Microsoft Exchange Server 2013 Inside Out: Mailbox
spine = 1.3” Conquer Mailbox administration—from the inside out! Focusing on the Mailbox server role, dive into Exchange Server 2013—and really put your enterprise messaging to work! This supremely organized reference packs hundreds of timesaving solutions, troubleshooting tips, and workarounds for managing mailboxes and high availability. Discover how the experts manage core operations and support tasks—and challenge yourself to new levels of mastery. • Prepare for installation or upgrade • Master role-based access control (RBAC) fundamentals • Create, manage, move, and archive mailboxes • Implement email address policies • Configure and manage distribution groups • Understand Store components and functionality • Deliver high availability through database availability groups Inside OUT For experienced Exchange Server administrators Foreword by Rajesh Jha Corporate Vice President, Exchange Server Group, Microsoft Corporation About the Author Tony Redmond is a Microsoft Most Valuable Professional (MVP) and one of the leading voices in the Exchange Server community. He has two decades of experience with enterprise mail, focusing on Exchange Server since version 4.0. As an industry consultant, he guides customers through Exchange Server deployment and management, and he’s written 10 books. (DAGs) • Manage compliance, retention, mailbox search, and data loss Microsoft Exchange Server 2013 Mailbox and High Availability Microsoft Exchange Server 2013 Mailbox and High Availability Inside OUT The ultimate, in-depth reference Hundreds of timesaving solutions Supremely organized, packed with expert advice prevention • Use the Exchange Management Shell and cmdlets • Administer public folder architecture Inside OUT Also look for Microsoft Exchange Server 2013 Inside Out: Connectivity, Clients, and UM 9780735678378 Redmond microsoft.com/mspress ISBN: 978-0-7356-7858-3 U.S.A.$49.99 Canada $52.99 [Recommended] Messaging/Microsoft Exchange Server Celebrating 30 years! Microsoft Exchange Server 2013: Mailbox and High Availability Tony Redmond Award-winning author + Microsoft MVP PUBLISHED BY Microsoft Press A Division of Microsoft Corporation One Microsoft Way Redmond, Washington 98052-6399 Copyright © 2013 by Tony Redmond All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Library of Congress Control Number: 2013948703 ISBN: 978-0-7356-7858-3 Printed and bound in the United States of America. First Printing Microsoft Press books are available through booksellers and distributors worldwide. If you need support related to this book, email Microsoft Press Book Support at [email protected] Please tell us what you think of this book at http://www.microsoft.com/learning/booksurvey. Microsoft and the trademarks listed at http://www.microsoft.com/about/legal/en/us/IntellectualProperty /Trademarks/EN-US.aspx are trademarks of the Microsoft group of companies. All other marks are property of their respective owners. The example companies, organizations, products, domain names, email addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred. This book expresses the author’s views and opinions. The information contained in this book is provided without any express, statutory, or implied warranties. Neither the authors, Microsoft Corporation, nor its resellers, or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book. Acquisitions Editor: Anne Hamilton Developmental Editor: Karen Szall Project Editor: Karen Szall Editorial Production: nSight, Inc. Technical Reviewer: Paul Robichaux; Technical Review services provided by Content Master, a member of CM Group, Ltd. Copyeditor: Kerin Forsyth Indexer: Lucie Haskins Cover: Twist Creative • Seattle Contents at a Glance Chapter 1 Introducing Microsoft Exchange Server 2013. . . 1 Chapter 2 Installing Exchange 2013 . . . . . . . . . . . . . . . . . . . 43 Chapter 3 The Exchange Management Shell. . . . . . . . . . . . 83 Chapter 4 Role-based access control . . . . . . . . . . . . . . . . . 131 Chapter 5 Mailbox management. . . . . . . . . . . . . . . . . . . . . 169 Chapter 6 More about the Exchange Administration Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 Chapter 7 Addressing Exchange . . . . . . . . . . . . . . . . . . . . . 333 Chapter 8 The Exchange 2013 Store. . . . . . . . . . . . . . . . . 387 Chapter 9 The Database Availability Group. . . . . . . . . . . . 457 Chapter 10 Moving mailboxes. . . . . . . . . . . . . . . . . . . . . . . 567 Chapter 11 Compliance management . . . . . . . . . . . . . . . . 641 Chapter 12 Public folders and site mailboxes. . . . . . . . . . . 765 iii Table of Contents Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii Errata & book support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii We want to hear from you . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Stay in touch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Chapter 1 Introducing Microsoft Exchange Server 2013 . . . . . . . . . . . . . . . . . . . . . . . 1 Understanding development priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 The influence of The Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Exchange Online and Exchange development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Transition into the cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Exchange 2013 architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 The motivation to upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Evolving from earlier versions of Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Waiting for updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Fundamental questions before you upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Selecting the right Windows Server for Exchange 2013 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Using virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Preparing for Exchange 2013 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 A word about transport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 The test plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Testing for operational processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Testing for programming and customizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Updating earlier versions of Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Deploying earlier versions of Exchange servers alongside Exchange 2013 . . . . . . . . . 32 Exchange 2013 editions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Using the strong link between Exchange and Active Directory . . . . . . . . . . . . . . . . . . 34 ADSIEdit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 What do you think of this book? We want to hear from you! Microsoft is interested in hearing your feedback so we can continually improve our books and learning resources for you. To participate in a brief online survey, please visit: microsoft.com/learning/booksurvey v vi Table of Contents Useful utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . MFCMAPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange Web Services Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing Exchange 2013 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 2 Installing Exchange 2013 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Approaching the installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Types of Active Directory deployment that support Exchange . . . . . . . . . . . . . . . . . . . . . . . . Preparing Active Directory for Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating the Exchange 2013 organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Deploying an Exchange 2013 server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing UCMA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Running Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setup logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstalling Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Repairing Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Recovering a failed server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Versions, cumulative updates, and service packs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cumulative updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Version numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Object versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reporting licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security groups and accounts Exchange creates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Namespace planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Self-signed certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using the Exchange 2013 CAS to handle connections . . . . . . . . . . . . . . . . . . . . . . . . . . The case for protocol-specific namespaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Contemplating management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 3 37 38 40 41 43 45 47 49 50 53 53 56 58 61 61 63 64 67 69 70 73 77 77 79 80 81 The Exchange Management Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 How Exchange uses Windows PowerShell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Using remote Windows PowerShell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Connecting to remote PowerShell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Limiting user functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 EMS basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Command editing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Handling information EMS returns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Selective output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Using common and user-defined variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Using PowerShell ISE with Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Identities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Piping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 OPATH filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Server-side and client-side filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Transcripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Bulk updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Calling scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Chapter 4 Table of Contents vii Execution policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Active Directory for PowerShell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting the right scope for objects in a multi-domain forest . . . . . . . . . . . . . . . . . . . Exploring useful EMS examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Looking for large folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Outputting a CSV file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating a report in HTML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Verbose PowerShell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Controlling access to Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 119 120 122 123 124 125 127 129 129 Role-based access control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 RBAC basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Role groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scopes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Working with RBAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating a new role group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maintaining role group membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Role group management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Role assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using role assignment policy to limit access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating roles for specific tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Specific scopes for role groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database scoping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Special roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Unscoped roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Which role groups do I belong to? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Assignment policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Implementing a split permissions model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Figuring out RBAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . On to management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 5 132 136 139 141 143 145 149 151 152 153 155 157 158 159 160 162 163 166 167 168 Mailbox management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Seeking perfection halts progress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Starting EAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How EAC accesses Exchange data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Changing EAC columns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Naming conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing Recipients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Recipient filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exporting EAC information to CSV files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Some mysterious mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The need for mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Naming mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating new mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Completing mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 173 176 177 178 180 180 181 182 183 185 187 193 viii Table of Contents Bulk mailbox creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating new room and resource mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Languages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Default folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Manipulating mailbox settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Automating mailbox settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . What’s in a mailbox? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ready-to-go custom attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mailbox resources provisioning management agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting mailbox quotas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing or disabling mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reconnecting mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Discovery mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating additional discovery mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Health mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting mailbox permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mailbox delegation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing Full Access permission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mailbox auto-mapping through Autodiscover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Opening another user’s mailbox with Outlook Web App . . . . . . . . . . . . . . . . . . . . . . Sending messages on behalf of other users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Outlook delegate access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Shared mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Recalling messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moderated recipients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moderated groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Processing moderation requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moderated mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mail-enabled contacts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mail users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Resource mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Defining custom properties for resource mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . Providing policy direction to the Resource Booking Attendant . . . . . . . . . . . . . . . . . Processing meeting requests according to policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Equipment mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enough about mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 6 195 195 196 200 202 205 207 207 209 213 218 220 224 224 226 229 229 232 235 237 237 239 240 241 243 244 247 249 250 252 254 255 256 261 265 266 More about the Exchange Administration Center . . . . . . . . . . . . . . . . . . 267 Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating new groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Group owners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Group expansion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Protected groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Viewing group members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tracking group usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 269 270 275 277 278 281 284 285 Chapter 7 Table of Contents ix Allowing users to manage groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Room lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dynamic distribution groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . OPATH queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating new dynamic distribution groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Validating query results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating dynamic groups with EMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using custom filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Certificate management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mail flow and rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Delivery reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Administrator searches for delivery reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using EMS to search delivery reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Running EAC without an Exchange mailbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting diagnostics for Exchange servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . But what will you manage? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 298 300 300 302 305 306 308 313 313 318 320 322 327 329 330 332 Addressing Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 Email address policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Email policy priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating a new email address policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Focusing on certain recipients by using filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating email address policies with custom filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . Address lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Address book policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ABPs and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating and implementing an ABP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Offline Address Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The OAB and Outlook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How Exchange 2013 generates the Offline Address Book . . . . . . . . . . . . . . . . . . . . . . Creating and using customized OABs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hierarchical address book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . MailTips and group metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Client interaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring MailTips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Custom MailTips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Multilingual custom MailTips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . OAB support for MailTips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The display or Details Templates Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The next step . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 8 333 334 337 341 343 345 348 350 351 357 359 362 367 371 373 376 377 378 380 381 381 382 386 The Exchange 2013 Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 Long live JET! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 Maximum database size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389 Sizing mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 x Table of Contents Dealing with I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maintaining contiguity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The database schema . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exchange 2013 I/O improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Workers, controller, and memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managed Availability and the Managed Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating new mailbox databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Updating mailbox databases after installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Backups and permanent removal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing a database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transaction logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Log sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transaction log checksum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transaction log I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The question of circular logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reserved logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Background maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database checksums . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database defragmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database compaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page zeroing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Content maintenance tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Corrupt item detection and isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Protection against high latency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Protection against excessive database or log growth . . . . . . . . . . . . . . . . . . . . . . . . . . Debugging swelling databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Online repair cmdlets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Rebuilding a database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using ESEUTIL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database usage statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mailbox assistants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . And now for something completely different . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 9 392 397 398 400 402 407 407 410 414 416 417 419 419 427 427 429 431 432 433 435 436 436 436 437 442 443 444 445 448 450 451 454 455 The Database Availability Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 Changes in high availability in Exchange 2013 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database portability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database Availability Group basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The dependency on Windows clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Migrating an Exchange 2010 DAG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Active Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Automatic database transitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managed Availability and high availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Best copy and server selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ACLL: Attempt copy last logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transaction log replay: The foundation for DAG replication . . . . . . . . . . . . . . . . . . . . . . . . . Transaction log compression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 459 461 463 464 465 467 469 472 478 479 483 Chapter 10 Table of Contents xi Block mode replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transaction log truncation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Incremental resynchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Seeding a database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Changes in message submission within a DAG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Day-to-day DAG management and operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Building the DAG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Pre-staging the Cluster Name Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The role of the FSW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DAG task logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Crimson events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing DAG properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DAG networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cleaning up before creating database copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using circular logging inside a DAG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Adding new database copies to a DAG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Monitoring database copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reseeding a database copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Adding database copies with EMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using a lagged database copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Activating a mailbox database copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Rebalancing database copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Performing a server switchover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AutoDatabaseMountDial and potential issues moving databases . . . . . . . . . . . . . . . Activation blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moving database locations within a DAG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing database copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing servers from a DAG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Handling storage failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Datacenter Activation Coordination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Approaching DAG designs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How Exchange 2013 changes the resilience equation . . . . . . . . . . . . . . . . . . . . . . . . . Building a DAG with Exchange Standard edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Server maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stressed servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . On to protecting data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 486 487 489 489 489 494 497 499 502 502 504 506 510 510 514 517 523 525 525 533 534 536 539 542 544 546 548 549 551 552 558 560 562 565 566 Moving mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 The Mailbox Replication service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moving mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Asynchronous moving . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Migration service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mailbox Replication service processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . MRS and system resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preventing loss of data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating and managing migration batches with EAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using EMS with migration batches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 568 571 572 575 579 580 581 592 xii Table of Contents Reporting mailbox moves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Getting more information about a move . