Did you know that today is 20 years since we declared RTM (Released to Manufacturing) of Exchange 4.0?

Okay, so maybe this did not happen in the galaxy far away, but it sure feels like it! Here is a great overview of Exchange's earlier years (up to Exchange 2007).

Exchange has been evolving for over 20 years now, and is still going strong! From our humble beginnings, adding SMTP protocol through an IMC connector as well as web access to email in Exchange 5.0 back in 1997 (that was some cutting edge stuff back then!), starting to play in service waters 10 years later in 2007 (ever heard of Exchange Labs?) all the way to where we are today with Exchange Server 2016 and Exchange Online – we have gone through many a transformation.

One thing is certain, though – we would not have been here without you, our customers. You keep pushing us to get better and bring you more features. When we do something wrong (yeah, that happens), the incredible Exchange community is always quick to let us know. And for those of you wishing that this virtual birthday celebration could somehow take place in person, you’ll want to sign up to attend Microsoft Ignite in Atlanta.

Thank you for all the support and amazing ride! Anyone up for 20 more?

(Hat tip, Tony.)

The Exchange Team

The Exchange team is happy to announce our spring quarterly updates for Exchange Server are now available on the Microsoft Download Center. Exchange Server 2016 receives its first Cumulative Update, and Exchange Server 2013 Cumulative Update 12 is also released. Exchange Server 2007 and Exchange Server 2010 Update Rollups provide an updated OWA S/MIME control signed with a SHA-2 certificate. More information and highlights of all these releases can be found below.

Updated OWA S/MIME control

All of the packages released today include an update to the OWA S/MIME control. The control itself has not changed, but has now been signed with a SHA-2 compliant certificate. All of the updates released will install the updated control onto the Exchange Server. Users who have installed the control into their browser will need to re-install this onto devices where the previous version was installed. Installing the control is straight forward and can be done quickly using OWA Options, Exchange Control Panel or Exchange Admin Center depending upon the release of Exchange you are using.

New distribution package for Exchange Server 2016 updates

With the introduction of Cumulative Updates for Exchange Server 2016, we are making a change to the update package type for this product version. Previous versions of Exchange used self-extracting packages to deliver service packs and cumulative updates. We have heard requests to release these updates as .ISO’s. With the capability to mount .ISO’s directly in Windows Server 2012 and later, we think it makes sense to ship Cumulative Updates as .ISO’s. At this time, we are not planning to do this for Exchange Server 2013 Cumulative Updates but could be persuaded to do so if enough people ask for it. One down side to this approach is that the package is much larger. However, copying a single .ISO vs. the ever growing number of files and folders over the network is much more efficient and faster. We hope you like this change.

Change to Mailbox Anchoring for Remote PowerShell

We heard your feedback on the changes to load balancing Remote PowerShell introduced into Exchange Server 2013 and 2016. As announced by Ross here, we have reverted this behavior in the Cumulative Updates being released today.

Additional languages for Outlook on the Web

Exchange Server 2016 Cumulative Update 1 adds support for 17 additional languages in Outlook on the Web. These languages will appear automatically in the language selection drop down after a server is updated to Cumulative Update 1.

.Net 4.6.1 Support

We know that many of you have been asking about .Net 4.6.1 and Exchange. Rest assured we are working closely with the .Net Framework team to resolve issues preventing us from supporting .Net 4.6.1 with Exchange Server. While we are not there yet, we hope to be very soon. Support for .Net 4.6.1 is planned for future Cumulative Updates for Exchange Server 2013 and 2016.

Slow installations on Windows Server 2012 R2

For customers who are running Exchange on Windows Server 2012 R2, we want to make certain you are aware of a condition which can substantially increase the amount of time it takes to install Exchange Updates on this OS. Working with the .Net team, we have discovered that systems which have applied Windows Update KB3097966 can take 50% more time to install Exchange. The .Net team is working on a resolution to this and will include a fix in a future product update. In the meantime, customers who have deployed this Windows update can take a one-time action on their server before installing Exchange or a Cumulative Update to bring installation time back to normal. This procedure needs to be done once on every Exchange server running Windows Server 2012 R2. The command to execute is:

“%windir%\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update”

Errors and warnings encountered running this command can be safely ignored provided the final exit status code of 0 is reported in the output.

Support for Standalone Hybrid Configuration Wizard in Exchange Server 2010

Customers using Exchange Server 2010 in Hybrid mode with Office 365 will notice a new link in the EMC to use the Updated Standalone Hybrid Configuration Wizard. We encourage all customers to use this updated version of the Hybrid Configuration Wizard.

Release Details

KB articles which contain greater depth on what each release includes are available as follows:

• Exchange Server 2016 Cumulative Update 1 (KB3134844), Download, UM Lang Packs
• Exchange Server 2013 Cumulative Update 12 (KB3108023), Download, UM Lang Packs
• Exchange Server 2010 Service Pack 3 Update Rollup 13 (KB3141339), Download
• Exchange Server 2007 Service Pack 3 Update Rollup 19 (KB3141352), Download

Note: Documentation may not be fully available at the time this post was published.

Exchange Server 2016 Cumulative Update 1 does include updates to Active Directory Schema. These updates will apply automatically during setup if the permissions and AD requirements are met during installation. If the Exchange Administrator lacks permissions to update Active Directory Schema, a Schema Admin should execute SETUP /PrepareSchema before installing Cumulative Update 1 on your first server. The Exchange Administrator should also execute SETUP /PrepareAD to ensure RBAC roles are updated correctly.

Exchange Server 2013 Cumulative Update 12 does not include updates to Active Directory or additional RBAC changes. However, depending on the version you are upgrading from, it may be required. PrepareAD will run automatically during the first server upgrade if Setup detects this is required and the logged on user has sufficient permission, otherwise, setup will require you to re-run setup with sufficient permissions.

Additional Information

Microsoft recommends all customers test the deployment of any update in their lab environment to determine the proper installation process for your production environment. For information on extending the schema and configuring Active Directory, please review the appropriate TechNet documentation.

Also, to prevent installation issues you should ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed. To verify the policy settings, run the Get-ExecutionPolicy cmdlet from PowerShell on the machine being upgraded. If the policies are NOT set to Unrestricted you should use the resolution steps in KB981474 to adjust the settings.

Reminder: Customers in hybrid deployments where Exchange is deployed on-premises and in the cloud, or who are using Exchange Online Archiving (EOA) with their on-premises Exchange deployment are required to deploy the most current (e.g., CU12) or the prior (e.g., CU11) Cumulative Update release.

For the latest information on Exchange Server and product announcements please see What's New in Exchange Server 2016 and Exchange Server 2016 Release Notes. You can also find updated information on Exchange Server 2013 in What’s New in Exchange Server 2013, Release Notes and product documentation available on TechNet.

The Exchange Team

If you’re an Exchange Online or Exchange Online Protection (EOP) subscriber and you have configured connectors, this post contains important information that might impact your organization. To make sure that your mail flow isn’t interrupted, we strongly recommend that you read this post and take any necessary action at your earliest convenience.

The change will impact you if one of the following scenarios apply to your organization:

• Your organization needs to send NDR (non-delivery report) messages to a recipient on the Internet and needs to relay them through Office 365.
• Your organization needs to send messages from your own email server (on-premises environment) from domains that your organization has not entered in Office 365 (see Add Domains in Office 365). For example, your organization Contoso needs to send email as the domain fabrikam.com, which doesn’t belong to your organization.
• There is a forwarding rule configured on your on-premises server, and messages need to relay through Office 365. For example, contoso.com is your organization’s domain, a user in your organization’s on-premises server, kate@contoso.com, has enabled forwarding. All her messages go to kate@tailspintoys.com. If john@fabrikam.com sends a message to kate@contoso.com, the message gets automatically forwarded to kate@tailspintoys.com. From Office 365’s point of view, the message is sent from john@fabrikam.com to kate@tailspintoys.com. Because Kate’s mail is being forwarded, neither the sender domain nor the recipient domain belongs to your organization.

