Exchange - where email goes to die - The Something Awful Forums

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die

EoRaptor: Sep 13, 2003; by Fluffdaddy

LamoTheKid posted:

...
I have a BES Express server in place hooked up to the old server. Do I need to worry about permissions or for tha tmatter, ANYTHING, with the new server at all or will I be ok until I move the mailbox over to the new one?

BES will need to have *matching* versions of the Exchange MAPI CDO dll's on both the BES and Exchange box. When you do the cutover, I'd switch BES to point to the new box, make sure the CDO dll's are the latest version and match (2010 doesn't ship with them, you'll need to install them).

Once BES is pointed to the new server, it will correctly find/access mailboxes, regardless of the server they are on (exchange has a re-director for requests that BES supports)

# ¿ Aug 22, 2011 17:49

Adbot: ADBOT LOVES YOU

# ¿ Apr 30, 2024 03:53

EoRaptor: Sep 13, 2003; by Fluffdaddy

Drumstick posted:

Is there a way to have new users created in AD automatically create an exchange mailbox? I thought it would or did do it automatically at some defined interval. My help desk is making mistakes on user accounts. They are creating them in Exchange, then moving and assigning them in AD. I would prefer that they did not, and have told them so but unfortunately I have no authority over them.

Exchange will create a new mailbox the first time an account receives mail if one doesn't already exist. It will also create accounts if the System Attendant is restarted.

# ¿ Feb 29, 2012 22:39

EoRaptor: Sep 13, 2003; by Fluffdaddy

Crackbone posted:

If I understand correctly, you're recommending a UCC because outlook is using autodiscover.companyname.com (or alternatively just companyname.com), and I don't have a cert for those?
To be clear, OWA is working other than that annoying popup. Don't suppose I could utilize remote.company.com for the autodiscover process, or disable SSL on it? I've got pretty much every other external site running off remote.company.com

(Yes I know I should just get a new cert but boss is a massive cheapskate.)

Create autodiscover SRV dns records for the domain 'company.com' that point to remote.company.com
Remove any universal resolvers for company.com (no *.company.com)
If you have an autodiscover.company.com domain, either delete it, or set it to redirect to remote.company.com
Poison your internal dns so remote.company.com resolves to the internal exchange address.

Get away with only a cert for remote.company.com, and no more outlook bitching.

# ¿ Apr 10, 2012 18:57

EoRaptor: Sep 13, 2003; by Fluffdaddy

Crackbone posted:

External DNS isn't hosted on the SBS box.

This is going to gently caress over a poo poo ton of stuff with AD, and SBS2011 in particular. You are boned. If you can, give up and walk away, because nothing is ever going to work quite right unless AD and DNS are bound together in a windows domain.

Nevergirls posted:

but my best practices!

This actually is the current recommended practice. autodiscover.* is being retired, as SRV records offer a lot more flexibility. Maybe not the dns poisoning part, though if SBS2011 is the dns for the domain, it does the remote.company.com poisoning for you anyway.

# ¿ Apr 10, 2012 21:23

EoRaptor: Sep 13, 2003; by Fluffdaddy

EoRaptor posted:

This is going to gently caress over a poo poo ton of stuff with AD, and SBS2011 in particular. You are boned. If you can, give up and walk away, because nothing is ever going to work quite right unless AD and DNS are bound together in a windows domain.

To clarify: Clients on the internal network should use the SBS2011 machine for all DNS requests. SBS2011 should be set to use external forwarders for any domain names it doesn't know.

The domain can use any external Name Server for providing it's records to the internet at large.

You can use this to create an internal record for remote.company.com that points to your internal ip for the SBS2011 box, and use the Name Server to create a record for remote.company.com pointing to the external IP for the SBS2011 box. You'll need to pass port 443 to the SBS2011 box through your firewall.

In fact, SBS2011 does this by default. When you did the setup wizard, the external name it suggested (remote.company.com) is setup so SBS2011 will return its own internal address for the domain name, and anybody outside the company (or not using the SBS2011 DNS server) will see your external IP address.

A SRV record is pretty straight forward. I'm surprised your Name Server Provider doesn't support it.

This website: http://www.thirdtier.net/2011/06/setting-up-autodiscover-for-sbs-2011/ was the most helpful when I set mine up.

# ¿ Apr 11, 2012 17:28

EoRaptor: Sep 13, 2003; by Fluffdaddy

Crackbone posted:

They support SRV records, but their system has a web-based editor we use to manage the entries. Whatever software they use doesn't have autodiscover as an available protocol to use from the drop-down box when defining the record.

Oh, just create a SRV record for _autodiscover._tcp.company.com with the following value '0 0 443 remote.company.com.'

It really isn't complex.

