The Exchange Server Troubleshooting Assistant (ExTRA)

This content is 17 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

Microsoft’s Exchange Best Practices Analyzer (ExBPA) has been around for a few years now and it’s an excellent preventative maintenance and troubleshooting resource. ExBPA was recently joined by the Exchange Server Troubleshooting Assistant (ExTRA) which, according to the Microsoft website:

“[…] Programmatically executes a set of troubleshooting steps to identify the root cause of performance, mail flow, and database mounting issues. The tool automatically determines what set of data is required to troubleshoot the identified symptoms and collects configuration data, performance counters, event logs and live tracing information from an Exchange server and other appropriate sources. The tool analyzes each subsystem to determine individual bottlenecks and component failures, then aggregates the information to provide root cause analysis.”

ExTRA v1.1 brings together a number of troubleshooting tools: the Exchange Server Disaster Recovery Analyzer (ExDRA); the Exchange Server Performance Troubleshooting Analyzer (ExPTA); and the Exchange Server Mail Flow Analyzer (ExMFA). Furthermore, ExTRA is integrated in the ESM Toolbox for Exchange Server 2007.

Microsoft EVO launch

This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

Microsoft UK EVO Launch

Let’s get one thing straight. Over the last twelve-or-so years I’ve built a reasonably-successful career out of working with Microsoft products. At times, I’ve even been accused of bias towards Microsoft; however, I don’t exclusively use Microsoft products. I’m also aware that I’ve been fairly critical of Microsoft of late – but that’s because I am “not backwards in coming forwards” – i.e. I will say what I think. One of those times was a recent blog post about Office Groove 2007 and at the time I chose not to name the Microsoft presenter in question (so I won’t now either); however for an organisation that claims to crave feedback, my comments, written on blog with a relatively-small readership, do seem to have touched a raw nerve. Regardless of the comments I made on that particular presentation, I will also give credit where credit is due – the majority of Microsoft events I attend are informative and generally represent a good use of my time.

I spent today at Ready for a New Day: Microsoft’s Launch of Exchange, Vista and Office (EVO) (there was an earlier UK business launch event held at Arsenal FC’s Emirates Stadium, to coincide with the US launch at NASDAQ) – I’m pleased to say that it was well worth it (and I know that a lot of hard work went into a day where PowerPoint was dumped in favour of back-to-back demonstrations).

Despite being critical of the Windows Vista marketing message (clear, confident and connected), I’ve commented in the past that Windows Vista does have a lot to offer. I’ve also been impressed with Office 2007 (although the ribbon interface does take some getting used to; once you get the hang of it, everything works well) and since last April I’ve wanted to write lots about Exchange Server 2007 but was prevented by NDA (Exchange Server 2007 was released to manufacturing last week and I consider it to be just about the most exciting new version of Exchange Server since the original v4.0 launch in 1996 – more on that in a moment – I’m not alone as it seems that Gartner are pretty fired up about Exchange Server 2007 too).

The event was introduced by Phil Cross, Microsoft UK’s Audience Marketing Manager, who first took a look at the history of Windows, Office and Exchange and whilst it’s a bit of a diversion from the topic of this blog post, it represents a nice trip back down memory lane.

It seems that technology doesn’t always help us to do our work and according to a survey conducted by Microsoft and YouGov, in this ever-connected world, almost 40% of respondents admit to working extended hours and around 25% regularly work through lunch – despite the all-pervasive IT that’s supposed to make life easier. Also interesting is what has been important to information workers over the last 30-or-so years: in the 1970s, 32% considered a telephone on their desk to be the ultimate status symbol and 23% craved access to a computer terminal; by the 1990s the ‘phone was ubiquitous and 56% considered a PC to be essential; and in 2000 58% of respondents consider e-mailed to be an essential business tool.

Looking back to the early 90s, Microsoft MS-DOS 6.22 and Microsoft Windows for Workgroups 3.1 were the desktop operating system and windowing environments of choice, with Microsoft and IBM still working out the future of LAN Manager and OS/2.

In 1993, Microsoft’s UK server business was worth just £6m, of which £5m was revenue from Microsoft Mail. SQL Server cost £100,000 and needed to run on OS/2 and there were only three Microsoft server products (NT Server, SQL Server and Mail). Today, Microsoft has around 30 server products and the associated revenue in the UK is around £800m.

Just 10 years ago, in 1996, Microsoft launched Exchange Server – of particular relevance to me as it was the first time I worked with Microsoft. At the time, Phil Cross was the UK Product Manager and I worked for ICL, one of the Microsoft Solution Providers who joined Microsoft on the UK launch tour (I probably still have a t-shirt with our tour dates but I remember driving a van around the country with our presentation materials as we took a stand to every Microsoft event and ran our own events on the days in between).