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Accessing move report histories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing individual mailbox moves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Assigning move priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moves and mailbox provisioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Handling move request errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Checking and altering move request status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Clearing move requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Migration endpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enabling MRSProxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Planning mailbox moves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Suspending mailbox moves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ensuring high availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . MRS configuration file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mailbox import and export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gaining permission through RBAC to execute mailbox import and export . . . . . . . Planning the import of PST data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Importing and exporting mailbox data with EAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Importing and exporting mailbox data with EMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Time to comply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 11 595 597 599 605 607 607 607 609 610 611 612 614 615 619 621 623 624 626 629 632 638 640 Compliance management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 The joy of legal discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Archive mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enabling archives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The default archive and retention policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using an archive mailbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Disabling an archive mailbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Messaging records management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Types of retention tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Designing a retention policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managed Folder Assistant and retention policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Naming retention tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating retention tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating a retention policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Applying a retention policy to mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Modifying a retention policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Customizing retention policies for specific mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . User interaction with retention policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting a retention policy on a folder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing tags from policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing a retention policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Upgrading from managed folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 642 645 647 652 655 656 657 657 662 663 665 666 668 673 677 681 681 684 685 687 688 688 Chapter 12 Table of Contents xiii How the Managed Folder Assistant implements retention policies . . . . . . . . . . . . . . . . . . . Behind the scenes with the MFA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Retention date calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preserving information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Putting a mailbox on retention hold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Putting a mailbox on litigation hold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Searching mailbox content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . In-place holds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating a new search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Retrieving discovered content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Examining search results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Resource throttling for searches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How in-place holds work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using groups with searches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing a search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Executing searches with EMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . What Exchange can search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Search syntaxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The value of the Recoverable Items structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The function of the Recoverable Items structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Improvements in Exchange 2013 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Single-item recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Knowing what’s in Recoverable Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing quotas for Recoverable Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Auditing administrator actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The audit mailbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How administrator auditing happens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Auditing mailbox access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enabling mailboxes for auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Accessing mailbox audit data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Other compliance features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 691 693 696 698 699 701 703 708 716 720 724 726 728 730 731 733 736 737 737 739 743 745 746 748 749 750 754 757 759 763 Public folders and site mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765 Public folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . New concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating public folder mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How many public folder mailboxes are needed? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Controlling the root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Creating public folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mail-enabling public folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moving public folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Redirecting content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Removing a public folder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mobile access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Organizational forms library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Migration to modern public folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765 766 767 770 774 776 779 783 785 786 786 787 787 Site mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How site mailboxes work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The life cycle of site mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Site mailbox provisioning policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summarizing public folders and site mailboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Moving on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791 792 800 803 804 805 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 807 What do you think of this book? We want to hear from you! Microsoft is interested in hearing your feedback so we can continually improve our books and learning resources for you. To participate in a brief online survey, please visit: microsoft.com/learning/booksurvey Foreword for Exchange 2013 Inside Out books Those seeking an in-depth tour of Exchange Server 2013 couldn’t ask for better guides than Tony Redmond and Paul Robichaux. Tony and Paul have a relationship with the Exchange team that goes back two decades, to the days of Exchange 4.0. Few people have as much practical knowledge about Exchange, and even fewer have the teaching skills to match. You are in good hands. Over the past few years, we have seen significant changes in the way people communicate; a growing number of devices, an explosion of information, increasingly complex compliance requirements, and a multigenerational workforce. This world of communication challenges has been accompanied by a shift toward cloud services. As we designed Exchange 2013, the Exchange team worked hard to build a product and service that address these challenges. As you read these books, you’ll get an up-close look at the outcome of our efforts. Microsoft Exchange Server 2013 Inside Out: Mailbox and High Availability covers foundational topics such as the Exchange Store, role-based access control (RBAC), our simplified approach to high availability, and the new public folder architecture. It also covers our investments in eDiscovery and in-place hold. As you read, you’ll see how Exchange 2013 helps you achieve world-class reliability and provides a way to comply with internal and regulatory compliance requirements without the need for third-party products. Microsoft Exchange Server 2013 Inside Out: Connectivity, Clients, and UM explores the technologies that give users anywhere access to their email, calendar, and contacts across multiple devices. It also explains how to protect your email environment from spam, viruses, and other threats and describes how Exchange 2013 can connect with Office 365 so you can take advantage of the power of the cloud. From our new building-block architecture to data loss prevention, there’s a lot to explore in the newest version of Exchange. I hope that as you deploy and use Exchange 2013, you’ll agree that this is an exciting and innovative release. Enjoy! Rajesh Jha Corporate Vice President - Exchange Microsoft Corporation xv Introduction This book is for experienced Exchange administrators who want to get inside the soul of Exchange Server 2013, the latest version of the Microsoft enterprise messaging server first released in October 2012 and updated on a frequent basis since. You might learn how to work with Exchange 2013 by reading this book, but I sincerely doubt that this will happen simply because I have written it with experience in mind. The book does not cover every possible topic relating to Exchange 2013. In fact, it focuses primarily on the Mailbox server role. Let me explain why. After completing Microsoft Exchange Server 2010 Inside Out (Microsoft Press, 2010), it became very clear that attempting to cover all of a complex product such as Exchange in any depth in just one book was a fool’s errand. There are too many details to master, too much work to do, too much information that can only be skimmed over to keep to a reasonable page count. The result would probably be a book that weighs 2 kilos, spanning 1,400 pages that takes 2 years to write. All in all, an unacceptable situation in both commercial and practical terms. Paul Robichaux and I ran a number of Exchange 2010 Maestro seminars in the 2010–2011 period. Despite the infamous cockroach sandwich affair, the events were good fun, and we enjoyed discussing the technology in some depth, even if we tended to ramble on at times. Brian Desmond, an Active Directory MVP who did an excellent job of lab master and stand-in speaker when required, helped us. Because we worked well together and because Paul has an excellent record of writing both books and articles, it seemed like a good idea to consider a joint approach for Microsoft Exchange Server 2013 Inside Out. We arrived at the basic idea quickly—we would split coverage into the two server roles. I’d write about the Mailbox role and Paul took on client access, including all the various clients Exchange supports, and unified messaging, which, strictly speaking, is part of an Exchange 2013 Mailbox server. However, Paul is an acknowledged expert in this space, and it would have made no sense to have me write about a subject of which Paul is the master. Because Exchange 2013 is an evolution of Exchange 2010, we decided to use Microsoft Exchange Server 2010 Inside Out as the base for the new book. An evolution it might be, but an extensive level of change at the detail level exists in Exchange 2013. The upshot is that I’m not sure how much of that book remains in the current text—maybe 20 percent. One thing I am glad of is that we did not rush to press after Exchange 2013 first appeared. Given the amount of change that has occurred in updates from Microsoft since, a book that describes the release to manufacturing (RTM) version of Exchange 2013 would have been obsolete very soon after publication. We hope that these volumes will last longer. xvii xviiiIntroduction I hope that you enjoy this book and that you’ll read it alongside Paul’s Microsoft Exchange Server 2013 Inside Out: Clients, Connectivity, and UM. The two books really do go together. Paul has scrutinized every word in this book and I have done the same for his. We therefore share the blame for any error you might find. Acknowledgments I owe enormous thanks to the many people who agreed to look over chapters or portions of the book. Each has deep expertise in specific areas and all contributed greatly to eradicating errors and increasing clarity. These folks include Sanjay Ramaswamy, Jürgen Hasslauer, David Espinoza, William Rall, Todd Luttinen, Tim McMichael, Vineetha Kalvakunta, Fred Monteiro da Cruz Filho, Kanika Ramji, Lokesh Bhoobalan, Astrid McClean, Alfons Staerk, Kern Hardman, Andrew Friedman, Abram Jackson, and Scott Schnoll. Even if they didn’t realize it, many of the Exchange MVPs played their part in improving the book by prompting me to look into topics that I had forgotten to cover. I should also acknowledge the huge contribution made by my editor, Karen Szall. We fought many times about page counts, content, and too many other topics to list here but always kept the project moving. I apologize sincerely if I have omitted to mention anyone who has contributed to making the text of the book as accurate and as informative as possible. Errata & book support We’ve made every effort to ensure the accuracy of this book and its companion content. Any errors that have been reported since this book was published are listed on our Microsoft Press site: http://aka.ms/ExIOv1/errata If you find an error that is not already listed, you can report it to us through the same page. If you need additional support, email Microsoft Press Book Support at [email protected] Please note that product support for Microsoft software is not offered through the addresses above. Introduction xix We want to hear from you At Microsoft Press, your satisfaction is our top priority, and your feedback our most valuable asset. Please tell us what you think of this book at: http://www.microsoft.com/learning/booksurvey The survey is short, and we read every one of your comments and ideas. Thanks in advance for your input! Stay in touch Let's keep the conversation going! We're on Twitter: http://twitter.com/MicrosoftPress. C HA PT E R 3 The Exchange Management Shell How Exchange uses Windows PowerShell. . . . . . . . . . . . . 83 Exploring useful EMS examples. . . . . . . . . . . . . . . . . . . . . 123 Using remote Windows PowerShell. . . . . . . . . . . . . . . . . . . 86 Verbose PowerShell. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 EMS basics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Controlling access to Exchange. . . . . . . . . . . . . . . . . . . . . 129 Active Directory for PowerShell. . . . . . . . . . . . . . . . . . . . . 120 W indows PowerShell is an extensible automation engine consisting of a command-line shell and a scripting language. Exchange Server 2007 was the first major Microsoft application to support Windows PowerShell in a comprehensive manner. Although not every administrator welcomed the opportunity to learn a new scripting language, the overall impact was extremely positive. The role of Windows PowerShell continues to expand across Microsoft products, and it now extends into the newest Microsoft offerings, including the deployment and management of applications on the Azure cloud computing platform. Windows PowerShell is built on top of the Microsoft .NET Framework and is implemented in the form of cmdlets, specialized .NET classes that contain the code to implement a particular operation such as the creation of a new mailbox or the enumeration of the processes that are currently active on a server. Applications implement Windows PowerShell support by providing sets of application-specific cmdlets that collectively represent the functionality required to support the application, or they can be used to access different data stores such as the file system or system registry. Cmdlets can be run separately or combined by piping the output generated by one cmdlet to become the input of the next. Cmdlets can also be combined into scripts (with a .ps1 file extension) to provide more comprehensive processing and logic or included in executables when the need exists to launch a standalone application. Many scripts are available on different Internet sites to assist with Exchange management. How Exchange uses Windows PowerShell From an Exchange perspective, Windows PowerShell provides a way to perform tasks quickly and simply in a variety of manners, from one-off interventions to process one or more Exchange objects to complex scripts to perform tasks such as mailbox provisioning. Most administrators cut their teeth on PowerShell by using the Exchange Management Shell (EMS) to do simple things, such as using Get-Mailbox to report on a mailbox’s 83 84 Chapter 3 The Exchange Management Shell properties and Set-Mailbox or Set-CASMailbox to set a property, before moving on to the more esoteric commands to manipulate connectors or control the ability of devices to connect through ActiveSync and so on. The saying is that almost anything is possible with Windows PowerShell, and this is certainly true when you dedicate enough energy and time to mastering the language, not to mention the time necessary to scan the Internet for useful examples of scripts that can be adapted to meet your needs. Prior to Exchange Server 2007, business logic was scattered in components throughout the product. The management console did things—even simple things like setting a property on a server—by using different code and logic than in the setup program, and the application programming interfaces (APIs) included in the product usually provided a third way to approach a problem. The result was a total lack of consistency, duplication of code, and a tremendous opportunity to create bugs in multiple places. In addition, administrators could not automate common tasks to meet the needs of their organization; essentially, if an Exchange engineer didn’t code something into the product, it couldn’t be done. Chapter 3 Figure 3-1 illustrates the central role Windows PowerShell now plays in the Exchange architecture and shows how it provides a central place to encapsulate business logic that underpins the Exchange setup program, the Exchange Administration Center (EAC), the mailbox options that users can update through Outlook Web App, and the Exchange Management Shell (EMS). Figure 3-1 Windows PowerShell at the heart of Exchange How Exchange uses Windows PowerShell 85 The exact scope and range of the functionality presented to any individual user is determined by the permissions granted to him through role-based access control (RBAC). RBAC is designed to function across a range of environments, from a single-server organization to an organization composed of a mixture of on-premises and hosted servers. The need to accommodate such a wide range of environments is also why Microsoft has moved from local PowerShell (by which all commands are executed on a local server) to remote PowerShell (by which commands are redirected through Internet Information Services [IIS] for execution on a target server). The details of just how remote PowerShell and RBAC work together in EMS are covered shortly. Simplifying the implementation of new functionality The administrative interfaces in Exchange all lead to the same place and execute the same business logic. Apart from removing redundant and overlapping code, having a single place to implement business logic enables the Exchange engineers to concentrate on implementing new functionality rather than re-implementing features specifically for use by EAC, EMS, or the setup program. The approach enables Exchange to deliver a more consistent administrative environment and a comprehensive method to automate tasks to deal with mailboxes, databases, connectors, and all the other components that collectively make up an Exchange organization. At the time of writing, Exchange 2013 RTM CU2 includes 965 cmdlets that are added to the standard set of Windows PowerShell cmdlets, including cmdlets to work with the system registry, file system, variables (including environmental variables), and so on that are available in an EMS session. Depending on the RBAC role groups of which your account is a member, the number of cmdlets available to you might vary. Collectively, the set of EMS cmdlets manages the objects and the properties of the objects that form Exchange. Objects include mailboxes, servers, transport rules, connectors, and so on. You can determine the exact number of cmdlets Exchange owns by using the following command (this command doesn’t work with Exchange Online): Get-ExCommand | Measure-Object | Select Count Chapter 3 The way Exchange uses Windows PowerShell to implement business functionality is probably the most extensive of any Microsoft application. As explored throughout this book, the options presented by EAC to work with mailboxes, connectors, servers, and other objects invariably result in a call to one or more PowerShell cmdlets that actually do the work. The functionality presented to administrators, specialist users (those who perform a subset of administrative tasks such as maintaining user details), and normal users is all based on PowerShell. 86 Chapter 3 The Exchange Management Shell INSIDE OUT Finding the cmdlets available to you As you learn in the discussion about RBAC in Chapter 4, “Role-based access control,” an EMS session allows you access only to the cmdlets and parameters that are defined in the roles included in the role groups of which your account is a member. Accounts that are highly permissioned, such as those belonging to the Organization Management role group, can use many more cmdlets than those that belong to a less-permissioned role group, such as Help Desk or Recipient Management. You can use this command to generate a full list of all the Exchange 2013 cmdlets your account can access: Get-ExCommand > C:\Temp\ExCommands.txt Chapter 3 By comparison, Exchange 2007 includes 394 cmdlets, Exchange 2010, 584; and the RTM version of Exchange 2013, 958. The hundreds of new cmdlets included in Exchange 2013 and subsequently augmented through cumulative updates reflect the new functionality in the product such as the introduction of site mailboxes and data loss protection policies, along with the expansion of existing functionality such as the changes to compliance. PowerShell use and syntax are fundamental skills for Exchange administrators to master. In fact, many Exchange administrators prefer EMS to EAC because of the additional flexibility that EMS provides. This chapter lays out the basics of Windows PowerShell and sets the stage for the examples of PowerShell found in other chapters. To begin, review how the Exchange management tools actually connect to PowerShell. Using remote Windows PowerShell Exchange 2010 began the necessary transformation from a model that assumed an administrator would always have some form of physical access to a server to the point at which remote management has become the norm. Remote PowerShell provides the fundamental building block for connectivity to remote systems. The combination of remote PowerShell and RBAC enables administrators to manage objects residing on a server in a remote datacenter as easily as managing objects on a local server. Note You can think of Windows PowerShell as implemented in Exchange Server 2007 as “local PowerShell” because cmdlets are executed in a local process. The only element of remote access in Exchange 2007 is when you pass the –Server parameter to identify a server against which to execute a command. Even so, if data are needed from a remote server, such as fetching a set of mailbox objects, it is retrieved across the network and processed locally. Using remote Windows PowerShell 87 Exchange 2010 and Exchange 2013 support the remote execution of commands in a secure manner, using HTTPS and a Kerberos-based encryption mechanism that is easily manageable through firewalls (assuming that port 80 is open). Remote PowerShell is now used for all EMS sessions. Even if you are logged on to an Exchange server and want to use EMS to change a property of that server, EMS still creates a remote session on the local server to do the work. The same applies for EAC because Exchange creates a remote session when you log on to connect to a server in the local Active Directory site to retrieve information about the organization and then display it in the console. In effect, remote PowerShell has replaced local PowerShell for all server roles except edge servers. The sole exception is for commands used during setup, which continue to execute locally. Remote PowerShell separates business logic into code that runs on the client and code that runs on the Exchange server. The logic for replacing local PowerShell with the remote model is simple. Just as the change in Exchange 2007 forced all messages to flow through the transport system so that a common place existed to apply features such as transport rules, remote PowerShell forces all aspects of Exchange administration to flow through RBAC so that tight control can be achieved over the actions an administrator—or, indeed, a user—is allowed to perform. An RBAC role group defines the set of administrative actions a user is allowed to perform inside Exchange and can be resolved into a set of PowerShell cmdlets the user is allowed to use within her PowerShell session. After it is created, a PowerShell session is populated with cmdlets by reference to the RBAC role groups of which the user is a member so that it will only ever include the cmdlets that have been assigned to an administrator through her membership in role groups. Thus, the fact that an administrator is not a member of a particular role group is reflected in that any PowerShell session she initiates will never be able to call the cmdlets associated with the management group. Consider the case of an administrator who is a member of the Organization Management role group, typically believed to be the all-powerful role for Exchange management. Even though membership in the Organization Management role group grants a user access to the vast majority of Exchange cmdlets, out of the box, it does not grant access to the set that controls movement of data into and out of mailboxes. To protect user data, the Mailbox Import-Export role has to be explicitly assigned to any user who wants to perform these tasks, even those who are already members of the Organization Management role group. The need to support massively scalable, multitenant platforms such as Office 365 was a major influence on the Exchange move to remote PowerShell. Providing a secure and controllable mechanism to permit administrators to execute privileged commands to control the subset of objects they own inside an infrastructure that is controlled and managed by someone else is always a difficult task, especially when all the data have to pass across the Internet. When you use PowerShell to create a session with Exchange Online, the session is by default remote because you cannot connect to the servers running in Microsoft datacenters in any other way. After it accepts the credentials you provide in the connection request, PowerShell loads in the cmdlets you are allowed to use through membership in Chapter 3 88 Chapter 3 The Exchange Management Shell RBAC role groups. The fact that Exchange Online restricts the number of cmdlets available to administrators when compared to on-premises deployments is immaterial. Exactly the same mechanism populates your PowerShell session with cmdlets whether you connect to an on-premises deployment or to a cloud-based service. CAUTION ! Until Microsoft removes the functionality, it is possible to use local PowerShell with the Exchange 2013 snap-in to perform management operations on a server. However, Microsoft is not testing local PowerShell with Exchange anymore, and it is possible that problems will appear in local PowerShell that will never be resolved. In addition, running local PowerShell means that you bypass the controls otherwise imposed by RBAC. Given the engineering and strategic focus on remote PowerShell, it makes sense for everyone to make the transition now and embrace this platform as the future of command-line Exchange management. Chapter 3 Connecting to remote PowerShell To understand how remote PowerShell and RBAC work together, examine how an administrator might create a new mailbox on a remote server. In this example, the administrator works on a help desk and has been assigned a role that enables him to create new mailboxes and update the properties of existing mailboxes. Further, assume that the user’s account is enabled to use remote PowerShell. In many cases, people in specialist roles such as help desk personnel use EAC to perform tasks, but an experienced Exchange administrator might prefer to use a command-line interface because of its power and flexibility, especially when processing multiple objects, when compared to EAC. Figure 3-2 lays out the various components remote PowerShell uses from the local PowerShell host on a workstation or server across the network to IIS and the PowerShell application running there. The other components are the PowerShell engine and the complete set of cmdlets available to Exchange 2013, the Exchange authorization library that handles the interpretation of roles in terms of the cmdlets that each RBAC role can use, and the Active Directory driver that reads data from Active Directory. For the purpose of this discussion, assume that the account has been assigned a role such as Recipient Management and is enabled for remote PowerShell. If you are unsure about the account’s status, you can enable it to use remote PowerShell as follows: Set-User –Identity AccountName –RemotePowerShellEnabled $True All PowerShell sessions flow through IIS because even a local connection goes through localhost. All Exchange 2013 servers support IIS and the PowerShell virtual directory, or Using remote Windows PowerShell 89 vdir; all are members of the Exchange Trusted Subsystem security group and therefore can manipulate any object in the organization. Chapter 3 If you run EMS on a workstation or server on which the Exchange management components are installed, EMS creates a remote session automatically as part of its initialization process. If you run PowerShell on a workstation that doesn’t have the Exchange management components installed, you must specify the name of the server with which you want to work. This is done by using the New-PSSession cmdlet, passing the name of the server to which to connect in the https://fqdn/PowerShell/ form. This cmdlet creates a secure, authenticated connection to IIS running on the target server and begins a session there by checking the role held by the account that initiates the connection. Figure 3-2 Remote PowerShell architecture When you run EMS on a server on which the Exchange 2013 management components are installed, the EMS initialization script creates an environment by executing the code in the RemoteExchange.ps1 script (in the Exchange binaries folder), which first attempts to create a remote session with the local host. If successful, it then identifies your account to Exchange, uses RBAC to determine the cmdlet set you are allowed to use, and so on. 90 Chapter 3 The Exchange Management Shell The RemoteExchange.ps1 script is quite complex because it has to handle the initiation of sessions in different circumstances, so it’s easier to look at the code that connects a new session with Exchange Online to see how the basic requirements to create a remote PowerShell session are met. The following code defines the Connect-ExchangeOnline function, which is suitable for inclusion in your PowerShell profile (a document that initializes a session with common commands and settings that you might want to use during the session). In fact, this is how I connect to Exchange Online when I want to manage my tenant domain. Three commands are executed: ●● ●● ●● Get-Credential gathers the name of the account with which to connect and its password. New-PSSession establishes the remote PowerShell session with Exchange Online. Import-PSSession imports the Exchange commands from the Exchange Online session into your current session. Chapter 3 function Connect-ExchangeOnline { $LiveCred = Get-Credential $global:Session365 = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection Import-PSSession $global:Session365 } How the initialization script finds a server When a user creates a remote PowerShell session on an Exchange server, the initialization script attempts to connect him to the same server. If the attempt to establish a connection with the local server fails, the initialization script then enumerates the full set of Exchange servers in the local site and attempts to make a connection to one of the servers chosen at random. If this