Exchange Server 2010 Tips

[LEFT][B]Backup and Restore Personal Folders in Outlook [/B]

[B]Backing Up Personal Folders[/B]
The Microsoft Office Online site ([URL="http://office.microsoft.com/"]office.microsoft.com[/URL]) offers a Personal Folders Backup Tool as a free download. To use this tool, be sure to download the appropri¬ate version for your version of Outlook and then exit Outlook before installing the tool. After you download and install the backup tool, you can back up a user’s personal folders by completing the following steps:
[B]1. [/B] Log on as the user, and then start Outlook.
[B]2. [/B] In Outlook, on the File menu, click Backup.
[B]3. [/B] Click Options.Select the check boxes for the personal folders you want to back up.
[B]4. [/B] Click Browse.Navigate to the location where you want to save the backup, and then click Open.
[B]5. [/B] To remind users to create personal folder backups, select the Remind Me To Backup Every … Days check box, specify the reminder interval, and then click OK.
[B]6. [/B] Click Save Backup.
[B]7. [/B] Exit Outlook so that the backup process can begin.

[B]Restoring Backed-Up Personal Folder Data[/B]
After you’ve created a backup of a personal folder, you can recover any backed-up messages or data by following these steps:
[B]1. [/B] In Outlook, open the .pst file as discussed previously in the “Creating New or Opening Existing Personal Folders” section.
[B]2. [/B] Drag messages or data entries from the backup personal folder to the current personal folder.You’ll restore the selected items.

To recover the entire .pst file from backup, follow these steps:
[B]1. [/B] In Outlook, on the Tools menu, click Account Settings.
[B]2. [/B] In the Account Settings dialog box, click the Data Files tab.Write down the name and folder location of the damaged .pst file.
[B]3. [/B] Exit Outlook.
[B]4. [/B] In Windows Explorer, rename the damaged .pst file.
[B]5. [/B] In Windows Explorer, copy the backup .pst file to the folder containing the original .pst file.
[B]6. [/B] In Windows Explorer, give the backup .pst file the original name of the .pst file.
[B]7. [/B] Restart Outlook
[/LEFT]

[LEFT][B]Hide Mailboxes from Address Lists in Exchange Server 2010[/B]

Occasionally, you might want to hide a mailbox so that it doesn’t appear in the global address list or other address lists. One reason for doing this is if you have administrative mailboxes that you use only for special purposes.
To hide a mailbox from the address lists, follow these steps:

[B]1. [/B] Open the Properties dialog box for the mailbox-enabled user account by double-clicking the user name in the Exchange Management Console.

[B]2. [/B] On the General tab, select the Hide From Exchange Address Lists check box and then click OK
[/LEFT]

[LEFT][B]Use a cmdlet to Create a User account and Mailbox in Exchange 2010[/B]

In the Exchange Management Shell, you can create a user account with a mailbox by using the New-Mailbox cmdlet.

Here’s an example of the syntax and usage.

Note: When you are prompted, enter a secure password for the new user account.

[B]Syntax
[/B][CODE]
New-Mailbox -Name Name -Password Password
-UserPrincipalName UserNameAndSuffix
[-MailboxPlan <MailboxPlanIdParameter>] {AddtlParams} {ModParams}
New-Mailbox -Name Name -Password Password -WindowsLiveID WindowsLiveId
[-EvictLiveId {$true | $false}] [-MailboxPlan MailboxPlanId]
{AddtlParams} {ModParams}
New-Mailbox -Name Name -UserPrincipalName UserNameAndSuffix
[-MailboxPlan MailboxPlanId] {AddtlParams} {ModParams}
New-Mailbox -Name Name -UseExistingLiveId {$true | $false} -WindowsLiveIDWindowsLiveId
[-MailboxPlan MailboxPlanId] {AddtlParams} {ModParams}
New-Mailbox -Name Name -Shared {$true | $false} -UserPrincipalNameUserNameAndSuffix
[-Password Password] {AddtlParams} {ModParams}
New-Mailbox -Name Name -Room {$true | $false} -UserPrincipalNameUserNameAndSuffix
[-Password Password] {AddtlParams} {ModParams}
New-Mailbox -Name Name -Equipment {$true | $false} -UserPrincipalNameUserNameAndSuffix
[-Password Password] {AddtlParams} {ModParams}
New-Mailbox -Name Name -LinkedDomainController DCName
-LinkedMasterAccount Identity -UserPrincipalName UserNameAndSuffix
[-LinkedCredential Credential] [-Password Password]{AddtlParams} {ModParams}
New-Mailbox -Name Name -ImportLiveId {$true | $false}
-WindowsLiveIDWindowsLiveId {AddtlParams} {ModParams}
New-Mailbox -Name Name -Arbitration {$true | $false} -UserPrincipalNameUserNameAndSuffix
[-Password Password] {AddtlParams}
New-Mailbox -Name Name -FederatedIdentity FederatedId -WindowsLiveIDWindowsLiveId {AddtlParams}