I’m not going to repeat the whole day’s worth of presentations, but some of the key messages from the day appear below, with demonstrations structured around 4 key tracks, introduced by Eileen Brown:

  • Simplify how people work together.
  • Help protect and manage content.
  • Find information and improve business insight.
  • Reduce IT costs and improve security.

Looking firstly at simplifying how people work together, Jane Lewis demonstrated:

  • Outlook autoconfiguration – creating a profile based on just the user’s e-mail address, auto-populated from Active Directory.
  • Office Groove 2007 – quickly setting up a collaborative workspace and inviting an external contact, then synchronising changes as they collaborated on documents before finally uploading the content to Windows SharePoint Services for long-term storage.
  • Exchange Server 2007 proxying links to internal document shares to allow access without a VPN connection and providing web-ready document viewing (HTML rendering of documents, so that no temporary files are left behind when accessed via a public PC).
  • The ever-improving Outlook Web Access – now richer than ever – and unified messaging, with voicemail in the Inbox, along with the ability to add notes for searching and indexing voice messages and finally, self-service PIN reset for voicemail access.

Jason Langridge followed this up with demonstrations of some of Microsoft’s mobile technology including:

  • The Windows Vista Mobility Center (for quick and easy switches to PC configurations – e.g. presentation mode).
  • Outlook Mobile, including folder access, global address list lookup and spell-checking.
  • Word Mobile, with full support for document formatting.
  • Excel Mobile, with the ability to summarise data in charts.
  • PowerPoint Mobile, with read only access to presentations, including animations.
  • Setting up a new device, then seeing the application of device policies including mandatory passwords and the ability to wipe a device remotely.
  • Exchange Server 2007 self-service management of connected devices including a log of device interaction with the server, the ability to remove devices from the list, password display and remote wipe capabilities.
  • The Windows Mobile Device Center – replacing ActiveSync and built into Windows Vista, managed via Active Directory and allowing access to device settings (partnerships/synchronisation settings), file transfer, as well as the ability to tag and rate pictures, music and video.
  • Finally, Jason demonstrated OneNote Mobile, creating meeting notes with embedded pictures and audio.

Some key facts from Jason’s presentation included:

  • In the UK, 90% of 9-year-olds and above have a mobile phone (we actually have move handsets than there are people… I carry two and so do many others that I know!).
  • 250m PCs will be sold this year, but this is eclipsed by the 1.5bn mobile devices.
  • The Samsung BlackJack has 4 times the power of a PC from just 5 years ago with HSDPA allowing 1.8Mbps access to data.
  • Microsoft supports 46,000 mobile users using just 8 HP ProLiant DL350 servers (it could be less if it wasn’t for the requirement to provide global coverage and resilience).

The next demonstration was given by Arthur Pounder of the Microsoft Unified Communications User Group UK and the Microsoft Messaging and Mobility User Group UK, who started out by explaining the difference between unified messaging (an asynchronous technology from the combination of voicemail and e-mail) and unified communications (synchronous communications with multiple parties simultaneously) before demonstrating how instant messaging (IM) and presence awareness reach new levels in the forthcoming Office Communications Server 2007 (formerly Live Communications Server) and Office Communicator 2007 with multiparty conferencing and voice over IP (VOIP). Arthur demonstrated:

  • Replying to an e-mail with an instant message (reply or reply all).
  • Inclusion of formatted data (from Excel) within an instant message.
  • Multiple levels of presence (i.e. sharing some contact details with certain individuals but not all).
  • Documents with smart tags indicating presence information where a name is recognised in Active Directory.
  • Enabling VOIP on an organisational or per-user basis, including the routing of calls across the corporate network until they reach a break-out point.
  • Policies for control of conferencing settings as well as archival and call detail records for IM, conferencing and VOIP.
  • Intelligent IM filter, including URL filtering and file-type filtering.

Moving on to the protection and management of content (brought to every IT Manager’s attention with the recent theft of a laptop, containing millions of customers’ personal details, from the home of a Nationwide Building Society employee), Andy Malone from Quality Training showed how the forthcoming Longhorn Server product implements network access protection (describing it as analogous to a nightclub bouncer enforcing standards for dress) through the Network Policy Server and a number of health validators. He continued by examining Windows Vista’s user account control and the Windows Firewall with advanced security, which now supports, domain, public and private profiles for both inbound and outbound rules, along with connection security and monitoring. Andy then went on to look at the current beta of Forefront client security, analysing and reporting on the security of PCs across the enterprise, as well as Exchange Hosted Services (a development of the anti-spam and anti-malware technologies acquired with FrontBridge) and Forefront for Microsoft Exchange with real-time capture and incident reporting. Finally, Andy showed Outlook 2007 disabling links in suspicious messages as well as Internet Explorer 7’s anti-phishing filter (using a demonstration phishing site).