attempt fails, the script moves on to the next server and continues until a successful connection is established or all available servers have been attempted and have failed. The initialization script works in the same way when executed on a workstation that has the Exchange management components installed on it, except that the initialization begins by randomly selecting one of the servers from the site. IIS uses the RBAC mechanism to check the user’s role and associated permissions through the Exchange Authorization Library. The Exchange Authorization Library (or ADDriver) connects to Active Directory to use it as the definitive source of information about accounts and supplements these data with its knowledge about the Exchange-specific roles that Using remote Windows PowerShell 91 administrators have assigned to users. During a PowerShell session, ADDriver connects to a domain controller in the local site to fetch data from Active Directory and keeps this connection throughout the session (referred to as DC affinity). Many PowerShell cmdlets support the DomainController parameter to enable you to connect to a specific domain controller (specifying the fully qualified domain name [FQDN]) if the need arises. Because this user works with mailboxes as defined by the Recipient Management role group, the set of cmdlets he can use includes commands with easily identified purposes such as New-Mailbox, Set-Mailbox, Get-Mailbox, and so on. Tip Users are not normally aware that they are restricted in terms of available cmdlets unless they attempt to use one to which they do not have access. The point is that they shouldn’t care that they can’t use hundreds of cmdlets, many of which do obscure things such as setting properties on messaging connectors or performing one-off operations such as creating a new Database Availability Group (DAG) or mailbox database. Instead, RBAC makes sure that users can access only the cmdlets they need to perform their jobs. Limiting user functionality When a new PowerShell session is created, you see no evidence that your role has forced RBAC to restrict the cmdlet set or the parameters you can use with cmdlets because the initialization of a session progresses just as it would for a fully privileged user. However, after you start to execute cmdlets, you quickly realize that you can’t do as much as you’d like. For instance, if you log on with a restricted user account and attempt to use the Get-Mailbox cmdlet to fetch a list of mailboxes, all you’ll see is your own mailbox. This is logical because your role allows you to see details of your own mailbox but not others’. In the same way, if you then attempt to use the Set-Mailbox cmdlet to update a property that only administrators can access, you won’t be able to use even tab completion to reveal a restricted property. However, unless the default role assignment policy has been amended to block access to basic user options, you can use the Set-Mailbox cmdlet to update properties that are generally exposed for user update through Outlook Web App options, so (assuming JSmith is the alias for your mailbox) you’ll be able to do things such as this: Set-Mailbox -Identity JSmith –MailTip 'Hello World' Chapter 3 Permissions granted through RBAC are evaluated during session initialization. If you are assigned a new role, you have to create a new session with EMS or EAC before you can access the cmdlets made available through the newly assigned role. 92 Chapter 3 The Exchange Management Shell or this: Set-Mailbox –Identity JSmith –Languages 'EN-US', 'EN-IE' INSIDE OUT You can do some things; you can’t do others Somewhat strangely, you’ll also be able to execute Get-MailboxStatistics to report the number of items in your mailbox but not Get-MailboxFolderStatistics to report on the folders and the items that each contains. This is all controlled by RBAC, the roles that your account holds, and the scope for the roles in terms of the cmdlets and parameters defined in each role. From this discussion, you should now understand how critical RBAC is to remote PowerShell and, by extension, to every aspect of the Exchange 2013 management toolset. Chapter 3 EMS basics Exchange 2013 RTM CU2 includes 965 cmdlets, but you’re not likely to use the vast majority of these simply because many are designed for one-time use. For example, after you configure a receive connector, you probably will not revisit the Set-ReceiveConnector cmdlet very often after the connector is working. However, you’ll use cmdlets such as GetMailbox daily. Some examples (in no particular order) of frequently used Exchange cmdlets are the following: ●● Get-ExchangeServer Return a list of Exchange servers in the organization. ●● Disable-Mailbox Disable a user’s mailbox. ●● Add-DistributionGroupMember Add a new member to a distribution group. ●● Set-Mailbox Set a property of a user’s mailbox. ●● Get-MailboxDatabase Retrieve properties of a mailbox database. ●● Get-MailboxStatistics Return statistics about user mailboxes such as the total item count, quota used, and so on. Note the consistent syntax of verb (Get, Set, Move, Remove, or Disable) and noun (Mailbox, User, and so on). Along with commands that operate on objects, you find commands that help you work with data, such as Where-Object, Sort-Object, and Group-Object. WhereObject, Sort-Object, and Group-Object are commonly shortened by using their aliases of EMS basics 93 Where, Sort, and Group. You can type Help followed by a cmdlet name at any time to get help on the syntax of the command. Tip When you start to write scripts, consider spelling out cmdlet names completely and avoiding the use of aliases. This is important because you can never know in what environment a script will be run and therefore cannot assume that an alias will be defined and available for use in your code. ●● Use the Get-Command cmdlet to list the cmdlets you can use with different objects. The set of cmdlets will be limited to whatever is permitted by the RBAC roles held by your account. For example, Get-Command *contact* lists all the cmdlets available to work with contacts (shown in the following example). You can also use the shortened alias of gcm for Get-Command. CommandType ----------Function Function Function Function Function Function Function Function ●● ●● ●● Name ---Disable-MailContact Enable-MailContact Get-Contact Get-MailContact New-MailContact Remove-MailContact Set-Contact Set-MailContact Definition ---------... ... ... ... ... ... ... ... Use the /detailed switch to get more detailed help about a cmdlet. For example: GetHelp Get-CASMailbox –Detailed. Use the /full switch to have EMS return every bit of information it knows about a cmdlet. For example, Get-Help Get-DistributionGroup –Full. Use the /examples switch to see whatever examples of a cmdlet in use EMS help includes. For example, Get-Help Get-MailboxServer –Examples. Chapter 3 The Exchange developers have provided very accessible help for the EMS cmdlets. Apart from using the Help cmdlet, there are other ways of seeking help. RBAC controls limit help content so that a user sees help only for the set of cmdlets available to the roles that user holds. You can do the following: 94 Chapter 3 The Exchange Management Shell ●● Use the /parameter switch to get information about a selected parameter for a cmdlet. For example, Get-Help Get-Mailbox –Parameter Server. This switch supports wildcards, so you can do something like Get-Help Set-Mailbox –Parameter *Quota*. INSIDE OUT Getting to know the cmdlets You will probably begin by using the /full switch to retrieve all available help for a cmdlet to get to know what each cmdlet does. After you learn more about the cmdlet, you can move on to the default view as you become more accustomed to working with EMS. Remember that the Exchange help file contains information about all the EMS cmdlets. The advantage of using the help file (which is always present on a server) is that you can use the help file’s index to search for specific entries. Chapter 3 Most of the time, you will probably work with commands by invoking EMS interactively and then typing whatever individual commands or scripts are necessary to perform a task. The user interface of EMS is based on the Win32 console with the addition of features such as customizable tab completion for commands. After you become accustomed to working with EMS, things flow smoothly, and work is easy. It is then usually faster to start EMS and issue the necessary code to change a property on a mailbox or a server than to start EAC and navigate to the right place to make the change through the graphical user interface (GUI). Tip Working through EMS is especially valuable if you have to perform management operations across an extended network link when waiting for the GUI to display can be painful. If you have a programmatic mind, you can also call EMS cmdlets through C# code, which is how Microsoft invokes them in EAC and other places throughout Exchange, such as to set up servers and databases in the setup program. (The blog Glen Scales writes at http://gsexdev.blogspot.com/ provides many good examples of how to call EMS cmdlets from code.) In the past, the different groups that contributed to Exchange had to build their own programming interfaces, whereas now everyone uses PowerShell. You can see that EMS focuses on performing tasks rather than taking the more objectfocused approach implemented in the GUI, something that reflects a desire to accommodate administrators who think about how to do things rather than how to work with objects. After all, it is human nature to think in terms of the task of moving a mailbox to a different server rather than thinking about how to manipulate the properties of a mailbox object to reflect its new location. EMS basics 95 Cmdlets accept structured pipelined input from one another in a common manner to allow them to process data in a consistent manner, no matter which cmdlet provides the data. Programmers therefore do not have to reformat data for input to specific cmdlets, so the task of assembling different cmdlets into a script to do a job is much easier. Microsoft built PowerShell around the concept of objects, so objects are accepted as input, and the output is in the form of objects that you can then pipe to other cmdlets. Even if the output from a cmdlet looks like plaintext, what you see is one or more objects that you can manipulate in a much more powerful manner than you can ever work with text output. The implementation is elegant. Command editing TABLE 3-1 Command editing keystrokes for PowerShell Keyboard command Effect F2 Creates a new command based on your last command. A pop-up screen appears in which to enter a character. PowerShell then creates a new command, using the last entered command up to the character you specify. For example, if the last command is Get- MailboxStatistics –Identity TRedmond, and you enter F2 followed by c, PowerShell inserts “Get-MailboxStatistics”. You can then complete the command as you like. F4 Deletes characters in the current command up to a specified position. For example, if the cursor is located at the “M” of Get- MailboxStatistics, and you enter F4 followed by x, PowerShell deletes “Mailbo” and the result is “Get-xStatistics”. Although this example wouldn’t result in a useful command, F4 is useful when you need to edit many parameters in a complex command. F7 Opens a list of the last 50 commands used in the current session to enable you to select a command for reuse. F8 Moves backward through the command history. Tab Requests PowerShell to complete a command based on what you’ve typed. Left/Right arrows Moves the cursor left and right through the current command line. Up/Down arrows Moves up and down through the history of previous commands. Delete Deletes the character under the cursor. Insert Toggles between character insert and character overwrite mode. Backspace Deletes the character before the cursor. Chapter 3 It should be apparent that you could do a lot of typing to enter commands into PowerShell, make the inevitable mistakes, correct them, and try again. To make the task a little easier, PowerShell supports the same kind of command-line editing as the Win32 console (CMD) does. Some of the more important keys you can use are described in Table 3-1. 96 Chapter 3 The Exchange Management Shell Most of these keys are straightforward. The two most interesting keys are F7 and Tab. F7 opens a list of the last 50 commands you have run in the current session (Figure 3-3) so that you can both see what you’ve done in the immediate past and select one of the commands to re-execute. You can type a couple of characters into the F7 list, and EMS will look for the first matching command, or you can use the Up and Down arrows to navigate through the command history. At times, it’s more convenient to use Up and Down arrows because you can retrieve more commands and edit a command before executing it. (F7 selects the command and executes it immediately.) Chapter 3 Figure 3-3 Using F7 to recall EMS commands INSIDE OUT An easy way to type a command Tab completion is a wonderful feature that Windows PowerShell inherited from CMD. You can partially enter a command and then press Tab to have PowerShell fill in the rest of the cmdlet name followed by its parameters. For example, type: Get-Dist This isn’t the name of a valid cmdlet, but it is the root of several cmdlets, so when you press Tab, PowerShell completes the first valid cmdlet that matches and inserts: Get-DistributionGroup If you press Tab again, PowerShell moves to the next cmdlet that matches and inserts: Get-DistributionGroupMember If you press Tab again, PowerShell returns to Get-DistributionGroup because there are only two valid matches. PowerShell also supports completion for parameters. If you insert a dash to indicate a parameter value after Get-DistributionGroup and press Tab, EMS basics 97 PowerShell starts with the first parameter and continues through all valid parameters. If you press Tab too many times and pass the parameter you want to use, you can press Shift+Tab to go back through the parameter list. If you add some characters to help PowerShell identify the parameter, it attempts to complete using that value. For example: PowerShell completes Get-DistributionGroup –Ma into the command Get-DistributionGroup –ManagedBy. Even better, tab completion is context-sensitive, so it understands the structure of the object you are navigating. For example, if you want to move through the system registry, tab completion understands the hive structure, so you can type a location in the registry and then use the Tab key to move through the available choices from that point. For example, type: Now press Tab, and PowerShell leads you through all the registry locations Exchange uses. Windows PowerShell supports both named and positional parameters. Identifiers are a good example of a positional parameter. For example, if you enter Get-Mailbox Tony, PowerShell assumes that Tony is the value for the –Identity parameter. Finally, PowerShell completes variables and even the properties of variables (such as their length) in a way similar to how the Microsoft Visual Studio IntelliSense feature works. If you type the incomplete name of a variable and press Tab, PowerShell completes it from the list of known variables. For example, if you fill a variable with details of a mailbox as in the following: $Mailbox = Get-Mailbox –Identity Redmond and then type $Ma and press Tab, PowerShell completes it and returns $Mailbox. This is a useful feature if you forget the names of variables you’ve defined. To see how properties are completed, type: $Mailbox.Di Pressing Tab now will request PowerShell to go through the list of properties beginning with Di. For a mailbox, the list is DistinguishedName and DisplayName. Chapter 3 CD HKLM:\Software\Microsoft\Exchange 98 Chapter 3 The Exchange Management Shell Handling information EMS returns Any cmdlet such as Get-EventLog that retrieves some information about an object will output a default set of properties about the object (or references to an object). Sometimes those properties are not exactly the ones you want to examine, so you will inevitably use the Format-List and Format-Table cmdlets to expand the set of properties a command returns. For example, if you use the Get-Mailbox cmdlet to view the properties of a mailbox, the information returned isn’t interesting: Get-Mailbox –Identity TRedmond Name ---Tony Redmond Alias ----TRedmond ServerName ---------ExServer1 ProhibitSendQuota ----------------unlimited Chapter 3 However, if you pipe the output to Format-List, you see much more information—far too much to review comfortably on screen—so it’s better to pipe the output to a text file and compare it at your leisure. The Get-Mailbox cmdlet does not return every property you can set on a user object because EMS differentiates between general Active Directory properties for a user object and those that are specific to Exchange. For example, Get-Mailbox does not list the Office property for a user because every user object in Active Directory has this property regardless of whether it is mail-enabled. Thus, if you want to retrieve or update the Office property, you have to use the Get-User and Set-User cmdlets, respectively. The same differentiation exists for groups and contacts when the Get-Group/Set-Group and Get-Contact /Set-Contact cmdlets are available. Selective output It is easy to list every property, but when you have limited screen space, you need to be more selective about the properties you want to output, and that’s why it’s often a good idea to use the Select-Object cmdlet to select the data you need before you pipe to Format-Table. In this case, you use the Select alias for Select-Object just because this cmdlet is used so often and it is nice to use shorthand. Get-Mailbox –Identity Pelton | Select Name, PrimarySmtpAddress, Database Name ---David Pelton PrimarySmtpAddress [email protected] Database -------ExServe1\DB1 EMS basics 99 PowerShell output can obscure data because it contains too many spaces. For example: Get-ExchangeServer Name ---EXSERVER1 EXSERVER2 Site ---contoso.com/Conf.... contoso.com/Conf.... ServerRole ---------Mailbox,... Mailbox Edition ------Enterprise Enterprise AdminDisplayVersion ------------------Version 15.0 (Bu... Version 15.0 (Bu... To force PowerShell to remove spaces and display more useful data, pipe the output to the Format-Table cmdlet and use the –AutoSize parameter to fit the output columns into the available space: Name ---EXSERVER1 EXSERVER2 Site ServerRole Edition AdminDisplayVersion ------------------------------------contoso.com/Configuration/Sites/Default-First-Site-Name Mailbox, ClientAccess Enterprise Version 1... contoso.com/Configuration/Sites/Default-First-Site-Name Mailbox, ClientAccess Enterprise Version 1... Another way of extracting and then working with data is to direct the output of a command into a variable, in which case you have a complete picture of the object’s properties in the variable. For example, this command loads all the available information about the ExServer2 server into the $Server variable: $Server = Get-ExchangeServer –Identity 'ExServer2' -Status You can extract additional information about the server to use by including the name of the property in which you’re interested. (Specifying the –Status parameter requests GetExchangeServer to provide some additional information about the current domain controller and global catalog the server is using.) You can also use a variable as an array and populate the array with a call to a command. In this example, you populate a $Mailboxes array with a call to Get-Mailbox, using a filter to extract details of all the mailboxes stored in a particular database. This output is a good example of how cmdlets can generate individual objects or an array of objects with each object being individually accessible within the array. $Mailboxes = Get-Mailbox –Database DB2 Chapter 3 Get-ExchangeServer | Format-Table -AutoSize 100 Chapter 3 The Exchange Management Shell When it is populated, you can then navigate through the array as follows: $Mailboxes[0] $Mailboxes[1] $Mailboxes[2] etc etc etc. You can reference specific properties of the objects by using the “.” operator. $Mailbox[2].Name $Mailbox[53].PrimarySmtpAddress INSIDE OUT Finding what you want when there’s a lot of output Chapter 3 The output from a cmdlet such as Get-Mailbox can easily result in a lot of data that are hard to read to find the piece of information in which you are really interested. One technique that helps is to pipe the output to the Out-String cmdlet and then use the FindStr cmdlet to search the output for a particular term. For example, here’s how to use the two cmdlets to search the output from Get-Mailbox to find a particular term. In this instance, EMS lists any occurrence of the word “Tony” if it exists in the list of mailbox names Get-Mailbox returns: Get-Mailbox | Out-String | FindStr "Tony" By default, EMS truncates the output of multivalue properties after 16 values. For example: Get-Mailbox –Identity 'Pelton, David' | Format-List Name, EmailAddresses Name : Pelton, David EmailAddresses : {smtp:[email protected], smtp:[email protected], smtp:[email protected] contoso.com, smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected] contoso.com, smtp:[email protected], smtp:[email protected]} Truncation can hide some valuable data. In the preceding example, many of the email addresses are defined for a mailbox, but the default Simple Mail Transfer Protocol (SMTP) address is not shown. If this limitation becomes a concern, you can force EMS to output more values for a property by amending a $FormatEnumerationLimit variable. This variable is defined in the EMS initialization script (\bin\Exchange.ps1), and the default value of 16 is usually more than sufficient for normal purposes. If you want to see more variables, you can set the variable to a different limit or set it to -1 to instruct EMS that it can enumerate as many values as are available for any property. For example: $FormatEnumerationLimit = -1 Get-Mailbox –Identity 'Pelton, David' | Format-List Name, EmailAddresses EMS basics 101 Name : Pelton, David EmailAddresses : {smtp:[email protected], smtp:[email protected], smtp:[email protected] contoso.com, smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected] contoso.com, smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected], smtp:[email protected] contoso.com, smtp:[email protected], SMTP:[email protected]} PowerShell includes a number of variables you will use a lot. $True and $False are variables you can pass to shell commands and scripts to check for true and false conditions. Usually, $True is equivalent to setting a check box for an option in EMC, and $False is equivalent to clearing a check box. If you prefer numeric values, you can replace $True and $False with 1 (one) and 0 (zero), respectively. Other global variables you commonly meet as you work with PowerShell include $Null (no value), $home, which returns the user’s home folder, and $pwd, which returns the current working folder. Important Exchange variables include the following: ●● ●● ●● $ExBin Points to the directory in which Exchange binaries and other important files are kept. On an Exchange 2013 server, this variable normally resolves to disk: \Program Files\Microsoft\Exchange Server\V15\bin. $ExScripts Points to the directory in which important Exchange .ps1 scripts are kept. On an Exchange 2013 server, this variable resolves to disk: \Program Files \Microsoft\Exchange Server\V15\Scripts. $ExInstall Points to the root directory for Exchange. On an Exchange 2013 server, this variable resolves to disk: \Program Files\Microsoft\Exchange Server\V15. You can use these variables to access files in these directories. For example, to see a list of scripts Exchange provides, type Dir $ExScripts. Checking that a value is $True or $False is a common occurrence. For positive conditions, you can shorten the check by just passing the property against which to check, and PowerShell will assume that you want to check whether it is true. For example, assume that you want to find out which mailboxes are enabled to use Outlook Web App. You can use this command and, as you can see, there is no mention of $True, but it works: Get-CASMailbox | Where-Object {$_.OWAEnabled} | Select Name Note the use of $_ in the last command. $_ is a very important variable because it points to the current object in the pipeline. Scripting languages on other platforms such as UNIX and Linux also support pipelines, which compose complex commands by allowing the output of Chapter 3 Using common and user-defined variables 102 Chapter 3 The Exchange Management Shell one command to be passed as the input to another. The | operator indicates that a pipeline is in place. Data are passed as fully formed objects rather than as a text stream. This enables PowerShell to operate on the full structure of data that are pipelined, including the attributes and types that define the objects piped from one cmdlet to another. For example, if you create a filter to look for people in a certain department because you want to update the name of the department, you might do this: Get-User | Where-Object {$_.Department –eq 'Legal'} | Set-User –Department 'Law' The Department property is prefixed with $_ to indicate that you want to check this property for every object the call to Get-User passes through the pipeline. You actually use $_. as the prefix because it includes the “.” operator to specify that you want to access a property. If you just passed $_ the comparison would not work because PowerShell would compare “Legal” against the complete object. Chapter 3 User-defined variables can be integer, decimal, or string—you decide by passing a value to the variable you want to use. For example: $Tony = 'Tony Redmond' $Figure = 15.16 This creates a string variable, and the second variable holds a decimal value. Variables are case-insensitive and case-preserving. Using the preceding example, you can refer to $Tony as $TONY or $tony or even $ToNY, and PowerShell will refer to the same variable. Variables are local unless you declare them to be global by prefixing them with Global, as in: $Global:Tony = 'Tony Redmond' When a variable is global, you can reference it interactively and in scripts you can call from anywhere. A word of caution about PowerShell and quotation marks Be careful how you use quotation marks in PowerShell because although it might appear that double and single quotation marks are interchangeable, there is a subtle difference that might catch you out. Single quotation marks represent a literal string, one that PowerShell will use exactly as you provide it. Double quotation marks mean that PowerShell should examine the string and resolve any variable it finds inside through a process called variable expansion. Consider this example: $n = Date $n1 = 'Right now, it is $n' Right now it is $n EMS basics 103 $n2 = "Right now, it is $n" $n2 Right now, it is Tue Jan 16 17:59:54 2013 Tip Do not include hyphens when you name variables because PowerShell interprets the hyphens as parameters. In other words, $ServerName is a good name for a variable, but $Server-Name is not. Like any good scripting language, PowerShell supports conditional checking with IF and ELSEIF that you will mostly use in scripts. It’s easy to generate code that goes through a certain number of iterations with constructs such as 1..100 | ForEach-Object <command…>. You will see examples of these constructs as you see more sophisticated PowerShell code in later chapters. Using PowerShell ISE with Exchange If you don’t like the bare-bones nature of EMS, you might prefer to use ISE, the PowerShell Integrated Scripting Environment. ISE is installed on Windows 2008 R2 SP1 and Windows 2012 servers to provide a GUI for PowerShell that allows users to write, test, and debug scripts. PowerShell ISE is also installed by default on Windows 7 and Windows 8 workstations. ISE supports multiline editing, tab completion, syntax coloring (or highlighting of different parts of commands), context-sensitive help, and keyboard shortcuts. Because of its debug features, ISE is a good way to write complex scripts for use with Exchange 2013. All the code included in this book can be worked on through ISE. Chapter 3 Can you see the difference a little quotation mark makes? Best practice is to use single quotation marks whenever you are sure that you want a string variable to stay exactly as you have typed it and to use double quotation marks elsewhere. Be careful about using editors that insert smart quotation marks because PowerShell cannot deal with them; it is best to use a simple text editor whenever you create or edit a script. You cannot mix and match the different types of quotation marks to enclose a variable because PowerShell will refuse to accept the command. You will not do any great harm if you use double quotation marks instead of single quotation marks, but it is best to use single quotation marks as the default. 