Beginning February 1, 2017, Office 365 will no longer by default support relaying messages for the scenarios described above. If your organization needs those scenarios to continue to work, you need to make sure that the following are all true:

• You have created a connector in Office 365 that instructs the service to use certificate to authenticate emails coming from your organization’s own email server (on-premises environment).
• Your own email server (on-premises environment) is configured to use the certificate to send email to Office 365.
• This certificate is CA signed and its certificate name (CN) or subject alternative name (SAN) contains a domain that you have entered in Office 365.

To do so, use the following instructions.

Create or Edit a certificate-based connector in Office 365

For Office 365 to relay messages to internet that match with the scenarios listed above, you need to follow the below steps.

1. Sign in to Office 365 admin center, and go to Admin > Exchange.

2. Go to mail flow > connectors, and do one of the following:

If there are no connectors, choose ’+’ (Add) to create a connector.

If a connector already exists, select the connector, and choose Edit to modify it.

3. On the Select your mail flow scenario page, choose From: Your organization’s email server and To: Office 365. This creates a connector that indicates that your on-premises server is the sending source for your messages.

4. Enter connector name and other information, and then choose Next.

5. On the New connector or Edit connector page, choose the first option to use a TLS certificate to identify the sender source of your organization’s messages. The domain name in the option should match with the CN name or SAN in the certificate that you’re using. The domain you use needs to be a domain that belongs to your organization and you need to have added the domain to Office 365. For example, contoso.com belongs to your organization, and it’s part of CN name or SAN name in the certificate that your organization uses to communicate with Office 365.

Configure your on-premises environment

Use the following steps to prepare your on-premises servers to relay messages through Office 365:

1. If your organization uses Exchange server for its on-premises server, you need to configure your server to send messages over TLS. To do this, follow Set up your email server to relay mail to the Internet via Office 365, which is part 2.2 of “Set up connectors to route mail between Office 365 and your own email servers.” If you have already used Hybrid Configuration Wizard, then continue to use it, but ensure to use a certificate that matches the criteria outlined in step 5 of the previous section.
2. Install a certificate in your on-premises environment. For details, follow “Step 6: Configure an SSL certificate” of Configure mail flow and client access.

For more details about how to relay messages through Office 365, see the Setting up mail flow where some mailboxes are in Office 365 and some mailboxes are on your organization’s mail servers section of Mail flow best practices for Exchange Online and Office 365.

Carolyn Liu

Today marks the start of the one-year countdown before Exchange Server 2007 reaches the end of extended support. If Exchange Server 2007 is still part of your messaging infrastructure, it’s not too early to start planning an update.

It’s hard to believe that it’s been 9+ years since we released CCR, LCR and SCR. These technologies of course laid the ground work for the Database Availability groups we’ve relied upon since Exchange Server 2010. Exchange Server 2007 also marked the start of the transition to building Exchange Server on .Net Frameworks as well. We have continued that investment and the .Net Frameworks is now the foundation of all critical Exchange processes in Exchange Server 2013, 2016 and Office 365. PowerShell, also new to Exchange Server 2007, is even more prevalent in current versions of Exchange and is the de facto management tool for modern Exchange Servers.

As revolutionary as Exchange Server 2007 was at the time, our latest versions of Exchange Server and Office 365 have even more to offer. Customers running Exchange Server 2007 have the option to upgrade via mailbox move to Exchange Server 2010, 2013 or migrate directly to Office 365. Customers wanting to migrate to our latest version of Exchange Server, Exchange Server 2016, will need to first decrement Exchange Server 2007. Customers wanting to maximize their on-premises server investment should strongly consider migrating to Exchange Server 2016 as Exchange Server 2013 is already three years into its own 10-year lifecycle.

Below are links which you may find helpful to start planning your migration off of Exchange Server 2007 and be on your way to experiencing the latest capabilities of Exchange Server.

• Microsoft Exchange Server Deployment Assistant
• Upgrade from Exchange Server 2007 to Exchange 2013
• Planning and Deployment of Exchange Server 2016
• Office 365 Fast Track Center

The Exchange Team

Wanted to let you all know that it is not your imagination, our blog does look quite different now.

We have moved blogging platforms and are figuring out how it all fits and how we can customize the look. In other words – there will be more changes in the future. The new blog URL is https://blogs.technet.microsoft.com/exchange/ but any of the older URLs should still be redirecting you here.

Thanks for your patience while we are working through this!

Some known issues:

– Search does not seem to return any results
– Most of the URLs tried redirect correctly, but there seem to be some that do not redirect to posts themselves but rather to the whole “month” of posts
– Currently, the new blog does not have the ability to email subscribe to new posts; we suggest subscribing to the blog feed instead

Nino Bilic

If you plan to implement Exchange Server 2016 or Exchange Online, or if you want to make sure that your implementation was done right, these online training courses are for you! We are excited to announce the release of four new edX online training courses for Microsoft Exchange Server 2016:

• Course 1x: Microsoft Exchange Server 2016 Infrastructure: Learn how to plan, configure, and manage Active Directory infrastructure requirements for Microsoft Exchange Server 2016.
• Course 2x: Microsoft Exchange Server 2016 Client Access Services: Find out how to plan and implement mobile messaging, Outlook, and secure Internet access to improve client access services.
• Course 3x: Microsoft Exchange Server 2016 Mailbox Databases: Get the details on planning and configuring mailbox databases, including backup, recovery, and restoration.
• Course 4x: Microsoft Exchange Server 2016 Transport Services: Explore planning and configuring message transport services, including anti-virus, malware-filtering, and spam-filtering solutions.

Each Exchange course is targeted to the IT Professional audience, with hands-on labs that reinforce student learning. Students are graded on completing each module, as well as on module assessment exams and a final course exam. A Certificate can be earned by completing each course with a passing grade. Courses are self-paced, allowing IT Professionals to build Exchange skills at their own pace as their schedules permit.

The first course, CLD208.1x: Microsoft Exchange Server 2016 Infrastructure, is free. The remaining three courses are for-fee courses, at a cost of $49 USD per course.

edX is a massive open online course (MOOC) provider that was developed by MIT and Harvard University. The Microsoft Learning Experiences team has created a wide range of online training courses for edX, and these four Exchange courses are the team’s latest Office releases. They are the first of seven courses that cover the core skills an Exchange administrator needs to proficiently design, implement, and manage an Exchange 2016 and Exchange Online implementation.

Microsoft Learning Experiences team

Customers currently in the process of finalizing a migration from legacy Public Folders in Exchange 2010/2007 to Modern Public Folders in Exchange Online or Exchange 2016/2013, should read KB3161916. We’ve identified a scenario which, although it doesn’t appear to be common, could result in a loss of data.  If you have previously completed a migration of legacy to modern public folders and believe you may have encountered data loss, please contact support services for additional assistance.

Exchange Team

Some of relatively common and difficult issues we see in support are related to Outlook connectivity to Exchange.  There are several variations that we classify as connectivity (related to server performance or otherwise).  They can include:

• Clients prompting for credentials (intermittently or continuously)
• Clients getting disconnected
• Clients are unable to establish a connection
• Clients freezing or going unresponsive

There are many factors that can contribute to these symptoms, and each one can lead down a completely different troubleshooting path. In this particular post we will focus on methods and tools to troubleshoot these. There are too many potential underlying causes to cover them all but hopefully this will serve as a good starting point for troubleshooting.

This post is not meant to be a post that you necessarily read from start to finish, but rather serve as a guidance for when you need to troubleshoot hard to find issues related to client connectivity. It can be a bit overwhelming, sure, but depending on the depth that you need to get into – it might be all worth it!

Note: If you are an Office 365 customer with users having mailboxes in Exchange Online, we highly recommend using our new Office 365 Support and Recovery Assistant (aka SaRA) to troubleshoot Outlook connectivity and other common issues. SaRA is available at http://diagnostics.office.com.

