Backup Exchange 2007

What should you Backup:



1) Your Mail and public folder database - in an exchange-aware fashion.

2)System state(and/or havve multiple domain controllers).

3)Data under program Files\Microsoft\Exchange Server\

Exclude the storage Group folders under the mailbox directory.



Local continuous Replication:



LCR create a passive copy of the active database.

Configure LCR to create the databse copy on another drive.

Public folder store cannot be replicated with this method.

LCR will increase your processor overhead due to log/database activity.



Standby Cluster Replication Basics:



Like LCR,but the passive database exist on a remote Exchange 2007 mailbox server.

If original mailbox store goes offline, a passive copy can be made active.



Clustered Continuous Replication (CCR):

Anti Virus on Exchange 2007

Exchange 2007 Anti Virus:



a)Puremessage from Sophos

b)Scan mail suit from Trend Micro

c)Mail security from GFI

d)F-secure Anit virus for Exchange 7 from F-secure.

e)Symantec mail security from Symantec.

f)Kaspersky Antivirus from Kaspersky Lab.

g)Group shield from Mcafee

h)Microsoft Forefront(the rebranded sybari Antigen)

Edge Ani-Spam

Installing Anti-Spam filters on the Hub transport:







EMS -> type-> cd 'Program Files'



c:\program Files> cd Microsoft



c:\program Files\microsoft\cd 'Exchange Server'



c:\program Files\Microsoft\Exchange Server\Scripts



c:\program Files\Microsoft\Exchange Server\scripts\>.\install-AntispamAgents.ps1

then

Restart Transport Service.

EMS->restart-service msexchangetransport

If you are using Edge uninstall anti spam filter from Hub transport Server using following command

EMS->uninstall-antispamAgents.ps1 this will uninstall anti spam from hub transport.After that restart msexchange transport using the following command.Ems->restart-service msexchangetransport

configureing IP block list provider:

like DNSBL.SORBS.NET -You can configure custom error message like this if you want"Your IP address has been blocked because it was listed in the SORBS RBL as a open relay or known spaming server.If your server was listed in error,you can attempt to have your IP removed from the SORBS database by going to their website ".

You can add more IP block list proiders if you want.

To create an SPF record:

http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/

(go through the trainsignal 19 vedio)

To check your IP http://www.whatismyip.com/

Configuring Content Filtering:

SCL rating go from 0 to 9 ...9 is most likely to be spam.

Use the Get-TransportAgent cmdlet to view the configuration of a transport agent on a computer that has the Edge Transport server role or the Hub Transport server role installed in a Microsoft Exchange Server 2007 organization.

Using the address Rewrite Agent:This feature allows Exchange Administrators to centrally rewrite outgoing SMTP addresses. Exchange Server Address Rewrite is available as an additional tool for Exchange Server 2003 which can be downloaded for free at the Microsoft website. In Exchange Server 2007, Address rewrite is natively integrated into the core messaging system in the form of Exchange Management Shell CMD'lets.

http://www.msexchange.org/articles_tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007/2003-address-rewrite-feature.html

Eg:EMS->Get-transportagent -check this option is available or not.

EMS->New-addressRewriteEntry -name "Eustocktrader" -internaladdress orders@cashkocapitalgroup.com -externaladdress orders@eustocktradersnetwork.com

EMS->Get-addressRewriteEntry -Display all address rewrite entry

What is SafeList Aggregation in Exchange 2007 or How to help you administer Safe senders list in Exchange 2007 to fight false-positives?