Brett Johnson is one of my favourite Microsoft speakers – charismatic and full of energy – and, in the first of two Exchange Server 2007 sessions, he examined some of the controls that can be put in place from the view of compliance and records management, in the process highlighting that:

  • Exchange Server 2007 is available as a 32-bit application for test purposes only and only the 64-bit version is supported by Microsoft.
  • Many organisations have an issue relating to compliance and e-mail as mailbox restrictions lead to a proliferation of personal folder (.PST) files spread around the network, with consequential issues of management.
  • With Exchange Server 2003, message journalling (sending a copy of every message sent to a particular mailbox or mail-enabled document store) was either on or off – and it affects server performance. Exchange Server 2007 allows message journalling to be set at the per-user or per-group level within the hub transport as well as controlling the scope to global, internal or external messages.
  • The Exchange Server 2007 Exchange System Manager gives details of the equivalent PowerShell command at the end of each GUI operation.
  • Managed content folders can be used to control the placement of messages within a mailbox – e.g. expiring Exchange voicemail messages to a particular folder after a number of days (a similar function has been possible in Outlook, but appears to be more granular and is configured by the Exchange administrator).
  • Each message can be assigned a message classification (e.g. confidential) and new classifications can be created to, for example, mark a message as being suitable for a particular audience (e.g. internal account use only).

In the last session before lunch, Jessica Gruber took a look at protecting corporate intellectual property (IP). Unfortunately, despite Jessica’s offers of huge thanks when something worked, the demo gods were not with Jessica but she soldiered on and used her witty responses to keep the audience on her side. I have no doubts that had it not been for an incorrect system clock (and consequential Kerberos authentication issues) from a previous demonstration (used to avoid product activation – proving that even Microsoft has problems with keys!) which made life extremely difficult for Jessica, she would have been able to completely demonstrate:

  • Exchange Server 2007’s hub transport role being used to create an ethical firewall within an organisation (preventing one part of the organisation from communicating with another) and control what happens to the associated messages (e.g. bounce with a custom reply).
  • Even though information rights management (IRM) and rights management services (RMS) are not new Microsoft technologies, Exchange Server 2007 pre-processes the tasks (rather than relying on the client to implement them).
  • Device installation restrictions within group policy (e.g. to prevent the installation of a USB key or to control the ability to write to CD/DVD).
  • Application of information management policies within SharePoint to enable auditing, expiration, etc.
  • SharePoint allowing multiple document types within a single library.
  • The information panel within Office exposing document properties for completion (used within SharePoint to organise the data).
  • The Document Inspector, which may be used to remove internal comments, etc. prior to publication.
  • SharePoint Designer (formerly FrontPage) being used to define control the workflow around approving a document and assigning it to a particular site collection or list, without writing any code.

As the day moved on to the topic of finding information and improving business insight, Melville Thomson did a fine job of demonstrating a SharePoint dashboard with webparts connecting to BizTalk Server and SQL Server providing a sales scorecard. Using this web interface, business data can be exposed to managers who may not have Microsoft Excel on their PC, including the ability to view comments stored with data values and to drill down into the data. For more detailed analysis, the data was then opened within Excel and a pivot table used, along with conditional formatting (with new data bars and colour scales, and now understanding hierarchical data to apply a similar scheme to related cells) allowing the user to visualise the data and identify problem areas. Melville then created a chart which was active, changing dynamically along with the data exposed by the pivot table and published the results to a SharePoint library. Finally, he used the new data mining capabilities within Excel (an add-in from the forthcoming SQL Server 2005 SP2) to examine the demographics within the sales data and identify key influencers, allowing marketing to be targetted to the appropriate group of prospective customers.

I will confess that I was the guy on the front row who fell asleep in the next session (a combination of post-lunch weariness, sleep deprivation and the mention of Microsoft Project letting my mind wander to the stresses of my current assignment and immediate desire to forget it all) as Bob Walker spoke about Microsoft’s Enterprise Project and Portfolio Management products, which facilitate strategic decision making rather than focusing on task-oriented milestones.

(At this point I should make an observation – in my experience, most Project and Programme Managers are completely task-led and think a Gantt chart is a project plan. I’ve never yet worked in an organisation that uses Microsoft Project Server to co-ordinate individual plans and provide a programme-level view of operations).

Bob demonstrated:

  • Microsoft Office Portfolio Server, featuring a builder, optimiser and dashboard to allow analysis of potential projects to be balanced against available resource at a programme, project or application level.
  • Microsoft Project Server, now featuring multiple undo levels, the ability to highlight milestones and to view the impact of timescale changes using colour and reporting, with export to an Excel pivot table.
  • Microsoft Project Web Access, which runs on Windows SharePoint Services to provide a lightweight project client for others to view projects.
  • Integration of Microsoft Project with Outlook tasks and timesheets.