104 Chapter 3 The Exchange Management Shell When you start ISE, it has no knowledge of Exchange or how to create the kind of remote session with an Exchange server in the way EMS does when it starts. Some work is therefore necessary to integrate ISE with Exchange. The easiest way to do this is to insert some code in the PowerShell profile so that ISE learns enough about Exchange when it initializes to access Exchange when you need it to. The code you need to use with ISE is very similar to the code you met earlier when discussing the basics of creating a remote PowerShell session. Start ISE and type Notepad $Profile to edit your PowerShell profile, and then insert the following code (amending the reference to contoso.com to reflect your own environment): Chapter 3 $PSISE.CurrentPowerShellTab.AddOnsMenu.SubMenus.Add( "Connect to Exchange", { $user = Get-Credential $Server = Read-Host "Connect to what Exchange server " $connectpoint = $Server + ".contoso.com/PowerShell/" $ExSession= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $connectpoint -Credential $user Import-PSSession $ExSession }, "Control+Alt+1" ) The code defines a new menu choice called Connect to Exchange that appears on the ISE Add-ins menu. The option can also be invoked with the Control/Alt/1 key combination. In either case, when invoked, the code prompts for user credentials and the server to which to connect and then initiates a new remote PowerShell session with the selected Exchange server. After the connection is established, you can work as with EMS except that extra information and facilities are available to you, such as a context-sensitive list of cmdlets that appears when you start typing a cmdlet name (Figure 3-4). EMS basics 105 Figure 3-4 Working with Exchange 2013 through the PowerShell ISE Identities You might have noticed the –Identity parameter in some of the cmdlets you have explored so far. In many cases, a call to an Exchange cmdlet results in a set of objects being returned (for example, all the mailboxes on a server). In these instances, you might need to identify a specific object within the chosen set with which to work. (Think of a pointer to an item in an array.) For example, if you issue the Get-ExchangeServer cmdlet, you retrieve a list of all the Exchange servers in the organization. If you want to work with one server, you have to tell EMS which server you want to select by passing its identity. For example, to work with just the server named ExServer1: Get-ExchangeServer –Identity 'ExServer1' Apart from its obvious use to identify the object with which you want to work, –Identity has a special meaning within PowerShell because it is a positional parameter. You can specify the parameter’s value without specifying the parameter’s name, so the example previously used is just as valid if you use: Get-ExchangeServer 'ExServer1' Chapter 3 106 Chapter 3 The Exchange Management Shell INSIDE OUT Best practice to include the –Identity parameter Although you might find it faster to omit the –Identity parameter when you’re working interactively with EMS, it is best practice always to include the –Identity parameter when you write code for reusable scripts because this ensures that there is no possibility that another administrator or programmer will mistake the value passed for the identity for anything else. If you want, you can retrieve a list of objects and store them in a variable and retrieve the values as you wish. The variable holds the objects as an array. For example, to populate a variable with a set of mailboxes hosted by a server: $Mbx= Get-Mailbox –Server 'ExServer1' Chapter 3 To retrieve the different objects in the array, pass the number of the object with which you want to work, starting from zero. For example, to fetch the first mailbox in the array: $Mbx[0] You can be more specific and ask for one of the object’s properties. For example, to get the identity of the first mailbox in the array: $Mbx[0].Identity IsDeleted Rdn Parent Depth DistinguishedName IsRelativeDn DomainId ObjectGuid Name : : : : : : : : : False CN=Eoin P. Redmond contoso.com/Exchange Mailboxes 3 CN=Eoin P. Redmond,OU=Exchange Mailboxes,DC=contoso,DC=com False contoso.com 0bcd15b3-c418-43be-b678-2658614f732b Eoin P. Redmond You might be surprised by the amount of information returned here for the mailbox’s identity (it’s all defined in the schema), but it contains all the ways you can navigate to this object through its relative distinguished name (shown here as the rdn property), distinguished name, globally unique identifier (GUID), and name. Normally, you’ll just use the name of a mailbox to find it, but you can use the other methods, and Exchange will find the mailbox. There is no requirement to parse out a specific piece of the identity you want to EMS basics 107 use or to trim values; PowerShell does it all for you. For example, you can use an identity to discover the groups to which a user belongs. Here’s the code: $U = (Get-User –Identity TRedmond).Identity; Get-Group | Where-Object {$_.Members –eq $U} If you don’t like user-friendly forms such as email addresses or mailbox names, Exchange also allows you to use GUIDs as identifiers. Because they are obscure and long, GUIDs are difficult to type, but you can still use them. One slightly complicating factor is that you must know which GUID to use where. You might want the GUID that points to a user’s mailbox, the GUID pointing to her Active Directory account, or even the one pointing to her archive mailbox. For example, this command displays all GUIDs registered for a mailbox: Get-Mailbox –Identity 'Tony Redmond' | Format-List *Guid* ExchangeGuid ArchiveGuid DisabledArchiveGuid Guid : : : : c2c4a3b5-c1a6-5a17-971d-8549123a78d0 00000000-0000-0000-0000-000000000000 00000000-0000-0000-0000-000000000000 288617d1-4592-4211-bb20-26ab755458c8 The ExchangeGuid property points to the user’s mailbox. This is a tremendously important property because the GUID pointing to a mailbox can be guaranteed to be unique across an Exchange organization, which is why the Store uses this value to locate a user’s mailbox. It’s also why Outlook users see the ExchangeGuid of their mailbox instead of the server name when viewing the server name property shown when viewing the server settings of an Exchange 2013 mailbox (Figure 3-5). Chapter 3 The Get-User cmdlet loads the user’s identity into a variable, and then the Get-Group and the Where-Object cmdlets scan all groups to discover any that include the user in their membership. Scanning the membership list of groups to discover string matches is never going to be as quick (and will get slower as the number of groups in the forest grows) because a string compare will never get close to the backward pointers that consoles such as Active Directory Users and Computers or EMC use to display group membership in terms of speed of access, so don’t be surprised. Scanning for group membership in this way takes some time to complete. 108 Chapter 3 The Exchange Management Shell Chapter 3 Figure 3-5 How Outlook displays the ExchangeGuid It is confusing, but if you run Get-MailboxStatistics to retrieve summary details of the contents of a mailbox, EMS returns a MailboxGuid property. This is the same value as the ExchangeGuid when reported by Get-Mailbox. Why Microsoft felt that two names were required for the same GUID is beyond me. The Guid property identifies the user’s Active Directory account and thus provides the essential link between a mailbox and an account. In this case, the ArchiveGuid is shown as all zeros, so no archive mailbox is associated with this mailbox. The DisabledArchiveGuid value is also all zeros. This GUID is used only when a user has been assigned an archive mailbox that was subsequently disabled for some reason. Exchange maintains the GUID so the archive can be reconnected to the mailbox up to the point at which it is permanently removed from a database after the expiry of the deleted mailboxes’ retention period. Now that you know what the GUIDs are, you could use them to reference a mailbox. For example: $GUID = (Get-Mailbox –Identity 'Tony Redmond').Guid Get-User | Where {$_.Guid –eq $GUID} | Format-Table Name The great thing about identities is that you sometimes don’t need to use them. This situation occurs when you pipe information from one cmdlet for processing by another because the shell understands that it needs to operate on the current object that has been fetched EMS basics 109 through the pipe. For example, this command pipes a list of mailbox identities passed in strings to the Set-Mailbox cmdlet: "TRedmond", "JSmith", "JDoe" | Set-Mailbox –Office "Dublin" You’ll pipe output from one cmdlet to another frequently as you work with Exchange data. The important thing to remember is that PowerShell outputs fully formed objects that can be manipulated when fed as input to other cmdlets through the pipeline. This wouldn’t be possible if PowerShell output text strings. For example, assume that you want to change the value of the Office property for a set of users who have moved to a new building. It would be tedious if you had to fetch the identity of each user individually, determine each identity, and then pass the value to make the change to each user’s properties. A simple pipe works because PowerShell knows that it can use the stream of data from one command to identify the objects it has to process with another. Here’s how you might update the Office property for a complete set of users without any mention of an identity. You’ll see that the two cmdlets that do the work are separated by the pipe character, “|”. This is the character that tells PowerShell to pipe the output from the first cmdlet to become the input to the second. Get-User –Filter {Office –eq 'Building A'} | Set-User –Office "Building B" Too many objects By default, EMS returns up to 1,000 objects in response to cmdlets. (The value in Exchange 2007 is 5,000.) Therefore, if you run a cmdlet such as Get-Mailbox, Exchange will return up to 1,000 mailboxes if they are available. If you work in a small Exchange organization that supports fewer than 1,000 mailboxes, you don’t need to worry too much about the number of objects you have to deal with because PowerShell will likely return relatively few objects, and things usually progress quickly. However, it’s a different situation in large organizations, in which you have to pay attention to the filters you specify to retrieve data or override the default limit for returned objects by specifying the ResultSize parameter for cmdlets. For example, to let EMS return as many mailboxes as it can find, you could use a command like this: Get-Mailbox –ResultSize Unlimited This command will work, but it will be very slow because EMS has to read every mailbox in the organization. Think about how long this might take to execute in an organization that supports more than 300,000 mailboxes. In these situations it’s always better to specify a filter to restrict the number of objects EMS looks for and returns. Chapter 3 Piping 110 Chapter 3 The Exchange Management Shell OPATH filters OPATH is the basic syntax used for PowerShell queries. It is similar in concept to but uses different syntax from Lightweight Directory Access Protocol (LDAP) queries. Dynamic distribution groups (see Chapter 6, “Groups and other objects”) also use OPATH queries to locate objects in Active Directory when the transport system builds addressee lists to deliver message addresses to these groups. Some base guidelines about the syntax OPATH queries are as follows: ●● ●● ●● OPATH requires a hyphen before –and, –or, and –not operators. Comparison operators include –eq (equal), –ne (not equal), –lt (less than), –gt (greater than), –like (like), –ilike, and –notlike. –Like and –notlike are wildcard string compares. –iLike and –inotlike are case-insensitive. Filters should be expressed within braces; for example, {Office –eq ‘London’}. Chapter 3 You’ll see many more examples of OPATH queries in the remainder of this book. Server-side and client-side filters Windows PowerShell supports server-side and client-side filters. There’s a big difference in performance between the two types of filters, especially when you have to process more than a hundred objects. Client-side filters are the default. Any code that uses the Where cmdlet executes a client-side filter. Client-side filters request data from a server and then perform the filtering on the client. This is an effective approach if you only have 10 or 15 objects to process, but it obviously doesn’t scale too well as the number of objects increases. Server-side filters have better scalability because the request for data forces the server to return a filtered data set to the client. Because Exchange servers often have to deal with tens of thousands of objects, a number of the Exchange cmdlets support server-side filters. If a cmdlet supports the –Filter parameter, it supports server-side filters. Usually, these are cmdlets that deal with objects that output large numbers, such as mail-enabled recipients or message queues. All the precanned filters generated for dynamic distribution groups, address lists, and email address policies use server-side filters. As an example of server-side and client-side filtering in action, two methods are available to find all the mailboxes with “James” in their name, as demonstrated in these commands: Get-Mailbox –Filter {Name –like '*James*'} –ResultSize 5000 Get-Mailbox –ResultSize 5000 | Where {$_.Name –like '*James*'} EMS basics 111 On the surface, these two pieces of code seem reasonably similar, but they are very different in reality. The first difference is that the first code example uses a server-side filter, and the second uses a client-side filter. The second difference is that the two filter types can generate very different results because of the way the filters operate. If you omit the –ResultSize parameter, the same query is generated: Find all the mailboxes with a name that contains “James.” (The ResultSize parameter in the first example limits the total number of objects returned to 5,000.) However, if you time both queries, the server-side filter invariably executes faster than the client-side filter, largely because fewer data are transferred between server and client. To understand why the filters generate different results, you have to appreciate how the filters work: ●● The server-side filter returns the first 5,000 mailboxes it finds that include “James” in the mailbox name. The client-side filter fetches data for the first 5,000 mailboxes and then applies the filter to find the mailboxes that include “James” in the mailbox name. However, the filter applies only to the set the client fetched and might not find all the mailboxes you actually want to discover. Even though you ask the server-side filter to do more work (working with any reasonably sized set of mailboxes, the server-side filter will have to process significantly more data to find the first 5,000 mailboxes that match), it still executes faster. For example, when I executed similar commands within a very large Exchange organization (170,000 mailboxes), the server-side filter completed processing in 43 seconds, whereas the client-side filter completed in 81 seconds. The rule here is that the effect of server-side filtering gets better as the number of objects increases. INSIDE OUT PowerShell and memory limits Another aspect to consider is that PowerShell cannot fetch and cache data on disk temporarily the way a database might. This is not an issue if you want to process only a few objects, but it can lead to memory issues if you attempt to process tens of thousands of mailboxes at one time, especially if you use client-side filters and want to pipe the output to another command. In this case, you ask PowerShell to find all the objects that match the specified filter, store the data in memory, process the data, and pipe the matching objects to the second command. Experience shows that these operations can cause PowerShell to complain that it is running out of memory. This is likely to be one of the growing pains through which all software goes and, apart from using loops to process data, no good solution to the memory exhaustion problem is available today. Chapter 3 ●● 112 Chapter 3 The Exchange Management Shell Sometimes people make the mistake of assuming that client-side filters are faster because server-side filters provide the data in one motion after the server processes all the data. You therefore wait for a while without seeing anything and then see all the filtered records at one time. By comparison, client-side filters fetch and filter data continuously, so you see output as the command finds each matching record. However, the important indicator of performance is how long each type of filter takes to complete, and server-side filters are always faster. The commands you are most likely to use with server-side filters are as follows: ●● ●● ●● Get-User Retrieve basic Active Directory properties for any user account, including mail-enabled accounts. Get-Mailbox Retrieve Exchange-specific properties for mailboxes. Get-DistributionGroup Retrieve Exchange-specific properties for mail-enabled groups. Chapter 3 Each of the commands you can use to work with user accounts, groups, and mailboxes supports a different set of filterable properties. To discover which properties are available for filtering, you can use PowerShell to query the properties of a returned object. For example: Get-Mailbox -Identity Redmond | Get-Member | Where-Object {$_.MemberType –eq 'Property'} | Sort-Object Name | Format-Table Name This set of commands calls a command to return some information about an object. It then pipes the information returned by the first command to the Get-Member cmdlet, which extracts information about the properties. You sort the properties by name and output them in table format. Here’s an excerpt from the output: Name ---AcceptMessagesOnlyFrom AcceptMessagesOnlyFromDLMembers AddressListMembership Alias AntispamBypassEnabled CustomAttribute1 CustomAttribute10 ... WindowsEmailAddress This method works for the Get-Mailbox, Get-CASMailbox, Get-User, Get-Recipient, GetDistributionGroup, and Get-DynamicDistributionGroup cmdlets. You can use any of the values reported in a –Filter statement. For instance, the call you just made to Get-Mailbox EMS basics 113 reports that the custom attributes are available, so to find all mailboxes that have a value in the CustomAttribute10 property, you can generate a command like this: Get-Mailbox –Filter {CustomAttribute10 –ne $Null} If you look at the filterable properties reported by the Get-DynamicDistributionGroup cmdlet, you can see that the ManagedBy property is available for this dynamic distribution group, whereas it is not for mailboxes. Hence, you can execute a filter like this: Get-DynamicDistributionGroup –Filter {ManagedBy –ne $Null} When you create a filter, it is best to be as specific as possible. You can state several conditions within a filter. An example of a server-side filter that returns all the mailboxes in the Dublin office where the user name contains “Tony” is shown next. The Get-User cmdlet also works with this filter, but Get-Mailbox executes a tad faster because the server does not have to process accounts that are not mail-enabled. After you have mastered server-side filtering, you will use it all the time to work with sets of users. For example, assume that you want to give a new mailbox quota to members of a certain department but no one else. Get-User –Filter {Department –Eq 'Advanced Technology'} | Set-Mailbox –UseDatabaseQuotaDefaults:$False –IssueWarningQuota 5000MB –ProhibitSendQuota 5050MB –ProhibitSendReceiveQuota 5075MB INSIDE OUT WhatIf and Confirm Before you execute any command to perform a bulk update of objects, you can run the command with the /whatIf switch added to force EMS to show you which objects will be altered. After you are sure that the correct set of objects will be updated, you can run the command without /whatIf, and EMS will perform the changes. The /confirm switch is also useful in terms of stopping administrators before they do something they should not. If you include the Confirm parameter, EMS prompts the administrator with “Are you sure that you want to perform this action” and waits for a “Y” or “Yes” response (or “A” for “all” if multiple objects are involved) before continuing. Act in haste, repent in leisure. Chapter 3 Get-Mailbox –Filter {Office –eq 'Dublin' –and Name –like '*Tony*'} 114 Chapter 3 The Exchange Management Shell Transcripts If you encounter a problem executing some EMS commands and need to produce some debug information to give to your support team or Microsoft, you can do this by generating a transcript. A transcript captures details of all commands executed in a session and is useful in terms of capturing the steps necessary to solve a problem or documenting steps to expose an issue that you want to report to Microsoft. You can combine this by adding the –Verbose parameter to most commands to gather a lot of information about what you’ve tried to do and what happened when you tried it. Use the Start-Transcript cmdlet to force EMS to capture debug information. For example: Start-Transcript c:\Temp\Transcript.txt All commands and output will be captured until you stop the transcript by using the StopTranscript cmdlet. At this point, you can examine the output with any text editor, and you’ll see something like the output shown in the following example. Chapter 3 ********************** Windows PowerShell Transcript Start Start time: 20130313093116 Username : CONTOSO\Administrator Machine : ExServer1 (Microsoft Windows NT 6.2.9200.0) ********************** PS C:\temp> $env:path C:\Windows\system32\WindowsPowerShell\v1.0\;C:\Windows\system32;C:\Windows;C: \Windows\System32\ Wbem;C:\Windows\System32 \WindowsPowerShell\v1.0\;C:\Windows\idmu\common;C:\Program Files\System Center Operations Manager 2007\;C:\Program Files\Microsoft\Exchange Server\V14 \bin;c:\temp Bulk updates Those faced with the task of bulk updates (either to create a lot of new mailboxes or other objects or to modify many existing objects) before the advent of PowerShell support for Exchange had quite a lot of work ahead of them because Exchange offered no good way to perform the work. You could create comma-separated value (CSV) or other load files and use utilities such as CSVDE or LDIFDE to process data in the files against Active Directory, or you could write your own code to use CDOEXM or ADSI to update Active Directory. Either approach involved a lot of detailed work and made it quite easy to make a mistake. Using a console to make the necessary changes was boring and an invitation to make a mistake. The cause of Exchange’s problems with bulk changes was the lack of a programmable way to automate common management operations, a situation that changed with the arrival of EMS. EMS basics 115 You can combine the Get-User and Set-Mailbox cmdlets effectively to solve many problems. Here is an example in which you need to update the send quota property on every mailbox for a set of users whose business group has decided to fund additional storage. You can identify these users by their department, which always starts with “Advanced Tech” but sometimes varies into spellings such as “Advanced Technology” and “Advanced Technology Group.” Conceptually, the problem is easy to solve: 1. Look for all users who have a department name beginning with “Advanced Tech.” You could use the Find option in Active Directory Users and Computers to build a suitable filter to establish the set of users, but then you have to open each user’s mailbox that Active Directory Users and Computers locates to update his quota through the GUI, which could become boring after several accounts. You could also export a CSV-formatted list of users to a text file, manipulate the file to find the desired users, and then process that list through CSVDE to make the changes, but you have to search for all matching users across the complete directory first. That is a lot of work to do. The process is easier in EMS. First, you use the Get-User cmdlet with a suitable filter to establish the collection of mailboxes you want to change. The following command returns all users who have a department name that begins with “Advanced Tech” and then updates the ProhibitSendQuota property to the desired amount (say, 20 GB). Because you have a collection of user objects established, you can use the Set-Mailbox cmdlet to perform the update. Note that some of these users might not be mail-enabled, but error handling is another day’s work. Get-User | Where {$_.Department –like '*Advanced Tech*'} | Set-Mailbox – ProhibitSendQuota 20GB –UseDatabaseQuotaDefaults $False Mergers, acquisitions, and internal reorganizations pose all sorts of problems for email administrators. EMS will not solve the big problems, but it can automate many of the mundane tasks that are necessary. For example, department names tend to change during these events. EMS makes it easy to find all users who belong to a specific department and update their properties to reflect the new organizational naming conventions. If only executing organizational change were as easy as this one-line command, which transfers everyone who works for the Old Designs department over to the Cutting Edge Design department, things would be much easier: Get-User | Where {$_.Department –eq 'Old Designs'} | Set-User –Department 'Cutting Edge Design' Note the use of $_.Department; this indicates a value fetched from the current pipeline object. In this case, it is the department property of the current user object that Get-User Chapter 3 2. Update the send quota property for each user. 116 Chapter 3 The Exchange Management Shell fetched. To verify that you have updated all the users you wanted to (and maybe provide a report to human resources or management), you can use code like this: Get-User | Where {$_.Department –eq 'Cutting Edge Design'} | Select Name, Department | Sort-Object Name | Format-Table > c:\temp\Cutting-Edge.tmp A variation on this theme is to output the data to a CSV file to make the data easier to work with in Microsoft Excel, Microsoft Access, or another tool that can read CSV data. Get-User | Where {$_.Department –eq 'Cutting Edge Design'} | Select Name, Department | Sort Name | Export-CSV c:\temp\Cutting-Edge.CSV Things are even easier if you just need to change everyone’s company name after your company is acquired. Get-User | Set-User –Company 'New Company' Chapter 3 You can even do such things as alter only the users whose mailbox belongs to a particular database: Get-Mailbox –Database 'VIP Mailboxes' | Set-User –company 'Big Bucks' –Department 'Executives' Tip All the examples discussed so far depend on you being able to identify some property you can use as the basis for a filter. But what about when you do not have a common property value to check for? In this case, you can build a simple list of mailbox names (or any other format the –Identity parameter will accept, such as a Universal Principal Name [UPN]), use the Get-Content cmdlet to read the names one by one, and pipe these values to whatever other command you need to use. For example, here is how you can use that trick to enable ActiveSync access for a set of users. In this example, the Get-Content cmdlet reads lines containing the identities of the mailboxes you want to change from a text file and pipes them as input to the Set-CASMailbox cmdlet: Get-Content c:\temp\Users.txt | Set-CASMailbox –ActiveSyncEnabled $True Another example of when EMS excels is when you want to apply a common setting across all servers in your organization. For example, assume that you want to apply a new deleted item retention limit of 150 days (perhaps mandated by the legal department) to all servers: Get-MailboxDatabase | Set-MailboxDatabase –DeletedItemRetention 150.00:00:00 These simple examples demonstrate the value of having a scripting language that supports automation of common management tasks. EMS basics 117 Calling scripts After you have written a script, you have to decide where to keep it. You could put the new script in the directory that stores the Exchange binaries, but this is a bad idea for many reasons, not least because your script could be overwritten by the installation of a future Exchange service pack, a roll-up update, or even a completely new version. INSIDE OUT A wise practice The basic rule of calling a script is that if the script is in the working directory (the directory you are currently in), you prefix the name with “.\” C:>.\Get-All-Users.ps1 If you’re not in the right directory, you can move to where you want to be by using the cd command: C:> cd c:\Scripts\ Alternatively, you can supply the full path to where the script is located: C:>c:\Scripts\Get-All-Users.ps1 If there are spaces in the directory names, then you need to enclose the path in single or double quotation marks: C: '\Program Files\Microsoft\Exchange Server\V15\Scripts\CollectOverMetrics.ps1' Even better, you can amend the path PowerShell uses by looking for scripts and adding your directory to it. For example, running this command adds the C:\MyScripts directory to the path: $env:path = $env:path + ";c:\MyScripts' After a script is in a directory that’s included in the path, you can invoke it by just typing its name. Chapter 3 It is wise to maintain a clear separation between the code for which you are responsible and the code Microsoft distributes with Exchange. Therefore, you should create a directory to hold all the scripts you use to work with Exchange. You can then call your scripts safely in the knowledge that they will be available. 