{ModParams}
[-ArbitrationMailbox ModeratorMailbox] [-ModeratedBy Moderators][-ModerationEnabled <$true | $false>]
[-SendModerationNotifications<Never | Internal | Always>]

{AddtlParams}
[-ActiveSyncMailboxPolicy MailboxPolicyId] [-Alias ExchangeAlias] [-Archive {$true | $false}]
[-Database DatabaseId] [-DisplayName Name] [-DomainController FullyQualifiedName] [-FirstName FirstName]
[-Initials Initials] [-LastName LastName] [-ManagedFolderMailboxPolicy MailboxPolicyId]
[-ManagedFolderMailboxPolicyAllowed {$true | $false}] [-Organization OrgName] [-OrganizationalUnit OUName]
[-PrimarySmtpAddress SmtpAddress] [-QueryBaseDNRestrictionEnabled <$true | $false>]
[-RemoteAccountPolicy RemoteAccountPolicyId] [-ResetPasswordOnNextLogon <$true | $false>]
[-SamAccountName PreWin2000Name] [-SharingPolicy SharingPolicyId] [-ThrottlingPolicy ThrottlingPolicyId]

[/CODE]

[B]Usage
[/B][CODE]
New-Mailbox -Name "Shane S. Kim" -Alias "shanek" -OrganizationalUnit "cpandl.com/Engineering"
-Database "Engineering Primary" -UserPrincipalName "shanek@cpandl.com" -SamAccountName "shanek" -FirstName "Shane"
-Initials "S" -LastName "Kim" -ResetPasswordOnNextLogon $true -Archive $true

[/CODE]
[/LEFT]

[LEFT][B]Configure Auditing for Exchange Server Usage[/B]

Auditing lets you track what’s happening with Exchange Server. You can collect information about logons and logoffs, permission use, and much more. Any time an action that you’ve configured for auditing occurs, it is written to the system’s security log, which you can access from Event Viewer.

You can audit Exchange activity by enabling auditing in a Group Policy object applied to your Exchange servers. This policy object can be a local Group Policy object or an Active Directory Group Policy object. You manage a server’s local Group Policy object using the Local Security Policy tool. You manage Active Directory Group Policy using the Group Policy Management Console (GPMC). GPMC is included as a Windows feature with Windows Vista and later versions of Windows. After you add GPMC as a feature, you can access it on the Administrative Tools menu.

You can enable Exchange auditing by completing the following steps:

[B]1. [/B] Start the Group Policy Management Console by clicking Start, All Programs, Administrative Tools, Group Policy Management. You can now navigate through the forest and domains in the organization to view individual Group Policy objects.

[B]2. [/B] To specifically audit users’ actions on Exchange Server, you should consider creating an organizational unit (OU) for Exchange servers and then define auditing policy for a Group Policy object applied to the OU. After you’ve created the OU or if you have an existing OU for Exchange servers, right-click the related policy object, and then select Edit to open the policy object for editing in Group Policy Management Editor.

[B]3. [/B] You access the Audit Policy node by working your way down through the console tree. Expand Computer Configuration, Policies, Windows Settings, Security Settings, and Local Policies. Then select Audit Policy.