Next up was Rod Gordon of the Access User Group and Office User Group, who gave a very interesting demonstration of linking Microsoft Visio to a dynamic data source. In Rod’s example, he used an Excel spreadsheet of PC audit data to link it to a Visio diagram with an office floor layout. Key features of the demonstration included:

  • Use of the control and shift keys with the mouse to drag a box around an area of the diagram to zoom in on and a pan and zoom window to drag the selected area and highlight different sections of the diagram.
  • Using Visio’s data menu to link a Visio diagram to source data from a number of sources including Microsoft Access, Excel, SQL Server and Windows SharePoint Services.
  • Selection of data within the external data pane and dragging/dropping it onto the appropriate shape in order to create a link (alternatively, by setting a primary key and populating just that field for each shape, the data can be automatically linked). Once the link has been created, a simple right click on the shape allows the associated data to be viewed and the shape can have conditional formatting defined in order to highlight certain conditions.
  • Editing of source data with a manual (or periodical) refresh of the corresponding data in Visio.
  • Use of multi-layered diagrams to expose different layers for viewing/printing.

The last topic area of the day was focused on reducing IT costs and improving security and another friendly face from Microsoft UK, Steve Lamb, gave a short demonstration of some of Windows Vista’s security features including:

  • BitLocker, which encrypts the hard disk such that a key is required to start up the computer (stored on a USB key, within the computer’s trusted platform module, or entered manually). Using a drive analysis tool (diskscape.exe), Steve showed how an encrypted hard disk looks the same throughout, whereas a non-encrypted drive has definite areas of data that can be detected.
  • The Application Compatibility Manager (replacing the Application Compatibility Toolkit), which now incorporates community feedback on the steps required to make a particular application run successfully on a modern Windows system.
  • The Business Desktop Deployment (BDD) deployment workbench, which allows the customisation of Windows images to choose the appropriate operating system version, integrate new drivers, create new builds, edit default settings using the Windows System Image Manager and finally prepare the build for deployment using a single server, deployment share, removable media or the Microsoft SMS Operating System Deployment (OSD) feature pack.
  • Demonstration of a program’s ability to inflict malware on a system running as a Windows XP Administrator, Windows XP unprivileged user, Windows Vista user (by default unprivileged) and Windows Vista user running with elevated permissions, at which point User Account Control (UAC) intervened.
  • (Did we tell you that Internet Explorer 7 has new anti-phishing capabilities?)

Next up was Brett Johnson, continuing his Exchange Server 2007 theme by looking at Exchange Server efficiency:

  • Exchange System Manager 2007 is based on the new MMC 3.0 console and exposes more properties in each view – making it easier to find what is required.
  • Exchange Server 2007 actually has three default levels of administration – organisation, server and user (e.g. create a mailbox and make limited changes). In effect, the Active Directory and Exchange Server administration roles combine to allow flexibility in managing the organisation’s e-mail infrastructure.
  • Resources (e.g. rooms and equipment) now have their own mailbox type (not just customised user mailboxes).
  • There are 4 main server roles in Exchange Server 2007 – mailbox, hub transport, client access, and unified messaging (there is also a fifth role – edge services – but that is deployed on a separate server – generally inside the DMZ).
  • Exchange Server logfiles are now 1MB in size (down from 5MB).
  • Exchange Server 2007 offers two new forms of resilient architecture:
  • Local continuous replication (LCR) creates a second copy of the database and log files (e.g. on a separate storage system) for local resilience.
  • Clustered continuous replication (CCR) extends this capability to span multiple cluster nodes.
  • Hub transport rules can be used to customise message flow (e.g. Jessica Gruber’s earlier creation of an ethical firewall, or adding a disclaimer message to all e-mail.
  • The Exchange Server Best Practice Analyzer (ExBPA) is now available, along with various Microsoft Product Support Services (PSS) tools within Exchange System Manager. Quoting Brett, “We are making this product a cinch to use”.
  • PowerShell (I still can’t stand that name) offers powerful scripting capabilities, including the ability to perform Exchange Server functions from the command line, using one of the many commandlets provided by Microsoft. It’s also possible to create a log of PowerShell activities using the start-transcript command.
  • The last demonstration was from Adam Shepherd, looking at how Windows Vista improves operational efficiency:

    • There are 700 new group policy settings in Windows Vista (e.g. new settings to deploy printers via GPO or enforce power management).
    • After deliberately sabotaging a system by using the Windows Recovery Environment to rename a core system file, Windows Vista detected the fault and repaired it at reboot time.
    • The Windows diagnostics infrastructure can be used to warn of impending faults (e.g. utilising the SMART technology in modern hard disks).
    • The entire hard disk from a Windows Vista system can be backed up to a virtual hard disk (.VHD) file for later recovery.
    • Windows Vista includes guided help, with options to watch as the computer performs the operation or to be guided on a step-by-step basis. What I found really impressive is that the Windows Automated Installation Kit (WAIK) includes a guided help studio for creation of custom guided help routines in little more than a few clicks, recorded with a task recorder.