118 Chapter 3 The Exchange Management Shell Execution policies EMS is powerful, and just a few cmdlets can have a tremendous effect on many objects throughout Exchange. You might have thought about how to control the ability of users to execute EMS commands. RBAC provides the first line of protection. As you recall, users are permitted access only to the set of cmdlets and parameters available to the roles each user holds. Even though trusted users are assigned the roles they need to do their work, you still don’t want them to execute scripts they download from the Internet or obtain elsewhere. Chapter 3 A second line of defense is therefore provided by Execution Policies, which define the conditions under which Windows PowerShell loads files for execution. There are four policies: Restricted, AllSigned, RemoteSigned, and Unrestricted. You configure the execution policy used for a server by using the Set-ExecutionPolicy cmdlet. The default is RemoteSigned, which you can verify by using the Get-ExecutionPolicy cmdlet. In this mode, EMS permits the execution of any script created locally and any script downloaded from the Internet, provided the script includes a digital signature. All the scripts that come with Exchange are signed for this purpose (see Table 3-2). The caveat is that any script you attempt to run can contain only Exchange cmdlets that are supported by the role the user holds who invokes the script. Table 3-2 lists the alternate modes together with the potential trade-off in security that you might have to make for each mode. TABLE 3-2 Windows PowerShell execution policies Execution Policy mode Meaning Restricted No scripts can be run, even if they are signed by a trusted publisher. AllSigned Scripts must be digitally signed by a trusted partner before EMS will run them. RemoteSigned EMS will run any script created locally. Scripts that originate outside the system (such as those downloaded from the Internet) cannot be run. Unrestricted EMS will run any script. This mode should be used for test environments only. If you attempt to run an unsigned script that doesn’t comply with policy, Windows PowerShell signals that it cannot load the script. Scripts are signed with the SetAuthenticodeSignature cmdlet, but you need to get a valid certificate first. The certificate can be one you generate yourself or one you buy from a commercial vendor such as VeriSign. See http://technet.microsoft.com/en-us/library/bb125017.aspx for further details of how to generate and apply certificates to sign scripts. EMS basics CAUTION 119 ! Obviously, running an Exchange server with an unrestricted execution policy is a bad idea. In fact, you should avoid any deviation from the default policy unless you have an excellent reason to change. For example, you might decide that you want to run scripts you find on the Internet. This might be acceptable if you run the scripts on a test system only, but it’s a much better idea to take the time to go through the code to understand exactly what it does before you think of deploying to a production system. Remember that if you edit a script to create a new version on your computer, that version of the script is now considered local and can be run without changing the execution policy. Opening a downloaded script and saving it can lead to unintended consequences, so be sure that you only save a script that you didn’t write when you absolutely intend to create a new version. Set-ExecutionPolicy –ExecutionPolicy Unrestricted The change to the execution policy is effective immediately. Be sure to test any change you want to make before you enable the change in production because it might break scripts on which you or applications depend. Execution policy is a server-specific setting. However, its setting is recorded in the system registry, and it is possible to use Group Policy to apply the same setting to every server within the organization. To do this, configure Group Policy to set the value of ExecutionPolicy to the desired execution mode. The key is located under: HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft\PowerShell Note that because the setting for the execution policy is held in the system registry, Windows will deny any attempt to update the value unless your account has the privilege to change the system registry. Profiles When you start EMS, PowerShell runs a script called Bin\RemoteExchange.ps1 to initialize EMS by loading the Exchange snap-in and defining a set of variables that EMS uses, such as the default scope for Active Directory queries. The script also prints some welcome information for EMS. If you use EMS frequently, consider creating a profile EMS can load when it initializes a new session. If it finds a profile, PowerShell executes the commands in it before it runs Chapter 3 If you deem it necessary to change the policy, use the Set-ExecutionPolicy command to update the default execution policy on an Exchange 2013 server. For example: 120 Chapter 3 The Exchange Management Shell Exchange ps1 to create the EMS session. This order ensures that you can’t interfere with the creation of the EMS session. I like profiles because they remind me of the convoluted logon command procedures I used to create for OpenVMS. Typical examples of commands included in profiles are the following: ●● Define some aliases (shorthand for commands). For example, you could use Set-Alias gmbx Get-Mailbox to use gmbx any time you want to run the Get-Mailbox cmdlet. ●● Add one or more directories containing scripts to the path, as discussed earlier. ●● Position your session in a specific directory in which you prefer to work. Chapter 3 PowerShell defines a global variable called $Profile to hold the location of your profile. The exact location varies across different versions of Windows. The profile doesn’t exist by default, and you might have to create it before you can edit it to add some commands. First, see whether a profile is available for the account you use: Test-Path $Profile If the response is $True, you know that a profile exists. If not, you have to create it with: New-Item –Path $Profile –Type File –Force After you have a profile, you can edit it as follows: Notepad $Profile Here’s a simple profile that you could begin with: $env:path = $env:path + ";c:\Scripts" 'You are now entering PowerShell: ' + $env:Username $StartTime = (Get-Date) Write-Host "Session starting at $StartTime" Set-Location c:\temp After you finish updating the profile, save the file and restart EMS to see whether your changes are effective. There are endless possibilities for inventive code to run within a profile. Active Directory for PowerShell Active Directory is a huge dependency for Exchange, and it makes a lot of sense to be able to manage Active Directory through PowerShell. This was not always possible, but on Windows Server 2008 R2 SP1 servers, all you need to do is load the Active Directory Module for PowerShell that’s installed under Administrative Tools. Assuming that the Active Active Directory for PowerShell 121 Directory module is available on a server or client, you can load it into any PowerShell session by using the following command: PS C:\> Import-Module ActiveDirectory The Active Directory module is loaded automatically into EMS on Windows 2012 servers, so you can execute commands against Active Directory data immediately. To get a list of the Active Directory cmdlets, type: PS C:\> Get-Help *-AD* PS C:\> CD AD: PS AD:\> CD "DC=contoso,DC=com" PS AD:\DC=contoso, DC=com> MD "OU=Marketing" Figure 3-6 Creating a new OU in Active Directory To compare how much easier it is to access Active Directory data by using the new module, the command to retrieve a list of domain controllers is: PS C:\> Get-ADDomainController Name ---CONTOSO-DC07 | Format-Table Name, OperatingSystem Operatingsystem --------------Windows Server 2012 Standard Chapter 3 In terms of navigation through the directory structure, Active Directory is represented to PowerShell like files on a hard drive that is referenced as the AD: drive. If your system is joined to a domain, you can then navigate Active Directory. For example, here’s how to create a new organizational unit (OU) called Marketing after navigating to the desired location in Active Directory. You can see the same in Figure 3-6. 122 Chapter 3 The Exchange Management Shell CONTOSO-DC01 CONTOSO-DC02 Windows Server 2012 Standard Windows Server 2008 R2 Enterprise Another useful example is when you want to scan for inactive Active Directory accounts so that you can clean up the directory. In this command, you scan for any account that has not been logged on to in the past 120 days and report the account name and the date the user last logged on. Search-ADAccount –UsersOnly –AccountInActive –TimeSpan 120 | Format-Table Name, LastLogonDate You could then disable these accounts by piping the discovered list to the DisableADAccount cmdlet. However, this is a dangerous thing to do in an Exchange environment because so many accounts are never logged on to because they are used for purposes such as room and discovery mailboxes. Chapter 3 Another one-liner that is extremely useful on test systems searches for all Active Directory accounts that have an email address and sets the accounts so that the passwords never expire. This gets rid of a lot of annoying prompts you might otherwise encounter because passwords expire! Get-ADUser –Filter {EmailAddress –Like "*@contoso.com"} –PasswordNeverExpires $True | Set-ADUser See http://technet.microsoft.com/en-us/library/dd378937(v=ws.10).aspx for information about how to perform Active Directory management by using PowerShell for Windows 2008 R2. Setting the right scope for objects in a multi-domain forest When you start EMS, Exchange sets the default scope for queries performed against Active Directory to the domain to which the server belongs. This is fine if you operate a singledomain forest, but it is definitely not if you have to manage objects in a multi-domain forest because it means that any query you perform will return only objects from the local domain. To control the scope for Active Directory objects, use the Set-ADServerSettings cmdlet. Set the ViewEntireForest parameter to be $True (to see the entire forest) or $False (to see just the objects owned by the default domain). The logical place to do this is in your personal PowerShell profile. For example: Set-ADServerSettings -ViewEntireForest $True You can also use this command to point to a particular domain controller to retrieve Active Directory data. For example: Set-ADServerSettings –PreferredServer 'DC1.contoso.com' Exploring useful EMS examples 123 If you do not want to set your scope to the entire forest, a partial workaround is to specify a global catalog server in the remote domain to use for the query. Another way of forcing EMS to operate on a forest-wide basis is to specify the –IgnoreDefaultScope parameter for cmdlets such as Get-Mailbox. This parameter tells EMS to ignore the default recipient scope setting for EAC (typically the domain into which a server is installed) and use the entire forest instead. For example, if you wanted to set up a batch of mailboxes to move from an Exchange 2007 server to Exchange 2013 that used accounts in multiple domains, you could use a command like this: The natural question at this point is whether changing the scope for Active Directory queries will affect how you work with EMS. The answer is yes because when you set a forestwide scope, EMS fetches data from across the forest rather than from the local domain. Unless you use parameters to focus on particular groups of objects, such as specifying that you want to work with the mailboxes from one server, you will probably have to wait longer for a response. This is because you will ask EMS to process cmdlets that deal with servers, mailboxes, databases, or other objects across a complete forest rather than with just one domain, but in most cases, the wait is worthwhile because you see the complete picture and do not run the risk of missing something. Exploring useful EMS examples A scan of the Internet results in many interesting EMS code snippets that can be usefully employed by an Exchange administrator. This section discusses some good examples. The idea is not to present complete solutions. Rather, I hope to inspire you to experiment with EMS to see just how much value you can get from a few lines of reasonably straightforward code. After all, if you can do a lot of work in a couple of lines that take just a few minutes to type in and get running, think of how much you can do if you really set your mind to exploiting EMS! Before reviewing the examples of EMS in use, I have two specific pieces of advice for the aspiring EMS aficionado. Because this book is emphatically not designed to be a reference guide for EMS, if you think that you will become heavily involved with EMS, purchase a copy of Microsoft Exchange 2013 PowerShell Cookbook, Second edition (Packt Publishing, 2013). The book is packed full of guidance, tips, and programming examples that are extremely useful for both on-premises and Exchange Online administrators. Second, many of the Exchange MVPs provide an extremely valuable service to the Exchange community by publishing what become de facto standards for how to write a script to solve certain problems. You should download these scripts and use them as a Chapter 3 Get-Mailbox –Server 'Exchange2007' –ResultSize Unlimited –IgnoreDefaultScope | New-MoveRequest -TargetDatabase 'Mailbox Database 1002' –BatchName 'Move Group from Exchange 2007' 124 Chapter 3 The Exchange Management Shell starting point for understanding just how to approach writing industrial-strength EMS code. I would also bookmark their websites and keep up to date with their activities so that you can learn from their future work. At the risk of offending others, among my favorite sites are: ●● ●● ●● ●● Chapter 3 ●● Pat Richard (http://www.ehloworld.com/) Features a great script (SendNewUserWelcome.ps1) that shows how to build a welcome message to new Exchange users on a scheduled basis. Andy Grogan (http://www.telnetport25.com) Look at his script for automating the setup of an Exchange lab environment. Mike Crowley (http://mikecrowley.wordpress.com/) Contains a nice script to report on the proxy addresses assigned to email users. Steve Goodman (http://www.stevieg.org/) Shows an extremely useful Exchange environment report, a comprehensive overview of lots of information about your Exchange organization; output in HTML format. Paul Cunningham (http://exchangeserverpro.com/) Offers the best mailbox report script around (Get-MailboxReport.ps1). Paul also maintains a nice server health monitoring script that generates and sends an HTML format message to administrators on a regular basis. These scripts can be downloaded from these sites; the code is fully revealed and is easily adapted to meet any particular needs that exist in your environment. New sites that feature great tips appear all the time, and I’m sure you will accumulate your own list of go-to people you consult when you meet a problem. In the meantime, look at some examples to get started with EMS. Looking for large folders The first example shows how to discover users who might be suffering from performance problems because they have very large folders in their mailboxes. The number of items that is considered bad has grown over time in line with the updates Microsoft has made to tune the database schema. With Exchange 2000 or Exchange 2003, the danger mark is around 5,000 items. The threshold increases to 20,000 with Exchange 2007 and leaps to 100,000 for Exchange 2010 onward. The client used is also important because Outlook 2010 and Outlook 2013 are better at dealing with large folders than Outlook 2007 is. Having more than 20,000 items in a folder is evidence of solid pack-rat behavior by anyone, and it marks a folder that probably will never be cleaned out simply because it takes too much effort to explore the contents and decide what should be kept and what should be deleted. Assume Exploring useful EMS examples 125 that you want to flag potential issues to users who have more than 5,000 items in a folder. You can use code like this: Get-Mailbox –Server ExServer2 | Get-MailboxFolderStatistics | Where {$_.ItemsInFolder –GT 5000} | Sort ItemsInFolder –Descending | Format-Table Identity, ItemsInFolder –AutoSize Users/Redmond, Eoin\I Users/Ruth, Andy\Inbox Users/Andrews, Ben\Inbox Users/Pelton, David\Inbox Users/Simpson, David\Inbox Users/Redmond, Tony\Sent Items ItemsInFolder ----------------5271 5265 5263 5230 5218 5215 Of course, it would be impolite to send a note to these users to remind them that good filing practices lead to clean mailboxes, but you can still think about it! This code does the following: ●● Calls Get-Mailbox to generate a list of all mailboxes located on databases hosted by a server. It is possible to process all mailboxes in an organization by changing the code to Get-Mailbox –ResultSize Unlimited, but such a command will take a long time to process in any organization with more than a couple of thousand mailboxes (though you could use a server-side filter when appropriate). ●● Calls Get-MailboxFolderStatistics to extract a count of items in each folder. ●● Filters any folder with more than 5,000 items. ●● Sorts the filtered folders by descending order. ●● Outputs the information. If you run this command against an Exchange 2010 or Exchange 2013 server, even details of the folders in the dumpster (for example, Deletions) will be shown that are not reported by an Exchange 2007 server. Outputting a CSV file Many examples of outputting CSV files from Exchange data use the Export-CSV cmdlet. For instance, here’s a two-line script that looks for any mailbox that has an ActiveSync partnership created, which indicates that the user has connected a mobile device to the mailbox by using ActiveSync. An expression is included to force a call to the Get-ActiveSyncDevice Chapter 3 Identity --------contoso.com/Exchange contoso.com/Exchange contoso.com/Exchange contoso.com/Exchange contoso.com/Exchange contoso.com/Exchange 126 Chapter 3 The Exchange Management Shell cmdlet to retrieve the count of devices associated with each user. This kind of information is useful when understanding how many people actually connect mobile devices to Exchange! $Mbx = Get-CASMailbox –Filter {HasActiveSyncDevicePartnership –eq $True} | Get-Mailbox $Mbx | Select DisplayName, UserPrincipalName, @{Name="Devices";Expression= {(Get-ActiveSyncDevice –Mailbox $_.Identity).Count)} | Export-CSV "c:\temp\ActiveSync.csv" –NoTypeInformation Export-CSV is great because it takes care of all the formatting issues required to create a valid CSV file that will be recognized by applications such as Excel. However, there are other ways to generate CSV data. This script creates a CSV file you can use to analyze mailbox usage (Figure 3-7). A check in the code limits processing to the mailboxes found in a specific database and ignores anything but user mailboxes. (Objects such as room or arbitration mailboxes are ignored.) This script could take quite a while to finish if there are more than a few hundred mailboxes in the selected database, so be sure to test it on perhaps a smaller group before you launch it to process larger collections. Chapter 3 $Outputfile = "C:\temp\Mailboxes.csv" Out-File -FilePath $OutputFile -InputObject "UserPrincipalName, Items, Mailbox Size" -Encoding UTF8 $mbx = Get-Mailbox –Database DB2 Foreach ($M in $Mbx) { if ($M.RecipientTypeDetails -eq "UserMailbox") { # Fetch information about the mailbox $UserMailbox = Get-Mailboxstatistics -Identity $($M.Identity) $UserPrincipalName = $M.UserPrincipalName $ItemSizeString = $UserMailbox.TotalItemSize.ToString() $MailboxSize = "{0:N2}" -f ($ItemSizeString.SubString(($ItemSizeString. IndexOf("(") + 1),($itemSizeString.IndexOf(" bytes") - ($ItemSizeString.IndexOf("(") + 1))).Replace(",","")/1024/1024) $ItemCount = $UserMailbox.ItemCount #Prepare the user details in CSV format for writing to file and append line $UserDetails = $UserPrincipalName + "," + $ItemCount + "," + $MailboxSize Out-File -FilePath $OutputFile -InputObject $UserDetails -Encoding UTF8 -append } } This script generates fairly basic data about mailboxes, and if you scan the Internet, you can find many other approaches to the problem of mailbox reporting, some of which are much better than others. With anything to do with mailboxes, the key is speed because code that is quite good at processing one or two mailboxes might not be smart when confronted with Exploring useful EMS examples 127 Chapter 3 a few thousand. It’s also a good idea to consider what information needs to be output and make sure that the data reported is formatted in a way that is most useful to the reader. Figure 3-7 User mailbox CSV data Creating a report in HTML PowerShell is flexible in terms of processing output. Generated reports can show management and others the kind of work that servers do. The typical reports EMS generates are plaintext. You can also generate HTML reports by piping objects through the ConvertToHTML cmdlet. (The Out-HTML cmdlet at http://poshcode.org/1612 is also useful for generating HTML content.) This example explores how to generate a useful report that shows mailboxes that have exceeded their storage quota. You could use a report like this to check proactively for users who are experiencing problems with their quota and perhaps allocate them some additional quota to enable them to resume working. The output is shown in Figure 3-8. Get-Mailbox –Database VIP | Get-MailboxStatistics | Sort TotalItemSize –Descending | ConvertTo-HTML DisplayName, Database, ItemCount, TotalItemSize > C:\Temp\Mbxs.html You can enhance the output further by formatting the HTML with a style sheet or adding other information such as the date and time of the report. I leave that as an exercise for the reader. 128 Chapter 3 The Exchange Management Shell Chapter 3 Figure 3-8 Viewing the HTML version of the mailbox report It’s worth noting that when you run the Get-MailboxStatistics cmdlet, you force EMS to make a remote procedure call (RPC) to the Information Store to retrieve the latest data for the mailboxes (individual, database, or server). The information is completely up to date and reflects the exact state of the mailbox rather than cached data that could be a couple of hours old. The Store caches information about mailbox quotas and updates the cache every two hours to avoid the overhead of the I/O that it would otherwise need to generate to check quotas every time a user attempts to send a message or to check that a mailbox can accept a new message. TROUBLESHOOTING Users report that they’ve deleted messages but still exceed quota Given the dynamic flow of messages in and out of mailboxes, it’s likely that a small difference exists between the cached data and the actual state. This sometimes causes confusion when a user reports that she has exceeded quota and can’t send mail even though she has deleted many messages, and she has to wait until the Store refreshes its cache to determine the new mailbox size and respect the fact that she has reduced the size under quota. If this becomes a problem and users complain that Exchange takes too long before it allows them to resume email activity, you can amend the system registry to force Exchange to refresh the cache more often with the caveat that more frequent refreshes impose an extra overhead on the server. See http://technet.microsoft .com/en-us/library/aa996988(EXCHG.80).aspx for details. Controlling access to Exchange 129 Verbose PowerShell Sometimes you need to know exactly what EMS does to help track down a problem, perhaps to provide information to Microsoft support to help them figure out what’s going on in your Exchange deployment. You might just want to know what’s happening when you execute a command. In either case, you can add the /verbose switch to a command to have PowerShell generate details of exactly what it does as it proceeds. Figure 3-9 shows some of the output when the New-MailboxDatabase cmdlet is used to create a new mailbox database. You can see how EMS validates the context within which it is executing, including checks to locate a global catalog server, validate RBAC authorization, and confirm that the mailbox database doesn’t already exist. Figure 3-9 Examining some verbose PowerShell output Controlling access to Exchange EMS is a great way to get work done with Exchange as long as you don’t mind grappling with the command-line interface. If no control were exerted, you could do massive damage to an Exchange organization with EMS, such as selecting all the mailboxes in a database and removing them with a single line of code. Only the people who need to control the full scope of the organization should be able to take such drastic action. Traditionally, control is Chapter 3 Usually, EMS gets on with whatever you ask it to do and doesn’t give any indication of the processing it performs in the background. You ask for a new mailbox to be created, and it’s created, or some problem occurs that stops the command from executing. If the problem originates with an error introduced by the user, such as an error in syntax or attempting to do something that doesn’t make sense, such as creating a mailbox in a database that doesn’t exist, you can just fix the problem and try again. 130 Chapter 3 The Exchange Management Shell given through permissions and privileges. Exchange takes a different approach and adopts the RBAC model. All administrators need a solid grounding in RBAC and its implementation in Exchange, and that’s the next subject of discussion. Chapter 3 Index Numbers and Symbols $_ variable, 101–102 $_. variable, 102 { } (braces), 110 & (ampersand), 385 * (asterisk), 138, 481 - (hyphen), 103, 110 . operator, 100 " (quotation marks), 102–103 _ (underscore), 26 | operator, 102, 109 A ABPs (address book policies) about, 348–350 creating and implementing, 351–357 groups and, 350 accepted domains, 340 –AcceptLargeDataLoss cmdlet parameter, 632 AcceptMessagesOnlyFrom property, 279–280 AcceptMessagesOnlyFromDLMembers property, 279–280 AcceptMessagesOnlyFromSendersOrMembers property, 279 access control, role-based. See RBAC (role-based access control) access control lists (ACLs), 131–132, 143, 282 ACID test, 419 ACLL (attempt copy last logs) process, 473, 478–479 ACLs (access control lists), 131–132, 143, 282 activating mailbox database copies, 533–534 activation blocks, 542–544 activation preference for databases, 477 ActivationPreference property, 521 Active Directory about, 34–37 address book policies and, 350 ADSIEdit utility, 36–37, 59–60 deployment support, 45–47 ensuring full visibility, 364 Federated Services role, 313 forest functional mode, 26 preparing, 47–48 removing tags from, 687 storing information, 35–36 user accounts, 49 Windows PowerShell and, 120–123 Active Directory Domain Services (AD DS), 47–48 Active Directory Rights Management Services (AD RMS), 734 Active Directory Users and Computers audit entries and, 754 changing group properties, 285 creating computer objects, 497 displaying group membership, 268 Find option, 115 moving groups, 289 USGs and, 141 Active Manager about, 461, 465–467 ACLLs, 478–479 automatic database transitions, 467–469 best copy and server selection, 472–477 DAC and, 552 failover clustering and, 464 high availability and, 465–466, 469–472 Managed Availability and, 469–472, 536 scanning for failed copies, 458 ActiveCopy property, 521 ActiveDirectoryConnectivityConfigDCRestart responder, 470 ActiveSync, 29, 125–126 –ActiveSyncMailboxPolicy cmdlet parameter, 193 AD DS (Active Directory Domain Services), 47–48 AD RMS (Active Directory Rights Management Services), 734 Add-AdPermission cmdlet, 232, 794 Add-DatabaseAvailabilityGroupServer cmdlet, 494, 496 Add-DistributionGroupMember cmdlet, 92, 193, 296, 298 Add-MailboxDatabaseCopy cmdlet, 525, 527, 545 Add-MailboxPermission cmdlet, 202, 233–234, 236–237, 260 Add-PublicFolderClientPermission cmdlet, 787 Add-RoleGroupMember cmdlet, 150 Add-WindowsFeature cmdlet, 51, 53 807 808 AddNewRequestsTentatively property AddNewRequestsTentatively property, 258 AddOrganizerToSubject property, 258 address book policies (ABPs) about, 348–350 creating and implementing, 351–357 groups and, 350 address lists, 345–349 addressing messages about, 333 address book policies, 348–357 address lists, 345–348 display templates, 382–386 email address policies, 333–345 hierarchical address books, 349, 371–373 MailTips and group metrics, 373–382 Offline Address Book, 357–371 ADDriver (Exchange Authorization Library), 90–91 Admin Audit Log agent, 750 AdminAuditLogs folder, 749 Administrator user account, 163 administrators auditing actions of, 748–754 delivery reports, 321–327 page zeroing, 436 quorum voting, 494 running EAC without Exchange mailbox, 329–330 security and, 319–320 user accounts, 163 ADSIEdit utility about, 36–37 arbitration mailboxes, 59 auditing and, 754 email address formats, 344 removing server objects, 60 viewing group properties, 374 Advanced Search Syntax (AQS), 736 AgeLimitForRetention property, 666, 670 AggregateCounts corruption type, 446 AggregatePFData.ps1 script, 788–789 alerts EAC, 172–173 health mailboxes, 227 mail flow and rules, 318–319 moving mailboxes and, 638–639 self-signed certificates, 78 –Alias cmdlet parameter, 192, 253, 307 Alias property, 185 aliases, 93 All Contacts container, 345 All Groups container, 345 All Rooms container, 345 All Users container, 345 AllBookInPolicy property, 262–264 AllRequestInPolicy property, 262, 264 AllRequestOutofPolicy property, 262–263 AllSigned execution policy, 118 AlternateWitnessDirectory property, 505 AlternateWitnessServer property, 505 ambiguous name resolution (ANR), 365–366 ampersand (&), 385 ANR (ambiguous name resolution), 365–366 ANSI format, 623 APIPA (Automatic Private IP Addressing), 492 Application and Service Logs, 502 Application Event Log diagnostic levels and, 332 ecTooManyMountedDatabases error, 544 excessive growth, 443 usage examples, 364, 433 Application Impersonation role, 159 AQS (Advanced Search Syntax), 736 arbitration mailboxes about, 182 alerts and, 638–639 checking, 547 discovery mailboxes, 224 migration, 573 moving, 59–60 organization mailboxes, 362 suppressing, 312 ArbitrationMailbox property, 249 architecture, Exchange Server, 10–11 –Archive cmdlet parameter, 193, 446, 648, 652 archive mailboxes about, 645–647, 655–656 checking space usage, 652 compliance management and, 644 DAG design, 557 default archive and retention policy, 652–655 development priorities, 4 disabling, 656–657 enabling, 647–650 limitations of, 647 managing properties, 651–652 server failure and, 649 troubleshooting, 656 updating properties, 652 –ArchiveDatabase cmdlet parameter, 648–649 ArchiveDomain property, 651 ArchiveRelease property, 651 ArchiveState property, 651 ArchiveStatus property, 651 arrow keys, 95 –AssociatedMessagesCopyOption cmdlet parameter, 633 asterisk (*), 138, 481 asynchronous moving, 571–572 AsyncOperationNotification system retention tag, 639 attachments, 398 attempt copy last logs (ACLL) process, 473, 478–479 attributes. See specific properties audit mailbox, 749–750 AuditAdmin property, 758 AuditDelegate property, 758 auditing administrator actions, 748–754 mailbox access, 239, 754–762 AuditLogAgeLimit property, 757–758 AuditOwner property, 758 authentication certificates and, 314 cmdlets and, 89 Kerberos, 79 sending messages to groups, 280–281 auto-mapping mailboxes, 235–237 –AutoDatabaseMountDial cmdlet parameter, 478–479, 539–542 AutoDatabaseMountDial setting, 478–479, 539–542 –Autodiscover cmdlet parameter, 612 Autodiscover feature, 235–237 AutomateProcessing property, 257, 261 automatic database transitions, 467–469 Automatic Private IP Addressing (APIPA), 492 automatic reseeding of failed databases, 458 automating mailbox settings, 205–206 –AutoSize cmdlet parameter, 99 –AutoStart cmdlet parameter, 593 autosynchronization, 588 Azure File Server, 490 B B+ tree defragmentation, 435 backend (Mailbox server role), 1, 314 background maintenance about, 390, 432–433 content maintenance tasks, 432, 436–437 continuous, 482 database checksums, 432–435 database compaction, 432, 436 database defragmentation, 432, 435 page zeroing, 433, 436 Backspace key, 95 backups database, 416–417 streaming, 29, 389 VSS, 458 bad-item limit, 584–587, 590, 608 –BadItemLimit cmdlet parameter, 637 BadItemLimit property, 593 BalanceDbsByActivationPreference mode, 535 BalanceDbsBySiteAndActivationPreference mode, 536 –BatchName cmdlet parameter, 575, 634 BCS (best copy selection), 472 BCSS (best copy and server selection), 472–477 Begin log record type, 425 best copy and server selection (BCSS), 472–477 CER file 809 best copy selection (BCS), 472 binary large objects (BLOBs), 401 Binpatch.oab file, 361 BLOBs (binary large objects), 401 block mode replication, 484–486 BookInPolicy property, 262–264 BPOS (Business Productivity Online Services), 6 braces, 110 bulk mailbox creation, 195 bulk updates, 114–116 business cases, building, 16 Business Productivity Online Services (BPOS), 6 –BypassDelegateChecking cmdlet parameter, 328 –ByPassNestedModerationEnabled cmdlet parameter, 245 –BypassSecurityGroupManagerCheck cmdlet parameter, 277 C Calcheck (Calendar Checking Tool for Outlook), 445 Calendar Assistant, 259, 261, 454 Calendar Checking Tool for Outlook (Calcheck), 445 Calendar folder, 658, 695 Calendar Repair Assistant, 746 CalendarLoggingQuota property, 746 calendars, retention policies and, 677 CalendarVersionStoreDisabled property, 746 Calender Logging folder, 746 CALs (Client Access Licenses) about, 33 applying retention policy to mailboxes, 678 archiving and, 644 mailbox management and, 184, 191 requirements, 27, 72–73 Can Opener screen, 55 canceling repair jobs, 447 capacity planning, 389–392 CAS (Client Access Server) about, 1 address book policies, 349 architectural overview, 10–11 client interaction, 376–377 DAG and, 461 development problems, 7–8 MailTips and, 376–377 MRS and, 567 MRSProxy and, 612–613 namespace planning, 79–81 public folders and, 767 testing programming and customizations, 30–31 transport service, 27 case sensitivity, date/time formats, 199 CCR (cluster continuous replication), 29 cd command, 117 Central Help Desk security group, 323 CER file, 317 