safelist aggregation refers to a set of anti-spam functionality that is shared across Microsoft Office Outlook and Exchange" - Microsoft
So let's see what this functionality really is. Presume your Exchange architecture is using Hub Transport and no Edge Transport Exchange server role. You enabled Anti-spam functionality on your Hub Transport server and you created quarantine mailbox for collecting spam mails.To help you reduce instances of false-positives you can enable the SafeList Aggregation which uses Outlook's Safe senders and safe recipients, Safe Domain and External Contacts collections for Exchange's ALLOWED senders list.
First, you need to send this data to Active Directory from where it can be read by Anti-spam agent on Exchange 2007 Hub or Edge Transport Exchange role.This can be done by running the Exchange Management Shell cmdlet Update-SafeList on a user's mailbox.
Syntax: Update-SafeList -Identity
Let's say you want to use Safe Senders collection from Dusan Kosaric's mailbox. You would use the following syntax:
Update-SafeList -Identity "Dusan Kosaric"
If you wan to update Safe List from every mailbox in organization on regular basis you can create scheduled task. First create the SafeList.bat file with following entries:
"C:\Program Files\Microsoft Command Shell\v1.0\Powershell.exe" -psconsolefile"C:\Program Files\Microsoft\Exchange Server\bin\exshell.psc1" -command
"get-mailbox where {$_.RecipientType -eq [Microsoft.Exchange.Data.Directory.Recipient.RecipientType]::UserMailbox } update-safelist"
After you create SafeList.bat file, run this command in Exchange Management Shell:
at 01:00 /every:M,T,W,Th,F,S,Su cmd /c "X:\SafeList.bat"
If your organization is not a large one and you are not dealing with A LOT of spam, you can use SafeList Aggregation only from Quarantine mailbox. You can open your quarantine mailbox in Outlook 2003 or 2007 and search through mails to find false-positives. Add senders to the Outlook Safe Senders list under Actions -> Junk e-mail -> Junk e-mail options -> Safe Senders in Outlook and than run Update-SafeList cmdlet in Exchange Management Shell.

http://www.exchangelog.info/2007/04/what-is-safelist-aggregation-in.html

Client Access server(outlook Anywhere)

Outlook Anywhere configuration:

1) Install Rpc over Http proxy.
2)enable outlook anywhere via EMC.
go to cmd-> iisreset /noforce ----Reset IIS.

3)After configuring outlook anywhere on client system.you can test the outlook anywhere using

Run -> outlook.exe /rpcdiag

Autodiscover in Exchange 2007(issue certificate etc)

Implementing Autodiscover:

Obtain the SSl:

Working with the subject alternative name cert(SAN):

A SAN cet can provide SSL encription for several FQDNs

http://www.digicert.com

Eg:3cgmail07
3cgmail07.local
cowmail.cashkocapitalgroup.com
autodiscover.cashkocapitalgroup.com (create a host record in ISP DNS called autodiscover map to same ip)


How to install your certificate in Exchange 2007
1) Login to your DigiCert account and download the CertificateBundle.p7b file.
Using the certificate bundle file saves you time by installing the intermediate certificate at the same time.
2) Copy your CertificateBundle.p7b file to C:\ on your Exchange server.
3) Open the Exchange Management Shell.
Click Start, click Programs, and then click Microsoft Exchange Server 2007. Then click Exchange Management Shell.
4) Install and enable your certificate with the Import-ExchangeCertificate and Enable-ExchangeCertificate cmdlets.

Import-ExchangeCertificate -Path C:\CertificateBundle.p7b

then

Get-ExchangeCertificate -to get the thumprint

then

Enable-ExchangeCertificate - thumbprint****** - Services "POP, IMAP, IIS, SMTP"

yes to All


*************************************************************

The Services option can be any combination of these values: IMAP, POP, UM, IIS, SMTP. To disable a certificate, set the Services parameter to 'None'.
For further reading about the Exchange commands, visit Microsoft's Exchange Server TechCenter.http://technet.microsoft.com/en-us/library/aa997231.aspx


5) Test your certificate by connecting to your server with IE, ActiveSync, or Outlook.

Note:

Outlook 2007 license are not included in exchange 2007.

Recipient in Exchange 2007

By default mail enabled group not available from internet.To change this

set-distributiongroup accounts -requiresenderauthenticationenabled $false

or to change it on all security groups:

get-distributiongroup ! setdistributiongroup -requiresenderauthenticationenabled $false

Exchange 2007 Going Live

cmd->nslookup
->set type=mx - To view MX record

cmd->nslookup
->set type=PTR
->33.184.168.67.in-addr.arpa -to view reverse dns record.

Fairwall rule allowing inbound port 25.
outbound port 25 access(cmd->telnet microsoft.com 25)


Configure send connector and recieve connector:

Send connecor: internet-> Add address space you need to type * .

Exchange 2007 Database

Each databse has a 16Tb limit.