In every case, it’s best to spend some time understanding what the user is actually experiencing. Understanding the full client experience and effect can help determine the logging and troubleshooting path. When you define the users issue, you should also run the Microsoft Office Configuration Analyzer Tool (OffCAT) on the client to have a good view of configuration that can impact their experience.

Client configuration

Here are some examples of things to consider when troubleshooting these issues.

• Are the clients connecting with Outlook Anywhere or MAPI/HTTP? Try to use the Outlook “Connection Status” window to access more information on the user’s connection by holding down the CTRL key and clicking the Outlook icon in the system tray so that the “Connection Status” window appears. Here you can see the protocol, the connection type, and so on RPC/HTTP indicates Outlook Anywhere, whereas HTTP indicates MAPI/HTTP.

• Are clients online or in cached mode? Cached mode is recommended. Moving critical users to cached mode to improve their experience might be a good thing. You can enable BitLocker if there are local storage considerations. What devices are clients traversing to hit the CAS? Run Tracert to the CAS to determine the devices in the path of the client.
• Test several clients with a hosts file pointing to the IP address of CAS using the external host name. The Hosts file is located in C:\Windows\System32\Drivers\etc directory.
• What is the user attempting to do when they experience issues? Accessing a calendar, public folders or just moving around in the Inbox?
• Are effected mailboxes on the same database, same server?
• What is the Outlook full build number? Always make sure that you are working with an updated client. Information about recent updates can be found in the following references:
  • How to install the latest applicable updates for Microsoft Outlook
  • Outlook and Outlook for Mac Update File Versions
• Using the OffCAT output, examine which add-ins are being used and consider disabling those for testing. Make sure that you restart Outlook and verify the add-ins remain disabled.
• Try running Outlook in safe mode for a few clients. Not all add-ins are removed when using safe mode so ensure you have verified they are no longer loaded with Process Explorer if you suspect they are still loaded.
• Enable Outlook logging.

CAS configuration

The first step for the Exchange server checks is to review all the settings noted in TechNet article, Exchange 2013 Sizing and Configuration Recommendations. Several items such as setting power management to “High Performance” and verify the OS isn’t turning off power to the NIC. Making sure the server is running updated and supported .NET version, and so on are extremely important:

• Run the Exchange Performance Health Checker script. Review the output for any results that have to be updated.
• As of right now, Exchange 2013 should be running .NET 4.5.2. Please see the Supportability Matrix for current version supported.
• Turn off hyper-threading
• Update outdated Outlook clients
• Update NIC drivers
• Eliminate any slow disk issues identified in Perfmon
• Set Power Management to “High Performance”
• Locate the NIC “Properties |Configure | Power Management” and verify the box for “Allow the computer to turn off this device to save power” is unchecked.
• Verify RSS and Chimney offload on CAS.
• Verify that all the noted hotfixes are installed from Exchange 2013 Sizing and Configuration Recommendations.
• CAS Keep Alive values should be set to 30 minutes and no less than 15 minutes. If there’s no entry in the registry for KeepAliveTime then the value is 2 hours. This value, if not set correctly, can affect both connectivity and performance as noted in KB, Unable to connect using Exchange ActiveSync due to Exchange resource consumption. You must make sure that the load balancer and any other devices in the path from client to CAS be set correctly. More information on load balancer settings are listed later in this document under Load Balancing Configuration section. The goal is to set CAS with the lowest value so that client sessions when ended, are ended by the CAS and not by a device.

Path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\
Value name: KeepAliveTime
Value Type: 1800000 (30 minutes, in milliseconds) (Decimal)

• Max Core Count – In Exchange 2013 and 2016, you can encounter performance problems if you go too far off of the preferred architecture, particularly when referring to core count. This can even include having too many cores. The maximum number of cores on a server should be no more than 24. Hyper-threading can artificially inflate this value so it’s important to disable it as mentioned. For more information, refer to following articles:
  • Troubleshooting High CPU utilization issues in Exchange 2013
  • Ask the Perf Guy: How big is too BIG?
• As a general statement, Preferred Architecture should be your guidance.

Load balancer configuration

Please note that for 3rd party load balancer configuration, you should always refer to product documentation / guidance. The following are some general best practices and things we see misconfigured:

1. Verify the client TCP Idle Time-Out is a slightly larger value than the Keep Alive setting on CAS, as noted earlier.

In this example, we are using the 30-minute Keep Alive on CAS and we have both a firewall and load balancer in front of the clients. Here is the connection path.

Clients > Firewall > Load Balancer > CAS

In this example, if you have a firewall in the path from client to CAS, we are referencing the firewall “idle” time out and not the persistence time out. This value should be greater than the load balancer and the load balancer time out should be greater than CAS. Note that it is not recommended to go below 15 minutes for Keep Alive on CAS or TCP idle timeout on the load balancer.

Firewall time out = 40 minutes
LB TCP Idle time out = 35 minutes
CAS Keep Alive = 30 minutes

2. If the load balancer supports it, the preferred option is to configure it to use “Least Connections” with “Slow start” during typical operation.

With the “least connections” method, be mindful it is possible for a CAS to become overloaded and unresponsive during a CAS outage or during patching/maintenance. In the context of Exchange performance, authentication is an expensive operation.

The TechNet article Exchange 2013 Sizing and Configuration Recommendations describes the differences as:

A hardware or software load balancer should be used to manage all inbound traffic to Client Access servers. The selection of the target server can be determined with methods such as “round-robin,” in which each inbound connection goes to the next target server in a circular list, or with “least connections,” in which the load balancer sends each new connection to the server that has the fewest established connections at that time. These methods are detailed further in the following blog Load Balancing in Exchange 2013 and TechNet Load balancing.

3. For ActiveSync persistence setting, set the load balancer to use “Authorization header cookie” to avoid one CAS becoming overloaded because source IP will send all the connections to one server as per this.

Additional troubleshooting steps

If you have completed the previous steps and you are still experiencing issues, the following data is necessary:

• Start Perfwiz on CAS and Mailbox server to run for 4 hours during the busiest part of the day (assuming this is when issues are happening). Download ExPerfwiz from here. Example command line: \experfwiz.ps1 -server MBXServer -interval 10 -filepath D:\Logs. Once you have the performance data, see blog on Troubleshooting High CPU Utilization issues in Exchange 2013
• Review the application logs for any 4999 events that occurred around the time of problems.
• In the Application log, review the 2080 event to make sure that all domain controllers are responding with correct Boolean values. If there are any responses that are not accurate, the DC’s should be repaired or excluded.

Expected values are“CDG 1 7 7 1 0 1 1 7 1” as shown in the following table.

For testing, a DC can be excluded by using the Set-Exchangeserver –StaticExcludedDomainControllers parameter as shown in this section, however, troubleshooting Global Catalog access should also be done as soon as your testing is completed. Statically excluding a GC takes effect immediately and will be viewable on the next 2080 Event ID with all zero values. Some additional resources on the subject:

• The PDC column should show 0 and not be used by Exchange
• More information for Set-ExchangeServer is located here
• More information about Event ID 2080 from MSExchangeDSAccess can be found here
• When in Application log, also check for Event ID 2070 or 2095. A 2070 event occurs when Exchange tries to query a DC and fails and it cannot contact/communicate with a DC. If this event occurs during the time when clients have issues (or frequently), then it should be investigated. If you only see this event occasionally over several days, it could be a result of the DC being restarted during maintenance. The same is true with event 2095; infrequent isn’t a concern but continued logging of this event could be a sign of a problem.
• Always ensure MaxConcurrentApi bottlenecks are not present in the environment. To avoid this problem now or in future review the following information:
  • You are intermittently prompted for credentials or experience time-outs when you connect to Authenticated Services
  • Updated – NTLM and MCA Concerns
  • Quick Reference: Troubleshooting, Diagnosing, and Tuning MaxConcurrentApi Issues
• LDAP latencies can impact server and client performance. When you work with client connectivity issues, the LDAP counter can help point delays with communications to the DC’s. These are under the MSExchange ADAccess Domain Controllers(*) LDAP Read Time and LDAP Search Time, and is recommended that the average be within 50ms and spikes no greater than 100ms. More information here.