810 certificates certificates managing, 313–317 protocols and, 314 self-signed, 77–78, 314, 317 signed scripts, 118 SSL, 30 X.509, 26, 313 ChangedGroups.txt file, 376 ChangePermission right, 260 Checkbox control type, 385 CheckDatabaseRedundancy script, 522 checkpoint files, 408, 426–427 checksums database, 432–435 transaction logs, 427 CI (Content Indexing) catalog, 554 circular logging about, 429–431 DAG and, 510–514, 554 default state, 414 transaction log truncation, 486 clearing move requests, 610–611 Client Access Licenses (CALs) about, 33 applying retention policy to mailboxes, 678 archiving and, 644 mailbox management and, 184, 191 requirements, 27, 72–73 Client Access Server (CAS) about, 1 address book policies, 349 architectural overview, 10–11 client interaction, 376–377 DAG and, 461 development problems, 7–8 MailTips and, 376–377 MRS and, 567 MRSProxy and, 612–613 namespace planning, 79–81 public folders and, 767 testing programming and customizations, 30–31 transport service, 27 client-side filters, 110–113 client-side rules, 318 closed groups, 270 cloud service, 5, 9, 646 cluster continuous replication (CCR), 29 Cluster Name Object (CNO), 490, 496–499 cluster technology, 463–464, 492–493 cmdlets. See also specific cmdlets about, 21, 83–86, 92–95 Active Directory module, 120–122 bulk updates, 114–116 command editing, 95–97 default view, 94 determining availability of, 86 execution policies, 118–119 filtering, 110–113 /full switch, 94 handling information returns, 98 HTML reports, 127–128 online repair, 445–448 output from, 100, 125–127 /parameter switch, 94 piping, 109 quarantined mailboxes, 439 RBAC restrictions, 154 remote Windows PowerShell and, 86–92 repair, 445–448 role assignment policies, 153–155, 163–166 roles and, 139 in scripts, 93, 117 selective output, 98–101 transcripts, 114 variables and, 101–103 /verbose switch, 129 /whatIf switch, 113 CNO (Cluster Name Object), 490, 496–499 Codeplex website, 38 columns, EAC, 177–178 comma-separated-value (CSV) files analyzing, 68 CSVDE utility, 114 exporting EAC information to, 181–182 migration batches, 592 modern public folders and, 789 moving mailboxes, 582, 590 outputting, 125–127, 281–282 command editing, PowerShell, 95–97 Commit log record type, 425 compacting database, 432, 436 comparison operators, 110 Complete-MigrationBatch cmdlet, 594 compliance management about, 641–642 archive mailboxes, 645–657 auditing administrator actions, 748–754 auditing mailbox access, 754–762 development priorities, 4 evolving needs of, 3 legal discovery actions, 642–645 messaging records management, 657–689 preserving information, 696–737 Recoverable Items structure, 737–747 testing operational processes, 29 upgrading considerations, 18 Compliance Management role group, 74 compression attachments and, 398 LZ77, 506 LZX, 361 mailbox database, 394, 397–398 transaction log, 483–484 Computer Administrator account, 329–330 concurrent searches, 733 conditional checking in scripts, 103 conditional parameters, 307–313 –ConditionalCompany cmdlet parameter, 307, 309 –ConditionalCustomAttribute cmdlet parameter, 307, 309 –ConditionalDepartment cmdlet parameter, 309 –ConditionalStateOrProvince cmdlet parameter, 307, 309 –ConfictResolutionOption cmdlet parameter, 632 configuration Active Directory information, 35 MailTips, 377–378 MRS, 621–623 XML files, 51–52, 205–206 Configuration read scope, 142 Configuration write scope, 142 –ConfigurationOnly cmdlet parameter, 545–546 –Confirm cmdlet parameter, 113, 656 ConflictPercentageAllowed property, 260 Connect-ExchangeOnline function, 90 Connect-Mailbox cmdlet, 222–223 contacts, mail-enabled, 179, 250–251 Contacts folder, 658 content indexes, 701, 776 Content Indexing (CI) catalog, 554 content maintenance tasks, 432, 436–437 ContentIndexState property, 542 ContentMailbox property, 780 contiguous space, 392, 394–395, 397–398 continuous replication circular logging (CRCL), 511 controller process, 402–407 ConvertTo-HTML cmdlet, 127 cookie files, 376 copies, database. See database copies Copy action, 756 CopyQueueLength property, 521 corrupt items detection and isolation, 437–448 moving mailboxes, 569 corruption, logical, 526 Country property, 305 CrashCount system registry setting, 438 CRCL (continuous replication circular logging), 511 Create action, 756 –Credentials cmdlet parameter, 612 crimson channel, 475–476, 502–504 Crowley, Mike, 124 CSV (comma-separated-value) files analyzing, 68 CSVDE utility, 114 exporting EAC information to, 181–182 migration batches, 592 DAG (Database Availability Group) 811 modern public folders and, 789 moving mailboxes, 582, 590 outputting, 125–127, 281–282 CSVDE utility, 114 Ctrl+Click key combination, 361 CU (cumulative updates), 14, 27, 64–67 cumulative updates (CU), 14, 27, 64–67 Cunningham, Paul, 124 custom filters, 308–313 –CustomAttribute cmdlet parameter, 352–355, 385 –CustomConfigWriteScope cmdlet parameter, 143 –CustomRecipientWriteScope, 143, 157 D %d variable, 339 DAC (Datacenter Activation Coordination), 551–552 DACP bit, 552 DACP (Datacenter Activation Coordination Protocol), 552 DAG (Database Availability Group) about, 19–20, 32–33, 311, 457, 461–463, 489–494 activating mailbox database copies, 533–534 activation blocks, 542–544 Active Manager, 465–479 adding database copies, 514–517 adding database copies with EMS, 525 architectural overview, 10–11 AutoDatabaseMountDial setting, 539–542 building, 494–496 building DAG, 494–496 changes in high availability, 457–459 changes in message submission, 489 circular logging, 510–514, 554 cleaning up, 510 crimson events, 475–476, 502–504 DAG networks, 506–509 data center activation coordination, 551–552 databases and, 362, 411, 459–464 day-to-day management and operations, 489–551 design considerations, 552–562 handling storage failures, 549–551 I/O performance improvements, 401 lagged database copies, 525–532 managing properties, 504–506 migrating, 464–465 monitoring database copies, 517–522 moving database locations within, 544–546 moving databases, 539–542 naming conventions, 179 passive database copies, 460 performing server switchovers, 536–539 pre-staging Cluster Name Object, 497–499 public folders and, 767–768 rebalancing database copies, 534–536 removing database copies, 546–548 removing servers, 548–549 812 DAMs (deferred action messages) reseeding database copies, 523–525 role of FSW, 499–501 server maintenance, 562–565 server names, 44 sizing mailboxes, 394 stressed servers, 565–566 task logging, 502 transaction log replays, 479–489 virtual servers, 24 Windows Failover Clustering, 463–464 DAMs (deferred action messages), 318–319 dark zone, 60 Data Guarantee API, 609 data loss prevention (DLP), 18, 642, 646 Database Availability Group (DAG) about, 19–20, 32–33, 311, 457, 461–463, 489–494 activating mailbox database copies, 533–534 activation blocks, 542–544 Active Manager, 465–479 adding database copies, 514–517 adding database copies with EMS, 525 architectural overview, 10–11 AutoDatabaseMountDial setting, 539–542 building, 494–496 building DAG, 494–496 changes in high availability, 457–459 changes in message submission, 489 circular logging, 510–514, 554 cleaning up, 510 crimson events, 475–476, 502–504 DAG networks, 506–509 data center activation coordination, 551–552 databases and, 362, 411, 459–464 day-to-day management and operations, 489–551 design considerations, 552–562 handling storage failures, 549–551 I/O performance improvements, 401 lagged database copies, 525–532 managing properties, 504–506 migrating, 464–465 monitoring database copies, 517–522 moving database locations within, 544–546 moving databases, 539–542 naming conventions, 179 passive database copies, 460 performing server switchovers, 536–539 pre-staging Cluster Name Object, 497–499 public folders and, 767–768 rebalancing database copies, 534–536 removing database copies, 546–548 removing servers, 548–549 reseeding database copies, 523–525 role of FSW, 499–501 server maintenance, 562–565 server names, 44 sizing mailboxes, 394 stressed servers, 565–566 task logging, 502 transaction log replays, 479–489 virtual servers, 24 Windows Failover Clustering, 463–464 Database Availability Group management service (MsExchangeDAGMgmt.exe), 503 –Database cmdlet parameter, 193, 634 database copies activating mailbox, 533–534 activation blocks, 542–544 adding with EMS, 525 automatic database transitions, 467–469 cleaning up, 510 DAGs and, 465, 514–517, 555 failover, 466 identifying specific, 525 lagged, 525–532 monitoring, 517–522 passive, 460, 544 rebalancing, 534–536 removing, 546–548 reseeding, 523–525 scanning for, 458 switchover, 466, 533–534 database management about, 407–409 activation preference, 477 automatic database transitions, 467–469 automatic reseeding of failed databases, 458 backups, 416–417 circular logging and, 429–430 cleaning up before creating copies, 510 creating mailbox databases, 410–414 custom filter to address mailboxes in databases, 310–313 DAGs and, 362, 555–556 database checksums, 432–435 database compaction, 432, 436 database copies, 510, 514–536 database defragmentation, 432, 435 database redundancy, 411, 522 database replication, 390, 411, 459, 479–489 database schemas, 398–400 database usage statistics, 451–453 debugging swelling databases, 444–445 dismounting databases, 422, 447, 469, 545 estimating database size, 217–218 log placement, 428–429 mailbox resources provisioning management agent, 209–213 maximum database size, 389–392 maximum number of active databases, 402–403 mounted databases, 407, 426–427, 462–463, 546 moving databases, 536, 539–542, 544–546 naming conventions, 179 numbers supported, 407 OAB and, 371 protection against excessive database growth, 443–444 rebuilding databases, 448–451 removing databases, 416–418 renaming databases, 414–415 seeding databases, 489 updating after installation, 414–416 write smoothing, 395 database portability, 459–464 database scope, 158–159 database usage statistics, 451–453 DatabaseAvailabilityGroupIpAddresses property, 505 Datacenter Activation Coordination (DAC), 551–552 Datacenter Activation Coordination Protocol (DACP), 552 –DatacenterActivationMode cmdlet parameter, 552 DataMoveReplicationConstraint property, 620–621 DataMoveReplicationConstraint setting, 481, 609 Data.oab file, 361 DataPath property, 410–411 date formats, 199 debugging generating transcripts, 114 swelling databases, 444–445 Default Archive and Retention Policy, 653–655 Default Archive Policy, 653 default folders, 200–201, 393 default group location, 288–289 Default MRM Policy, 652, 655 default policy tags (DPT), 658–659, 666 Default Role Assignment Policy, 290, 295 DefaultPublicFolderMailbox property, 771 deferred action messages (DAMs), 318–319 Deferred Actions folder, 318 defragmentation, database, 432, 435 Defragmentation Tasks counter, 435 Delegated Setup role group, 63, 74, 141 delegating groups, 275 mailboxes, 229–232 Outlook access, 239–240 role assignments, 160 roles, 140, 163, 625 –Delegating cmdlet parameter, 154 Delete key, 95 delete tags, 672 DeleteAndAllowRecovery action, 672 DeleteAttachments property, 257 DeleteComments property, 257 –DeleteContent cmdlet parameter, 703 Deleted Items folder, 393, 649, 658, 695 –DeleteExistingFiles cmdlet parameter, 524 DeleteNonCalendarItems property, 258 DeleteSubject property, 257 DisplayName property Deletions folders, 746 delivery reports about, 320–322 administrator searches for, 322–327 EMS searches for, 327–329 troubleshooting, 323 designing DAGs, 552–562 retention policies, 663–665 detail templates, 382–386 Details Templates Editor, 382–386 detecting corrupt items. See corrupt items –DetectOnly cmdlet parameter, 446 development priorities, 2–5 DHCP (Dynamic Host Configuration Protocol), 490 diagnostics for Exchange Server, 330–332 Direction property, 598 dirty pages, 425 Disable-Mailbox cmdlet, 92, 219, 656 Disable-MailPublicFolder cmdlet, 786 disabling administrative auditing, 748 archive mailboxes, 656–657 mailboxes, 218–220, 223 retention tags, 687 disaster recovery mechanisms, 529 DisconnectDate property, 220 discovery actions, 642–643, 646 discovery mailboxes, 76, 182, 188, 224–226, 721 Discovery Management role group about, 74 controlling access to discovery mailboxes, 722 default discovery mailboxes and, 234 linking to tasks, 135 performing searches, 225 RBAC support, 174 role assignment and, 152 discovery metadata mailboxes, 224 discovery search mailboxes, 224 DiscoveryHolds folder, 726–727, 746 DiscoveryMaxConcurrency property, 725 DiscoveryMaxKeywords property, 725 DiscoveryMaxKeywordsPerPage property, 725 DiscoveryMaxMailboxes property, 725 DiscoveryMaxMailboxResultsOnly property, 725 DiscoveryPreviewSearchResultsPageSize property, 725 DiscoverySearchMailbox account, 76 DiskFreeSpace property, 522 DiskFreeSpacePercent property, 522 DiskTotalSpace property, 522 Dismount-Database cmdlet, 415, 512, 545 dismounting databases, 422, 447, 469, 545 display templates, 382–386 –DisplayName cmdlet parameter, 192, 307, 348 DisplayName property, 185, 222 813 814 DistinguishedName property DistinguishedName property, 185 distribution groups about, 267–269 address book policies and, 350 completing mailboxes, 193 creating, 270–275 defining default location, 288–289 dynamic, 179, 246, 300–313 group expansion, 277–278 group naming policy, 287, 289–295 group owners, 271, 275–277, 350 managing, 269–270, 286–297 metrics for, 275 moderated, 244–246, 270, 283 protected, 278–281 security groups, 252, 284–285 tracking usage, 285–286 viewing group members, 268–269, 281–283 Distribution Groups role, 147 DistributionGroupNamingPolicy property, 292 DLL (dynamic link library), 344–345 DLP (data loss prevention), 18, 642, 646 DNS (Domain Name System), 327, 462, 508 document library, 796 domain controllers, 495 Domain Name System (DNS), 327, 462, 508 –DomainController cmdlet parameter, 91 domains accepted, 340 Active Directory information, 35 preparing, 48 –DoNotIncludeArchive cmdlet parameter, 731 DPT (default policy tags), 658–659, 666 drizzle synchronization, 578 .dsc file extension, 376 DSN error code 5.7.1, 280 dynamic buffer allocation, 402 dynamic distribution groups about, 270, 300 Active Directory and, 176 creating, 302–305 creating with EMS, 306–308 custom filters, 308–313 OPATH queries, 300–302 validating query results, 305–306 Dynamic Host Configuration Protocol (DHCP), 490 dynamic link library (DLL), 344–345 dynamic quorums, 494 dynamic throttling, 580 E E2EComplete migration product, 575 EAC (Exchange Administration Center) about, 24 accessing data, 176–177 accessing mailbox audit data, 759 address book policies, 352–353 applying retention policy to mailboxes, 677 archive mailboxes, 650–652 bulk mailbox creation, 195 certificate management, 313–317 changing columns, 177–178 Compliance Management section, 171, 668, 673, 759 creating DAGs, 490–491 delivery reports, 320–329 development priorities, 4 distribution groups, 267–313 exporting information to CSV files, 181–182 filtering capabilities, 177, 342 Groups section, 302, 331 Hybrid section, 172 importing and exporting mailbox data with, 629–632 in-place holds, 705–706 language support, 196–200 mail flow and rules, 318–320 Mail Flow section, 172, 325, 333, 335 Mailbox Delegation section, 229–230, 232–233 mailbox import and export, 629–632 management interfaces, 21–22, 170–173 managing migration batches, 581–592 managing recipients, 180–183 migration batches with, 574, 581–592 Mobile section, 172–173 moving databases and, 544 mysterious mailboxes, 182–183 naming conventions, 178–180 Offline Address Book and, 362 Organization section, 171, 313, 346, 352 permissions, 143–144, 233–234 Permissions section, 133–134, 143–144, 171, 295 Protection section, 171 public folders and, 766 Public Folders section, 172, 188, 767 RBAC support, 132 Recipients section, 146, 171, 177, 182, 241, 250, 273–274, 581 refresh option, 176 replication queue lengths, 481 reporting licenses, 70–71 running without mailboxes, 329–330 Servers section, 172, 315, 409–410, 494, 537 setting diagnostics for Exchange Server, 330–332 setting up mailboxes, 191–193 sharing policies, 313 starting, 173–175 Unified Messaging section, 172 viewing correct, 174 viewing migration batch properties, 595–596 Windows PowerShell and, 84 ECP (Exchange Control Panel), 21–22, 170, 269, 707 ecTooManyMountedDatabases error, 544 EDB (Exchange database), 388 edge servers, 48 eDiscovery searches, 224–225, 233, 702, 726 Edit control type, 385 editions, Exchange Server, 22–23, 32–33 ELC (Email Lifecycle Assistant), 726–727 email address policies about, 333–334 creating, 337–340 email policy priority, 334–336, 340 filters and, 341–345 mask variables, 339 Email Lifecycle Assistant (ELC), 726–727 email notification, 595–596 email service. See addressing messages; mailbox management –EmailAddress cmdlet parameter, 612 EMC (Exchange Management Console), 21–22, 650 EMS (Exchange Management Shell) about, 24, 31, 83, 92–120 accessing mailbox audit data, 759 Active Directory for PowerShell, 120–123 adding database copies, 525 address book policies, 352–353 creating dynamic distribution groups, 306–308 delegated setup and, 63 email address policies, 343–345 enabling archives, 648 executing searches, 731–732 handling information returns, 98 mailbox import and export, 632–637 MailTips management, 377–378 management interfaces, 21–22, 170 migration batches with, 574, 592–595 public folders and, 766 room lists, 270, 298 searches for delivery reports, 327–329 useful examples, 123–128 Windows PowerShell, 83–92, 129 Enable-CmdletExtensionAgent cmdlet, 206 Enable-Mailbox cmdlet, 193–194, 206, 649, 651 Enable-QuarantineMailbox cmdlet, 440 end-user roles, 164–165 endpoints, migration, 611–612 Enterprise Administrators group, 48 Enterprise edition, 33, 462 EOP (Exchange Online Protection), 16 –eq comparison operator, 110 –Equipment cmdlet parameter, 195 equipment mailboxes about, 188, 254–255, 265 creating, 195 defining custom properties, 255–256 naming conventions, 178–179 Exchange Administration Center (EAC) ESE (Extensible Storage Engine) about, 388–389 DAG and, 466 handling storage failures, 549 memory allocation and, 402–403 timestamps, 425 transaction logs, 419–425, 479 view tables, 400 ESEUTIL utility about, 57, 445, 450–451 /D parameter, 448 database compaction, 436 /K switch, 482 /MH parameter, 422 /MS parameter, 450 /p switch, 427 /R switch, 482 rebuilding databases, 451 –EstimateOnly cmdlet parameter, 731 event-based assistants, 454 Event Viewer, 471 EWS (Exchange Web Services) about, 40–41 ESE versus, 389 message tracking, 326 synchronizing information, 792 testing considerations, 28, 30 EWSEditor (Exchange Web Services Editor), 40–41 examining search results, 720–724 $ExBin variable, 101 Exchange Administration Center (EAC) about, 24 accessing data, 176–177 accessing mailbox audit data, 759 address book policies, 352–353 applying retention policy to mailboxes, 677 certificate management, 313–317 changing columns, 177–178 Compliance Management section, 171, 668, 673, 759 creating DAGs, 490–491 delivery reports, 320–329 development priorities, 4 distribution groups, 267–313 exporting information to CSV files, 181–182 filtering capabilities, 177, 342 Groups section, 302, 331 Hybrid section, 172 I/O performance improvements, 401 importing and exporting mailbox data with, 629–632 in-place holds, 705–706 language support, 196–200 mail flow and rules, 318–320 Mail Flow section, 171–172, 325, 333, 335 Mailbox Delegation section, 229–230, 232–233 mailbox import and export, 629–632 815 816 Exchange Authorization Library (ADDriver) management interfaces, 21–22, 170–173 managing recipients, 180–183 migration batches with, 574, 581–592 Mobile section, 172–173 moving databases and, 544 mysterious mailboxes, 182–183 naming conventions, 178–180 Offline Address Book and, 362 Organization section, 171, 313, 346, 352 permissions, 143–144, 233–234 Permissions section, 133–134, 143–144, 171, 295 Protection section, 171 public folders and, 766 Public Folders section, 172, 188, 767 RBAC support, 132 Recipients section, 146, 171, 177, 182, 241, 250, 273–274, 581 refresh option, 176 replication queue lengths, 481 reporting licenses, 70–71 running without mailboxes, 329–330 Servers section, 172, 315, 409–410, 494, 537 setting diagnostics for Exchange Server, 330–332 setting up mailboxes, 191–193 sharing policies, 313 starting, 173–175 Unified Messaging section, 172 viewing correct, 174 viewing migration batch properties, 595–596 Windows PowerShell and, 84 Exchange Authorization Library (ADDriver), 90–91 Exchange Control Panel (ECP), 21–22, 170, 269, 707 Exchange database (EDB), 388 Exchange Install Domain Servers group, 75 Exchange LegacyInterOP role group, 74 Exchange Management Console (EMC), 21–22, 650 Exchange Management Shell (EMS) about, 24, 31, 83, 92–120 accessing mailbox audit data, 759 Active Directory for PowerShell, 120–123 adding database copies, 525 address book policies, 352–353 creating dynamic distribution groups, 306–308 delegated setup and, 63 email address policies, 343–345 enabling archives, 648 executing searches, 731–732 mailbox import and export, 632–637 MailTips management, 377–378 management interfaces, 21–22, 170 migration batches with, 574, 592–595 public folders and, 766 room lists, 270, 298 searches for delivery reports, 327–329 useful examples, 123–128 Windows PowerShell, 83–92, 129 Exchange-MBX.xml file, 52 Exchange Online-ApplicationAccount, 76 Exchange Online Protection (EOP), 16 Exchange Online (Service), 5–9 Exchange Organization Administrators security group, 48 Exchange Personal Information property set, 35 Exchange Server about, 1–2 Active Directory support, 34–37, 45–48 addressing, 333–386 architectural overview, 10–11 creating organization, 49–50 Database Availability Group, 457–566 deploying, 50–63 development priorities, 2–5 editions supported, 22–23, 32–33 Exchange Administration Center, 267–332 Exchange Store, 387–456 influence of cloud service, 5–9 installing, 43–81 mailbox management, 169–266 moving mailboxes, 567–640 preparing for, 26–32, 47–48, 63–73, 77–81 public folders, 765–790 role-based access control, 131–168 setting diagnostics, 330–332 site mailboxes, 791–805 synchronization with SharePoint and, 795–799 upgrading, 11–22, 63–73 utilities supported, 37–41 virtualization, 24–25 Windows PowerShell, 83–130 Exchange Servers role group, 74–75 Exchange Store. See also Information Store about, 19–20 background maintenance, 432–437 corrupt item detection and isolation, 437–448 database management, 407–418 database usage statistics, 451–453 I/O operation, 392–402 mailbox assistants, 454–455 managed availability, 226–227, 407 maximum database size, 389–392 rebuilding databases, 448–451 transaction logs, 419–432 workers, controller, and memory, 402–407 Exchange Trace Analyzer (ExTRA) utility, 57 Exchange Trusted Subsystem role group about, 74, 77 FSW and, 500 remote PowerShell and, 89 split permissions model, 166–167 Exchange Web Services Editor (EWSEditor), 40–41 Exchange Web Services (EWS) about, 40–41 ESE versus, 389 message tracking, 326 synchronizing information, 792 testing considerations, 28, 30 Exchange Windows Permissions role group, 74, 166–167 ExchangeGuid property, 107 –ExchangeRemoteMove cmdlet parameter, 612 ExchangeSetup.log file, 56–57 –ExcludeDuplicateMessages cmdlet parameter, 713, 731 –ExcludeFolders cmdlet parameter, 633, 636 executing searches, 731–732 execution policies, PowerShell, 118–119 $ExInstall variable, 101 –ExpansionServer cmdlet parameter, 277 Expert diagnostic level, 331 expiry dates, 437, 684 export. See import and export (mailbox) Export-CSV cmdlet, 125–127, 281–282 Export-PublicFolderStatistics.ps1 script, 789 Export-RetentionTags.ps1 script, 681 $ExScripts variable, 101 Extensible Storage Engine (ESE) about, 388–389 DAG and, 466 handling storage failures, 549 memory allocation and, 402–403 timestamps, 425 transaction logs, 419–425, 479 view tables, 400 ExternalURL property, 366 ExTRA (Exchange Trace Analyzer) utility, 57 F F2 key, 95 F4 key, 95 F7 key, 95–96 F8 key, 95 facilities provisioning, 191 FAI (folder-associated item), 207 failover, database copies, 466 Failover Cluster Manager, 463–464, 498 $False variable, 101 Federated Services role, 313 FederatedEmail account, 76, 638 file share witness (FSW), 491, 499–501 –Filter cmdlet parameter, 109–110 filters address mailboxes in databases, 310–313 client-side, 110–113 custom, 308–313 database, 158–159 dynamic distribution groups, 308–313 EAC, 177 Get-CASMailbox cmdlet email address policies, 341–345 OPATH, 110, 346 recipient, 180–181, 306, 334, 337, 341–342 server-side, 110–113 firewall rules, 492 –FirstName cmdlet parameter, 192 FirstName property, 185 folder-associated item (FAI), 207 FolderBind action, 756 folders. See also public folders default, 200–201, 393 larger, 124–125 managed, 688–689 naming conventions, 179 retention policy tags, 661 setting retention policy on, 685–687 –FolderScope cmdlet parameter, 746 –ForceGroupMetricsGeneration cmdlet parameter, 376 Forefront Protection for Exchange (FPE), 16 forest functional mode, 26 Format-List cmdlet, 98 Format-Table cmdlet, 98 $FormatEnumerationLimit variable, 100 Fortune magazine, 643 FPE (Forefront Protection for Exchange), 16 FQDN (fully qualified domain name), 90, 314 free disk space, 432, 522 front-end. See CAS (Client Access Server) FSW (file share witness), 491, 499–501 Full Access permission, 226, 230, 232–235 FullScanMoveJobsPollingInterval property, 622 fully qualified domain name (FQDN), 90, 314 G %g variable, 339 GAL (Global Address List) about, 35 address book policies and, 348–349, 351–357 address lists and, 346 group naming policy and, 287, 292 mail-enabled contacts, 250–251 mail users, 252 naming mailboxes, 178, 185–187 Offline Address Book and, 360, 367–371 public folders, 775 resource mailboxes, 254–255 tracking group usage, 286 gap coalescing technique, 394–395 Get-ActiveSyncDevice cmdlet, 125–126 Get-ADDomainController cmdlet, 121 Get-AddressList cmdlet, 347 Get-AdminAuditLogConfig cmdlet, 749 Get-ADUser cmdlet, 122 Get-CalendarProcessing cmdlet, 202, 258–259, 261 Get-CASMailbox cmdlet, 112 817 818 Get-ClusterNode cmdlet Get-ClusterNode cmdlet, 564 Get-Command cmdlet, 85, 93–94 Get-Contact cmdlet, 98 Get-Credential cmdlet, 90, 612 Get-DatabaseAvailabilityGroup cmdlet, 467, 493 Get-DatabaseAvailabilityGroupNetwork cmdlet, 507, 509 Get-DistributionGroup cmdlet, 112 Get-DistributionGroupMember cmdlet, 217, 305 Get-DynamicDistributionGroup cmdlet, 112–113, 278, 304, 307–308 Get-EmailAddressPolicy cmdlet, 334, 341–342 Get-EventLog cmdlet, 98 Get-EventLogLevel cmdlet, 331–332 Get-ExchangeDiagnosticInfo cmdlet, 576 Get-ExchangeServer cmdlet about, 92 finding property values, 410 identities, 105–106 reporting issues, 71–72 selective output, 99 version numbers, 67–68 Get-ExCommand cmdlet, 86 Get-ExecutionPolicy cmdlet, 118 Get-FailedContentIndexDocuments cmdlet, 734 Get-Group cmdlet, 98, 107, 350 Get-HealthReport cmdlet, 471 Get-InboxRule cmdlet, 320 Get-Mailbox cmdlet about, 83 address book policies, 354–356 applying retention policies, 678 arbitration mailboxes, 59, 547 archive mailboxes, 650 checking language, 196 checking mailboxes, 312, 362–363 checking quotas, 217 EAC support, 174, 182–183 equipment mailboxes, 195, 265 filter examples, 110, 112–113 health mailboxes, 228, 547 larger folders and, 125 limiting number of objects returned, 109–111 multi-domain forests, 123 OAB generation mailboxes, 367 object versions, 69 removing databases, 417–418 returning properties, 98, 108 room mailboxes, 195, 262 selective output, 99–100 server names and, 44 shared mailboxes, 241 Get-MailboxAutoReplyConfiguration cmdlet, 202–203 Get-MailboxCalendarConfiguration cmdlet, 202–204, 261 Get-MailboxCalendarSettings cmdlet, 261 Get-MailboxDatabase cmdlet about, 92 checking mounted databases, 517 checking OABs, 413 debugging swelling databases, 444 moving database locations, 544 reconnecting mailboxes, 220 removing database copies, 547 removing mailboxes, 510 removing servers, 548 retrieving maintenance schedule, 434 updated status information, 481 viewing activation preferences, 535 white space, 449–450 worker processes, 402 Get-MailboxDatabaseCopyStatus cmdlet content index, 482 database copy information, 520–522, 536, 542 moving database locations, 545–546 replay queue length, 529 replication status, 516, 518–519 server location, 362 wildcard characters, 481 Get-MailboxExportRequest cmdlet, 626, 637 Get-MailboxExportRequestStatistics cmdlet, 626, 637 Get-MailboxFolder cmdlet, 202, 204, 320 Get-MailboxFolderPermission cmdlet, 240 Get-MailboxFolderStatistics cmdlet, 92, 125, 746, 798 Get-MailboxImportRequest cmdlet, 625, 633–634 Get-MailboxImportRequestStatistics cmdlet, 625, 631, 634–635 Get-MailboxJunkEMailConfiguration cmdlet, 202, 204–205 Get-MailboxMessageConfiguration cmdlet, 202, 204 Get-MailboxRegionalConfiguration cmdlet, 199, 202 Get-MailboxSearch cmdlet, 702, 707, 731 Get-MailboxServer cmdlet, 375, 455, 519 Get-MailboxSpellingConfiguration cmdlet, 202 Get-MailboxStatistics cmdlet about, 92, 108, 207 accessing move report histories, 600 auditing mailboxes, 184 checking space usage, 652 getting more information about a move, 597 health mailboxes, 228 quarantined mailboxes, 439 reconnecting mailboxes, 222 remote procedure calls and, 128 removing database copies, 547 source of mailbox move information, 599 Get-ManagementRole cmdlet, 136, 138, 142 Get-ManagementRoleAssignment cmdlet, 152–155, 162– 164, 296 Get-ManagementRoleEntry cmdlet, 136, 138, 146, 156 Get-Member cmdlet, 112 Get-MessageTrackingLog cmdlet, 286 Get-MigrationUser cmdlet, 594–595 Get-MigrationUserStatistics cmdlet, 585, 595, 599 Get-MonitoringItemIdentity cmdlet, 471 Get-MoveRequest cmdlet about, 605 checking status of move request, 609 clearing move requests, 610 removing databases, 417–418 suspending mailbox moves, 617 viewing move request properties, 598 Get-MoveRequestStatistics cmdlet about, 576, 605 percentage of move completed, 176, 598 retrieving updated information, 481 source of mailbox move information, 599 status detail, 579 suspending mailbox moves, 616–618 total mailbox size, 597 troubleshooting with, 599 Get-Notification cmdlet, 638 Get-OfflineAddressBook cmdlet, 362, 364–366 Get-OrganizationConfig cmdlet, 292, 770 Get-PublicFolder cmdlet, 769, 780, 786 Get-PublicFolderMailboxDiagnostics cmdlet, 772 Get-PublicFolderMoveRequest cmdlet, 784 Get-PublicFolderStatistics cmdlet, 773 Get-Queue cmdlet, 564 Get-Recipient cmdlet archive mailboxes, 650 checking mailboxes, 312 discovering hidden recipients, 357 filters and, 112, 343 validating query results, 305–306 Get-RetentionPolicy cmdlet, 662, 674–675 Get-RetentionPolicyTag cmdlet, 662, 666, 670, 672 Get-RoleGroup cmdlet, 139, 144, 151, 162 Get-RoleGroupMember cmdlet, 144 Get-SearchDocumentFormat cmdlet, 730 Get-SendConnector cmdlet, 70 Get-SiteMailboxDiagnostics cmdlet, 148 Get-StoreUsageStatistics cmdlet, 442, 451–453 Get-ThrottlingPolicy cmdlet, 724 Get-TransportService cmdlet, 324 Get-User cmdlet bulk updates and, 115–116 filters and, 112–113 handling information returns, 98 variables and, 102, 107 Get-WebServicesVirtualDirectory cmdlet, 613 –GetEffectiveUsers cmdlet parameter, 163 