti Networks

Ubiquiti's Nano Station Very cool.

Free Software Based Enterprise/SMB Firewalls

Buying a traditional appliance based firewall for a business can be expensive. The base models are normally reasonably priced but you get poor performance and none of the bells and whistle's that the expense ones give you. Your also locked into the appliance hardware so the only way to upgrade to better performance is to purchase a brand new firewall and the price curve for better performance normally shoots straight up.

Because of the lack of performance and lack of functionality of the lower end Firewall appliances I have been testing out a few free software based firewalls. The cool thing about software based firewalls is your only limited by the hardware that you install it on. A lot of times and old PC (P3 or P4) will out perform the low end appliances. A bunch of the free open source firewall projects include advanced features like RAIDing your hard drives, clustering multiple devices, Quality of Service, Captive Portal, web filtering, Intrusion Prevention (Snort), and real-time Anti-virus scanning of email and websites.

Here are a few of the larger open source projects that I've been testing.

pfSense

Smoothwall

Endian

IPCop

Untangle

M0n0wall