Coexistence with Exchange 2010 and 2007

In order to coexist with newer versions of Exchange, certain configuration steps are necessary. This section outlines typical organization changes that are needed to connect through an Exchange 2013 CAS.

• Verify that legacy servers are at the latest available Service Pack and RU.
• If Outlook Anywhere is not enabled on legacy Exchange servers, we recommend that you enable Outlook Anywhere on every CAS in the organization with NTLM authentication for ClientAuthenticationMethod and NTLM and Basic for IISAuthenticationMethods. The external host name should be the DNS name of the Exchange 2013 CAS external URL.

Example:
Enable-OutlookAnywhere -Server ‘ConE10′ -ExternalHostname Mail.Contoso.com’ -ClientAuthenticationMethod ‘Ntlm’ -SSLOffloading $false –IISAuthenticationMethod Basic, NTLM

• Configure the Exchange 2010 SCP for AutoDiscover to point to Exchange 2013 CAS. The AutoDiscover SCP is used for the internal clients only. In some cases, you can just update DNS to point to Exchange 2013. DNS would have to point AutoDiscover to Exchange 2013 for all the external clients also. We do not recommend that you use separate URL’s for legacy mailboxes. All connections should use an Exchange 2013 CAS.

To set the SCP for AutoDiscover (example):
Set-ClientAccessServer ConE10 -AutoDiscoverServiceInternalUri https://Mail.Contoso.com/autodiscover/autodiscover.xml

• Verify all legacy CAS are pointed to 2013 for the SCP AutoDiscover URI.

Example:
Get-ClientAccessServer |fl *uri*
AutoDiscoverServiceInternalUri : https://Mail.Contoso.com/autodiscover/autodiscover.xml

• Be aware that Exchange 2007 mailboxes will access EWS and OAB by using “Legacy.Domain.com” as discussed here.

Known issues in coexistence

• Mailboxes located on 2010 Unable to Connect through Exchange 2013
• Users may be prompted for credentials when accessing additional mailboxes, calendars or Public Folders on Exchange 2010 server. See #2 in the previous section indicating that NTLM is not enabled on legacy CAS for Outlook Anywhere.

Troubleshooting Logs and Tools

HTTP Proxy RPCHTTP Logs

In Exchange 2013, there are several logs in the logging folder. For Outlook clients one of the first logs to examine are the HTTP Proxy logs on CAS. The connection walk-through section shows the process that is used to connect to Exchange 2013. This complete process is logged in the HTTP Proxy log. Also, if it is possible, add Hosts file to the client for one specific CAS to reduce the number of logs.

The logs on CAS are located here by default: C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\RpcHttp

HTTP Proxy AutoDiscover Logs

Exchange 2013 has HTTP Proxy logs for AutoDiscover that are similar to the logs shown earlier that can be used to determine whether AutoDiscover is failing.

The logs on CAS are located here by default: C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\AutoDiscover

HTTP Error Logs

HTTP Error logs are failures that occur with HTTP.SYS before hitting IIS. However, not all errors for connections to web sites and app pools are seen in the httperr log. For example, if ASP.NET threw the error it may not be logged in the HTTP Error log. By default, HTTP error logs are located in C:\Windows\System32\LogFiles\HTTPERR. Information on the httperr log and codes can be found here.

IIS Logs

IIS logs can be used to review the connection for RPC/HTTP, MAPI/HTTP, EWS, OAB, and AutoDiscover. The full data for the MAPI/HTTP and RPC/HTTP is not always put in the IIS logs. Therefore, there is a possibility that the 200 connection successful may not be seen. IIS codes.

In Exchange 2013 IIS logs on the CAS should contain all user connections on port 443. IIS logs on the Mailbox server should only contain connections from the CAS server on port 444.

Most HTTP connections are first sent anonymously which results in a 401 challenge response. This response includes the authentication types available in the response header. The client should then try to connect again by using one of these authentication methods. Therefore, a 401 status found inside an IIS log does not necessarily indicate an error.

Note that an anonymous request is expected to show a 401 response. You can identify anonymous requests because the domain\username is not listed in the request.

RPC Client Access (RCA) Logs

The RCA logs can be used to find when a user has made a connection to their mailbox, or a connection to an alternate mailbox, errors that occur with the connection, and more information. RCA logs are located in the logging directory which is located at %ExchangeInstallPath%\Logging\RpcClientAccess. By default, these logs have a maximum size of 10MB and roll over when size limit is reached or at the end of the day (based on GMT), and the server keeps 1GB in the log directory.

Outlook ETL Logging

ETL logs are located in %temp%/Outlook Logging and are named Outlook-#####.ETL. The numbers are randomly generated by the system.

To enable Outlook logging

In the Outlook interface:

• Open Outlook.
• Click File, Options, Advanced.
• Enable “Enable troubleshooting logging (requires restarting Outlook)”
• Restart Outlook.

How to enable Outlook logging in the registry:

• Browse to HKEY_CURRENT_USER\Software\Microsoft\Office\xx.0\Outlook\Options\Mail
• DWORD: EnableLogging
• Value: 1
• Note: xx.0 is a placeholder for your version of Office. 15.0 = Office 2013, 14.0 = Office 2010

ExPerfwiz (Perfmon for Exchange)

You can use Perfmon for issues that you suspect are caused by performance. http://experfwiz.codeplex.com/

Exchange 2013 has daily performance logs that captures the majority of what is needed. These logs are by default located in C:\Program Files\Microsoft\Exchange Server\V15\Logging\Diagnostics\DailyPerformanceLogs

Log Parser Studio

Log Parser Studio is a GUI for Log Parser 2.2. LPS greatly reduces complexity when parsing logs. Additionally, it can parse many kinds of logs including IIS Logs, HTTPErr Logs, Event Logs (both live and EVT/EVTX/CSV), all Exchange protocol logs from 2003-2013, any text based logs, CSV logs and ExTRA traces that were converted to CSV logs. LPS can parse many GB of logs concurrently (we have tested with total log sizes of >60GB).

Blog with tips/how to about LPS: http://blogs.technet.com/b/karywa/

Exmon tool (aka Microsoft Exchange Server User Monitor)

We use this tool to get detailed information about client traffic.

Hopefully this is helpful; we expect that we will make some updates to this checklist as time goes on!

Thanks to Brendon Lee, Marc Nivens, Nasir Ali, Louise Budrow and The Exchange Performance V-Team for technical review.

Charlene Weber

Once again the OffCAT team has shipped a new version (v2.2) that includes some pretty cool features to those found in earlier versions. Hopefully, you will find these features useful and that you understand why there were added in v2.2.

Let OffCAT fix issues for you

We heard you loud and clear that OffCAT needs to be able to fix issues that it finds. Well, in OffCAT v2.2 we added a ‘Fix it for me’ option for rules that detect problems in the registry.

Depending on the detected issue, you may also see a Fix it for me link at the top of the Solution and Issue Description pane.

When you click the Fix it for me link, OffCAT will make the necessary changes to your registry to fix this problem.

Note: When you click Fix it for me, the changes made by OffCAT are the same changes provided in the article referenced by the Click there to see possible solutions to this issue link and the changes can be undone, as shown in the following figure.

We are adding this functionality to more rules in the near future, so the list of issues that can be fixed by OffCAT will certainly grow over time.

Addition of ROIScan to the tools found under ADVANCED Tools

The Robust Office Inventory Scan (ROIScan) tool is a very popular tool that has lived as a vbs script in TechNet for many versions of Office. It is such a great tool for troubleshooting issues such as Office installation and Office updating that we decided to offer it as an advanced tool in OffCAT.

Just click that link, select your scan type, and then click the ‘Click to scan’ control to start the scan.