GivenName property, 385 Global Address List (GAL) about, 35 address book policies and, 348–349, 351–357 address lists and, 346 group naming policy and, 287, 292 Guid property mail-enabled contacts, 250–251 mail users, 252 naming mailboxes, 178, 185–187 Offline Address Book and, 360, 367–371 public folders, 775 resource mailboxes, 254–255 tracking group usage, 286 global tables, 400 globally unique identifier (GUID) active copy of user's mailbox, 44 archive mailboxes, 651 database portability and, 459 default OAB operation, 363 as mailbox identifiers, 107–109 system registry and, 438 target mailboxes, 601 GlobalWebDistributionEnabled property, 366 GoDaddy certificate vendor, 314 Goodman, Steve, 124 Grant Full Access permission, 230 Grant Send As permission, 229 Grant Send On Behalf Of permission, 229 –GrantSendOnBehalfTo cmdlet parameter, 232 Grogan, Andy, 124 group metrics, 373–382 Group Metrics mailbox assistant, 375–376 Group-Object cmdlet, 92–93, 286 Groupbox control type, 385 groups. See also distribution groups; role groups ABPs and, 350 authentication and, 280–281 closed, 270 delegating, 275 group metrics, 373–382 moderated, 244–246, 270, 283 public, 270 with searches, 728–730 searches and, 728–730 security, 252, 284–285 tracking usage, 285–286 user-maintained, 286–299 USGs, 73–77, 139–141, 267 version numbers, 268 viewing members, 268–269, 281–283 GroupType property, 284 –gt operator, 110 GUID (globally unique identifier) active copy of user's mailbox, 44 archive mailboxes, 651 database portability and, 459 default OAB operation, 363 as mailbox identifiers, 107–109 system registry and, 438 target mailboxes, 601 Guid property, 108 819 820 HABs (hierarchical address books) H HABs (hierarchical address books), 349, 371–373 HardDelete action, 756 hardware development influenced by, 5 freeing disk space, 432, 522 protection against high latency, 442 recycling, 23 transaction log I/O, 428 health mailboxes, 182–183, 226–229, 547 Health Manager Service process (MSExchangeHMHost.exe), 226 Health Manager Worker process (MSExchangeHMWorker .exe), 226 health sets, 471 Help Desk role group, 74, 135, 141, 145–146 Hidden From Address Lists property, 357 hidden recipients, 357–358 hidden system folder, 786 hierarchical address books (HABs), 349, 371–373 hierarchy, public folders, 766–767 high availability. See also DAG (Database Availability Group) about, 457–459 Active Manager and, 469–472 handling move request errors, 609 lagged copies and, 527 mailbox moves and, 619–621 High diagnostic level, 331 high latency, 442, 508, 550, 553 HighAvailability channel, 503 HoldForMigration parameter, 789 $home variable, 101 HomeMDBBL property, 59 HomeMTA property, 44 Hotmail, 6 HR provisioning, 190 HTML-format messages, 397–398 HTML reports, 127–128 HTTP proxy logs, 367 HTTPS protocol, 8 Hygiene Management role group, 74, 152 Hyper-V, 24–25 hypervisors, 24–25 hyphen (-), 103, 110 I I/O operations about, 392–397 database schema, 398–400 high availability and, 457–458 import of PST data, 626 improvements to, 400–402 maintaining contiguity, 392, 394–395, 397–398 memory and, 463 sizing mailboxes, 394 transaction logs, 427–429 %i variable, 339 ICS (Incremental Change Synchronization), 578, 772 identities (cmdlets), 105–109 –Identity cmdlet parameter, 105–109, 116, 690 –IgnoreDefaultScope cmdlet parameter, 123 –IgnoreNamingPolicy cmdlet parameter, 290 –IgnoreNetworkParameter cmdlet parameter, 509 IIS (Internet Information Services), 53, 85, 88–90 –ilike operator, 110 import and export (mailbox) about, 623–624 with EAC, 629–632 with EMS, 632–637 exporting mailbox data, 635–637 gaining permission to execute, 624–626 planning import of PST data, 626–629 running multiple concurrent, 633 Import-Module cmdlet, 52, 121 Import-PSSession cmdlet, 90 Import-RetentionTags.ps1 script, 681 in-place holds, 703–708, 726–728, 736 Inbox folder, 393, 658 –IncludedRecipients cmdlet parameter, 307, 347 –IncludeFolders cmdlet parameter, 633, 636 IncludeKeywordStatistics property, 713 –IncludeMoveHistory cmdlet parameter, 600 –IncludeMoveReport cmdlet parameter, 601 –IncludeReport cmdlet parameter, 599 –IncludeSystemTags cmdlet parameter, 662 IncludeUnsearchableItems property, 713 IncomingLogCopyingNetwork property, 522 Incremental Change Synchronization (ICS), 578, 772 incremental resynchronization, 487–488 incremental synchronization, 575, 615 incremental updates, 578 indexes content, 776 secondary, 393, 395, 437, 578 Information Assistant process, 248 Information Store about, 388 DAG and, 466 improvements in, 19–20 MailTips and, 374 MRS and, 568 processing overview, 402–407 remote procedure calls to, 128 startup process, 421 Information Store Integrity maintenance utility (ISINTEG), 445 initialization scripts, 90, 100 –Initials cmdlet parameter, 192 InPlaceHoldEnabled property, 707, 714 InPlaceHoldPeriod property, 707 Insert key, 95 Insert log record type, 425 Install-WindowsFeature cmdlet, 47, 51, 53 installing Exchange Server about, 43–44 Active Directory support, 45–48 creating Exchange organization, 49–50 deployment overview, 50–63 domain controllers and, 495 namespace planning, 77–81 security groups and accounts, 73–77 updates and, 63–73 updating mailbox databases, 414–416 InstallWindowsComponent.ps1 script, 52 Integrated Scripting Environment (ISE), 103–105 Integrated Windows Authentication (IWA), 79–80 interfaces, management, 21–22 Internet Information Services (IIS), 53, 85, 88–90 IP addresses, 492–493, 508 IPM_SUBTREE, 775 ISA Server, 6 –IsArchive cmdlet parameter, 637 iSCSI networks, 509 ISE (Integrated Scripting Environment), 103–105 IsExcludedFromInitialProvisioning property, 210 IsExcludedFromProvisioning property, 210 IsExcludedFromProvisioningBySpaceMonitoring property, 210 IsExcludedFromServingHierarchy flag, 771 IsHierarchicalGroup property, 372 ISINTEG (Information Store Integrity maintenance utility), 445 IsMemberOfDL property, 385 isolating corrupt items. See corrupt items IssueWarningQuota property, 214, 803 IsSuspendedFromProvisioning property, 210 IT provisioning, 190–191 IWA (Integrated Windows Authentication), 79–80 J JET database engine, 511 journaling messages, 249 Junk Email Options Assistant, 454 K Kerberos authentication, 79 keyboard commands, 95–97 keyword query language (KQL), 710–711, 736 KQL (keyword query language), 710–711, 736 L Label control type, 385 lagged database copies about, 525–530 logs and logging Safety Net and, 531–532 self-maintained, 530–532 large-item limit, 584–585, 590 LastAvailableLogTime property, 521 LastCrashTime system registry setting, 438 LastLogGenerated property, 521 LastLogInfoIsStale property, 521–522 –LastName cmdlet parameter, 192 LastName property, 185 LastNumberOfRecords property, 365 LastStatusTransitionTime property, 521 LastTouched property, 364–365 latency, 442, 508, 550, 553 LCR (local continuous replication), 29 LDAP (Lightweight Directory Access Protocol), 110, 270, 301, 349 LDAPReads metric, 453 LDAPSearches metric, 453 LDIFDE utility, 114, 386 LegacyExchangeDN property, 34, 222 legal compliance. See compliance management licenses, reporting, 70–73 life cycle of site mailboxes, 800–803 Lightweight Directory Access Protocol (LDAP), 110, 270, 301, 349 –like operator, 110 linked mailboxes, 188 linked value replication (LVR), 268–269 Listbox control type, 385 litigation hold (mailboxes), 19, 697, 699–701 Litigation Hold role, 704 –LitigationHoldDate cmdlet parameter, 700 –LitigationHoldOwner cmdlet parameter, 700 [email protected] service, 6 load balancing moving mailboxes, 568–569 upgrade considerations, 16 local continuous replication (LCR), 29 Log Record Checksum (LRCK) algorithm, 427 log sets (log streams), 419–427 logical corruption, 526 logical unit number (LUN), 395, 428 –LogLevel cmdlet parameter, 731 –LogonType cmdlet parameter, 760 LogRecordBytes metric, 453 LogRecordCount metric, 453 logs and logging. See also transaction logs Application and Service Logs, 502 Application Event Log, 332, 364, 433, 443, 544 circular, 414, 429–431, 486, 510–514, 554 diagnostic levels, 330–332, 608 fluctuations in number of, 480 HTTP proxy, 367 message-subject, 324 migration batches, 592 821 822 %m variable placement considerations, 428–429 protection against excessive log growth, 443–444 rebuilding databases, 448–449 reserved, 408, 431–432 setup, 56–57 task, 502 temporary log files, 430–431 lossy failure, 580–581 Lotus Notes, 337, 344 Low diagnostic level, 331 Lowest diagnostic level, 331 LRCK (Log Record Checksum) algorithm, 427 –lt operator, 110 LUN (logical unit number), 395, 428 LVR (linked value replication), 268–269 Lync, integration with, 3, 18 LZ77 compression, 506 LZX compression, 361 M %m variable, 339 mail-enabled contacts, 179, 250–251 mail-enabled security groups, 284–285 mail-enabling public folders, 779–783 Mail Recipient Creation role, 146–147 Mail Recipients role, 146–147, 156 mail users, 252–253 mailbox assistants, 375–376, 454–455 –Mailbox cmdlet parameter, 783 Mailbox Import Export role, 133, 140, 159, 174, 624 mailbox management. See also specific mailboxes about, 169–170 activating database copies, 533–534 applying retention policy to, 677–681 attributes and names, 185 auditing mailbox access, 239, 754–762 AutoDatabaseMountDial setting, 539–542 automating settings, 205–206 bulk mailbox creation, 195 common problems, 191 completing mailboxes, 193–194 creating mailboxes, 187–209 custom attributes, 207–209 custom filter to address mailboxes in databases, 310–313 data retention states, 745 default folders, 200–201 disabling mailboxes, 218–220, 223 enabling mailboxes for auditing, 757–758 language support, 196–200 mail-enabled contacts, 250–251 mail users, 252–253 mailbox assistants, 375–376, 454–455 mailbox databases, 410–416 mailbox quotas, 213–218, 391–392, 396, 606 mailbox repair cmdlets, 445–448 managing recipients, 180–183 manipulating settings, 202–206 message quotas, 128 MFCMAPI utility and, 38–40 migrating DAGs, 464–465 moderated recipients, 243–250 moving mailboxes, 59–60, 567–640 naming mailboxes, 185–187 need for mailboxes, 183–184 OAB generation mailboxes, 366–367 operational flexibility and, 4 perfection and progress, 170–180 placing mailboxes on hold, 19 provisioning mailboxes, 607 quarantined mailboxes, 439–441 recalling messages, 241–243 reconnecting mailboxes, 220–223 removing mailboxes, 218–220, 223 resources provisioning management agent, 209–213 role assignment policies and, 164–166 setting mailbox permissions, 229–240 setting mailbox quotas, 213–218 sizing mailboxes, 391–394 transport service, 27–28 viewing properties, 176 Mailbox Replication Proxy service (MRSProxy), 612–614 Mailbox Replication Service (MRS) about, 567–568 archive mailboxes and, 211 autosuspended state for moves, 587 configuration file, 621–623 corrupt item detection and isolation, 440–441 creating mailbox databases, 413–414 ensuring high availability, 620–621 improvements in, 8 mailbox import and export, 623 managing individual mailbox moves, 605–611 migration batches, 584–590, 593 Migration service and, 574 MSExchangeRepl versus, 465, 567 planning import of PST data, 627 planning mailbox moves, 615 preventing loss of data, 580–581 processing overview, 575–578 removing databases, 418 reporting mailbox moves, 599–604 suspending mailbox moves, 616–618 system resources and, 579–580 transaction log replay, 480 Mailbox Search role, 159, 704 Mailbox server role (backend), 1, 314 mailbox tables, 400 Mailbox Transport Submission service, 243 MailboxDatabaseFailureItems channel, 503 MailboxGuid property, 108 MailboxReplicationService policy, 579, 607 MailboxReplicationServiceHighPriority policy, 579, 607 MailboxType property, 593 MailTips about, 373–376 auto-reply message, 203 client interaction, 376–377 configuring, 377–378 customizing, 380–381 distribution groups, 187 DLP and, 18 mail delivery indication, 251 moderated groups, 245–246 moderated mailboxes, 250 multilingual, 381 OAB support, 371, 381–382 setting up, 253, 275 user experience, 378–379 –MailTipsAllTipsEnabled cmdlet parameter, 377 –MailTipsExternalRecipientTipsEnabled cmdlet parameter, 378 –MailTipsGroupMetricsEnabled cmdlet parameter, 378 –MailTipsLargeAudienceThreshold cmdlet parameter, 378 –MailTipsMailboxSourcedTipsEnabled cmdlet parameter, 378 –MailTipTranslations cmdlet parameter, 381 MailUniversalDistributionGroup, 267 MailUniversalSecurityGroup, 267 maintenance, background. See background maintenance Majority Node Set clusters, 493 Managed Availability (MSExchangeHWWorker) Active Manager and, 469–472, 536 database redundancy, 522 health mailboxes and, 226–227 Managed Store and, 407 tracking actions, 472 Managed Folder Assistant (MFA) about, 454 background maintenance, 390 cumulative updates, 65 Email Lifecycle Assistant, 726–727 expired items, 673 PST data and, 629 public folder mailboxes, 773 retention policies and, 653, 655, 665–666, 684–685, 689–696 retention settings for mailboxes, 513 writing policy information into mailbox, 678 managed folders, 688–689 Managed Store. See Exchange Store –ManagedBy cmdlet parameter, 149, 151, 276 ManagedBy property, 113 –ManagedFolderMailboxPolicy cmdlet parameter, 193 ManageGroupManagementRole.ps1 script, 297 Management Committee group, 245 messages 823 management interfaces, 21–22, 170 management roles. See roles managing databases. See database management –ManualDAGNetworkConfiguration cmdlet parameter, 509 MAPI (Messaging Application Programming Interface) about, 8 applying retention policies, 689 DAG networks and, 507 LZ77 algorithm and, 506 MFCMAPI utility, 38–40 OAB support, 366 properties supported, 692–693 MaxActiveMovesPerSourceMDB property, 622 MaxActiveMovesPerSourceServer property, 622 MaxActiveMovesPerTargetMDB property, 622 MaxActiveMovesPerTargetServer property, 622 MaxConcurrentMigrations property, 614 maximum database size, 389–392, 614 maximum number of active databases, 402–403 maximum number of open site mailboxes, 800 MaximumActiveDatabases property, 402–404 MaxMoveHistoryLength property, 623 MaxReceiveSize property, 803 MaxRetries property, 623 –MaxSendSize cmdlet parameter, 584–585, 605, 627 MaxTotalMovesPerMRS property, 622 Medium diagnostic level, 331 meeting requests meeting room conflicts, 260 processing, 261–265 room lists, 270, 298–299 MemberDepartRestriction property, 272, 284 MemberJoinRestriction property, 272, 284, 294 memory management Exchange Store, 402–407 I/O operations and, 463 mailbox searches and, 726 PowerShell memory limits, 111 Message Tracking role, 137–138, 141, 147, 323 MessageBind action, 756–757 messages. See also addressing messages approving, 274 auto-reply, 187 changes in submission, 489 compressing, 398 FAI, 207 health mailboxes, 227, 229 journaling, 249 message-subject logging, 324 moderated groups and, 245 processing moderation requests, 247–249 recalling, 241–243 recovering, 643 sending on behalf of other users, 237–239 troubleshooting, 443 824 MessageTrackingReportId property MessageTrackingReportId property, 328 MessageTypes property, 713 Messaging Application Programming Interface (MAPI) about, 8 applying retention policies, 689 DAG networks and, 507 LZ77 algorithm and, 506 MFCMAPI utility, 38–40 OAB support, 366 properties supported, 692–693 messaging connectors, 179 messaging records management (MRM) about, 18, 641, 657 archive mailboxes and, 650 creating retention policies, 673–677 creating retention tags, 668–673 designing retention policies, 663–665 Managed Folder Assistant, 665–666 naming retention tags, 666–668 system tags, 662–663 types of retention tags, 657–662 metadata, 578, 712 MFA (Managed Folder Assistant) about, 454 background maintenance, 390 cumulative updates, 65 Email Lifecycle Assistant, 726–727 expired items, 673 PST data and, 629 public folder mailboxes, 773 retention policies and, 653, 655, 665–666, 684–685, 689–696 retention settings for mailboxes, 513 writing policy information into mailbox, 678 MFCMAPI utility about, 38–40 accessing mailbox audit data, 759 deferred action messages, 319 quarantined mailboxes and, 439–440 validating dates, 696 viewing properties, 693, 796–797 Microsoft Business Productivity Online Service, 6 Microsoft Exchange Replication service Active Manager and, 465–479 handling storage failures, 549–550 MRS versus, 465, 567 verifying transaction logs, 482 Microsoft Exchange Security Groups OU, 73, 75, 148 Microsoft Exchange Server 2013. See Exchange Server Microsoft Exchange Service Host process, 572–573 Microsoft Exchange System Objects OU, 781 Microsoft Exchange Transport Log Search service, 326 Microsoft Federation Gateway, 313 Microsoft Internet Information Services, 53, 85, 88–90 Microsoft Lync, integration with, 3, 18 Microsoft Management Console (MMC), 21, 36, 170, 382 Microsoft SharePoint, 3, 18, 389 Microsoft System Center Data Protection Manager, 527 Microsoft System Center Operations Manager, 442–443, 470, 520 Microsoft Technology Adoption Program, 14, 68 Microsoft Unified Communications Managed API, 53 migrating DAGs, 464–465 Migration account, 76 migration arbitration mailbox, 573 Migration Batch Wizard, 588 migration batches clearing, 584 completing, 590 controlling processing, 615–616 with EAC, 574, 581–592 with EMS, 574, 592–595 logging, 592 removing, 584 removing move requests, 591, 610–611 viewing details, 589 viewing properties of, 595–596 migration endpoints, 611–612 Migration role, 148 Migration service about, 570, 572–575 logging activity, 592 managing individual mailbox moves, 605–611 managing migration batches with EAC, 581–590 managing migration batches with EMS, 592–595 planning mailbox moves, 614–615 MMC (Microsoft Management Console), 21, 36, 170, 382 mobile access to public folder mailboxes, 786 mobile devices, 786 MobilePhone property, 154 moderated groups, 244–246, 270, 283 moderated mailboxes, 249–250 moderated recipients, 243–250 moderation requests, 247–249 modern public folders, 20–21, 420–421, 787–790 monitoring database copies, 517–522 Mount-Database cmdlet, 411–412, 512, 546 –MountDialOverride cmdlet parameter, 539 mounted databases, 407, 426–427, 462–463, 546 Move action, 756 Move-ActiveMailboxDatabase cmdlet, 538–541 Move-DatabasePath cmdlet, 415, 545–546 Move-Mailbox cmdlet, 606 Move Mailboxes role, 142, 148, 152 move reports about, 597–598 accessing histories, 599–606 outputting to files, 600–601 move requests checking and altering status, 609–611 clearing, 610–611 enforcing age limits for, 610–611 handling errors, 607–609 removing, 591, 610–611 viewing properties, 598 move tags, 672 MoveToArchive action, 672 MoveToDeletedItems action, 756 moving databases moving locations within DAGs, 544–546 potential issues, 539–542 server health and, 536 transaction logs and, 480 moving mailboxes about, 567–571 alerts and, 638–639 assigning priority, 607 asynchronous moving, 571–572 checking and altering move request status, 609–610 creating mailbox databases, 413–414 enabling MRSProxy, 612–614 ensuring high availability, 619–621 handling move request errors, 607–609 import and export processes, 623–637 managing individual moves, 605–611 migration batches with EAC, 581–592 migration batches with EMS, 592–595 migration endpoints, 611–612 Migration service, 572–575 MRS and, 567–568, 575–581, 621–623 planning, 614–619 removing databases, 418 reporting moves, 595–604 scheduling, 617 suspending, 615–619 transaction log replay, 480 transaction logs, 578 variations in speed, 619 moving public folders, 783–785 MRM (messaging records management) about, 18, 641, 657 archive mailboxes and, 650 creating retention policies, 673–677 creating retention tags, 668–673 designing retention policies, 663–665 Managed Folder Assistant, 665–666 naming retention tags, 666–668 system tags, 662–663 types of retention tags, 657–662 MRS (Mailbox Replication Service) about, 567–568 archive mailboxes and, 211 autosuspended state for moves, 587 configuration file, 621–623 corrupt item detection and isolation, 440–441 MSExchMDBAvailabilityGroupLink property 825 creating mailbox databases, 413–414 ensuring high availability, 620–621 improvements in, 8 mailbox import and export, 623 managing individual mailbox moves, 605–611 migration batches, 584–590, 593 Migration service and, 574 MSExchangeRepl versus, 465, 567 planning import of PST data, 627 planning mailbox moves, 615 preventing loss of data, 580–581 processing overview, 575–578 removing databases, 418 reporting mailbox moves, 599–604 suspending mailbox moves, 616–618 system resources and, 579–580 transaction log replay, 480 MRSProxy (Mailbox Replication Proxy service), 612–614 MsExchange Database counter, 435 MSExchange Database/Instances/DB Maintenance IO Reads/sec counter, 449 MsExchangeDAGMgmt.exe (Database Availability Group management service), 503 MSExchangeHMHost.exe (Health Manager Service process), 226 MSExchangeHMWorker.exe (Health Manager Worker process), 226 msExchangeHomeServerName property, 44 MSExchangeHWWorker (Managed Availability) Active Manager and, 469–472, 536 database redundancy, 522 health mailboxes and, 226–227 Managed Store and, 407 tracking actions, 472 MSExchangeRepl (Replication service) Active Manager and, 465–479 handling storage failures, 549–550 MRS versus, 465, 567 verifying transaction logs, 482 MSExchangeServicesAppPool setting, 614 msExchDataPath property, 236 msExchDelegateLinkList property, 236–237 msExchESEParamCacheSizeMax property, 405 msExchESEparamCacheSizeMin property, 406 msExchExtensionAttribute property, 385 msExchGroupExternalMemberCount property, 374 msExchGroupMemberCount property, 374 msExchMailboxMoveBatchName property, 577 msExchMailboxMoveFlags property, 577 msExchMailboxMoveRemoteHostName property, 577 msExchMailboxMoveSourceMDBLink property, 577 msExchMailboxMoveStatus property, 577 msExchMailboxMoveTargetMDBLink property, 577 msExchMaxActiveMailboxDatabases property, 34 MSExchMDBAvailabilityGroupLink property, 496 826 MSExchQueryFilter property MSExchQueryFilter property, 301 multi-domain forest, 122–123 multi-forest design, 45–46, 172 Multivalued Listbox control type, 385 MyBaseOptions role, 164 MyContactInformation role, 164 MyDistributionGroupMembership role, 165, 350 MyDistributionGroups role, 165, 290, 295–296 MyMarketPlaceApps role, 165 MyProfileInformation role, 164 MyRetentionPolicies role, 165, 682 MyTeamMailboxes role, 165 MyTextMessaging role, 165 MyVoiceMail role, 164 N –Name cmdlet parameter, 192, 251, 253, 307, 348, 731 Name property, 185 name resolution, 365–366 Name Service Provider interface (NSPI), 365 named parameters, 97 namespace planning about, 77 handling connections with CAS, 79–80 protocol-specific, 80–81 self-signed certificates, 77–78 naming conventions about, 43–44 applying different, 186 EAC, 178–180 mailboxes, 185–187 public folder mailboxes, 768 retention tags, 666–668 retroactive, 180 underscores, 26 user-maintained groups, 289–295 NDRs (nondelivery reports), 420 –ne comparison operator, 110 .NET Framework, installing, 44 network interface cards (NICs), 458, 499, 506–508 NetworkCompression property, 505 NetworkEncryption property, 505 networks APIPA addressing, 492 DAG, 506–509 iSCSI, 509 transient conditions, 483 New Address List screen, 347, 353 New-AddressBookPolicy cmdlet, 354 New-AdminAuditLogSearch cmdlet, 751 New-DatabaseAvailabilityGroup cmdlet, 490, 493, 498, 508 New-DistributionGroup cmdlet, 295–296, 298 New-DynamicDistributionGroup cmdlet, 306–308, 310–311 New Email Address Policy screen, 337–338, 342 New-EmailAddressPolicy cmdlet, 343 New-FederationTrust cmdlet, 313 New-GlobalAddressList cmdlet, 353 New-InboxRule cmdlet, 319–320 New-Item cmdlet, 120 New-Mailbox cmdlet about, 206 archive mailboxes, 648 database scope, 159 discovery mailboxes, 225 equipment mailboxes, 195 OAB generation mailboxes, 367 properties supported, 192–193 remote PowerShell, 91 room mailboxes, 195 New-MailboxAuditLogSearch cmdlet, 755, 759–760 New-MailboxDatabase cmdlet, 129, 212, 412 New-MailboxExportRequest cmdlet, 160, 625, 636, 722 New-MailboxFolder cmdlet, 202, 204 New-MailboxImportRequest cmdlet about, 625, 632 importing PST data, 635 role assignments and, 160 tickles, 576 New-MailboxRepairRequest cmdlet, 446–447 New-MailboxRestoreRequest cmdlet, 581, 785 New-MailboxSearch cmdlet, 702–703, 731–732 New-MailContact cmdlet, 251 New-MailUser cmdlet, 253 New-ManagementRole cmdlet, 156, 161 New-ManagementRoleAssignment cmdlet, 157, 160–162, 323, 625 New-ManagementScope cmdlet, 143, 158–159 New-MigrationBatch cmdlet, 592–594, 611, 639, 790 New-MigrationEndpoint cmdlet, 612, 614 New-MoveRequest cmdlet about, 148, 605–606 database scope and, 159 discovery mailboxes, 226 enforcing age limits for move requests, 610–611 immediate processing, 440 mailbox provisioning and, 607 migration processing, 573, 575, 587 suspending mailbox moves, 616, 618 New-OfflineAddressBook cmdlet, 354 New-PSSession cmdlet, 89–90 New-PublicFolder cmdlet, 777, 783 New-PublicFolderMigrationRequest cmdlet, 789 New-PublicFolderMoveRequest cmdlet, 773, 784 New-RetentionPolicyTag cmdlet, 661, 671, 673–674, 689 New-RoleGroup cmdlet, 145, 148, 158 New-SiteMailbox cmdlet, 148, 801 New-TestCASConnectivityUser.ps1 script, 183 New-ThrottlingPolicy cmdlet, 725 NICs (network interface cards), 458, 499, 506–508 noderunner processes, 406 Outlook 827 nondelivery reports (NDRs), 420 nonsystem tags, 662–663 notification, email, 595–596 –NotificationEmails cmdlet parameter, 594 –notlike operator, 110 NSPI (Name Service Provider interface), 365 NTFS file system, 389 $Null variable, 101, 680 O OAB generation mailboxes, 366–367 OAB (Offline Address Book) about, 357–358 address book policies, 349, 354–355 contents of, 365–366 creating customized, 367–371 creating mailboxes, 366–367 default operation, 363–365 email address policies, 340 generating, 362–367 group metrics, 375 mailbox databases and, 412–413 MailTips support, 378, 381–382 mixed environment, 360–361 Outlook and, 359–362 user-maintained groups, 288 OABGeneratorAssistant, 363–365 OABGeneratorWorkCycle property, 363 OABGeneratorWorkCycleCheckPoint property, 363 Oab.xml file, 361 object versions, 69–70 ObjectModified property, 752 OffCAT (Office Configuration Analyzer Tool), 37 Office 365 about, 349 archive and, 649 influence of cloud service, 9 Managed Availability, 469 motivation for upgrading, 12 public folder mailboxes, 773 site mailboxes and, 800 Office Configuration Analyzer Tool (OffCAT), 37 Office property, 351–352 Offline Address Book (OAB) about, 357–358 address book policies, 349, 354–355 contents of, 365–366 creating customized, 367–371 creating mailboxes, 366–367 default operation, 363–365 email address policies, 340 generating, 362–367 group metrics, 375 mailbox databases and, 412–413 MailTips support, 378, 381–382 mixed environment, 360–361 Outlook and, 359–362 user-maintained groups, 288 offline defragmentation, 448 OLD defragmentation, 435 OnComplete event, 206 online defragmentation, 435, 448 online repair cmdlets, 445–448 OOF (out-of-office) notices, 371, 374, 377–378, 749 OPATH filters, 110, 346 OPATH queries, 268, 270, 300–302 Operational channel, 503 operational processes, testing, 29–30 OR operator, 705 organization mailboxes, 362 Organization Management role group about, 75, 134–135, 151 administrator searches and, 322 delegating roles, 140, 163 EAC and, 174–175 managing DAG properties, 504 public folders, 774 RBAC Address Lists role, 346 remote Windows PowerShell, 87 role assignments, 152, 160 security groups, 284 special roles, 159–160 organizational forms library, 786–787 organizational units (OUs) hierarchical address books, 372 mail-enabled accounts, 75–76 mail-enabled objects, 34 security groups and, 73 setting role scopes, 157 –OrganizationalUnit cmdlet parameter, 193, 307 OrganizerInfo property, 258 OST files, 585, 627 OUs (organizational units) hierarchical address books, 372 mail-enabled accounts, 75–76 mail-enabled objects, 34 security groups and, 73 setting role scopes, 157 Out-HTML cmdlet, 127 out-of-office (OOF) notices, 371, 374, 377–378, 749 Out-String cmdlet, 100 Outlook archive mailboxes, 649 delivery reports, 321 expired items and, 673 group membership and, 281–282 MailTips and, 378–379 maintaining rules, 319 managing groups, 269–270 MFCMAPI utility and, 38–40 828 Outlook Web App (OWA) moderated groups, 283 Offline Address Book and, 359–362 retention policies, 684–686 retention tags, 666–667, 676–677 room list groups, 299 site mailboxes and, 792, 799–800 troubleshooting, 443 upgrading versions, 11, 13, 16 Outlook Web App (OWA) about, 11 accessing personal tags, 662–663 address book policies, 356 archive mailboxes, 649 delegating access, 239–240 delivery reports, 321–322 EAC and, 177 expired items and, 673 group membership and, 281 language support, 196–200 MailTips settings, 377 MailTips support, 378–379 maintaining rules, 319 managing groups, 276, 287 opening another user's mailbox, 237 Options section, 154–156, 269, 276, 287, 331 Organize Email section, 321 People section, 348 retention policies, 684–686 retention tags, 666–667, 676 room list groups, 299 security groups, 284 Windows PowerShell and, 84 –OverrideContentMailbox cmdlet parameter, 784–785 OWA (Outlook Web App) about, 11 accessing personal tags, 662–663 address book policies, 356 archive mailboxes, 649 delegating access, 239–240 delivery reports, 321–322 EAC and, 177 expired items and, 673 group membership and, 281 language support, 196–200 MailTips support, 377–379 maintaining rules, 319 managing groups, 276, 287, 350 opening another user's mailbox, 237 Options section, 154–156, 269, 276, 287, 331 Organize Email section, 321 People section, 348 retention policies, 684–686 retention tags, 666–667, 676 room list groups, 299 security groups, 284 Windows PowerShell and, 84 ownership of groups, 271, 275–277, 350 P page zeroing, 433, 436 PagePreRead metric, 453 PageRead metric, 453 PAM (Primary Active Manager) role, 466–467 parameters. See also specific cmdlet parameters named, 97 positional, 97, 105 Partial Attribute Set (PAS), 35 PAS (Partial Attribute Set), 35 passive database copies, 460, 544 –Password cmdlet parameter, 192 passwords, mailbox, 190–191 Patches system registry setting, 69 Performance Monitor, 435, 449, 517, 520 –Permanent cmdlet parameter, 220 PermanentlyDelete action, 672 permissions discovery mailboxes, 226 EAC, 143–144, 233–234 mailbox import and export, 624–626 preparing Active Directory, 48 public folders, 775 revoking, 232 roles and, 139 setting for mailboxes, 229–240 split permissions model, 166–167 testing operational processes, 29–30 personal archive. See archive mailboxes personal tags about, 658, 660 accessing through OWA, 682 applying to items, 685–686 creating, 671–672 naming, 666–668 pipelines, 101–102, 109, 678 PKI (public key infrastructure), 315 planning import of PST data, 626–629 mailbox moves, 614–619 policies. See also retention policies address book, 348–357 EAC, 313 email address, 333–345 execution, 118–119 group naming, 287, 289–295 mailbox creation, 190–191 MRS, 579 processing meeting requests, 261–265 removing tags from, 687–688 Resource Booking Attendant and, 256–261 role assignment, 133–134, 153–155, 163–166 sharing, 313 site mailboxes, 803–804 user-maintained groups, 289–295 portability, database, 459–464 positional parameters, 97, 105 PowerShell. See Windows PowerShell PR_ARCHIVE_DATE