    In all the event was PowerPoint light and demo-heavy – with a huge amount of resource involved and a lot of hard work. I found it very worthwhile (although the format wouldn’t suit all events – it’s sometimes good to have the PowerPoint slides as a takeaway).

    It was interesting to hear James O’Neill comment to a couple of attendees that the event was originally targetted at Microsoft’s enterprise customers but was later opened to a larger audience after a lack of interest (opening the floodgates and leading to an event with very low levels of “no-show”). It seems to me that Microsoft Exchange Server 2007, Microsoft Windows Vista and Microsoft Office 2007 are all remarkably advanced products with a lot to offer and today’s demonstrations just scraped the surface. Quoting Steve Ballmer, “These are game-changing products. It’s an incredible step forward for business computing in a year of unprecedented innovation from Microsoft”.

    Considering Windows Vista in isolation may not be a convincing argument for an upgrade but once you add Exchange Server 2007 and the 2007 Office System into the mix then there is plenty of scope for using IT to support new ways of working (maybe even reducing those long hours). Find out more, by following the links below or check out one of the upcoming Microsoft TechNet UK Technical Roadshow 2007 events:

    Recovering a mailbox in Exchange Server 2003

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    Last night I had a bit of a panic when I deleted a user account (and the corresponding Exchange Server mailbox). Strictly speaking, deleting the user and associated mailbox was not a mistake – but I deleted the wrong one. Luckily, it’s a pretty easy mistake to rectify – as described in Microsoft knowledge base articles 274343 and 823176.

    There is one thing that it might be useful to be aware of – even though I kept running the cleanup agent the tombstoned mailbox didn’t show as disconnected (so I couldn’t reconnect or purge); however, like so many things in Exchange, I left it for a few hours (actually, it was overnight but I’m sure a few hours would have been fine) before refreshing Exchange System Manager and everything was as expected (after which I simply reconnected the mailbox to a new Active Directory user account and logged in successfully).

    Implementing real time block lists for spam control

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    The Spamhaus Project
    A couple of months back, I wrote a post about controlling spam using the Microsoft Exchange Intelligent Message Filter. Whilst it has to be said that the IMF has been effective in reducing my spam volumes (with very low false positives – strangely enough my blog posts are the ones it has most trouble with) it’s still not catching all of the unsolicited commercial e-mail (UCE) that I receive, so this week I resorted to another spam control – real time DNS block lists.

    Various lists exist with details of known spam relays and the one I’m using is from the Spamhaus project. Actually I’m using two of their lists – the Spamhaus block list (SBL) and the Spamhaus exploits block list (XBL), both of which are free for non-commercial use – I may add other services later.

    Setting up the block lists within Microsoft Exchange Server was reasonably straightforward, following advice from Daniel Petri (further information can be found in Microsoft knowledge base article 823866). I then tested the service as recommended at Crynwr Software’s spam blocking resources page. After initial problems testing the service as my mail was being routed via my ISP’s relays (but I could see the conversation when I telnetted to Crynwr’s servers) I switched to DNS-based routing and received a satisfactory response to the e-mail tests – most importantly showing the following text in the SMTP conversation:

    550 5.7.1 knownspamserveripaddress has been blocked by Spamhaus
    Terminating conversation

    So, that’s another tool in my anti-spam arsenal. The UCE levels appear to be tailing off now… hopefully I’m not dropping too much “real e-mail”. One day I hope to be able to say (in the style of John C Dvorak) “I get no spam”.

    E-mail protected by SBL advisory E-mail protected by SBL advisory

    Message hygiene principles for Microsoft Exchange Server

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    Whilst researching my post on the Microsoft Exchange intelligent message filter a couple of months back, I came across the following message hygiene architectural principles, which Microsoft promotes as best practice:

    • Anti-spam filtering must be performed before anti-virus filtering.
    • Anti-spam filtering should be performed for inbound mail only.
    • Anti-spam filtering should remove messages (cf. quarantining messages).
    • Anti-virus filtering must scan both inbound and outbound mail.
    • Anti-virus filtering must be mail-direction aware.
    • Anti-virus filtering must block messages that it cannot scan.
    • Anti-virus and anti-spam filtering system must integrate with Exchange Server.

    Customising the Outlook Web Access 2003 logon page

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    Unsupported it may be, but customising the Outlook Web Access logon page is something that many organisations will wish to carry out – I recently stumbled on Microsoft’s article on OWA logon customisation in the Microsoft Exchange Server TechCenter.