When the scan is finished, the results are displayed in a format similar to other types of OffCAT scans.

To view and/or save any of the files generated by the scan, select the (new) Collected Log Files tab of the report.

Easier access to log files

As you can see in the previous figure, there is a new tab called Collected Log Files found under Configuration Details in your reports. The list of files found in Collected Log Files varies by the application scanned or the tool run under Advanced Tools. For example, the following figure shows files available for an Excel scan.

And, the following example shows the files available when you use the Real-Time Logging feature in Advanced Tools.

Just click any file to save it to your local drive. Then, open the file in the your favorite program associated wth the file extension.

Note: The .etl log files are binary files that can’t be read without a conversion process. If you are working with a Microsoft Support engineer, you can upload the log files to a secure location that is provided by Microsoft Customer Support Services. A support engineer from Microsoft can then process and analyze the log file(s) for issues.

More control over the OffCAT icon in the Windows Notification area

OffCAT adds an icon to the Windows Notificaton area that is part of a feature set that manages rule file updates, add-in integration, and real-time crash detection. To give you more control over the display of this icon we added the Disable option to the context menu for the icon.

If you select Disable, the following changes occur:

1. The OffCAT icon is no longer displayed in the Windows Notification area
2. Notifications from OffCAT will not be displayed (for example, real-time crash alerts will not be displayed)

Give OffCAT a 5-star rating

In addition to the ‘Tell us what you liked’ and ‘Tell us what we could do better’ feedback options, you can also rate your OffCAT experience with the new 5-star rating control found on the HELP/FEEDBACK page.

We encourage you to use this new feedback option as it is a quick and easy way to let us know how we are doing.

Additional information

The OffCAT v2.2 ReadMe – full version.docx file contains a great deal more information on features, functionality, and administration of OffCAT. This includes, but is not limited to:

• Installing OffCAT, including system requirements
• Scanning programs with the command-line version of OffCAT (OffCATcmd.exe)
• Managing OffCAT through policy settings

We encourage everyone, especially people that use OffCAT in any Help Desk/Support context, to review the ReadMe file so you can take full advantage of everything found in this latest version of the tool.

OffCAT v2 ReadMe – full version

Note that we also published a ‘basic’ version of the ReadMe file. This version of the file is a much shorter version of the ReadMe and is aimed at first-time users of OffCAT.

Greg Mansius

As customers prepare to deploy Exchange Server 2016, we are receiving inquiries when the System Center Operations Manager (SCOM) Management Pack for Exchange Server 2016 will be released. The short answer to the question is, there are no plans to release an Exchange Server 2016 Management Pack.

Now that we have your attention, let’s delve a bit deeper into why that is the case.

As announced in Lessons from the Datacenter: Managed Availability, Exchange Server 2013 rewrote the rules on how Exchange Server was monitored. With the release of Managed Availability, Exchange became self-healing and the role of a monitoring system was reduced to simply providing “Red/Green” console status on the health of the system. The Exchange code natively monitored the system and took corrective action when things weren’t as expected. The role of the Management Pack (MP) was reduced to listening to the activity of Managed Availability probes, monitors and responders, and forwarding to a management console a health indication of the system or the need for an administrator to intervene when Managed Availability could not remediate an action. Removed from this paradigm was the notion of initiating corrective actions through the use of the Management Pack.

Managed Availability still exists in Exchange Server 2016. It has in fact benefited from three additional years of running inside the Office 365 datacenters. The version installed with Exchange Server 2016 provides additional learnings and improvements from the Exchange team’s experience operating Office 365. What has not changed is the role the MP plays in forwarding events to the management console. The MP version shipped with Exchange Server 2013 continues to function against Exchange Server 2016 without any modification. Customers deploying Exchange Server 2016 receive all of the benefits of improved Managed Availability without a single change to their monitoring infrastructure.

The only downside of not releasing a new version of the MP is that there is not a dedicated grouping in the console for servers running Exchange Server 2016. The console view does, of course, provide the version of all Exchange servers, making it easy to determine what version of Exchange is installed on any given server.

So there you have it. Rather than deploying and maintaining multiple versions of a MP which provides no improvement, we have chosen to stick with the much simpler MP developed for Exchange Server 2013 (and later). For those customers coming from Exchange Server 2010, we believe Managed Availability and a simpler MP dependency represent significant improvements over the experience with the correlation engine and SCOM-heavy approach used in Exchange Server 2010.

The Exchange Team

Every copy of a mailbox database in a DAG is assigned an activation preference number. This number is used by the system as part of the passive database activation process, and by administrators when performing database balancing operations for a DAG. This number is expressed as the ActivationPreference property of a mailbox database copy. The value for the ActivationPreference property is a number equal to or greater than 1, where 1 is at the top of the preference order. When a DAG is first implemented, by default all active database copies have an ActivationPreference of 1. However, due to the inherent nature of DAGs (e.g., databases experience switchovers and failovers), active mailbox database copies will change hosts several times throughout a DAG’s lifetime. As a result of this inherent behavior, a mailbox database may remain active on a database copy which is the not the most preferred copy.

Prior to Exchange 2016 Cumulative Update 2 (CU2), Exchange Server administrators had to either manually activate their preferred database copy, or use the RedistributeActiveDatabases.ps1 script to balance the databases copies across a DAG. Starting with CU2 (which will be releasing soon), the Primary Active Manager in the DAG performs periodic discretionary moves to activate the copy that the administrator has defined as most preferred is now built into the product. A new DAG property called PreferenceMoveFrequency has been added that defines the frequency (measured in time) when the Microsoft Exchange Replication service will rebalance the database copies by performing a lossless switchover that activates the copy with an ActivationPreference of 1 (assuming the target server and database copy are healthy).

Note: In order to take advantage of this feature, ensure all Mailbox servers within the DAG are upgraded to Exchange 2016 CU2.

By default, the Replication service will inspect the database copies and perform a rebalance every one hour. You can modify this behavior using the following command:

Set-DatabaseAvailabilityGroup <Name> -PreferenceMoveFrequency <value in the format of 00:00:00>

To disable this behavior, configure the PreferenceMoveFrequency value to ([TimeSpan]::Zero) and restart the Microsoft Replication Service on all servers in the DAG.

If you are leaving the behavior enabled, and you have created a scheduled task to execute RedistributeActiveDatabases.ps1, you can remove the scheduled task after upgrading the DAG to CU2.

We recommend taking advantage of this behavior to ensure that your DAG remains optimally balanced. This feature continues our work to improve the Preferred Architecture by ensuring that users have the best possible experience on Exchange Server.

As always, we welcome your feedback.

Ross Smith IV
Principal Program Manager
Office 365 Customer Experience

Today we are announcing the latest set of Cumulative Updates for Exchange Server 2016 and Exchange Server 2013. In addition to normal fixes to customer reported issues, these releases also include updated functionality. Exchange Server 2016 Cumulative Update 2 and Exchange Server 2013 Cumulative Update 13 are available on the Microsoft Download Center.

.Net 4.6.1 Support

Support for .Net 4.6.1 is now available for Exchange Server 2016 and 2013 with these updates. We fully support customers upgrading servers running 4.5.2 to 4.6.1 without removing Exchange. We recommend that customers apply Exchange Server 2016 Cumulative Update 2 or Exchange Server 2013 Cumulative Update 13 before upgrading .Net FrameWork. Servers should be placed in maintenance mode during the upgrade as you would do when applying a Cumulative Update. Support for .Net 4.6.1 requires the following post release fixes for .Net as well.

• Windows Server 2008/2008R2 – KB3146716
• Windows Server 2012 – KB3146714
• Windows Server 2012R2 – KB3146715

Note: .Net 4.6.1 installation replaces the existing 4.5.2 installation. If you attempt to roll back the .Net 4.6.1 update, you will need to install .Net 4.5.2 again.

AutoReseed Support for BitLocker

Beginning with Exchange 2013 CU13 and Exchange 2016 CU2, the Disk Reclaimer function within AutoReseed supports BitLocker. By default, this feature is disabled. For more information on how to enable this functionality, please see Enabling BitLocker on Exchange Servers.