Databse built on Jet.



Single instance sorage(SIS) provides large space saving.What is single instance storage?
The idea behind single instance storage is that if a message is addressed to multiple recipients, and these recipients are located on the same database, the message is stored just once.



There is no .stm file anymore.All data is in the .edb



The transaction logs are some of the most crucial files when it comes to a working Exchange server. Microsoft Exchange Server uses transaction logs as a disaster recovery method that can bring a Exchange database back to a consistent state after a crash. Before anything is written to the EDB file, it is first written to a transaction log. Once the transaction has been logged, the data is written to the database when convenient.
Until a transaction is committed to the database, it is available from memory and recorded in the transaction logs. This is why you will see store.exe use up to 1GB of memory after the Exchange server has been in use for a while. After an Exchange server is brought back up after a crash, the checkpoint file points to the last committed transaction in the transaction logs which are then replayed from that point on. This form of write-ahead logging is important for you to know.
There are four types of transaction logs:
E##.log is the current transaction log for the database. Once the log file reaches 5MB in size it is renamed E#######.log and a new E##.log is created. As with the checkpoint file the ## represents the Storage Group identifier. While the new E##.log file is being created you will see a file called Edbtmp.log which is a template for Exchange server log files.
E#######.log are the secondary transaction logs. They are numbered sequentially starting with E0000001.log using the hexadecimal numbering format and are 5MB in size.
Res1.log is a reserved log file that is limited to 5MB in size. When the disk has run out of space, transactions are written to this log file while you work on clearing up space on the disk.
Res2.log is another reserved log with the same function as Res1.log.
Transaction logs can grow at a fast pace as each and every transaction is recorded to the log files. There are two ways to manage this growth with the recommended method being a regular full backup of the Information Store. Upon successful backup, the transactions are committed to the database and then purged.
The other method is to enable circular logging. Circular logging is disabled by default as it only allows you to recover Exchange data since the last full backup. With circular logging enabled the transaction logs are purged as the transactions are committed to the database. If you have to restore from backup, the transaction logs will not be replayed and all transactions since that backup will be lost.
The two reserved log files, Res1.log and Res2.log, are used to “save” 10MB of space on the disk in case there is no more free space. When the disk runs out of free space, the transactions are logged to the reserve logs as the Information Store shuts down gracefully. You will not be able to restart the Information Store service until you clear up some disk space.

Exchange 2007 EMS

get-alias -it will show all alias
get-process -it will show all process curently running
get-mailbox -will display all the mailbox on the server.
get-mailbox shehim ! list -will display particular user mailbox details
get-mailbox shehim ! list > c:\shehim.txt - it will copy all details to a notepad.
ipconfig/all;netstat -an - uou can use two command at a time in EMS using comma.
get-help set-mailbox -will disply how to use that command

Very helpful command

get-mailbox ! list name,primarysmtpaddress >c:\list.txt -to list all mail address

get-mailbox ! convertt0-html name,primarysmtpaddress ! set-content c:\addresses.html -

this command will display all mail address in a html format.

test-servicehealth - to check all necessary service running or not.

get-mailboxstatistics -

get-mailboxdatabase ! list -

get-distributiongroup

Installing Exchange 2007

Hardware Requirements:

A 64 bit processor - AMD or intel (EM 64T,not itanium)
2 GB of RAM plus 5mb per mailbox.

Software requirement:

windows 2003 SP1 on a domain controller(schema master and global catalog)
windows 2003 x64 with sp1 or R2
.Net framework 2.0
MMC 3.0(comes with R2)
Powershell 1.0
Hotfix for windows X64 (KB904639)
Internet information server(without smtp & nntp)

Preparing the Disk:
Best practice:

Hardware RAID solution.
Separate Exchange database from OS.
If possible seperate out transaction logs from database.
Mirror set - OS
RAID 5 -Database
Mirror set -transaction logs

DNS Setup:(DC)
a)Configuring local adaptors:
Eg:
IP :192.168.67.2
Subnet: :255.255.255.0
Default Gateway:192.168.67.1
DNS :192.168.67.2

then
b)run->dcpromo<- dnsname:ecc.local after DCpromo complete,configure reverse look zone also. c)Verify DC gloabl catalog and schema. gloabal catalog->Active directory sites and service.