[B]4. [/B] You should now see the following auditing options:

[LIST][*][B]Audit Account Logon Events[/B] Tracks user account authentication during logon. Account logon events are generated on the authenticating computer when a user is authenticated.[*][B]Audit Account Management[/B] Tracks account management by means of Active Directory Users And Computers. Events are generated any time user, computer, or group accounts are created, modified, or deleted.[*][B]Audit Directory Service Access[/B] Tracks access to Active Directory. Events are generated any time users or computers access the directory.[*][B]Audit Logon Events[/B] Tracks local logon events for a server or workstation.[*][B]Audit Object Access[/B] Tracks system resource usage for mailboxes, information stores, and other types of objects.[*][B]Audit Policy Change[/B] Tracks changes to user rights, auditing, and trust relationships.[*][B]Audit Privilege Use[/B] Tracks the use of user rights and privileges, such as the right to create mailboxes.[*][B]Audit Process Tracking[/B] Tracks system processes and the resources they use.[*][B]Audit System Events[/B] Tracks system startup, shutdown, and restart, as well as actions that affect system security or the security log.[/LIST]


[B]5. [/B] To configure an auditing policy, double-click or right-click its entry, and then select Properties. This opens a Properties dialog box for the policy.

[B]6. [/B] Select the Define These Policy Settings check box, and then select the Success check box, the Failure check box, or both. Success logs successful events, such as successful logon attempts. Failure logs failed events, such as failed logon attempts.

[B]7. [/B] Repeat steps 5 and 6 to enable other auditing policies. Note that the policy changes won’t be applied until the next time you start the Exchange server
[/LEFT]

[LEFT][B]Easily Allow a User to Access Another User’s Mailbox [/B]

Occasionally, users need to access someone else’s mailbox, and in certain situations this is appropriate and preferable. You can grant permissions for a mailbox in two ways: grant access to a mailbox and its content or grant the right to send messages as the mailbox owner.

If you want to grant access to a mailbox and its contents but not grant Send As permissions, you can use the Manage Full Access Permission Wizard. In the Exchange Management Console, right-click the mailbox you want to work with and then select Manage Full Access Permission.

In the Manage Full Access Permission Wizard, click Add, and then use the Select User Or Group dialog box to choose the user or users who should have access to the mailbox. To revoke the authority to access the mailbox, select an existing user name in the Security Principal list box and then click Remove. Click Manage to set the desired access permissions.

In the Exchange Management Shell, you can use the Add-MailboxPermission and Remove-MailboxPermission cmdlets to manage full access permissions.

[B]Adding full access permissions[/B]

[CODE]
Syntax
Add-MailboxPermission -Identity UserBeingGrantedPermission -User UserWhoseMailboxIsBeingConfigured -AccessRights 'FullAccess'

Usage
Add-MailboxPermission -Identity 'CN=Jerry Orman,OU=Engineering,DC=cpandl,DC=com' -User 'CPANDL\boba' -AccessRights 'FullAccess'

[/CODE][B]Removing full access permissions
[/B][CODE]
Syntax
Remove-MailboxPermission -Identity 'UserBeingGrantedPermission' -User 'UserWhoseMailboxIsBeingConfigured' -AccessRights 'FullAccess'
-InheritanceType 'All'

Usage
Remove-MailboxPermission -Identity 'CN=Jerry Orman, OU=Engineering,DC=cpandl,DC=com' -User 'CPANDL\boba' -AccessRights 'FullAccess'
-InheritanceType 'All'

[/CODE]If you want to grant Send As permissions, you can use the Manage Send As Permission Wizard. In the Exchange Management Console, right-click the mailbox you want to work with and then select Manage Send As Permission. In the Manage Send As Permission Wizard, click Add, and then use the Select Recipient dialog box to choose the user or users who should have this permission. To revoke this permission, select an existing user name in the Security Principal list box and then click Remove. Click Manage to set the desired Send As permissions.

In the Exchange Management Shell, you can use the Add-ADPermission and Remove-ADPermission cmdlets to manage Send As permissions.

[B]Adding Send As permissions
[/B][CODE]
Syntax
Add-ADPermission -Identity UserBeingGrantedPermission -User UserWhoseMailboxIsBeingConfigured -ExtendedRights 'Send-As'

Usage
Add-ADPermission -Identity 'CN=Jerry Orman,OU=Engineering,DC=cpandl,DC=com' -User 'CPANDL\boba' -ExtendedRights 'Send-As'

[/CODE][B]Removing Send As permissions
[/B][CODE]
Syntax
Remove-ADPermission -Identity UserBeingRevokedPermission -User UserWhoseMailboxIsBeingConfigured -ExtendedRights 'Send-As'
-InheritanceType 'All' -ChildObjectTypes $null -InheritedObjectType $null -Properties $null

Usage
Remove-ADPermission -Identity 'CN=Jerry Orman,OU=Engineering, DC=cpandl,DC=com' -User 'CPANDL\boba' -ExtendedRights 'Send-As'
-InheritanceType 'All' -ChildObjectTypes $null -InheritedObjectTypes $null -Properties $null