    Controlling spam using the Microsoft Exchange intelligent message filter

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    It may just be a co-incidence, but since I switched my e-mail from my ISP’s servers to my own server a few months back, I’ve been seeing a huge increase in the amount of unsolicited commercial e-mail (UCE) – commonly known as spam – in my mailbox.

    At the time of writing, statistics from MessageLabs show a decline in the volumes of spam over the last 12 months (although they still indicate that 58.39% of all e-mails sent were spam). Postini’s statistics suggest that 73% of e-mail is spam.

    If you think those statistics are bad, according to Microsoft, Bill Gates receives 4 million spam messages a day, making him probably the most spammed man in the world (it’s no surprise then that he is rumoured to have his own mail server at Microsoft).

    Any effective strategy for dealing with UCE (specifically for Exchange Server 2003, but the generic advice is the same for all mail servers) needs to operate a multiple levels within the e-mail transport (these are defined on the Message Delivery Settings under Global Settings in Exchange System Manager but need to be imposed using the properties for each SMTP virtual server):

    • Server-level accept/deny lists can be used to always accept, or always deny, messages from certain domains. The trouble with this method of trapping e-mail is that I occasionally receive non-delivery reports (NDRs) for messages that were allegedly sent from markwilson.co.uk but that actually never came near my servers, so without a real-time DNS lookup mechanism to verify the sender’s domain (such as Sender ID), these are of limited use.
    • Connection filtering using real-time block lists (RBLs) is the next level of protection, using a DNS query against a RBL provider’s servers, such as the SpamHaus project.
    • Sender filtering can be used to drop any messages that claim to come from a particular e-mail address, optionally archiving them.
    • Recipient filtering is a method of rejecting certain e-mail addresses (e.g. for people who have left the organisation, or for non-existent addresses). One option is to filter messages for recipients who are not in the directory; however this can leave an organisation open to a directory harvest attack as the server gives different responses for valid and invalid addresses. To avoid such attacks, a “tarpit” (see Microsoft knowledge base article 842851) can be employed, to delay responses to bad addresses by a few seconds, slowing down any directory harvest attacks significantly (it would normally be possible to harvest all four-character address combinations within a few minutes – with a 5 second tarpit delay this is increased to a couple of months – and most addresses have much longer aliases than 4 characters).
    • Finally, the intelligent message filter (IMF – previously a separate download but now included with Exchange Server service pack 2) employs a Microsoft-proprietary algorithm (SmartScreen) to scan each message and mark it with a spam confidence level (SCL), which is then used to process the mail accordingly at the gateway or mailbox level.

    Each of these tools filters out less obvious types of UCE with increasing levels of cost in terms of server resource. Whilst the junk e-mail filters in Outlook 2003/2007 and Entourage 2004, which are also based on SmartScreen but doesn’t use the SCL mechanism, are pretty good at filtering messages, they are far from perfect (in my experience, Outlook seems to be better at this than Entourage). Activating the IMF on my server has provided an additional level of filtering which has greatly reduced the volume of UCE making it through as far as my mailbox.

    The IMF uses 11 SCL ratings, set as an attribute in the message header:

    • -1 is used for messages submitted internally with an authenticated connection – eliminating false positives for internal e-mail.
    • 0 is used for messages that are marked as not spam.
    • 1-9 are used to highlight varying levels of probability that a message is spam (9 being the most likely).

    Within Exchange, the SCL value can be used to filter UCE on gateway servers as well as with a lower level SCL used by the information store to move messages to the user’s junk e-mail folder – therefore allowing for the most obvious UCE to be trapped at the gateway (least chance of false positives) and for users to retrieve any messages in the mid-range that are incorrectly marked as junk. The gateway blocking action is also configurable – with options for archival, deletion (without NDR), no action, or rejection.

    Archived messages will be saved (by default) to %programfiles%\Exchsrvr\Mailroot\vsi 1\UCEArchive. Each message is archived as an .EML file, which can be viewed with a text editor. To resubmit a message for delivery it can simply be moved to the corresponding %programfiles%\Exchsrvr\Mailroot\vsi 1\Pickup folder. Obviously, viewing individual messages in a text file is time-consuming and the IMF Archive Manager is a great tool for managing IMF-archived messages.

    The SCL at which to block messages for a particular organisation will vary according to the profile of e-mail sent to/from the organisation – I have my SCL level for gateway blocking set to 7 with archiving enabled and so far I have only had one false positive – but clearly for organisations receiving more e-mail than I do, this will be a bigger issue! At the store level (set to move messages with an SCL greater than 4) things are not working quite so well but that is to be expected as in the grey area between good and bad mail, some legitimate (good) messages will inevitably get marked with the same SCL as the (bad) UCE. It’s worth noting that marking a sender as safe in Outlook will only override the SCL at the mailbox-level – it has no effect at the gateway.