# ¿ Apr 11, 2012 20:53

EoRaptor: Sep 13, 2003; by Fluffdaddy

SBS2011 comes with a tool to extend the time out beyond the default, and I think SBS2008 did the same thing.

But yes, SBS has very cheap licensing, and this is one of the things that is restricted because of that.

# ¿ May 22, 2012 19:21

EoRaptor: Sep 13, 2003; by Fluffdaddy

Nevergirls posted:

On an exchange 2007 server. I have a mail queue of like 70. Mail is going through, just very very slowly. Routing mail through our spam filter (postini) but I'm not seeing any serious activity on that side. Internal email goes through immediately. the "mail flow troubleshooter" doesn't detect any issues.

What's going on?

How are you routing email to Postini, the 'dns' method or smarthost?

Smarthost is limited to a single connection, so email can back up really quickly. The 'dns' way of routing email to postini isn't limited like this, and will make a new connection for every email, which Postini doesn't have a problem with.

# ¿ Jun 6, 2012 21:20

EoRaptor: Sep 13, 2003; by Fluffdaddy

Nevergirls posted:

OK so turns out it was getting stuck on a specific company/domain name we send to a lot. Anyway yeah I'm using smarthost. Is that the wrong way?

Postini strongly recommends the DNS method, as it will prevent one single large/bad email from stalling email flow through Postini.

Here is the relevent guides for setting up Postini. You want the 4th link.

Also, make sure your reinjection setup is correct, or some emails could be lost. Details

# ¿ Jun 7, 2012 14:55

EoRaptor: Sep 13, 2003; by Fluffdaddy

Chillbro Swaggins posted:

yes (2010 R3) and yes

GRT backs up each mail item as an individual record, and queries each message through exchange to do so. It's very, very slow.

Unless you need the granular restore ability, turn it off. For instance, I have it off, and instead lengthened the retention times in the exchange (2010) database to 30 days. Now, I get fast backups, and can recover email easily. For me, tapes are more disaster recovery, and much less file/item recovery (I use over provisioning and VSS for most of that stuff, much quicker and easier)

# ¿ Jun 28, 2012 19:05

EoRaptor: Sep 13, 2003; by Fluffdaddy

I like turtles posted:

I am hopeful there is a better way to do this because
Here's the scenario:
My department has been using @abc.foo.com aliases for a long time, a bunch of them for everything. This is currently managed by a simple tool on the MX server for the University, alias -> destination address.
My department is now within a department that can, in theory, handle all of this. They've got Exchange 2010 running. I have an accepted domain for abc.foo.com set up, and am currently looking at one of two possibilities. In both cases, I will point the MX record for abc.foo.com to the parent department server.
1. Change the accepted domain type from authoritative to internal relay. This way, aliases that aren't in the departmental server will get forwarded to the campus server and go on their merry way.
2. Figure out some clean way to manage aliases in departmental exchange and dump the campus server entirely.

Now, what do I mean by clean? Well, I had an initial approach that was a nightmare to manage, and last year when the exchange server ate itself, I didn't bother to recreate it. That approach was to go in and manually add each alias address into the email addresses for the recipient user. This changes around, though, and it would be very easy to lose email addresses or have them going somewhere where they aren't getting read - and not know it.

It seems as though I should be able to create mail contacts for each alias and then manage the recipient in there, but it isn't allowing me to have multiple contacts point at the same place. Should I just create a bunch of user mailboxes and have them set up to forward to the recipient? It seems like sort of overkill, but I'm not seeing other possibilities?

Edit: I'm seeing some mention of forwarding mailboxes, just have to figure out how to actually create those now.

I'd use Distribution Groups. You can script adding and removing people, deliver to multiple or single addresses, and hide them all from the exchange address lists.

Can be managed with very few permissions, so a worker account for a website is pretty safe.

# ¿ Oct 2, 2012 15:43

EoRaptor: Sep 13, 2003; by Fluffdaddy

Crackbone posted:

No Enterprise CAL available.

I just tested a separate database for the service account, and set that database to standard journaling, but it doesn't work. I'm thinking that the service account is using "send-as" permissions mucks up the whole deal - it looks like Exchange considers send-as emails as coming from the send-as account, not the actual originator.

Does the app have any configuration options, such as adding a blind cc to all emails, or keeping a local copy?

Does it send using SMTP, or MAPI? If it's SMTP, set up a new connector just for it, and add all the rules you want.

# ¿ Oct 11, 2012 16:56

EoRaptor: Sep 13, 2003; by Fluffdaddy

Crackbone posted:

The app does not have those abilities.

It's sending using an SMTP connection, but I don't get what you're saying about connectors. The app sits on a seperate box and connects to exchange via SMTP. Exchange has a receive connector setup to accept mail from that server. It goes out via the same send connector as everything else.

I don't see anything in the transport rules that can make determinations based on the connector the message is using.