[/CODE][/LEFT]

[LEFT][B]Set Message Send and Receive Restrictions on Individual Mailboxes
[/B]
By default, user mailboxes are configured to accept messages from anyone. To override this behavior, you can do the following:

[LIST][*]Specify that only messages from the listed users, contacts, or groups be accepted.[*]Specify that messages from specific users, contacts, or groups listed be rejected.[*]Specify that only authenticated users—meaning users who have logged on to the Exchange system or the domain—be accepted.[/LIST]


You set message send and receive restrictions by completing the following steps:
[B]1. [/B] Open the Properties dialog box for the mailbox-enabled user account by double-clicking the user name in the Exchange Management Console.
[B]2. [/B] On the Mail Flow Settings tab, double-click Message Delivery Restrictions. You can now set message acceptance restrictions.
[B]3. [/B] If you want to ensure that messages are accepted only from authenticated users, select the Require That All Senders Are Authenticated check box.
[B]4. [/B] To accept messages from all e-mail addresses except those on the reject list, under Accept Messages From, select All Senders.
[B]5. [/B] To specify that only messages from the listed users, contacts, or groups be accepted, select the Only Senders In The Following List option and then add acceptable recipients by following these steps:

[LIST][*]Click Add to display the Select Recipient dialog box.[*]Select a recipient, and then click OK.Repeat as necessary.[/LIST]
[B]6. [/B] To specify that no recipients should be rejected, under Reject Messages From, select No Senders.
[B]7. [/B] To reject messages from specific recipients, under Reject Messages From, select Senders In The Following List and then add unacceptable recipients by following these steps:

[LIST][*]Click Add to display the Select Recipients dialog box.[*]Select a recipient, and then click OK.Repeat as necessary.[/LIST]
[B]8. [/B] Click OK.

[/LEFT]

[LEFT][B]Format Output Data to Expose More of the Information You Want

[/B]When you work with the Exchange Management Shell, the standard output won’t necessarily provide all the information you are looking for. Often, you need to format the output as a list or table using Format-List or Format-Table, respectively, to get the additional information you desire.

Format-List comes in handy when you are working with a small set of resources or want to view all the properties that are available. Once you know what properties are available for a particular resource, you can format the output as a table to view specific properties.

For example, if you format the output of Get-MailboxStatistics as a list, you see all the properties that are available for mailboxes, as shown in this example and sample output:
get-mailboxstatistics -identity "cpandl\daniele" | format-list

[B]Output
[/B][CODE]
AssociatedItemCount : 2655
DeletedItemCount : 121
DisconnectDate :
DisplayName : Daniel Escapa
ItemCount : 2451
LastLoggedOnUserAccount : NT AUTHORITY\SYSTEM
LastLogoffTime : 6/15/2010 12:58:18 PM
LastLogonTime : 6/15/2010 12:58:14 PM
LegacyDN : /O=FIRST ORGANIZATION/OU=EXCHANGE ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=DANIEL ESCAPA
MailboxGuid : d3f6ce55-fe3d-4beb-ae65-9c9f7edaf995c
ObjectClass : Mailbox
StorageLimitStatus : BelowLimit
TotalDeletedItemSize : 97 KB (97,235 bytes)
TotalItemSize : 1155.11 KB (1,155,445 bytes)
Database : Customer Service Primary
ServerName : CORPSERVER45
DatabaseName : Customer Service Primary
MoveHistory :
IsQuarantined : False
IsArchiveMailbox : False
Identity : d3f6ce44-fe0c-4beb-ae79-9c9f8eaf123c
MapiIdentity : d3f6ce44-fe0c-4beb-ae79-9c9f8eaf123c
OriginatingServer : corpserver45.cpandl.com
IsValid : True

[/CODE]

Once you know the available properties, you can format the output as a table to get exactly the information you want to see. In this example, you get information about all the mailboxes in the Engineering Primary database and format the output as a table:
Get-MailboxStatistics -Database 'Engineering Primary' | format-table DisplayName, TotalItemSize, TotalDeletedItemSize, Database, ServerName
[/LEFT]

[LEFT][B]Quickly View the Current Mailbox Size, Message Count, and Last Logon[/B]

You can use the Exchange Management Console to view who last logged on to a mailbox, the last logon date and time, the mailbox size, and the message count by completing these steps:
[B]1. [/B] Expand the Recipient Configuration node and then select the Mailbox node.
[B]2. [/B] Double-click the mailbox with which you want to work.
[B]3. [/B] On the General tab, the Last Logged On By text box shows who last logged on to the mailbox, and the Modified entry shows the date and time the mailbox was last modified.
[B]4. [/B] On the General tab, the Total Items and Size (KB) areas show the number of messages in the mailbox and the current mailbox size in kilobytes, respec¬tively.