    To assist in judging the SCL levels to use for filtering, it is possible to expose the SCL in Outlook and in Outlook Web Access (OWA). Also useful may be (temporarily) enabling diagnostic logging on the MSExchangeTransport\SMTP Protocol for a server, such that SMTP events are logged. Performance monitor counters from the MSExchange Intelligent Message Filter object can also be used to log the amount of spam filtered or acted upon, the relative SCL levels and overall IMF performance. Based on the performance monitor data, the IMF gateway blocking configuration can be reduced from no action to archive, and then finally (once confident that the levels are correct) to delete, as the appropriate SCL levels are determined.

    It’s also possible to mark the SCL on archived messages by creating an new registry key called ContentFilter at HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ and a corresponding DWORD value named ArchiveSCL set to 1. A string value named ArchiveDir can also be used to change the archive folder. Both of these settings are detailed in the Microsoft Exchange Server TechCenter along with details for applying the IMF to trusted (authenticated) connections and increasing the size limit for the rule used to process spam at mailbox level (allowing more blocked and safe senders).

    Suggested further reading
    IMF release notes (Microsoft knowledge base article 867633).
    Microsoft Exchange Team Blog.

    New tools from Quest for Exchange Server 2007

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    Exchange Server 2007 has the potential to shake up messaging but there is no direct upgrade path for those organisations still running Exchange Server 5.5 (and there are a surprisingly high number of these). All is not lost though as, earlier today, I heard Joe Baguley, Global Product Director for Quest Software, give a presentation of the various tools that they now have on offer (the list is impressive) and, interestingly, Quest plan to have Exchange Server 5.5-2007 migration tools available when Exchange Server 2007 is released, as well as tools for migrating Exchange public folders to SharePoint.

    Enabling Outlook Mobile Access for Exchange Server 2003

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    A few years ago I attended an Exchange Server 2003 overview presented by Microsoft UK and Conchango (where I subsequently worked for a while) and got to play with Outlook Mobile Access (OMA) using an emulated mobile phone connection. I was pretty impressed (these were the days before smartphones became a reality) but haven’t used the functionality since. Until last night that was, when (inspired by a mobility presentation which Jason Langridge gave at the Microsoft UK Security Summit a couple of days back) I was tweaking a few settings on my Exchange server and decided to enable OMA.

    For those who are not familiar with OMA, it supports mobile microbrowser access to Exchange Server 2003 for browsers that use HTML, extensible HTML (XHTML), wireless application protocol (WAP) 2.x or compressed HTML (CHTML) with access to Inbox, Calendar, Contacts, and Tasks as well as a searchable global address list and searchable Inbox folders .

    OMA Main Menu

    My handset is a fairly simple Nokia 6021 (but it does everything that I need it to) and is not on the list of supported handsets but there’s an option in Exchange System Manager to enable unsupported devices. After enabling OMA in the mobile services global settings (and optionally enabling unsupported devices) browsing to the server and reading my messages should be as simple as initiating a GPRS connection from my phone to my Exchange server (but with /oma instead of /exchange) and logging on (SMTP forwarding is also available but it requires the use of a WAP gateway and additional settings to define the mobile carrier).

    Unfortunately my browse request was greeted with the following error message:

    A System error has occurred while processing your request. Please try again. If the problem persists, contact your administrator.

    Additionally, Exchange Server logged the following error in the application event log:

    Event Type: Error
    Event Source: MSExchangeOMA
    Event Category: (1000)
    Event ID: 1503
    Date: 06/07/2006
    Time: 23:36:57
    User: N/A
    Computer:
    servername
    Description:
    An unknown error occurred while processing the current request:
    Message: The remote server returned an error: (403) Forbidden.
    Source: Microsoft.Exchange.OMA.ExchangeDataProvider
    Stack trace:
    at Microsoft.Exchange.OMA.ExchangeDataProvider.OmaWebRequest.GetRequestStream()
    at Microsoft.Exchange.OMA.ExchangeDataProvider.ExchangeServices.GetSpecialFolders()
    at Microsoft.Exchange.OMA.ExchangeDataProvider.ExchangeServices..ctor(UserInfo user)

    Message: Exception has been thrown by the target of an invocation.
    Source: mscorlib
    Stack trace:
    at System.Reflection.RuntimeConstructorInfo.InternalInvoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture, Boolean isBinderDefault)
    at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
    at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
    at System.Activator.CreateInstance(Type type, BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
    at Microsoft.Exchange.OMA.UserInterface.Global.Session_Start(Object sender, EventArgs e)