Sorry, I messed up. You can create an additional send connector, but it won't work for you. I use one to carve out domain specific exceptions, and then log it. In our situation, all the destinations are on the same two domains, so the logging works and is manageable. Unless you have the same limit, the same thing won't work.

You could do the reverse, set up a receive connector, carve out an ip for it to listen for, and use an edge transport rule, though I've never worked with Edge Transport Rules. Are you sure this application has doesn't have some unique header you can trigger a hub transport rule on, then just add a local BCC to the email?

# ¿ Oct 11, 2012 19:33

EoRaptor: Sep 13, 2003; by Fluffdaddy

Crackbone posted:

The application allows the user to change the contents of the sub/message, so it's not a surefire method. And I still can't find any reference to transport rules being able to use connectors or IPs as criteria for firing off.

Edge Transport Rules can do the per receive or per send connector triggering, but like I said, I haven't used them. I don't even know if they show in EMC. http://technet.microsoft.com/en-us/library/dd351127.aspx

Transport Rules can look at headers, which are usually set by the sending application, and aren't usually visible to users. http://en.wikipedia.org/wiki/Email#Message_header

Examine the message headers of one of these messages, and see if there is anything distinct ie: 'X-Sender: SupAR Web to Email 1.1.3454' that you can use in a transport rule.

# ¿ Oct 11, 2012 20:26

EoRaptor: Sep 13, 2003; by Fluffdaddy

Syano posted:

Man the new versions of Exchange are so dang easy to install and admin and perform so well I wonder why people are still looking at hosted Exchange. I guess when an office has literally zero servers.

Zero servers, multiple locations, teleworking users and maybe understaffed IT all make hosted exchange a pretty good idea.

Office365 that includes Office Pro, Lync, Sharepoint and hosted exchange is, honestly, a great deal for the price. Yes, it totally has some reliability problems MS really needs to work on, but a smaller company who buys cheap hardware is going to be worse.

# ¿ Aug 29, 2013 19:16

EoRaptor: Sep 13, 2003; by Fluffdaddy

EvilRic posted:

I'm having an odd issue with Exchange 2007 permissions (no surprise there).

We have added a user for our data centre to use when migrating mailboxes. The user has been given full access to all mailboxes and it works fine with their tools, Outlook and OWA.

However 2 mailboxes aren't working. They can be accessed through Outlook as the user but when trying to access them in OWA it shows the "You do not have permission to open this mailbox" message.

I have checked and the new account does have full access to both mailboxes according to the GUI and powershell and i've tried removing the permission and re-adding it.

Has anyone else seen this issue or know of something i should be checking?

Do those mailboxes have OWA enabled? You can have permissions granted, but if OWA isn't enabled for the mailbox, it's not going to work. (it's under mailbox features)

# ¿ Nov 6, 2015 19:25

EoRaptor: Sep 13, 2003; by Fluffdaddy

Rick posted:

Having a problem where a user is getting asked for credentials of another user (who we recently deleted from the AD) whenever outlook is open. I thought that she had her mailbox open but she doesn't so I don't know how to get rid of this.

I see this around google but not answered many times?

If the remaining user had the departed users shared calendar open/pinned in outlook, this can also happen. Same with any shared outlook folder, but it's almost always the calendar.

# ¿ Sep 15, 2016 23:00

EoRaptor: Sep 13, 2003; by Fluffdaddy

anthonypants posted:

I was thinking when they update the server

There was an instance where it got enabled for all customers back in the past, because O365 didn't support DKIM at first launch, and when the feature was finally added, few existing customers turned it on. MS then turned it on for everybody that 'qualified', but they did a piss poor job of determining if it would break a clients configuration.

I think the only time you'd see it turned on now is if you interacted with support in a way that they turned it on as part of troubleshooting, or you environment config got reset or rolled back somehow, both of which *should* get you a notice on your admin panel.

# ¿ Feb 23, 2017 03:11

EoRaptor: Sep 13, 2003; by Fluffdaddy

Jeoh posted:

How do you 'qualify' without manually adding the CNAMEs required for O365's DKIM?

Those were sarcastic air quotes because I don't think microsoft ever checked anything, just went through and flipped that bit.

And a whole lot of companies use O365 for everything, including nameservers.

# ¿ Feb 23, 2017 22:26

Adbot: ADBOT LOVES YOU

# ¿ Apr 30, 2024 03:53

EoRaptor: Sep 13, 2003; by Fluffdaddy

KOTEX GOD OF BLOOD posted:

I bought the domain together with my Lithium hosting, so it should come preconfigured correctly, but I will double check with them.

When you send emails, are you sending them through your hosting providers SMTP server, or using your ISP's SMTP server?

# ¿ Jul 31, 2020 01:02

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die