Shema master->go to cmd->type regsvr32 schmmgmt.dll <- then MMC add "active directory shema"-check shema master. d)to check domain controller installed properly cmd->net share

Domain Registration:

a)Registering an external Domain name(godaddy.com etc).

b)dns settings

Add A-record -Map name to ip address

Eg: hostname :eccmail

Ip address:67.168.183.33

Add MX-record -make mail for a domain go to a specific named host.

Eg: priority :0 (means higest priority)
hostname :@
Enter goes to address:eccmail.eccdxb.com

AD Requirements:

Make sure domain fuctionality level is windows 2000 or higher.(to check this Go to active directory domain and trust)

AD shema Changes:

a) setup /prepareLegacyExchangePermissions if legacy exchange exist.

b)If there are windows 2000 DC's use setup /Domaincontroller servername

c)/PrepareSchema

d)/PrepareAD

e)/PrepareDomain

Steps:

Eg: join exchange server to the domain

Install .Net framework,mmc 3.0,powershell

install IIS common files,world wide web service.

setup /PrepareAD /ON:3CG

Run exchange best practice analyser:Exchange 2007 redieness check

http://support.microsoft.com/kb/894435

How to switch between the 32-bit versions of ASP.NET 1.1 and the 64-bit version of ASP.NET 2.0 on a 64-bit version of Windows

Install Exchange server 2007

Get updates from Exchange.

Install service pack 1 for exchange.

Edge Transport Role

Main purposes are security and anti spam.

Edge transport servers are never domain members.

Edge transport cannot coexist on same server with any other role.

Edge can function without other exchange 2007 server role existing.



Edgesync:



Edge uses information from the AD to make intelligent decision about filtering.

Edge receives updates about AD info via a one-way communication with Hub.

Active directory application mode(ADAM) component facilitates this AD data sync.

The edge service is responsible for pushing data to the edge server.



Instalation requirement:



W2k3 standerd R2 or standerd SP1

one or two network adapters

DNS suffix name resolution configuration

ADAM

configure the hosts file(add the dns&exchange IP)
.net framework and powershell.

In DNS server create the new host pointing to the edge server.

Exchange 2007 media.



Edgesync configuration:



Create an edgesubscription file using EMS from edge transport server:

EMS->New-Edgesubscription -file "c:\subscribeedge.xml"



Import the edge subscription file on a Hub transport.

EMC->org->Hub->Edge subscriptions.This will create the Edgesync relationship.

Verify the Edgesync is working:

On the Hub transport server: EMS->test -Edgesynchronization - to test edgesync.if not started restart Microsoft edgesync service.

EMS->start -edgesynchronization -to manually initiate full synchronization from Hub transport server.normally config data will sync each hour,recipient data every four hours.

On the Edge transport server: EMS->Get -AcceptedDomain

Securing the Edge server:

(Read the article http://www.msexchange.org/tutorials/Securing-Exchange-2007-Edge-Transport-Servers.html )

Add/Remove windows components->install the component"security configuration wizard".

Register the E2007 SCW extension.

on command prompt type and enter-> scwcmd register /kbname:Ex2007KB /kbfile:"%programfiles%\Microsoft\Exchange Server\scripts\Exchange2007.xml"

then

configure the security configuration wizard.

add the below ports
50389(TCP)
50636(TCP)

then go to hub server and verify edgesync EMS -> Test -Edgesynchronization.

Recommndations

1) Create a Postmaster mailbox:

Eg: go to administrator->email address->add postmaster@ecc.com. then on the edge transport server role->EMS->Set-TransportServer -ExternalpostmasterAddress postmaster@ecc.com <-

identity:edgeservername <-

Journaling

Journaling

Capturing and archiving mail traffic accross hub transport.

Mail can be journaled (archived) to several different types of locations:
1) Local mailbox.
2)distribution group.
3)External hosting service.
4)3rd party archiving database.

Journaling anything less than on a global level requires Enterprise CALs.

3rd party Archiving product:

1)quest archive manager.
2)GFI mail archiver (http://www.msexchange.org/tutorials/Software-Review-GFI-MailArchiver.html)