SHA-2 Support for Self-Signed Certificates

The New-ExchangeCertificate cmdlet has been updated to produce a SHA-2 certificate for all self-signed certificates created by Exchange. Creating a SHA-2 certificate is the default behaviour for the cmdlet. Existing certificates will not automatically be regenerated but newly installed servers will receive SHA-2 certificates by default. Customers may opt to replace existing non-SHA2 certificates generated by previous releases as they see fit.

Migration to Modern Public Folder Resolved

The issue reported in KB3161916 has been resolved.

Change to Get-ExchangeServer Cmdlet

The Get-ExchangeServer cmdlet has been updated in Exchange Server 2016 Cumulative Update 2 to reflect the Exchange 2016 ServerRole definitions; Mailbox or Edge. Due to the way Remote PowerShell (RPS) works, the ServerRole definition output will be based upon the version hosting the RPS session, e.g. CU2 endpoints will report CU2 ServerRole definitions for all servers in the org. Customers should use the properties assigned to a particular service on the Exchange Server object to determine capabilities of a server, if needed. For instance, customers with scripts relying upon ServerRole Output looking for ClientAccess to be installed will need to look for the IsClientAccessServer property in the cmdlet output instead. An example follows:

[PS] C:\Windows\system32>$MyServer = Get-ExchangeServer EXHV-9895
[PS] C:\Windows\system32>$MyServer.ServerRole
Mailbox
[PS] C:\Windows\system32>$MyServer.IsClientAccessServer
True
[PS] C:\Windows\system32>

Installing from a Mounted .ISO Displays English UI Only

We are aware that customers who mount the .ISO and install Exchange from the mapped drive will not receive a local language setup experience. For customers who desire a local language setup experience, the workaround is to copy the files from the mounted .ISO onto a local OS drive and execute SETUP from the local OS drive instead of the mounted .ISO. We are working to resolve this in a future cumulative update.

Release Details

KB articles which contain greater depth on what each release includes are available as follows:

• Exchange Server 2016 Cumulative Update 2 (KB3135742), Download, UM Lang Packs
• Exchange Server 2013 Cumulative Update 13 (KB3135743), Download, UM Lang Packs

Exchange Server 2016 Cumulative Update 2 does include updates to Active Directory Schema. These updates will apply automatically during setup if the permissions and Active Directory requirements are met during installation. If the Exchange Administrator lacks permissions to update Active Directory Schema, a Schema Admin should execute SETUP /PrepareSchema before installing Cumulative Update 2 on the first Exchange server. The Exchange Administrator should also execute SETUP /PrepareAD to ensure RBAC roles are updated correctly.

Exchange Server 2013 Cumulative Update 13 does not include updates to Active Directory, but may add additional RBAC definitions to your existing configuration. PrepareAD should be executed prior to upgrading any servers to CU13. PrepareAD will run automatically during the first server upgrade if Setup detects this is required and the logged on user has sufficient permission.

Additional Information

Microsoft recommends all customers test the deployment of any update in their lab environment to determine the proper installation process for your production environment. For information on extending the schema and configuring Active Directory, please review the appropriate TechNet documentation.

Also, to prevent installation issues you should ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed. To verify the policy settings, run the Get-ExecutionPolicy cmdlet from PowerShell on the machine being upgraded. If the policies are NOT set to Unrestricted you should use the resolution steps in KB981474 to adjust the settings.

For the latest information on Exchange Server and product announcements, please see What’s New in Exchange Server 2016 and Exchange Server 2016 Release Notes. You can also find updated information on Exchange Server 2013 in What’s New in Exchange Server 2013, Release Notes and product documentation available on TechNet.

Note: Documentation may not be fully available at the time this post was published.

Exchange Team

Over the past several years, we have received feedback from all sorts of customers on how the Hybrid Configuration Wizard can be improved. One highly requested piece of feedback has been focused around providing an option to allow a customer to configure the bare essentials to support a hybrid configuration with Office 365.

One of the challenges we needed to overcome is that a Staged Exchange Migration is not supported for customers that are deployed on Exchange Server 2010 or later. That left customers with two options, either perform a cutover migration or a hybrid configuration. A cutover migration is designed for small customer deployments because all the users need to be migrated at the same time, and all Outlook profiles have to be recreated. The limitation of the cutover migration led many customers to deploy a Hybrid configuration. The Hybrid configuration has strict prerequisites around certificates and configuration scenarios that for some customers are confusing and unnecessary.

Today, we are pleased to announce that the Minimal Hybrid Configuration feature is available. When you launch the Hybrid Configuration Wizard (for the first time), you will be presented with a new dialog option, entitled Hybrid Features. This dialog allows you to choose between a Minimal Hybrid Configuration or a Full Hybrid Configuration.

What’s the difference? In a nutshell, the Minimal Hybrid Configuration allows you to just to perform migration and administration in a hybrid deployment. The Minimal Hybrid Configuration excludes configurations of secure email and any Exchange Federation related features, such as free/busy. This new configuration allows a customer to have the user experience benefits tied to a Hybrid migration: when a mailbox is moved you will not have to recreate the user’s Outlook profile; online mailbox moves are performed, unlike in a staged or cutover migration (users are for the most part not disconnected from the mailbox during the move); user account credentials are synchronized; and you get to enjoy uninterrupted mail flow.

What customers should use the Minimal Hybrid Configuration?

• Small or medium sized customers that need a seamless migration experience for their users.
• Customers that do not require enhanced features like:
  • Cross-premises Free/Busy
  • TLS secured mail flow between on-premises and Exchange Online
  • Cross-premises eDiscovery
  • Automatic Outlook on the web and ActiveSync redirection for migrated users
  • Automatic Retention for Archive Mailbox
• Customers that plan on moving to the service quickly and, therefore, do not require the enhanced features previously mentioned.
• Merger or acquisition scenarios may benefit from this configuration since you can move the mailboxes to a tenant without having to configure all of the Hybrid features.

What conditions expose the Hybrid Features dialog?

Customers that are setting up hybrid by executing the Hybrid Configuration Wizard for the first time will see the Hybrid Features dialog and will be able to choose the type of hybrid deployment they want.

If you have already run the Office 365 Hybrid Configuration Wizard in the past, this new dialog option will not be exposed. In addition, once a customer chooses to deploy the Full Hybrid Configuration option, this new dialog option will no longer be available. This new feature is not intended to enable customers to remove a hybrid configuration and start over.

However, if a customer was to choose the Minimal Hybrid Configuration option, subsequent executions of the Hybrid Configuration Wizard will continue to expose the Hybrid Features dialog. This allows a customer to change and deploy a Full Hybrid Configuration in the event they find they need certain additional features, like cross-premises Free/Busy.

Will cross-premises mail flow function in a Minimal Hybrid Configuration?

Yes, mail flow will function between your on-premises environment and Office 365 as the routing domain (e.g., contoso.mail.onmicrosoft.com) is a target address for migrated users. However, the mail flow between your on-premises environment and Office 365 will not be TLS protected. If you require TLS protection, you have two options – you can manually create connectors or you could run the HCW and select the Full Hybrid Configuration option if there is a need for an enhanced feature, like TLS protected mail flow.

Will Exchange Online Archive mailbox access function in a Minimal Hybrid Configuration?

Yes, on-premises mailboxes will be able to access Exchange Online archive mailboxes in a Minimal Hybrid Configuration. However, if you want to have retention policies that move items to the Exchange Online archive mailboxes automatically, then you will need to select the Full Hybrid Configuration option.

How do I move mailboxes after I run the wizard?

We are working on a new MRS migration portal interface for MRS based moves, but you can still use the Exchange Administration Center to move your mailboxes. Even when the new portal experience for migrations is ready the EAC options will still be present.