    Message: Exception of type Microsoft.Exchange.OMA.DataProviderInterface.ProviderException was thrown.
    EventMessage:
    UserMessage: A System error has occurred while processing your request. Please try again. If the problem persists, contact your administrator.
    Source: Microsoft.Exchange.OMA.UserInterface
    Stack trace:
    at Microsoft.Exchange.OMA.UserInterface.Global.Session_Start(Object sender, EventArgs e)
    at System.Web.SessionState.SessionStateModule.RaiseOnStart(EventArgs e)
    at System.Web.SessionState.SessionStateModule.CompleteAcquireState()
    at System.Web.SessionState.SessionStateModule.BeginAcquireState(Object source, EventArgs e, AsyncCallback cb, Object extraData)
    at System.Web.AsyncEventExecutionStep.System.Web.HttpApplication+IExecutionStep.Execute()
    at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

    Microsoft knowledge base article 898131 suggested that the on-screen error may have been related to multiple server identities and incorrect host headers for the OMA website; however I didn’t find that to be the case (that is to say that the resolution I found works regardless of whether or not I change the host headers to include the NetBIOS name of my server, which is accessed externally using a totally different name). Microsoft knowledge base article 817379 was much more useful as it seems the issue is related to the fact that my server is only accessible using an SSL connection, forms-based authentication is enabled and I don’t have a dedicated front-end server. Following Microsoft’s advice to create a secondary virtual directory for Exchange that does not require SSL (/exchange-oma), and then adding a registry value to point to the new virtual directory resolved the issue for me.

    I still access the server using HTTPS to https://exchangeservername/oma (external HTTP connections cannot reach my Exchange server) but this fix resolves the internal operations between OMA, the OWA templates and DAV on the mailbox server.

    To read more about configuring OMA, an OMA 2003 tutorial is available at MSExchange.org. It’s also possible to test OMA using the Nokia mobile browser and WAP gateway simulators (which is what I used for the screenshot shown above).

    Exchange Server 2007 may well shake up messaging – and about time too!

    This content is 18 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

    A colleague recently alerted me to a Network World article about how Exchange 2007 will shake up messaging. Whilst Exchange Server 2007 (formerly codenamed E12) will bring significant improvements that will require careful consideration and planning, I found the article to be highly misleading and thought I’d probably better set the record straight.

    Firstly the article states that the new role-based architecture has the potential to require up to 5 types of Exchange server to be rolled out (up from just 2 with current versions); however it’s not that simple. The five roles are:

    • Edge transport (message hygiene).
    • Hub transport.
    • Client access.
    • Mailbox server.
    • Unified messaging.

    Exchange Server 2003 and earlier do not have message hygiene or unified messaging capabilities (so that counts for two of the new roles); however many organisations will have a separate product already performing message hygiene functionality so even that is not really an additional server to deploy (simply a case of replacing a third party product with a Microsoft one). Also (and crucially), four of the roles (all except edge transport) can be co-hosted on a single server if required. What the new role-based model really provides is flexibility in designing an Exchange server infrastructure.

    The move to 64-bit architecture has come in for much criticism from some people but quite simply that is the way things are going. All servers sold in the last 18 months or so by a tier 1 OEM (basically HP, Dell and IBM) have had 64-bit capabilities even if they have had a 32-bit operating system installed so the Longhorn Server wave of products that will hit us in 2007 are time to “get with the program”. A 64-bit architecture removes many constraints (e.g. memory limitations) and allows for applications such as Exchange to scale more effectively, allowing larger mailboxes and greater consolidation.

    The new clustering features are where there is the most uncertainly at the moment (features may well come and go before release); however the article refers to one user who doesn’t want his server to fail over from LA to Chicago. That may well be the case for some, but for many wouldn’t it be good if we could easily fail service over between two data centres? In any case, Exchange Server 2007 is likely to support three forms of clustering (on mailbox servers) – the current Microsoft cluster service, local continuous replication and continuous clustered replication (for geoclusters) so there are many options. As for only mailbox servers supporting clustering – so what! All other Exchange server roles either hold transient data or perform a client access role – load balancing is probably more appropriate.

    My final issue is that the article points out that upgrading from Exchange Server 5.5 is not supported. Whether or not there are many organisations using it, Exchange Server 5.5 will be 4 releases old when Exchange Server 2007 hits the streets and is already unsupported. It is time to drop legacy platforms in order to make better use (dare I say “leverage”) Active Directory more effectively. This is another case of needing to “get with the program” – e-mail is being viewed as more and more critical by organisations and should not be left languishing on an outdated and unsupported platform.

    As one would expect after 4 years (and for a major release), there are many additional features and enhancements planned for Exchange Server 2007, each with their own implications that need to be considered during the infrastructure design and implementation planning. Much of the information I have on Exchange Server 2007 was supplied under NDA but everything I’ve written here is available publicly and other information sources include the excellent Microsoft Exchange team blog, as well as Microsoft UK’s Eileen Brown (and of course my own ramblings here).