If you want to view similar information for all mailboxes on a server, the easiest way is to use the Get-MailboxStatistics cmdlet. Here are some examples of using this cmdlet.

[B]Syntax
[/B][CODE]
Get-MailboxStatistics -Identity 'Identity' [-Archive <$true|$false>] [-DomainContoller DomainController]
[-IncludeMoveHistory <$ true|$false>] [-IncludeMoveReport <$true|$false>]
Get-MailboxStatistics -Server 'Server' | -Database 'Database' [-DomainContoller DomainController]

[/CODE]

[B]Usage
[/B][CODE]
Get-MailboxStatistics -Server 'corpsvr127'
Get-MailboxStatistics -Database 'Engineering Primary'
Get-MailboxStatistics –Identity 'cpandl\williams'

[/CODE]
[/LEFT]

[LEFT][B]Understand the Exchange Server Roles in Exchange Server 2010[/B]

With Exchange Server Setup, you can deploy servers with specific roles through¬out the enterprise. Prior to setup and configuration, you need to decide how you will use Exchange Server 2010, what roles you will deploy, and where you will locate those roles. Afterward, you can plan for your deployment and then roll out Exchange Server.
Exchange Server 2010 implementations have three layers in their architecture: a network layer, a directory layer, and a messaging layer. The messaging layer is where you define and deploy the Exchange Server roles. The Exchange servers at the core of the messaging layer can operate in the following roles:

[B]Mailbox Server[/B] This is a back-end server that hosts mailboxes, public folders, and related messaging data, such as address lists, resource scheduling, and meeting items. For high availability of mailbox databases, you can use database availability groups.

[B]Client Access Server[/B] This is a middle-tier server that accepts connections to Exchange Server from a variety of clients. This server hosts the protocols used by all clients when checking messages. On the local network, Outlook MAPI clients are connected directly to the Client Access server to check mail. Remote users can check their mail over the Internet by using Outlook Anywhere, Outlook Web App, Exchange ActiveSync, POP3, or IMAP4.

[B]Unified Messaging Server[/B] This is a middle-tier server that integrates a private branch exchange (PBX) system with Exchange Server 2010, allowing voice messages and faxes to be stored with e-mail in a user’s mailbox. Unified messaging supports call answering with automated greetings and message recording, fax receiving, and dial-in access. With dial-in access, users can use Outlook Voice Access to check voice mail, e-mail, and calendar informa¬tion; to review or dial contacts; and to configure preferences and personal options. Note that to receive faxes, you need an integrated solution from a Microsoft partner.

[B]Hub Transport Server[/B] This is a mail routing server that handles mail flow, rout¬ing, and delivery within the Exchange organization. This server processes all mail that is sent inside the organization before it is delivered to a mailbox in the organization or routed to users outside the organization. Processing ensures that senders and recipients are resolved and filtered as appropriate, content is filtered and has its format converted if necessary, and attachments are screened. To meet any regulatory or organizational compliance require¬ments, the Hub Transport server can also record, or journal, messages and add disclaimers to them.

[B]Edge Transport Server[/B] This serves as an additional mail routing server that routes mail into and out of the Exchange organization. This server is designed to be deployed in an organization’s perimeter network and is used to establish a secure boundary between the organization and the Internet. This server ac¬cepts mail coming into the organization from the Internet and from trusted servers in external organizations, processes the mail to protect against some types of spam messages and viruses, and routes all accepted messages to a Hub Transport server inside the organization.

These five roles are the building blocks of an Exchange organization. Note that you can combine all of the roles except for the Edge Transport server role on a single server. One of the most basic Exchange organizations you can create is one that includes a single Exchange server that provides the Mailbox server, Client Access server, and Hub Transport server roles. These three roles are the minimum required for routing and delivering messages to both local and remote messaging clients. For added security, you could deploy the Edge Transport server role in a perimeter network on one or more separate servers
[/LEFT]