Summary

We are working hard to take the entire on-boarding and hybrid experiences to the next level and this is an important step in that journey. This will allow us to improve the experience for customers that want to move to the service quickly or just want a less painful way to cutover to Exchange Online.

As always, please keep the feedback coming by using the feedback option in the Hybrid Configuration Wizard. We read it all…

Office 365 On-boarding Team

Today, we released an updated version of the Exchange Server Role Requirements Calculator.

This release doesn’t contain many enhancements, but does contain a number of bug fixes, especially in the deployment scripts. You can view what changes have been made, or download the update directly.

Ross Smith IV
Principal Program Manager
Office 365 Customer Experience

Consider a hypothetical scenario where Contoso merges with World Wide Importers, and the two combine each others resources. World Wide Importers has Exchange 2016 deployed, so it’s decided that users from Contoso will link their accounts to mailboxes in worldwideimporters.com as a resource forest.

Each company’s corporate identity will remain intact, so they will maintain the contoso.com and worldwideimporters.com namespaces. Following Microsoft best practices, Kerberos will be enabled for client authentication when contoso.com forest users access Exchange in worldwideimporters.com.

To set up Kerberos in this topology the resource forest’s namespace will be used as the realm for issuing tickets to users requesting access. So clients requesting tickets from this realm will need a few extra considerations to get this all working:

Preparing DNS

For the scenario to work each forest’s namespaces and domains need to be resolvable by mutual name lookups. That means each namespace will be added to the other forest’s DNS solution. When using Windows Server DNS this can (for example) be achieved with a stub zone called contoso.com added to the worldwideimporters.com DNS servers:

. . . and a stub zone in the contoso.com forest:

Autodiscover name records, or an SCP, must be added to the authentication forest so that queries for mailbox information based on a user’s primary SMTP domain get directed to Exchange with the new namespace. In this example, a CNAME record for autodiscover.contoso.com is added which resolves to autodiscover.worldwideimporters.com.

Preparing Active Directory

For a resource forest deployment we recommend a forest trust between the authentication and resource forests. At a minimum, it should be a one-way outgoing trust, where the Exchange forest trusts the authentication forest.

For information on deploying Exchange in a resource forest topology visit, Deploy Exchange 2013 in an Exchange resource forest topology.

Preparing Exchange

Since Contoso users will keep their @contoso.com SMTP addresses the domain has to be added to Exchange (in worldwideimporters.com) as an accepted domain:

Configuring and Enabling Kerberos

With DNS and Active Directory prepared it is now possible to configure Kerberos according to readily available guidance.

First, an Alternative Service Account (ASA) must be added to Active Directory in the resource forest, using this format:

New-ADComputer -Name <CAName> -AccountPassword (Read-Host ‘Enter password’ -AsSecureString) -Description ‘Alternate Service Account credentials for Exchange’ -Enabled:$True -SamAccountName <CAName>
Set-ADComputer <CAName> -add @{“msDS-SupportedEncryptionTypes”=”28”}

So for our scenario:

New-ADComputer -Name EXCH2016ASA -AccountPassword (Read-Host ‘Enter password’ -AsSecureString) -Description ‘Alternate Service Account credentials for Exchange’ -Enabled:$True -SamAccountName EXCH2016ASA
Set-ADComputer EXCH2016ASA -add @{“msDS-SupportedEncryptionTypes”=”28”}

Next, the new ASA must be configured on each Mailbox server in the organization with RollAlternativeServiceAccountPassword.ps1:

.\RollAlternateServiceAccountPassword.ps1 -ToSpecificServer <ExchangeServer> -GenerateNewPasswordFor <Domain\CAName$>

For this scenario:

.\RollAlternateServiceAccountPassword.ps1 -ToSpecificServer wwiex1 -GenerateNewPasswordFor WWI\EXCH2016ASA$

After that we can register the SPNs for Exchange services:

Setspn.exe -S http/<AutodiscoverServiceHostname> <Domain\CAName$>
Setspn.exe -S http/<ExchangeServicesHostname> <Domain\CAName$>

For the scenario:

Setspn.exe -S http/autodiscover.worldwideimporters.com WWI\EXCH2016ASA$
Setspn.exe -S http/mail.worldwideimporters.com WWI\EXCH2016ASA$

Verification

Outlook Anywhere RPC/HTTPS: verify Kerberos is in use by following the section in the Technet article referenced above called “Validate Kerberos from the Client Access server”. As described the HttpProxy\RpcHttp logging will show a user’s connection with the “Negotiate” authentication protocol only. This ensures Kerberos is working for that user:

If for some reason the client is not able to authenticate with Kerberos it should fall back to NTLM authentication. In that case, the log will show either “NTLM” or “Negotiate+NTLM”.

MAPI/HTTPS: The HttpProxy log for MAPI always shows “Negotiate” if it’s configured as an available authentication method, so the method to verify Kerberos authentication described for Outlook Anywhere won’t be reliable. Instead, running KLIST.EXE can reveal whether the logged in user has received a ticket for the Exchange SPN.

Conclusion

Complex organizations with diverse Active Directory deployments may need to consolidate services under a simplified namespace. This necessitates additional steps for enabling Kerberos for authenticating user forest clients to access Exchange in a resource forest. With the concepts and examples presented here it should be straightforward to adapt them to a production deployment for a fully-supported, best-practice-compliant Exchange solution.

Jesse Tedoff
Senior Premier Field Engineer

On-premises Exchange environments support the ability for certain mobile apps to utilize certificate-based authentication (CBA). Today, we are pleased to announce that CBA is available in preview for customers using Office 365 Enterprise, Business, and Education plans. This feature is available in Outlook for Android and Exchange ActiveSync (EAS) protocol. Support for Outlook for iOS is coming soon.

What is certificate-based authentication?

CBA allows users to authenticate using a client certificate. The certificate is used in place of the user entering credentials into the device.

Why would I want certificate-based authentication?

By utilizing certificate-based authentication, administrators can allow their users to access resources without the need to enter credentials.

Prerequisites

The following are required to use CBA:

• Access to a certification authority (CA) to issue client certificates.
• Each CA must have a certificate revocation list (CRL) that can be referenced via an Internet-facing URL.
• Client certificates must be provisioned on mobile devices, typically done using MDM.
• For EAS clients, the RFC822 Name OR Principal Name value in the certificate’s Subject Alternative Name field must have the user’s email address.
   

  
  Figure 1: Client certificate with email address in RFC822 Name and Principal Name values in the SAN field

Using certificate-based authentication

Configuration in Azure Active Directory is required to use certificate-based authentication. All certificate authorities (and their associated CRL URLs) must be uploaded to Azure Active Directory. More information on getting started with CBA can be found in Get started with certificate-based authentication on iOS – Public Preview.

Certificate-based authentication in Outlook for iOS/Android

Currently, certificate-based authentication is only supported in Outlook for Android on Android Lollipop 5.0 and above. Support in Outlook for iOS is coming soon.

A federation server that is configured to perform certificate-based user authentication is also required when using Outlook for Android.

Certificate-based authentication in Exchange ActiveSync applications

Certain EAS applications may support certificate-based authentication. To determine if your application supports CBA, contact the application developer. Preview documentation on how EAS applications can support CBA can be found in Microsoft Exchange protocol documentation.

Tyler Lenig
Program Manager
Office 365

Exchange Server 2013 introduced modern public folders and also shift in the way clients access the public folders. Ever since, the Outlook for Mac client had limited or no support for public folders.

This article provides an update on how Outlook 2016 for Mac clients can access public folders in various topologies.

Current Scenario

The Outlook for Mac clients could not access public folders if:

Co-existence with legacy public folders

• Legacy public folders deployed on Exchange Server 2010 SP3 and user mailbox present on Exchange Server 2013/Exchange server 2016 in same organization.

