Exchange 2010: Database Stores, Not Quite Ready When You Are

Once I had my Exchange 2010 server up and running, I had a need to create a new store. Unfortunately, things didn't look so great when the store wouldn't mount after I created the store in the GUI console.  There were even some fine error messages in the logs letting me know that Exchange was unable to mount the store. If you search the Web for answers to this problem, you'll find all sorts of potential solutions and ideas.

Turns out the thing that worked best for me was some patience. Exchange 2010 is deeply ingrained in Active Directory and Active Directory does things at it's own pace.  Sometimes immediately, sometimes in 5 minutes and sometimes in fifteen.

So go ahead and read all those links you found in the great WWW and then after about 5 minutes, go back and try to mount that database again.  Chances are, it'll work just fine.

The Next Rev: ImageRight 5.4

My office is a week or so post-upgrade to ImageRight 5.4 from version 5.2.  While this version integrates some post-5.2 hotfixes to resolve some annotation and image display issues, it comes with it’s own post-5.4 hotfixes that need to be installed after the primary installation. If you deploy the desktop client with Group Policy, you’ll need to create an MSI file and a third policy to fully deploy the software and hotfixes automatically.

While the desktop client hasn’t changed much from a user standpoint, there were some security additions and tweaks that are important to know about.

• Alphabetizing Lists and Annotations – In previous versions, many of the lists that users interacted with were sorted by creation date.  This was less than ideal when selecting from a long list of private annotations or selecting from the document type tree drop-down. Those list displays are now alphabetized. 
• Read/Write permissions added to File Notes – while this is a great addition as a security feature, it’s turned on by default post-upgrade with the result being that users can’t see or add any file notes.  I needed to make a support call to find the odd place that permission change was located. (The Security properties of the "Storage Types" container in the EMC.)
• Annotations Limited to Specific File Types - There is a feature in version 5 where you can filter or limit on what file types an annotation is available for use.  When migrating from version 4 to 5.2 the system defaulted all the private annotations to be available on all file types (which was the behavior in previous version), but didn’t automatically check the “include all file types” option box.  In version 5.4, the check box status is enforced, which may make private annotations seem to disappear for the end users.
• New Permissions for "Desktop - Modify Document Date" - also defaulted to not having any permission set in 5.4, users will need this permission added to change a document date.  Also new is some functionality to track the date and time a document is received ("Desktop - Modify Receive Date and Time"), you may or may not want to let users change that.

Also, if you do any automated processes where you are using the FUP tool for updating file information, it's not working correctly.  Hopefully, that one is resolved quickly.  We don't use it often, but when we do we tend to have a lot of files that need a change and a manual process would be tedious.

Overall, ImageRight 5.4 brought several new features and welcome changes to the document management product, with a relatively easy upgrade process from 5.2.

From BlackBerry to Windows Phone

Last week, I landed myself brand-new Samsung Focus Flash phone with Windows 7.5.  I had debated about going with the older Samsung Focus model in mid-October, but figured it was probably worth the wait for some new hardware too.

Having a physical keyboard on the BlackBerry was hard to give up, but outside of the lack of real keys, I pretty much love everything about it right now.  One of the big factors in deciding on what phone to select was my ability to hold it and have a reasonable chance of being able to type with one hand.  The Focus Flash is the only phone in the Samsung Focus line that is the same width as the BlackBerry Bold 9700.  If I wanted a tablet, I would have bought one that has a screen larger than 4.3 inches.

As someone who spends a good amount of time using Twitter and dabbling in the other popular social media sites (depending on where my friends are), the People Hub has got to be the best idea since sliced bread.  Being able to group certain friends and family members and highlighting a tile for that group on home page is fantastic.  Even after a week, I feel less like I have to constantly watch my Twitter stream or check Facebook because I can easily view the postings from the people I care about the most.  The native integration for interacting with Facebook and Twitter lack some of the more robust features, but it certainly good enough for the majority of my social media interactions.

The live tiles on the home page are great for highlight the next appointment and the latest status updates from the People Hub.  Not having to open the calendar to see my next appointment is a nice bonus.  Plus having a miniature "digital picture frame" that highlights my favorite photos is a fun feature.

I know many iPhone lovers may find faults in some of current features in the Windows Phone. There isn't the extensive catalog of apps yet and some of the ones that exist lack some of the more refined functions that more mature apps for iPhone and BlackBerry have.  But I think it's only a matter of time before those app offerings catch up.  And I have a list of things that I do miss from the BlackBerry - battery life being one of them and I'm developing a wish-list of things I hope to see change or become available in 2012, but that's a post of its own!