property, 693 PR_ARCHIVE_PERIOD property, 693 PR_ARCHIVE_TAG property, 693 pre-staging Cluster Name Object, 497–499 precoded filters, 310 preparing for Exchange Server about, 26–27 Active Directory, 47–48 installation considerations, 63–73 namespace planning, 77–81 test plans, 28–29 testing for operational processes, 29–30 testing for programming and customizations, 30–31 transport considerations, 27–28 updating versions, 31–32 –PreserveMailboxSizeLimit cmdlet parameter, 606 preserving information about, 696–698 creating searches, 708–716 examining search results, 720–724 Exchange searches, 733–736 groups with searches, 728–730 in-place holds, 703–708 putting mailboxes on litigation hold, 699–701 putting mailboxes on retention hold, 698–699 removing searches, 730–731 resource throttling for searches, 724–726 retrieving discovered content, 716–720 search syntax, 736–737 searching mailbox content, 701–703 PreviewResultsLink property, 714 Primary Active Manager (PAM) role, 466–467 PrimarySMTPAddress property, 185 priorities assigning for moves, 607 development, 2–5 email policy, 334–336, 340 privacy challenges of, 4–5 complying with laws, 208 ProcessExternalMeetingMessages property, 262, 264 Products system registry setting, 69 $Profile variable, 120 profiles, 119–120 ProhibitSendQuota property, 115, 214 ProhibitSendReceiveQuota property, 214, 771, 803 properties. See specific properties protected distribution groups, 278–281 protocols and required certificates, 314 $pwd variable ProvisionedFolder corruption type, 446 provisioning mailboxes, 607 servers, 63 site mailboxes, 803–804 ProxyAddresses property, 385 PR_POLICY_TAG property, 693 PR_RETENTION_DATE property, 692 PR_RETENTION_FLAGS property, 693 PR_RETENTION_PERIOD property, 692 PR_ROAMING_XMLSTREAM property, 691 PR_START_DATE_ETC property, 692, 694 PST Capture Tool, 628 PST files about, 201 archive mailboxes and, 644–647 importing data directly into archives, 635 legitimate movement, 443 mailbox import and export, 623–624, 629–637 planning import, 626–629 public folder mailboxes about, 766 calculating size, 772–773 controlling the root, 774–776 creating, 767–770 mobile access, 786 naming conventions, 768 number needed, 770–772 redirecting content, 785–786 writeable hierarchy, 770 Public Folder Management role group, 75, 135, 774 public folders about, 765–766, 804 accessing, 778 content indexing and, 776 creating, 776–779 creating mailboxes, 767–770 hierarchy in, 766–767 importing-exporting data in, 624 mail-enabling, 779–783 modern, 20–21, 420–421, 787–790 moving, 783–785 naming conventions, 179 new concepts, 766–767 organizational forms library, 786 permissions, 775 removing, 786 transaction logs and, 420–421 Public Folders container, 345 public groups, 270 public key infrastructure (PKI), 315 PublicFolderMigrationComplete flag, 790 PublicFolderToMailboxMapGenerator.ps1 script, 789 Purges folder, 746 $pwd variable, 101 829 830 QBDG suffix Q QBDG suffix, 179 quarantined mailboxes, 439–441 queries OPATH, 268, 270, 300–302 validating results, 305–306 queue lengths, 481, 517, 529 queues, MRS, 576 quorums dynamic, 494 FSW role and, 499 QuotaNotificationSchedule property, 215 quotas accommodating imported data, 626 dealing with I/O, 396 ensuring sufficiency of, 606 Recoverable Items, 746–747 setting, 213–218 site mailboxes, 803 sizing mailboxes, 391–392 quotation marks ("), 102–103 R RBAC Address Lists role, 346 RBAC Discovery Management role group, 704 RBAC (role-based access control) about, 85, 131–136 Active Directory, 35 execution policies and, 118 figuring out, 167–168 mailbox import and export, 624–626 remote Windows PowerShell, 86–92 role assignment, 133–134, 152–166 role entries and, 134 role groups and, 133, 139–141 role scope and, 134, 141–143, 409 roles and, 133, 136–139 security groups, 284 split permissions model, 166–167 testing for operational processes, 29–30 universal security groups, 73 working with, 143–152 RCA (Remote Connectivity Analyzer), 37 read-status tracking, 324 rebalancing database copies, 534–536 rebuilding databases, 448–451 Recall Message feature, 241–243 Recipient Management role group about, 75 administrator searches and, 322 creating security groups, 284 linking to tasks, 135 remote PowerShell and, 91 Recipient Policies role, 148 Recipient read scope, 141 Recipient write scope, 142 –RecipientContainer cmdlet parameter, 307–308 RecipientContainer property, 301 –RecipientFilter cmdlet parameter, 309–311, 347 RecipientFilter property, 301 –RecipientOrganizationalUnitScope cmdlet parameter, 157 –RecipientPathFilter cmdlet parameter, 328 recipients about, 180 filtering, 180–181, 306, 334, 338, 341–342 hidden, 357–358 moderated, 243–250 Recipients property, 713 RecipientType property, 284 RecipientTypeDetails property, 228, 284, 802 reconnecting mailboxes, 220–223 Records Management role group, 75, 136, 322 Recoverable Items structure about, 737 asynchronous moving, 571 function of, 737–739 improvements, 739–742 managing quotas for, 746–747 retention periods and, 671 single-item recovery, 743–745 viewing items in, 745–746 RecoverableItemsQuota setting, 757 recovering failed servers, 61–63 recovering messages, 643 –Recurse cmdlet parameter, 769 recycling hardware, 23 Redirect-Message cmdlet, 564 redirecting content to public folder mailboxes, 785–786 RedistributeActiveDatabases.ps1 script, 535–536 redundancy, database, 411, 522 registry, system. See system registry regulatory compliance. See compliance management released to manufacturer (RTM), 13–14 relocating databases, 480, 536, 539–542, 544–546 Remote Connectivity Analyzer (RCA), 37 remote management, 492 remote procedure call (RPC) avoiding access errors, 492 delivering messages, 28 MAPI, 8, 506 retrieving mailbox information, 128 remote Windows PowerShell about, 86–88 connecting to, 88–91 limiting user functionality, 91–92 RemoteExchange.ps1 script, 90, 119–120 RemoteSigned execution policy, 118 Remove-ADPermission cmdlet, 232 Remove-DatabaseAvailabilityGroupNetwork cmdlet, 509 Remove-DatabaseAvailabilityGroupServer cmdlet, 494, 548–549 Remove-DistributionGroup cmdlet, 297 Remove-Mailbox cmdlet, 155, 219–220, 223 Remove-Mailbox Permission cmdlet, 205 Remove-MailboxDatabase cmdlet, 418, 548 Remove-MailboxDatabaseCopy cmdlet, 544, 547 Remove-MailboxExportRequest cmdlet, 626 Remove-MailboxImportRequest cmdlet, 625, 635 Remove-MailboxSearch cmdlet, 730–731 Remove-ManagementRoleAssignment cmdlet, 165 Remove-MigrationBatch cmdlet, 594 Remove-MigrationUser cmdlet, 591 Remove-MoveRequest cmdlet about, 591 clearing move requests, 610 migration batches with EAC, 584–585, 605 removing databases, 418 suspending mailbox moves, 619 Remove-PublicFolder cmdlet, 786 Remove-PublicFolderMoveRequest cmdlet, 785 Remove-RetentionPolicy cmdlet, 688 Remove-RetentionPolicyTag cmdlet, 671–672 Remove-RoleGroup cmdlet, 152 Remove-RoleGroupMember cmdlet, 150 Remove-StoreMailbox cmdlet, 219–220 RemovePrivateProperty property, 258 removing database copies, 546–548 databases, 416–418 mailboxes, 218–220, 223 migration batches, 584 move requests from migration batches, 591 public folders, 786 retention policies, 688 searches, 730–731 servers, 548–549 tags from policies, 687–688 renaming databases, 414–415 repair cmdlets, 445–448 repairing Exchange Server, 61 Replace log record type, 425 replay, transaction log. See transaction log replay ReplayLagManagerNumAvailableCopies system registry setting, 531 ReplayLagPlayDownPercentDiskFreeSpace system registry setting, 531 ReplayLagStatus property, 522 ReplayLagTime property, 527–528 ReplayQueueLength property, 521 replication block mode, 484–486 database, 390, 411, 459 public folders and, 767 retention hold (mailboxes) 831 queue lengths, 481, 517 transaction log replay and, 479–489 Replication service (MSExchangeRepl) Active Manager and, 465–479 handling storage failures, 549–550 MRS versus, 465, 567 verifying transaction logs, 482 ReplicationPort property, 505 reporting licenses, 70–73 reporting mailbox moves about, 595–596 accessing move report histories, 599–604 getting more information about moves, 597–598 troubleshooting, 599 reports delivery, 320–329 HTML, 127–128 representational state transfer (REST), 792 REQ file, 317 RequestInPolicy property, 262–263 RequestOutofPolicy property, 262, 264 –RequireSenderAuthenticationEnabled cmdlet parameter, 280 Reread Logon Quotas interval registry setting, 217, 235 reseeding database copies, 523–525 reserved logs, 408, 431–432 Reset Password role, 137 –ResetPasswordOnNextLogon cmdlet parameter, 192 resilience equation, 558–559 Resource Booking Assistant, 454 Resource Booking Attendant, 256–262, 265, 299 resource forest design, 46 resource mailboxes about, 188, 254–255 creating, 195 defining custom properties, 255–256 naming conventions, 178–179 resource throttling for searches, 724–726 ResourceCapacity property, 255 ResourceCustom property, 255 resources provisioning management agent, 209–213 REST (representational state transfer), 792 Restore-MailboxExportRequest cmdlet, 576 Restricted execution policy, 118 –ResultSize cmdlet parameter, 109–111, 328 Resume-ClusterNode cmdlet, 565 Resume-MailboxDatabaseCopy cmdlet, 529, 546 Resume-MailboxExportRequest cmdlet, 626 Resume-MailboxImportRequest cmdlet, 625 Resume-MoveRequest cmdlet, 605, 608, 617 Resume-PublicFolderMigrationRequest cmdlet, 790 Resume-PublicFolderMoveRequest cmdlet, 784 resynchronization after moving mailboxes, 587 incremental, 487–488 832 retention hold (mailboxes) retention date calculation, 693–696 retention hold (mailboxes), 19, 697–699 retention policies applying to mailboxes, 677–681 compliance management and, 644, 646 creating, 663, 673–677 customizing for specifc mailboxes, 681–683 designing, 663–665 Managed Folder Assistant and, 653, 655, 665–666, 689–696 managing in hybrid environment, 681 modifying, 681 removing, 688 setting on folders, 685–687 user interaction with, 684–685 retention policy tags (RPT), 658–659, 666 retention tags changing, 688 creating, 668–673 disabling, 687 managing in hybrid environment, 681 MRM and, 657 naming, 666–668 removing from policies, 687–688 troubleshooting, 671 types of, 657–662 RetentionAction property, 670 RetentionComment property, 680, 700 –RetentionEnabled cmdlet parameter, 672 RetentionEnabled property, 666 RetentionURL property, 678, 680, 700 RetryDelay property, 623 revoking permissions, 232 Rich Text Format (RTF), 397–398 Richard, Pat, 124 role assignment policies, 133–134, 153–155, 163–166 role assignments about, 133, 152–163 controlling, 153 default, 141 delegated, 160 role-based access control (RBAC) about, 85, 131–136 Active Directory, 35 execution policies and, 118 figuring out, 167–168 mailbox import and export, 624–626 remote Windows PowerShell, 86–92 role assignment, 133–134, 152–166 role entries and, 134 role groups and, 133, 139–141 role scope and, 134, 141–143, 409 roles and, 133, 136–139 security groups, 284 split permissions model, 166–167 testing for operational processes, 29–30 universal security groups, 73 working with, 143–152 role entries, 134 role groups. See also specific role groups about, 133 adding roles to, 147–149 creating, 145–149 default, 141 identifying membership, 162–163 linking to tasks, 135–136 maintaining membership, 149–150 managing, 151–152 specific scopes for, 157–158 universal security groups and, 139–141 role scope, 134, 141–143, 157–158, 409 roles about, 133, 136–139 adding to role groups, 147–149 cmdlets and, 139 creating for specific tasks, 155–157 delegating, 140, 163, 625 EAC and, 175 end-user, 164–165 scopes and, 141–143 unscoped, 160–162 –Room cmdlet parameter, 195 room lists, 270, 298–299, 349 room mailboxes about, 188, 254–255 creating, 195 defining custom properties, 255–256 naming conventions, 178–179 viewing delegates, 263 –RoomList cmdlet parameter, 298 ROPCount metric, 453 RPC (remote procedure call) avoiding access errors, 492 delivering messages, 28 MAPI, 8, 506 retrieving mailbox information, 128 RPT (retention policy tags), 658–659, 666 RTF (Rich Text Format), 397–398 RTM (released to manufacturer), 13–14 rule processing, 318–320, 492 S S/MIME (Secure Multipurpose Internet Mail Extensions), 734 %s variable, 339 Safety Net, 459, 503, 531–532 SAM (Standby Active Manager), 190 SAM (Standby Active Manager) role, 466 SAN (storage area networks), 557 Sarbanes–Oxley Act, 641 SCC (single copy cluster), 29 schedules, maintenance, 434 Scheduling Assistant, 454 scheduling mailbox moves, 617 scheduling threads, 550 Schema Administrators group, 48 schemas Active Directory information, 35–36 database, 398–400 preparing, 47–48 SCOM (System Center Operations Manager), 442–443, 470, 520 SCR (standby continuous replication), 29 scripting agent, 205 ScriptingAgentConfig.xml file, 205–206 scripts. See also specific scripts calling, 117 cmdlets in, 93, 117 conditional checking, 103 initialization, 90, 100 outputting CSV files, 125–127 pipelines and, 101–102 writing, 93 Search-ADAccount cmdlet, 122 Search-AdminAuditLog cmdlet, 751–752 Search Foundation, 578, 701, 733–735 Search-Mailbox cmdlet, 703, 731 Search-MailboxAuditLog cmdlet, 755, 759 Search-MessageTrackingReport cmdlet, 326–328 –SearchDumpster cmdlet parameter, 731 SearchDumpster property, 713 searches concurrent, 733 creating, 708–716 for delivery reports, 321–329 eDiscovery, 224–225, 233, 702, 726 examining results, 720–724 Exchange support, 733–736 executing, 731–732 groups with, 728–730 mailbox content, 701–703 memory limitations and, 726 refining, 712–716 removing, 730–731 resource throttling for, 724–726 Search Foundation processes, 578 syntax for, 736–737 SearchFolder corruption type, 446 –SearchQuery cmdlet parameter, 731 SearchQuery property, 713 secondary indexes (views), 393, 395, 437, 578 Secure Multipurpose Internet Mail Extensions (S/MIME), 734 Secure Sockets Layer (SSL), 30, 77, 313–314 security. See also permissions administrators and, 319–320 challenges of, 4–5 cmdlets and, 89 Set-DatabaseAvailabilityGroupNetwork cmdlet installation and, 73–77 mailboxes and, 184 PST files and, 646 self-signed certificates, 78 security groups about, 284–285 mail users and, 252 security support provider (SSP), 506 seeding databases, 489 Select-Object cmdlet, 98, 282 self-maintained lagging, 530–532 self-signed certificates, 77–78, 314, 317 Send As permission, 229–231, 275 Send-NewUserWelcome.ps1 script, 194 Send On Behalf Of permission, 229–231, 241, 275 SendAs action, 756 Senders property, 713 SendOnBehalf action, 756 Sent Items folder, 393, 658 separate rules functionality, 318 –Server cmdlet parameter, 86, 207 Server Management role group, 75, 135 server message block (SMB), 500 server-side filters, 110–113 server-side rules, 318 server switchovers, 536–539 ServerManager PowerShell module, 52 ServerManagerCmd cmdlet, 52 ServerManagerCmd PowerShell module, 52 servers edge, 48 maintaining, 562–565 mounted databases, 463 provisioning, 63 recovering failed, 61–63 removing, 548–549 stressed, 565–566 virtual, 24–25 witness, 490–491 Service (Exchange Online), 5–9 service level agreement (SLA), 9 service packs (SPs), 64 Set-AdminAuditLogConfig cmdlet, 748–749 Set-ADServerSettings cmdlet, 59, 122, 364 Set-AuthenticodeSignature cmdlet, 118 Set-CalendarProcessing cmdlet, 202, 204, 260–261, 264 Set-CASMailbox cmdlet, 84 Set-Contact cmdlet, 98, 381 Set-DatabaseAvailabilityGroup cmdlet adding IP addresses, 493 DAC and, 552 editing properties, 492, 505–506 exerting manual control over networks, 509 lag copy self-maintenance, 531 Set-DatabaseAvailabilityGroupNetwork cmdlet, 509 833 834 Set-DistributionGroup cmdlet Set-DistributionGroup cmdlet group expansion, 277–278 mail-enabled groups, 285 mailbox delegation permissions, 232 management lists for groups, 276 marking existing groups, 298 moderated groups, 245, 248–249 multilingual custom MailTips, 381 protected groups, 278–279 users maintaining groups, 294 Set-DynamicDistributionGroup cmdlet, 246, 301, 306, 313 Set-EmailAddressPolicy cmdlet, 335, 343 Set-EventLogLevel cmdlet, 331 Set-ExchangeServer cmdlet, 71, 411 Set-ExecutionPolicy cmdlet, 118–119 Set-Group cmdlet, 98, 372–373 Set-InboxRule cmdlet, 320 Set-Mailbox cmdlet about, 84, 192, 194 address book policies, 351–352, 355 applying retention policies, 678 assigning quota values, 216 bulk updates, 115 custom MailTips, 380 defining custom properties, 256 EAC and, 175 email address policies, 333 limiting user functionality, 91–92 mailbox delegation, 231–232 managing archive properties, 651 multilingual custom MailTips, 381 OAB generation mailboxes, 367 putting mailboxes on litigation hold, 699–701 putting mailboxes on retention hold, 698–699 RBAC and, 137 read tracking, 325 remote PowerShell and, 91 removing retention policies, 680 role assignment policies, 164–165 setting language, 196–197 shared mailboxes, 241 Set-MailboxAuditByPassAssociation cmdlet, 758 Set-MailboxAutoReplyConfiguration cmdlet, 202–203 Set-MailboxCalendarConfiguration cmdlet, 202–204, 206, 261 Set-MailboxCalendarSettings cmdlet, 261 Set-MailboxDatabase cmdlet activation performance numbers, 535 backup settings, 416 controlling checksum scans, 433 handling move request errors, 609 maintenance settings, 434 OAB assignments, 370 provisioning settings, 211 reconnecting mailboxes, 220–221 renaming databases, 414 setting values, 620 Set-MailboxDatabaseCopy cmdlet, 159, 525, 527, 531 Set-MailboxExportRequest cmdlet, 625, 637 Set-MailboxFolderPermission cmdlet, 239 Set-MailboxImportRequest cmdlet, 625 Set-MailboxJunkEMailConfiguration cmdlet, 202, 204–205 Set-MailboxMessageConfiguration cmdlet, 202, 204 Set-MailboxRegionalConfiguration cmdlet, 199, 202–203, 206 Set-MailboxSearch cmdlet, 730–731 Set-MailboxServer cmdlet activation blocks, 542–544 building DAGs, 561 database activation restrictions, 565 maximum number of databases, 402 OAB updates, 364 server switchovers, 538–539 work cycle information, 455 Set-MailboxSpellingConfiguration cmdlet, 202 Set-MailContact cmdlet, 251 Set-MailPublicFolder cmdlet, 381 Set-MailUser cmdlet, 253 Set-ManagementRoleAssignment cmdlet, 158 Set-MigrationBatch cmdlet, 594, 639 Set-MigrationEndpoint cmdlet, 614 Set-MoveRequest cmdlet, 608, 610–611 Set-Notification cmdlet, 639 Set-OfflineAddressBook cmdlet, 366, 370 Set-OrganizationConfig cmdlet configuring MailTips, 377–378 creating site mailboxes, 802 group creation settings, 288, 292 hierarchical address books, 372 locking down public files, 790 read-status tracking setting, 324 Set-OrganizationConfig command, 790 Set-OutlookAnywhere cmdlet, 79 Set-PublicFolder cmdlet, 784, 786 Set-ReceiveConnector cmdlet, 92 Set-ResourceConfig cmdlet, 255–256 Set-RetentionPolicyTag cmdlet, 671, 681–682, 688 Set-RoleAssignmentPolicy cmdlet, 165 Set-RoleGroup cmdlet, 151, 158 Set-ServerComponentState cmdlet, 563–566 Set-SiteMailbox cmdlet, 803 Set-SiteMailboxProvisioningPolicy cmdlet, 804 Set-ThrottlingPolicy cmdlet, 725 Set-TransportConfig cmdlet, 531, 627 Set-User cmdlet about, 98 address book policies and, 351–352 hierarchical address books, 373 remote PowerShell and, 88 updating mailbox properties, 194 Set-WebServicesVirtualDirectory cmdlet, 613 Set-WorkloadPolicy cmdlet, 580 Setup command about, 49–51 /ActiveDirectorySplitPermissionsparameter, 167 /ADToolsNeeded switch, 52 delegated setup, 63 /IAcceptExchangeServerLicenseTerms parameter, 49 /PrepareAD parameter, 52, 167 /PrepareSchema parameter, 52 recovering failed servers, 62 running, 53–56 split permissions model, 167 uninstalling Exchange Server, 58 Windows PowerShell and, 84 setup logs, 56–57 shared mailboxes, 188, 240–241 SharePoint integration with, 3, 18 site mailboxes and, 791–792 SQL support, 389 synchronization with Exchange and, 795–799 sharing policies, 313 Shift+Delete key combination, 738 Shift+Tab key combination, 97 –ShowDetails cmdlet parameter, 760 Simple Mail Transfer Protocol (SMTP) certificate management, 313 email address policies, 343–344 message routing and, 35 selective output example, 100 site mailboxes and, 794 single copy cluster (SCC), 29 single forest design, 45 single-instance storage, 393 single-item recovery, 743–745 SinglePageRestore property, 521 site mailboxes about, 18, 791–795, 804 accessing information from Outlook, 799–800 importing-exporting data in, 624 life cycle of, 800–803 Office 365 and, 800 opening maximum number of, 800 provisioning policy, 803–804 sizing, 803 sizing databases, 389–392 mailboxes, 391–394 public folder mailboxes, 772–773 site mailboxes, 803 transaction logs, 420 –SkipActiveCopyChecks cmdlet parameter, 541 –SkipClientExperienceChecks cmdlet parameter, 540 –SkipHealthChecks cmdlet parameter, 541 streaming backups –SkipLagChecks cmdlet parameter, 541 SLA (service level agreement), 9 SMB (server message block), 500 SMTP (Simple Mail Transfer Protocol) certificate management, 313 email address policies, 343–344 message routing and, 35 selective output example, 100 site mailboxes and, 794 SoftDelete action, 756, 759 SoftDeleted state, 581, 604 Sort-Object cmdlet, 92–93 Source property, 713 –SourceMailboxes cmdlet parameter, 731 SourceMailboxes property, 713 –SourceRootFolder cmdlet parameter, 636 split brain syndrome, 551 split permissions model, 166–167 Split-PublicFolderMailbox.ps1 script, 773 SPs (service packs), 64 SQL Server, 388–389 SSL (Secure Sockets Layer), 30, 77, 313–314 SSP (security support provider), 506 StalledDueToHA status, 481 Standard edition, 32–33, 407 Standby Active Manager (SAM), 190 Standby Active Manager (SAM) role, 466 standby continuous replication (SCR), 29 Start-MailboxSearch cmdlet, 702, 731 Start-ManagedFolderAssistant cmdlet, 678, 690 Start-MigrationBatch cmdlet, 593 Start-Transcript cmdlet, 114 StartDagServerMaintenance.ps1 script, 563 State or Province property, 305, 346, 351 statistics, database usage, 451–453 –Status cmdlet parameter, 99, 481, 493, 634 Status property, 520, 713–714 –StatusDetail cmdlet parameter, 579 –StatusMailRecipients cmdlet parameter, 731, 762 StatusRetrievedTime property, 521 Stop-MailboxSearch cmdlet, 702 StopDagServerMaintenance.ps1 script, 563 storage area networks (SAN), 557 storage management Active Directory, 35–36 DAG design, 557 eDiscovery searches, 225 handling storage failures, 549–551 setting mailbox quotas, 213–218 single-instance, 393 upgrading, 15–22 virtualized servers, 24–25 Store (Exchange Store). See Exchange Store –StoreMailboxIdentity cmdlet parameter, 220, 223 streaming backups, 29, 389 835 836 stressed servers stressed servers, 565–566 submission changes in messages, 489 Super Help Desk Users USG, 140 Support Diagnostics role, 160 Suspend-ClusterNode cmdlet, 564 –Suspend cmdlet parameter, 616, 618 Suspend-MailboxDatabaseCopy cmdlet, 529, 531, 545 Suspend-MailboxExportRequest cmdlet, 626 Suspend-MailboxImportRequest cmdlet, 625, 635 Suspend-MoveRequest cmdlet, 605 suspending mailbox moves, 615–619 –SuspendWhenReadyToComplete cmdlet parameter, 616–617 SuspendWhenReadyToComplete property, 606 swelling databases, 444–445 switchovers database copies, 466, 533–534 server, 536–539 targetless, 538 synchronization incremental, 575, 615 public folder hierarchy, 772 with SharePoint and Exchange Server, 795–799 site mailboxes, 791–792 syntax for searches, 736–737 System Attendant process, 363 System Center Operations Manager (SCOM), 442–443, 470, 520 system registry CrashCount entry, 438 execution policy, 119 LastCrashTime entry, 438 Patches entry, 69 Products entry, 69 ReplayLagManagerNumAvailableCopies entry, 531 ReplayLagPlayDownPercentDiskFreeSpace entry, 531 RereadLogonQuotasInterval entry, 217, 235 version numbers, 68 system resources, MRS and, 579–580 system tags, 662–663 SystemMailbox account, 76, 224, 363 T Tab key, 95–97 TAP (Technology Adoption Program), 14, 68 TargetArchiveDatabase property, 593 TargetDatabase property, 593 targetless switchovers, 538 –TargetMailbox cmdlet parameter, 713, 731 –TargetRootFolder cmdlet parameter, 636 task items, retention policies and, 677 task logging, 502 Tasks folder, 658 TCP (Transmission Control Protocol), 7–8, 479 Team Mailboxes role, 148 Technology Adoption Program (TAP), 14, 68 templates display, 382–386 OAB, 361 temporary log files, 430–431 Test-AssistantHealth cmdlet, 454–455 Test-MigrationServerAvailability cmdlet, 613 Test-Path cmdlet, 120 Test-ReplicationHealth cmdlet, 545 testing ACID tests, 419 cumulative updates, 67 customizations, 30–31 operational processes, 29–30 programming, 30–31 test plans, 28–29 virtual machines and, 25 Thawte certificate vendor, 314 threads, scheduling, 550 Threat Management Gateway (TMG), 16 throttle-based assistants, 454 throttling dynamic, 580 resource throttling for searches, 724–726 tickles (signals), 576 time formats, 199 time to live (TTL) settings, 462 time zone property, 261 TimeInCPU metric, 453 TimeInServer metric, 452–453 timestamps, 425 TLS (Transport Layer Security), 313 TMG (Threat Management Gateway), 16 tombstone maintenance, 437 TotalMailboxSize property, 597 tracking group usage, 285–286 transaction log replay about, 479–483 block mode replication, 484–486 incremental resynchronization, 487–488 seeding databases, 489 transaction log compression, 483–484 transaction log truncation, 486–487 transaction logs about, 388, 408, 419 block mode replication and, 484–486 checksums, 427 circular logging, 429–431 compressing, 483–484 database redundancy and, 411 debugging swelling databases, 445 excessive growth, 443–444 I/O operations, 427–429 log sets, 419–427 moving mailboxes, 578 replaying, 479–489 reserved logs, 431–432 sizing, 420 truncating, 486–487, 511 validating, 482 transcripts, 114 transient network conditions, 483 transitions, automatic database, 467–469 Transmission Control Protocol (TCP), 7–8, 479 Transport Dumpster, 459 Transport Layer Security (TLS), 313 Transport Queues role, 141 transport service, 27–28, 247–248 Troubleshoot-DatabaseLatency.ps1 script, 442 Troubleshoot-DatabaseSpace.ps1 script, 443 troubleshooting adding scopes, 158 archive mailboxes, 656 dark zone and, 60 delivery reports, 323 deployment, 56 exceeded message quotas, 128 excessive database or log growth, 443–444 high latency, 442 mailbox creation, 212 mailbox moves, 599 migration batch logs, 592 retention tags, 671 $True variable, 101 truncation, transaction log, 486–487, 511 TruncationLagTime property, 528 TTL (time to live) settings, 462 –Type cmdlet parameter, 671 U UAC (User Account Control), 54 UAnrdex.oab file, 360 UBrowse.oab file, 360 UCMA (Unified Communications Managed API), 53 UDetails.oab file, 360 UM Management role group, 75, 136 unattended installation, 54–55 UNC (Universal Naming Convention), 593 underscore (_), 26 Unicode format, 623 Unified Communications Managed API (UCMA), 53 Unified Messaging server role, 314 uninstalling Exchange Server, 58–60 Universal Naming Convention (UNC), 593 universal security groups (USGs), 73–77, 139–141, 267 Unrestricted execution policy, 118–119 Unscoped Role Management role, 160 unscoped roles, 160–162 –UnscopedTopLevel cmdlet parameter, 161 Unsearchable subfolder, 721 UTmplts.oab file Update action, 756 Update-EmailAddressPolicy cmdlet, 340, 343, 345 Update-MailboxDatabaseCopy cmdlet, 516, 524, 542 Update-OfflineAddressBook cmdlet, 354, 364–365 Update-PublicFolderMailbox cmdlet, 772 Update-RoleGroupMember cmdlet, 150 updates bulk, 114–116 cumulative, 14 incremental, 578 installation and, 27, 63–73 mailbox databases, 414–416 mailbox properties, 194, 652 OAB, 363–364 testing, 67 version, 31–32 waiting for, 13–15 UPdndex.oab file, 360 upgrading Exchange Server building business cases, 16 common scenarios, 11–12 evolving from earlier versions, 12–13 fundamental questions before, 15–17 Information Store improvements, 19–20 integration with Lync, 3, 18 integration with SharePoint, 3, 18 management interfaces, 21–22 modern public folders, 20–21 preparations for, 26–27, 63–73 waiting for updates, 13–15 upgrading from managed folders, 688–689 UPN property, 185 UPN (User Principal Name), 185 URdndex.oab file, 360 UseDatabaseQuotaDefaults property, 215, 772 User Account Control (UAC), 54 user accounts Active Directory, 49 administrators, 163 mail-enabled, 75–76 user-defined variables, 101–103 user mailboxes, 178, 187 user-maintained groups about, 286–287 creating group naming policy, 287, 289–295 defining default group location, 288–289 planning, 287–288 restricting users, 295–297 room lists, 298–299 User Options role, 145–146 User Principal Name (UPN), 185 –UserPrincipalName cmdlet parameter, 192 Users OU, 75, 228, 288 USGs (universal security groups), 73–77, 139–141, 267 UTmplts.oab file, 360 837 838validating V validating checksums, 427 query results, 305–306 transaction logs, 482 variables common and user-defined, 101–103 email address policies, 339 –Verbose cmdlet parameter, 114 verbose PowerShell, 129 VeriSign certificate vendor, 118, 314 versions and version numbers about, 67–69 DAG servers, 494–495 evolving from earlier, 12–13 groups and, 268 installation and, 63 object, 69–70 selecting for deployment, 22–23 updating, 31–32 Versions folder, 746 View-Only Organization Management role group, 75, 135, 323 View-Only Recipients role, 146 –ViewEntireForest cmdlet parameter, 122, 364 viewing group members, 268–269, 281–283 views (secondary indexes), 393, 395, 437, 578 VIPs (virtual IPs), 558 virtual IPs (VIPs), 558 virtual servers, 24–25 virtualization, 24–25 VMware, 24–25 voice mail, default tag, 661 Volume Shadow Copy Services (VSS) backup considerations, 458 restoring databases, 390 streaming backups, 29, 389 VSS (Volume Shadow Copy Services) backup considerations, 458 restoring databases, 390 streaming backups, 29, 389 W watermarks, 55–56 Watson dumps, 551 WCF (Windows Communications Foundation), 568 WebDAV API, 16, 30 Where-Object cmdlet, 92–93, 107 white space in databases, 444, 449–450, 597 wildcard characters, 94, 110, 138, 737 Windows CA (Windows Certificate Services), 314–315 Windows Certificate Services (Windows CA), 314–315 Windows Communications Foundation (WCF), 568 Windows Failover Clustering, 463–464, 492, 495–496, 553 Windows PowerShell. See also cmdlets about, 83–86 Active Directory for, 120–123 automation and, 170 command editing, 95–97 deployment overview, 50–53 development priorities, 4 execution policies, 118–119 hyphens and, 103 influence of cloud service, 6 installing, 44 Integrated Scripting Environment, 103–105 memory limits, 111 profiles, 119–120 quotation marks and, 102–103 remote, 86–92 ServerManager module, 52 ServerManagerCmd module, 52 starting sessions, 53 testing programming and customizations, 30 verbose output, 129 Windows Server Backup, 389 Windows Server Manager, 51 Windows Unified Communications Managed API, 44 Windows User Account Control (UAC), 54 witness servers, 490–491 WitnessDirectory property, 505 WitnessServer property, 505 worker processes health mailboxes, 226–227 Managed Availability, 402–407, 469–472, 522, 536 WorkerProcessId property, 402, 521 working directory, 117 Workload Management, 579 Write-AdminAuditLog cmdlet, 750 write smoothing, 395 writing scripts, 93 X X.400 standard, 343–344 X.509 certificates, 26, 313 %xg variable, 339 XML configuration files, 51–52, 205–206 %xs variable, 339 XSO API, 568 Z zeroing, page, 433, 436
* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project
Related manuals
Download PDF
advertisement