Modern public folder access in Hybrid topology

• Exchange Server 2013/Exchange Server 2016 in hybrid mode with an Office365 tenant.
  • Scenario1 – Modern PF’s deployed on-premises – on-premises users, with mailbox on Exchange Online, accessing modern public folders deployed in Exchange on-premises.
  • Scenario2 – Modern PF’s deployed in Office 365 – on-premises users, with mailbox on Exchange on-premises as well, accessing modern public folders deployed in Office 365 tenant

Solution

The April 2016 update of Outlook 2016 for Mac clients, along with changes in Cumulative Update for Exchange Server, will make public folders in above scenarios work for Outlook 2016 for Mac.

The following table summarizes access state for Outlook 2016 for Mac (post April 2016 update) access to public folder deployments, as well as the minimum Exchange CU required to enable access:

We’ll take a look at one of the common scenarios and explain the steps required. TechNet has detailed steps on how to configure public folder access in hybrid as well as for co-existence scenarios.

Scenario

EXO users accessing modern public folders hosted in on-premises organization.

Pre-requisites

Make sure all of the following pre-requisites are met before making any changes to your configuration:

Client side:

Make sure the Outlook 2016 for Mac client is installed with the April 2016 update, at the minimum. It’s recommended to install the latest available update.

Server side:

1) Exchange organization is configured in hybrid with Office 365 tenant, and DirSync is working and the mail sync script is performed.

2) The on-premises Exchange Servers, hosting public folder mailbox must be on or above:

1. Exchange Server 2013 CU13
2. Exchange Server 2016 CU2

3) Make sure the user that will be accessing public folders has a user account on-premises and mailbox in EXO.

You should be able to see the user listed in Get-RemoteMailbox:

On-premises:

Note:

Pure EXO user mailboxes cannot access public folders hosted on-premises.

4) Make sure the PF mailbox from on-premises shows as Mail User:

On-premises:

Office 365 tenant:

Configuration

1) Configure public folder access settings at EXO Tenant:

Command:

Set-OrganizationConfig -PublicFoldersEnabled Remote -RemotePublicFolderMailboxes <Mail User representing on-premises PF>

Example:

Set-OrganizationConfig -PublicFoldersEnabled Remote -RemotePublicFolderMailboxes OP1

2) The EXO User mailboxes are automatically assigned with DefaultPublicFolderMailbox:

That’s it! Now Outlook 2016 for Mac can subscribe and access public folders.

Related articles

Detailed configuration steps for each scenario are in following articles:

Co-existence with legacy public folders

User mailboxes are on Exchange 2013/Exchange 2016 servers accessing legacy public folders on Exchange Server 2010

https://technet.microsoft.com/en-us/library/dn690134(v=exchg.150).aspx

Hybrid topology

Scenario1 – modern PF’s deployed on-premises

On-premises users, with mailbox on Exchange Online, accessing modern public folders deployed Exchange on-premises:

https://technet.microsoft.com/en-us/library/dn986544(v=exchg.150).aspx

Scenario2 – modern PF’s deployed in Office 365

On-premises users, with mailbox on Exchange on-premises as well, accessing modern public folders deployed in an Office 365 tenant:

https://technet.microsoft.com/en-us/library/mt729076(v=exchg.150).aspx

Public Folder Team

We are excited to re-announce that the Exchange On-Premises TAP Program is accepting nominations! 

The purpose of this post is to provide you with the opportunity to nominate your company for the Exchange On-Premises Technology Adoption Program (TAP) Program. Joining the Exchange On-Premises TAP Program provides companies with a number of advantages, such as providing input and feedback for future releases, developing a close relationship with the Exchange Product Team; receiving Pre-Release information about Exchange, and more. 

Exchange On-Premises TAP Program Overview

The Exchange On-Premises TAP Program is designed to validate the next version of Exchange Server by having customers test deployments of Pre-Release builds of Exchange in their own production environment. This gives participants the opportunity to provide feedback to the Exchange product development team. Customers in the TAP Program are provided free support from Microsoft Customer Services and Support (CSS) for issues encountered with Exchange. Additional information on the TAP Program is discussed in this blog entry from a number of years ago, which is still quite relevant today.

What’s in it for TAP Program customers?

• A close relationship with the Exchange product team.
• An opportunity to provide feedback on future releases of Exchange directly to the product team.
• Technical conference calls with members of the product team.
• Production grade Pre-Release builds of Exchange Server.
• Access to free CSS Support for Exchange issues for the duration of the Exchange TAP Program (CSS support is 24/7 for any critical issues found in production).
• A head start in the next deployment cycle, taking advantage of new and enhanced features available in the next version of Exchange Server.

What do I have to commit to in order to participate in the Exchange TAP Program?

• Jump through a few legal hoops (signing some legal documents such as an NDA).
• Go through a few steps that will help assure easy communication between you and Microsoft (details will be provided when applicable)
• Deploy Pre-Release versions of Exchange Server in your production environment.
• Commit to timely response of surveys and feedback requests from Microsoft.
• Commit to providing resources for TAP Program activities for the duration of the program – people/time as well as machines needed for testing and production, and associated operating system software licenses.
• Provide us with deployment plans, including details of network topologies and additional reports, as applicable.  (Required before we can give production approval for the Pre-Release code.)

What makes a good TAP Program candidate?

• Willing to dedicate the resources (people/time and machines) to testing Pre-Release builds of Exchange in production. We find that we get some of our best feedback through production deployments, and so we will prioritize nominations from customers willing to be aggressive in their production rollouts higher.
• Responsive to our requests for feedback, including responding to surveys and attending conference calls and participating in a distribution list.
• Gives constructive criticism with context – don’t just stop at “I don’t like feature X,” provide us more information like “Here’s why feature X won’t work for my Exchange environment, and here’s why I think doing it another way would be better.”
• Gives feedback even when not requested. We may not have sent out a survey or had a call about a topic, but if something about the product is problematic for you– or you love it! :-) – we want to know.

Summary

If you feel your Company fits what we are looking for, you can nominate yourself by sending email to:

Davidesp@microsoft.com

Please place “TAP Customer Nomination” in the subject line.

Also please gave the following info;

• Legal company name
• Size in terms of number of mailboxes in your org
• Versions of Exchange you are currently running
• Name of a contact person we can speak to with email address
• Reason for interest in our program 

Note: This is for our business customers to self-nominate for inclusion in future Exchange Pre-Release programs. If you are a Microsoft representative and would like to nominate a customer you are working with, please contact us directly and we will provide appropriate guidance.

All nominations, internal and external, are reviewed and screened prior to acceptance into a program. No customers are allowed access to any Pre-Release downloads or information until all legal paperwork is properly executed. Nomination does not mean acceptance… not all nominees will be chosen for a program.

Thank you!

David Espinoza
Senior Program Manager, Customer Experience Team

Just wanted to let you know that the VSSTester script has now been updated to version 1.2. The main feature in this version is that the script now supports Exchange 2016 servers.

To read more about previous update see this, or for much more comprehensive information about the script, see the original blog post here.

Matthew Huynh

Right on the heels of our recent TAP program announcement, we wanted to see if there are customers who would like to help us validate migration of modern public folders from Exchange 2013/2016 to Exchange Online (EXO). This is a scenario that at this time we do not support, but plan on doing so. Estimated availability of bits for testing those topologies (subject to change):

• Exchange 2013 public folders > EXO: September 2016
• Exchange 2016 public folders > EXO: November 2016

In order to participate, you will need to enroll into the above mentioned TAP program.

If you are interested in trying out the migration, please contact the PF migration team at modernpfmigrationtoexo@service.microsoft.com with the following details:

1. Organization Name
2. Exchange version
3. Total size of Public Folders
4. Number of PF mailboxes
5. Largest Public Folder size
6. Total count of Public Folders
7. Count of Mail enabled Public Folders
8. Which clients are used by users to access PF?
9. Number of users
10. Number of exchange server installations
11. Is Exchange Hybrid setup done?
12. When is the plan to migrate users to EXO?

We will review the details and see if we can on-board the organization into TAP/Beta program. We are looking for customers with <250GB of public folder data.

Let us know!

Public Folder Migration team