Exchange 2010 and External Relays (Migration - Part 3)

The "Receive" Connector is a funny thing in Exchange 2010. The receive connectors on my system seem to double as "Send" connectors depending on who's doing the sending. Once my new server was up and running, it was a no brainer to make a proper "Send" connector so the server could access the Internet to deliver mail to external parties.  I was also able to quickly bring up "Receive" connector to collect mail from our Barracuda appliance.

Then I started tackling the servers within our organization that send alerts and reports via email.  I added their network addresses to the same connector I used for the Barracuda device, since they are all on the same network.

All the devices seemed happy until I ran across one that needed to send messages to external recipients. Turns out that on Exchange 2003, I was using the same connector for both internal and external relaying without issue, but Exchange 2010 is a little pickier from a security standpoint (a good thing) and I had to create a special receive connector to handle external relaying.

So why are we using "receive" connectors to relay external mail?  The receive connectors collect mail coming to the Exchange 2010 server which are then sent out using the Internet send connector.  So while all your devices are sending mail, the Exchange server is both receiving it and sending it.
Of course, I wouldn't be writing a post about External Relays if there wasn't something special about them. 

When creating an external relay you want to be sure to un-check all the security mechanisms from the Authentication tab, since it's likely you are relaying mail for things like your UPS which might be "phoning home" with updates to a support provider or copier/scanners that might need to send a scanned items to an outside party - all types of devices that likely won't have a mechanism to authenticate to your mail server.

You also need to set your "Permission Groups" to Anonymous, but the configuration doesn't end there.  Be sure to kick off this little extra PowerShell as well.

Get-ReceiveConnector "External Relay" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Recipient"

Now that this relay is pretty wide open, so lock down which IP addresses from your network are allowed to use it so that its well controlled.  If you need some screenshots for the configuration, check out this post from the Lazy Network Admin.
http://www.lazynetworkadmin.com/knowledgebase-mainmenu-6/2-windows/149-exchange-2010-configure-anonymous-relay-to-external-domains

Playing IT Fast and Loose

It's been a long time since I've been at work from dusk 'til dawn. I not saying that I'm the reason we have such fabulous uptime, there are a lot of factors that play into it. We've got a well rounded NetOps team, we try to buy decent hardware, we work to keep everything backed up and we don't screw with things when they are working. And we've been lucky for a long time.

It also helps that our business model doesn't require selling things to the public or answering to many external "customers".  Which puts us in the interesting position where its almost okay if we are down for a day or two, as long as we can get things back to pretty close to where they were before they went down. That also sets up to make some very interesting decisions come budget time. They aren't necessarily "wrong", but they can end up being awkward at times.

For example, we've been working over the last two years to virtualize our infrastructure. This makes lots of sense for us - our office space requirements are shrinking and our servers aren't heavily utilized individually, yet we tend to need lots of individual servers due to our line of business. When our virtualization project finally got rolling, we opted to us a small array of SAN devices from Lefthand (now HP).  We've always used Compaq/HP equipment, we've been very happy with the dependability of the physical hardware.  Hard drives are considered consumables and we do expect failures of those from time to time, but whole systems really biting the dust?  Not so much.

Because of all the factors I've mentioned, we made the decision to NOT mirror our SAN array. Or do any network RAID.  (That's right, you can pause for a moment while the IT gods strike me down.)  We opted for using all the space we could for data and weighed that against the odds of a failure that would destroyed the data on a SAN, rendering entire RAID 0 array useless.

Early this week, we came really close. We had a motherboard fail on one of the SANs, taking down our entire VM infrastructure. This included everything except the VoIP phone system and two major applications that have not yet been virtualized. We were down for about 18 hours total, which included one business day.

Granted, we spent the majority of our downtime waiting for parts from HP and planning for the ultimate worst - restoring everything from backup. While we may think highly of HP hardware overall, we don't think very highly of their 4-hour response windows on Sunday nights.  Ultimately, over 99% of the data on the SAN survived the hardware failure and the VMs popped back into action as soon as the SAN came back online. We only had to restore one non-production server from backup after the motherboard replacement.

Today, our upper management complemented us on how we handled the issue and was pleased with how quickly we got everything working again.

Do I recommend not having redundancy on your critical systems? Nope.

But if your company management fully understands and agrees to the risks related to certain budgeting decisions, then as a IT Pro your job is to simply do the best you can with what you have and clearly define the potential results of certain failure scenarios.  

Still, I'm thinking it might be a good time to hit Vegas, because Lady Luck was certainly on our side.